To replace the internal audit function<\/span><\/p>\nAnswer: 3) To provide direction and oversight for significant IT initiatives<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An IT steering committee provides governance and oversight for important technology initiatives and helps ensure that IT activities remain aligned with organizational objectives. Its responsibilities may include reviewing major projects, priorities, investments, risks, performance, and resource requirements. The committee normally includes representatives from business and IT functions so that decisions reflect both operational and technology considerations. An IS auditor should evaluate whether the committee has clearly defined responsibilities, appropriate membership, sufficient authority, and documented decisions. The committee does not normally perform day-to-day technical support or replace independent audit activities. Effective oversight helps management maintain alignment between technology investments and business priorities.<\/span><\/p>\nQuestion 142. Which document provides the best basis for determining whether an IT project achieved its intended business benefits?<\/b><\/h3>\n
1)<\/b> Project business case and approved objectives<\/span>
\n<\/span>2)<\/b> Employee attendance records<\/span>
\n<\/span>3)<\/b> Hardware inventory<\/span>
\n<\/span>4)<\/b> Network topology diagram<\/span><\/p>\nAnswer: 1) Project business case and approved objectives<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The approved business case and project objectives establish what the organization expected the project to accomplish. They may define expected benefits, costs, risks, performance targets, and strategic alignment. After implementation, these documented expectations provide a basis for evaluating whether the project delivered its intended outcomes. An IS auditor should compare actual results with approved objectives and investigate significant differences. A project may be completed on time and within budget but still fail to deliver expected business benefits. Therefore, post-implementation evaluation should consider business outcomes rather than relying solely on technical completion or financial measures. This supports accountability for technology investments.<\/span><\/p>\nQuestion 143. Which practice best supports effective IT portfolio management?<\/b><\/h3>\n
1)<\/b> Funding projects solely according to department preference<\/span>
\n<\/span>2)<\/b> Evaluating initiatives based on business value, risk, cost, and strategic alignment<\/span>
\n<\/span>3)<\/b> Approving every proposed technology project<\/span>
\n<\/span>4)<\/b> Selecting projects only according to implementation speed<\/span><\/p>\nAnswer: 2) Evaluating initiatives based on business value, risk, cost, and strategic alignment<\/b><\/p>\n
Explanation:<\/b><\/p>\n
IT portfolio management helps organizations prioritize technology investments across competing initiatives. Evaluating projects based on business value, risk, cost, resource requirements, and strategic alignment allows management to make informed investment decisions. An IS auditor should assess whether project selection and prioritization criteria are defined, consistently applied, and approved by appropriate management. Funding every proposed project can result in resource constraints and fragmented investments, while selecting projects solely on speed may overlook important risks and benefits. Portfolio management should also consider dependencies and changing business priorities. Effective oversight helps ensure that technology resources are directed toward initiatives that support documented organizational objectives.<\/span><\/p>\nQuestion 144. What is the primary purpose of a project risk register?<\/b><\/h3>\n
1)<\/b> To document employee payroll information<\/span>
\n<\/span>2)<\/b> To replace the project schedule<\/span>
\n<\/span>3)<\/b> To record identified project risks, their assessment, and planned responses<\/span>
\n<\/span>4)<\/b> To store application source code<\/span><\/p>\nAnswer: 3) To record identified project risks, their assessment, and planned responses<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A project risk register provides a structured record of risks that could affect project objectives. It may document each risk, its likelihood and impact, assigned ownership, response strategy, status, and monitoring information. Maintaining a risk register helps project management identify emerging concerns and track whether planned responses are being implemented. An IS auditor should assess whether significant risks are identified, appropriately assessed, assigned to responsible individuals, and periodically reviewed. The register should remain current throughout the project because risks can change as the project progresses. It does not replace the project schedule or technical documentation but complements broader project management practices.<\/span><\/p>\nQuestion 145. Which condition should cause an IS auditor to increase scrutiny of a major IT project?<\/b><\/h3>\n
1)<\/b> Significant scope changes without corresponding risk assessment<\/span>
\n<\/span>2)<\/b> A project having a documented budget<\/span>
\n<\/span>3)<\/b> Regular management reporting<\/span>
\n<\/span>4)<\/b> Clearly assigned project responsibilities<\/span><\/p>\nAnswer: 1) Significant scope changes without corresponding risk assessment<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Significant changes to project scope can affect cost, schedule, resources, security, technical architecture, and expected benefits. When scope changes occur without corresponding risk assessment, management may not fully understand their consequences. An IS auditor should determine whether major changes are appropriately evaluated, approved, documented, and reflected in project plans. The auditor should also consider whether changes affect business requirements or previously approved objectives. A documented budget and regular reporting are generally useful controls, while clearly assigned responsibilities support accountability. However, uncontrolled scope expansion without appropriate assessment can create substantial project risk and may indicate weaknesses in project governance and change management.<\/span><\/p>\nQuestion 146. Which control is most important when evaluating the accuracy of data migrated from a legacy system to a new application?<\/b><\/h3>\n
1)<\/b> Increasing the number of application screens<\/span>
\n<\/span>2)<\/b> Performing reconciliation between source and target data<\/span>
\n<\/span>3)<\/b> Removing the legacy database immediately<\/span>
\n<\/span>4)<\/b> Allowing users to modify migrated data before validation<\/span><\/p>\nAnswer: 2) Performing reconciliation between source and target data<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data reconciliation compares information in the source system with the corresponding information in the target system to identify missing, duplicated, altered, or incorrectly transformed records. This is an important control during system migration because conversion errors can affect financial reporting, operations, and decision-making. Reconciliation may involve record counts, control totals, field-level comparisons, or business-specific validation procedures. An IS auditor should determine whether migration requirements and reconciliation criteria were defined before conversion and whether exceptions were investigated and resolved. Deleting the legacy system immediately can make investigation more difficult. Migration should therefore include controlled validation before the new system becomes the authoritative source.<\/span><\/p>\nQuestion 147. What is the primary purpose of data conversion validation during an application implementation?<\/b><\/h3>\n
1)<\/b> To confirm that converted data retains required completeness and accuracy<\/span>
\n<\/span>2)<\/b> To increase employee access privileges<\/span>
\n<\/span>3)<\/b> To reduce the number of business requirements<\/span>
\n<\/span>4)<\/b> To eliminate the need for user acceptance testing<\/span><\/p>\nAnswer: 1) To confirm that converted data retains required completeness and accuracy<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data conversion validation determines whether information transferred from an existing system to a new environment remains complete, accurate, and usable. Conversion processes can introduce problems such as missing records, incorrect formats, truncated fields, duplicate information, or incorrect mappings. An IS auditor should evaluate whether conversion rules were documented and whether testing included appropriate reconciliation and validation procedures. Business users should participate where specialized knowledge is required to confirm that converted information remains fit for its intended purpose. Conversion validation does not replace user acceptance testing because UAT evaluates whether the overall system meets business requirements. Both activities address different aspects of implementation assurance.<\/span><\/p>\nQuestion 148. Which testing activity is specifically intended to determine whether different application components work together correctly?<\/b><\/h3>\n
1)<\/b> Unit testing<\/span>
\n<\/span>2)<\/b> Integration testing<\/span>
\n<\/span>3)<\/b> Disaster recovery testing<\/span>
\n<\/span>4)<\/b> Physical security testing<\/span><\/p>\nAnswer: 2) Integration testing<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Integration testing evaluates interactions between different software components, modules, systems, or interfaces to determine whether they function together as expected. This is particularly important when an application exchanges data with external systems, databases, APIs, or other services. Problems may involve incorrect data mapping, interface failures, sequencing issues, authentication problems, or unexpected dependencies. An IS auditor should assess whether integration testing covers important interfaces and business scenarios and whether identified defects are resolved before production deployment. Unit testing focuses more narrowly on individual components, while disaster recovery and physical security testing address different control objectives. Integration testing therefore provides assurance about system interactions and dependencies.<\/span><\/p>\nQuestion 149. Which control helps prevent unauthorized modifications to source code?<\/b><\/h3>\n
1)<\/b> Shared developer credentials<\/span>
\n<\/span>2)<\/b> Unrestricted production access<\/span>
\n<\/span>3)<\/b> Version control with appropriate access restrictions and approval procedures<\/span>
\n<\/span>4)<\/b> Disabling change records<\/span><\/p>\nAnswer: 3) Version control with appropriate access restrictions and approval procedures<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Version control systems help maintain a controlled history of source-code changes and can restrict who is authorized to modify repositories. Approval procedures, branch protections, code reviews, and change records can further reduce the risk of unauthorized or inappropriate modifications. An IS auditor should determine whether source-code access is based on business requirements and whether significant changes can be traced to authorized individuals. Shared credentials and unrestricted production access weaken accountability and increase risk. Disabling change records removes valuable evidence for monitoring and investigation. Effective source-code controls should support both security and reliable development practices while allowing authorized developers to perform their responsibilities.<\/span><\/p>\nQuestion 150. What is the main purpose of application interface controls?<\/b><\/h3>\n
1)<\/b> To ensure data transferred between systems is complete, accurate, and authorized<\/span>
\n<\/span>2)<\/b> To increase employee vacation allowances<\/span>
\n<\/span>3)<\/b> To replace database backups<\/span>
\n<\/span>4)<\/b> To eliminate all manual processing<\/span><\/p>\nAnswer: 1) To ensure data transferred between systems is complete, accurate, and authorized<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Interface controls help protect the integrity of information exchanged between applications or systems. They may include record counts, control totals, validation rules, error handling, duplicate detection, sequence checks, reconciliation, and monitoring of rejected transactions. These controls help ensure that information sent from one system is received and processed correctly by another. An IS auditor should evaluate whether important interfaces have clearly defined control requirements and whether exceptions are identified and resolved. Interface controls do not eliminate the need for backups or other application controls. They are particularly important when automated data exchanges support financial, operational, or regulatory processes where incomplete or inaccurate transfers could affect business outcomes.<\/span><\/p>\nQuestion 151. Which control provides evidence that an automated interface successfully transferred all expected transactions?<\/b><\/h3>\n
1)<\/b> User password complexity<\/span>
\n<\/span>2)<\/b> Transaction reconciliation using control totals or record counts<\/span>
\n<\/span>3)<\/b> Physical access badges<\/span>
\n<\/span>4)<\/b> Employee performance evaluations<\/span><\/p>\nAnswer: 2) Transaction reconciliation using control totals or record counts<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Control totals and record counts provide a mechanism for comparing transactions sent by a source system with transactions received or processed by a target system. Differences can indicate missing, duplicated, rejected, or incorrectly processed transactions. Depending on the interface, reconciliation may also compare monetary totals, hash totals, or other control values. An IS auditor should evaluate whether appropriate reconciliation procedures exist for significant interfaces and whether exceptions are investigated and resolved promptly. Authentication and physical access controls serve other purposes and do not directly demonstrate transaction completeness. Reconciliation provides valuable evidence that automated data transfers have occurred as expected and supports the integrity of downstream processing.<\/span><\/p>\nQuestion 152. Which application control is designed to ensure that a transaction contains all required fields before processing?<\/b><\/h3>\n
1)<\/b> Completeness validation<\/span>
\n<\/span>2)<\/b> Load balancing<\/span>
\n<\/span>3)<\/b> Data archiving<\/span>
\n<\/span>4)<\/b> Network segmentation<\/span><\/p>\nAnswer: 1) Completeness validation<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Completeness validation checks whether required information has been provided before a transaction is accepted for processing. For example, an application may require a customer identifier, transaction date, amount, and account number before allowing submission. Such controls reduce the risk of incomplete transactions entering downstream processes. An IS auditor should determine whether required fields are defined according to business rules and whether validation controls operate consistently across relevant transaction types. Completeness checks are different from other controls such as network segmentation or load balancing, which address infrastructure and performance concerns. Proper validation at the application level can prevent avoidable errors and improve the reliability of processed information.<\/span><\/p>\nQuestion 153. What is the purpose of an input validation control that checks whether a value falls within an acceptable range?<\/b><\/h3>\n
1)<\/b> To verify that the value meets predefined business limits<\/span>
\n<\/span>2)<\/b> To encrypt the entire database<\/span>
\n<\/span>3)<\/b> To authorize system administrators<\/span>
\n<\/span>4)<\/b> To determine the physical location of a server<\/span><\/p>\nAnswer: 1) To verify that the value meets predefined business limits<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A range check validates whether an input falls between defined minimum and maximum values or otherwise satisfies an established numerical or logical boundary. For example, an application might prevent an invalid quantity, age, percentage, or transaction amount from being entered. Range checks are application-level controls that help reduce data-entry errors and prevent invalid information from entering processing workflows. An IS auditor should determine whether ranges are based on documented business requirements and whether exceptions are appropriately handled. Range validation does not provide encryption or access authorization. It is one form of input control and should be evaluated together with other validation mechanisms relevant to the application’s processing requirements.<\/span><\/p>\nQuestion 154. Which control is most appropriate for detecting duplicate transactions in an automated processing system?<\/b><\/h3>\n
1)<\/b> Increasing network bandwidth<\/span>
\n<\/span>2)<\/b> Using duplicate detection based on appropriate transaction identifiers<\/span>
\n<\/span>3)<\/b> Removing transaction timestamps<\/span>
\n<\/span>4)<\/b> Allowing unrestricted data entry<\/span><\/p>\nAnswer: 2) Using duplicate detection based on appropriate transaction identifiers<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Duplicate detection controls compare new transactions with existing records using appropriate identifiers or combinations of fields. Depending on the application, these may include transaction numbers, reference identifiers, dates, amounts, account information, or other business-specific attributes. Detecting duplicates helps prevent repeated payments, duplicate orders, or other unintended processing. An IS auditor should determine whether duplicate detection rules reflect the nature of the transactions and whether potential duplicates are appropriately rejected, flagged, or reviewed. The control should also consider legitimate situations where similar transactions may occur. Removing timestamps or allowing unrestricted entry does not reduce duplication risk and may make investigation more difficult.<\/span><\/p>\nQuestion 155. What is the primary purpose of an audit trail within a financial application?<\/b><\/h3>\n
1)<\/b> To provide a chronological record of relevant transactions and activities<\/span>
\n<\/span>2)<\/b> To increase storage capacity<\/span>
\n<\/span>3)<\/b> To replace financial reconciliation<\/span>
\n<\/span>4)<\/b> To prevent every possible fraudulent transaction<\/span><\/p>\nAnswer: 1) To provide a chronological record of relevant transactions and activities<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An audit trail provides evidence about transactions and system activities, helping organizations trace what occurred, when it occurred, and, where appropriate, who performed the activity. In financial applications, audit trails can support accountability, investigation, compliance, reconciliation, and management review. An IS auditor should evaluate whether important events are logged, records are protected from unauthorized alteration, and retention periods meet organizational requirements. An audit trail does not itself prevent all fraud because it is primarily a detective and accountability mechanism. Its effectiveness depends on appropriate event coverage, reliable timestamps, access restrictions, and monitoring. Audit records should therefore be treated as important evidence.<\/span><\/p>\nQuestion 156. Which factor should determine the retention period for application audit logs?<\/b><\/h3>\n
1)<\/b> The size of the IT department<\/span>
\n<\/span>2)<\/b> The age of the application interface<\/span>
\n<\/span>3)<\/b> Legal, regulatory, business, security, and investigative requirements<\/span>
\n<\/span>4)<\/b> The number of monitors used by administrators<\/span><\/p>\nAnswer: 3) Legal, regulatory, business, security, and investigative requirements<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Audit-log retention should be based on the organization’s documented requirements and the risks associated with the information recorded. Relevant considerations may include regulatory obligations, legal requirements, contractual commitments, security monitoring needs, incident investigation, internal policy, and business requirements. An IS auditor should assess whether retention periods are formally defined and consistently implemented and whether logs remain accessible for the required period. Keeping logs indefinitely may create unnecessary storage and privacy concerns, while retaining them for too short a period can prevent effective investigation. A risk- and requirement-based retention approach helps balance evidence availability with operational and information-management considerations.<\/span><\/p>\nQuestion 157. Which control helps ensure that an application’s reported financial totals agree with underlying transaction records?<\/b><\/h3>\n
1)<\/b> Reconciliation<\/span>
\n<\/span>2)<\/b> Screen customization<\/span>
\n<\/span>3)<\/b> Password expiration<\/span>
\n<\/span>4)<\/b> Network cabling<\/span><\/p>\nAnswer: 1) Reconciliation<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Reconciliation compares information from different sources or processing stages to identify discrepancies. In a financial application, reported totals can be compared with underlying transaction records, subledgers, control totals, or independent source information. Differences may indicate processing errors, incomplete transactions, duplication, unauthorized activity, or data-integrity problems. An IS auditor should evaluate whether reconciliations are performed at appropriate intervals, documented, reviewed by responsible personnel, and followed by timely investigation of exceptions. Reconciliation does not necessarily prevent errors from occurring, but it can provide an important detective control for identifying inconsistencies. The scope and frequency should reflect transaction volume, risk, and business requirements.<\/span><\/p>\nQuestion 158. What is the primary purpose of an application exception report?<\/b><\/h3>\n
1)<\/b> To display normal transactions only<\/span>
\n<\/span>2)<\/b> To identify transactions or conditions requiring investigation<\/span>
\n<\/span>3)<\/b> To replace all preventive controls<\/span>
\n<\/span>4)<\/b> To eliminate management review<\/span><\/p>\n