I85PREP
⌘ K
ICAG Paper 1.2 BMIS study materials
ICAG Paper 1.2 BMIS study resources

ICAG Paper 1.2 BMIS practice questions

One question at a time. Build your ICAG Paper 1.2 BMIS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Paper 1.2 BMIS

In a business information system, which component is primarily responsible for converting raw transaction data into meaningful summaries for managers?

  1. The management reporting subsystem Correct answer.
  2. The operating system kernel
  3. The network firewall
  4. The transaction processing system

Explanation

Management reporting subsystems aggregate and summarise transaction data so that managers can monitor performance and make decisions. Transaction processing systems mainly capture and store day-to-day data rather than interpreting it. The operating system and firewall are technical infrastructure, not information-providing components.

Question 2Paper 1.2 BMIS

Which characteristic best distinguishes a management information system from a simple data-processing system?

  1. It processes transactions faster than manual methods
  2. It requires fewer staff to operate
  3. It supports managerial decision-making through organised, summarised information Correct answer.
  4. It stores data on magnetic media rather than paper

Explanation

A management information system is defined by its purpose of supplying organised information that supports planning, control and decision-making. Speed, storage medium and staffing levels are operational attributes that do not capture this managerial purpose.

Question 3Paper 1.2 BMIS

A company installs software that lets staff in different departments share a single customer record updated in real time. Which benefit of integrated business information systems does this illustrate most directly?

  1. Automatic compliance with tax legislation
  2. Lower hardware purchase costs
  3. Elimination of the need for internal controls
  4. Reduced duplication of data and improved consistency Correct answer.

Explanation

Sharing one authoritative record avoids multiple copies of the same data and keeps information consistent across departments. Integration does not by itself reduce hardware costs, remove the need for controls, or guarantee legal compliance.

Question 4Paper 1.2 BMIS

In the context of business information systems, what does the term 'legacy system' most accurately describe?

  1. A system that has never been tested in production
  2. A system that stores only archival data
  3. An older system still in use that is costly to replace and often poorly documented Correct answer.
  4. A system designed exclusively for external customers

Explanation

A legacy system is an existing, often ageing system that continues to run critical processes but is expensive to maintain or replace and may lack current documentation. It is not defined by lack of testing, by customer orientation, or by holding only archives.

Question 5Paper 1.2 BMIS

Which of the following is the best example of unstructured data held by a business?

  1. A free-text email from a customer describing a complaint Correct answer.
  2. A fixed-format invoice number field
  3. A bar code scanned at a point of sale
  4. A payroll table recording monthly salaries by employee

Explanation

Unstructured data lacks a predefined model, and free-text narrative such as a complaint email is the classic example. Payroll tables, bar codes and invoice number fields all follow defined formats and are structured.

Question 6Paper 1.2 BMIS

Which activity belongs to the input stage of an accounting information system?

  1. Producing a trial balance
  2. Calculating depreciation for the period
  3. Printing the statement of financial position
  4. Capturing a supplier invoice's details into the system Correct answer.

Explanation

Input is the capture and entry of source data into the system, such as recording invoice details. Trial balances, depreciation calculations and financial statements are outputs of processing.

Question 7Paper 1.2 BMIS

Which of the following best describes the role of a database management system (DBMS) in a business information system?

  1. It prepares statutory financial statements
  2. It provides controlled access to stored data and manages its integrity Correct answer.
  3. It encrypts all network traffic automatically
  4. It replaces the need for application software

Explanation

A DBMS sits between applications and the stored data, controlling access, enforcing integrity rules and managing concurrent use. It does not replace application software, encrypt all network traffic, or prepare statutory statements.

Question 8Paper 1.2 BMIS

Why do organisations maintain backup copies of their business data?

  1. To allow recovery of data lost through failure, error or malicious action Correct answer.
  2. To eliminate the need for user access controls
  3. To reduce the storage capacity required
  4. To increase the processing speed of the live system

Explanation

Backups exist so that data can be restored after loss caused by hardware failure, human error, or attack. They do not speed up processing, reduce storage needs, or substitute for access controls.

Question 9Paper 1.2 BMIS

A retail chain wants each branch to record sales locally but to send consolidated figures to head office each night. Which system architecture best fits this requirement?

  1. A purely centralised mainframe with dumb terminals only
  2. A distributed system with local processing and periodic consolidation Correct answer.
  3. A manual ledger system with postal reporting
  4. A stand-alone personal computer at each branch with no link

Explanation

Distributed processing allows branches to work locally while consolidated data is transmitted to head office for reporting. Purely centralised terminals, isolated PCs and manual ledgers fail to combine local processing with reliable consolidation.

Question 10Paper 1.2 BMIS

Which control most directly reduces the risk of unauthorised modification of master file data such as customer credit limits?

  1. Restricting update authority to named authorised users Correct answer.
  2. Scheduling backups at weekends
  3. Daily printing of the transaction log
  4. Increasing the size of the database

Explanation

Limiting update rights to specified authorised users is an access control that directly prevents unauthorised changes to sensitive master data. Log printing aids detection but does not prevent modification, while database size and backup timing are unrelated.

Question 11Paper 1.2 BMIS

A sales system automatically checks that a customer's order does not exceed the approved credit limit before accepting it. This is best described as which type of control?

  1. A detective control applied after month-end
  2. A physical access control
  3. A corrective control following an incident
  4. A preventive application control Correct answer.

Explanation

The check operates within the application before the transaction is accepted, so it prevents invalid orders and is a preventive application control. It is not detective, physical, or corrective, since it acts in advance of the event.

Question 12Paper 1.2 BMIS

Which of the following is the primary purpose of a feasibility study before developing a new business information system?

  1. To assess whether the proposed system is technically, economically and operationally viable Correct answer.
  2. To migrate existing data to the new platform
  3. To code the core modules of the new system
  4. To train end users on the new software

Explanation

A feasibility study evaluates whether a proposed system is worth and capable of being built, covering technical, economic and operational dimensions. Coding, training and data migration all occur later in the life cycle.

Question 13Paper 1.2 BMIS

In a systems development life cycle, which phase immediately follows the detailed design of a new system?

  1. Feasibility study
  2. Construction and testing Correct answer.
  3. Post-implementation review
  4. Requirements gathering

Explanation

Once detailed design is approved, the system is built and tested during construction. Feasibility and requirements gathering precede design, and post-implementation review comes after the system has gone live.

Question 14Paper 1.2 BMIS

Which approach to system changeover carries the highest risk of disruption to business operations?

  1. Parallel running
  2. Pilot changeover
  3. Phased changeover
  4. Direct (big bang) changeover Correct answer.

Explanation

Direct changeover switches off the old system and starts the new one on a single date, so any failure immediately disrupts operations with no fallback. Parallel, phased and pilot approaches provide staged or comparative cover that reduces this risk.

Question 15Paper 1.2 BMIS

What is the main advantage of parallel running during the implementation of a new accounting system?

  1. It allows results of the new system to be compared with the old before the old is abandoned Correct answer.
  2. It removes the need to reconcile the two systems' outputs
  3. It reduces the processing workload on staff
  4. It avoids the need for any user training

Explanation

Parallel running operates old and new systems together so that outputs can be reconciled and errors detected before reliance shifts fully to the new system. It increases rather than reduces workload and does not remove training needs.

Question 16Paper 1.2 BMIS

Which technique is most appropriate for a systems analyst to confirm how a complex clerical procedure is actually carried out by staff?

  1. Inspecting the fixed asset register
  2. Reading the annual report
  3. Reviewing the organisation chart
  4. Observing and interviewing the staff performing the task Correct answer.

Explanation

Observation combined with interviews reveals the real procedure, including informal workarounds that documentation may omit. Organisation charts, annual reports and asset registers do not describe operational procedures.

Question 17Paper 1.2 BMIS

A company's system records that goods were despatched but the related sales invoice is never raised. Which control would most likely detect this failure?

  1. Restricting warehouse staff from accessing the sales ledger
  2. Encrypting the despatch database
  3. Matching despatch notes to sales invoices in a periodic completeness check Correct answer.
  4. Taking weekly backups of the inventory file

Explanation

A completeness check that reconciles despatched goods with invoices raised will reveal despatches lacking a corresponding invoice. Access restriction, encryption and backups address security and recoverability, not the completeness of billing.

Question 18Paper 1.2 BMIS

Which of the following best describes a 'turnkey' system?

  1. A ready-made package supplied complete and ready for use with limited customisation Correct answer.
  2. A system with no user documentation
  3. A system used only for one-off projects
  4. A system built entirely in-house from first principles

Explanation

A turnkey system is a packaged solution delivered complete so that the customer can put it into operation with minimal development effort. It is not an in-house build, is not restricted to one-off projects, and normally includes documentation.

Question 19Paper 1.2 BMIS

An organisation is evaluating whether to buy a software package or develop a bespoke system. Which factor most strongly favours purchasing a package?

  1. The organisation needs the system operational quickly with limited internal IT resources Correct answer.
  2. The organisation wishes to own and resell the source code
  3. The organisation requires extensive integration with unique legacy components
  4. The organisation has highly unusual processes that provide competitive advantage

Explanation

Packages offer faster deployment and lower demand on internal development resources, making them attractive when speed and limited capability are constraints. Unusual processes, source-code ownership and complex unique integration generally favour bespoke development.

Question 20Paper 1.2 BMIS

Which of the following is a principal risk of relying on end-user computing, where departments build their own spreadsheets?

  1. Reduced flexibility for departmental staff
  2. Inability to perform any calculations
  3. Loss of data integrity through uncontrolled, undocumented models Correct answer.
  4. Excessive central control over departmental work

Explanation

End-user developed models are often undocumented, untested and uncontrolled, creating risks of error and inconsistent figures. End-user computing increases rather than reduces flexibility and central control, and it plainly permits calculations.

Question 21Paper 1.2 BMIS

A system uses check digits on account numbers entered by staff. What type of error is this control primarily designed to detect?

  1. Transposition or mistyping of digits during data entry Correct answer.
  2. Failure of the disk storage device
  3. Deliberate fraud by senior management
  4. Interception of data in transit over the network

Explanation

A check digit is calculated from the other digits and re-performed on entry, so it detects common keying errors such as transposition or single-digit mistakes. It does not address management fraud, hardware failure or network interception.

Question 22Paper 1.2 BMIS

In a relational database, what is the main purpose of defining a primary key on a table?

  1. To allow duplicate records to be stored efficiently
  2. To uniquely identify each record and prevent duplication Correct answer.
  3. To encrypt the values in that column
  4. To automatically delete old records

Explanation

A primary key enforces uniqueness so that each row can be identified unambiguously, and it prevents duplicate records. It does not encrypt data or trigger automatic deletion, and it forbids rather than permits duplicates.

Question 23Paper 1.2 BMIS

An auditor finds that program changes are made to the live production system without testing or approval. Which control weakness is most significant?

  1. Over-reliance on check digits at data entry
  2. Insufficient backup frequency for archived files
  3. Excessive segregation of duties in the warehouse
  4. Inadequate change management over system modifications Correct answer.

Explanation

Changes applied to production without testing or authorisation indicate a failure of change management, which risks introducing errors or unauthorised code into live processing. Warehouse segregation, archive backups and data-entry checks concern different risks.

Question 24Paper 1.2 BMIS

A company plans to outsource its payroll processing to an external service provider. Which consideration is most important from an internal control perspective?

  1. Obtaining assurance over the provider's controls and agreeing service levels and data protection terms Correct answer.
  2. Ensuring the provider uses the same office furniture as the client
  3. Requiring the provider to abandon all subcontractors
  4. Transferring all internal audit responsibility to the provider

Explanation

Outsourcing transfers processing but not accountability, so the client needs assurance over the provider's controls, clear service levels and enforceable data protection arrangements. Furniture, blanket bans on subcontractors and surrendering audit responsibility are not sound control responses.

Question 25Paper 1.2 BMIS

Which characteristic distinguishes a management information system (MIS) from a transaction processing system (TPS)?

  1. An MIS summarises and reports data to support managerial decision-making, whereas a TPS captures and records day-to-day transactions. Correct answer.
  2. An MIS replaces the need for a TPS by processing transactions in real time.
  3. An MIS is used only by operational staff to enter customer orders.
  4. An MIS captures and stores the raw transaction data that the organisation generates each day.

Explanation

A TPS is concerned with recording routine transactions accurately and efficiently, while an MIS draws on that stored data to produce summary reports for managers. The distinction is the level of management served and the purpose of processing, not the volume of data.

Question 26Paper 1.2 BMIS

In the context of business information systems, which pair correctly matches a system with the management level it primarily serves?

  1. Management information system - clerical data entry at the operational level
  2. Executive information system - strategic planning by senior management Correct answer.
  3. Decision support system - routine payroll calculation for all staff
  4. Transaction processing system - long-term strategic forecasting

Explanation

An executive information system is designed for senior managers and typically presents highly summarised internal and external data for strategic decisions. Each other pairing confuses the system with a lower-level processing role.

Question 27Paper 1.2 BMIS

Which of the following best describes the function of a data warehouse in a business information system?

  1. It is the operational database used to enter sales orders in real time.
  2. It is a backup facility that restores lost files after a system failure.
  3. It holds only the current day's transactions until they are posted to the ledgers.
  4. It provides a central store of integrated historical data drawn from several source systems for analysis and reporting. Correct answer.

Explanation

A data warehouse consolidates data extracted from multiple operational systems, often over long periods, and structures it for query and analysis. It is separate from the live operational databases that run daily transactions.

Question 28Paper 1.2 BMIS

Which statement best explains why data in a business information system must be accurate as well as timely?

  1. Accuracy matters only for statutory financial reporting, while timeliness matters for all other uses.
  2. Timely but inaccurate data can lead to confident but wrong decisions, so both qualities are needed for the information to be reliable. Correct answer.
  3. Accuracy is achieved automatically once data is entered into a computerised system.
  4. Timeliness guarantees accuracy because recent data cannot contain errors.

Explanation

Information quality depends on several attributes, and accuracy and timeliness are complementary rather than substitutes. Data delivered quickly but containing errors can mislead decision-makers more than delayed data, because it appears credible.

Question 29Paper 1.2 BMIS

Which of the following is the best example of a feedback control loop within a business information system?

  1. A clerk enters supplier invoices into the purchase ledger each morning.
  2. A system prints a receipt for every customer at the point of sale.
  3. A company stores its database on a server in a secure data centre.
  4. A variance report compares actual expenditure with budget and prompts managers to investigate and take corrective action. Correct answer.

Explanation

A feedback loop compares actual performance with a standard and returns information that triggers corrective action. The variance report does exactly this by linking measured results to managerial response.

Question 30Paper 1.2 BMIS

Which of the following best describes the role of electronic data interchange (EDI) between a retailer and its supplier?

  1. It provides a shared database that both parties can edit simultaneously.
  2. It allows customers to browse a supplier's catalogue over the internet and pay by card.
  3. It is a communication protocol used only for internal messaging between employees.
  4. It enables structured business documents such as purchase orders and invoices to be exchanged directly between the parties' computer systems. Correct answer.

Explanation

EDI is the computer-to-computer exchange of standard business documents in a structured format, reducing manual re-keying between trading partners. It is not a customer-facing shopping channel or a shared editing environment.

Question 31Paper 1.2 BMIS

What is the principal purpose of a firewall in a business information system?

  1. To detect and remove malicious software that has already infected a workstation.
  2. To keep a log of which employees have logged on to the accounting application.
  3. To filter network traffic and block unauthorised access between an organisation's internal network and external networks. Correct answer.
  4. To encrypt files stored on employees' laptops so they cannot be read if lost.

Explanation

A firewall controls traffic at the boundary between networks by applying rules that permit or deny connections. It is a perimeter control, distinct from encryption, antivirus software and application logging.

Question 32Paper 1.2 BMIS

Which of the following best describes a local area network (LAN) in an office environment?

  1. It connects computers and devices within a limited geographic area such as a single building so they can share resources. Correct answer.
  2. It is a set of rules governing the format of data exchanged between applications.
  3. It is a software layer that hides the physical structure of the database from users.
  4. It links an organisation's sites across several countries using public telecommunications.

Explanation

A LAN covers a limited area, typically a building or campus, and allows connected devices to share files, printers and applications. Wider geographic coverage is the role of a wide area network.

Question 33Paper 1.2 BMIS

An organisation's order-entry system is available 24 hours a day and cannot be taken offline during business hours. Which form of system changeover best meets this requirement?

  1. Phased changeover, in which parts of the new system go live in stages while the old system continues to handle the remainder. Correct answer.
  2. Pilot changeover, in which the new system is introduced at one branch only while other branches keep the old system.
  3. Parallel running, in which both old and new systems process all transactions until the new system is proven.
  4. Direct changeover, in which the old system is switched off and the new system started at a single point in time.

Explanation

Phased changeover introduces the new system in manageable portions, allowing the old system to keep serving the remaining functions so that continuous availability is maintained. It reduces risk compared with a single cut-over while still allowing a controlled transition.

Question 34Paper 1.2 BMIS

A systems analyst is documenting how a warehouse supervisor decides which deliveries to prioritise when stock is short. The decision rules are partly judgement-based and vary between supervisors. Which technique is most appropriate for capturing this requirement?

  1. Structured interviews with several supervisors combined with observation of actual decisions. Correct answer.
  2. Sending a questionnaire containing only yes/no questions to all warehouse staff.
  3. Examining the printed output reports produced by the current system.
  4. Reviewing the existing system's program source code line by line.

Explanation

Where decision rules are partly judgemental and vary between individuals, the analyst needs rich qualitative evidence from more than one source. Interviews reveal the reasoning, and observation shows what actually happens in practice.

Question 35Paper 1.2 BMIS

A company is choosing between a commercial off-the-shelf accounting package and bespoke development. Its processes are unusual and give it a competitive advantage, and it has strong in-house development skills. Which choice is best supported?

  1. Purchase of the package, because packages are always cheaper over the life of the system.
  2. Bespoke development, because bespoke systems never require testing.
  3. Bespoke development, because the unique processes are a source of advantage that a standard package may not support. Correct answer.
  4. Purchase of the package, because bespoke systems cannot be maintained after implementation.

Explanation

Where processes are genuinely distinctive and in-house capability exists, bespoke development can preserve the advantage that a standard package might force the organisation to abandon. Cost and maintenance must still be assessed, but the strategic fit favours bespoke work here.

Question 36Paper 1.2 BMIS

A payroll system calculates net pay as gross pay minus deductions. Which type of control is a check that verifies the total of individual net pay amounts equals the payroll control total?

  1. A field format check on the employee number.
  2. A password policy applied to payroll clerks.
  3. A batch or control total reconciliation performed after processing. Correct answer.
  4. A reasonableness check on the hourly rate.

Explanation

Control totals reconcile the sum of processed items with an independently established total, detecting lost or altered records during processing. Format, reasonableness and access controls address different risks.

Question 37Paper 1.2 BMIS

A user is able to view supplier bank details and also to amend them in the purchase ledger system. Which control weakness does this represent?

  1. Lack of segregation of duties, because the same person can both prepare and alter payment-related master data. Correct answer.
  2. Absence of a check digit on the supplier account code.
  3. Insufficient backup of the supplier master file.
  4. Failure to encrypt the supplier master file at rest.

Explanation

Segregation of duties requires that incompatible functions, such as viewing and changing sensitive payment data, are not combined in one role. Allowing the same user to do both increases the risk of fraudulent alteration of bank details.

Question 38Paper 1.2 BMIS

Which of the following best describes a distributed database architecture?

  1. Data is held only in printed ledgers at each branch office.
  2. Data is stored across multiple locations or servers but is managed so that users can access it as a single logical database. Correct answer.
  3. Data is copied in full to every user's personal computer each night.
  4. All data is stored on one central server and accessed only through terminals.

Explanation

A distributed database spreads storage and processing across sites while presenting a unified logical view to users. This differs from a single centralised store and from uncontrolled local copies.

Question 39Paper 1.2 BMIS

In a relational database, a foreign key in the sales order table that references the customer table is primarily used to do which of the following?

  1. Encrypt the customer's identifying details.
  2. Enforce referential integrity so that an order cannot exist without a matching customer record. Correct answer.
  3. Sort the sales order records into customer order.
  4. Uniquely identify each row within the sales order table.

Explanation

A foreign key links a child record to a parent record and enforces referential integrity, preventing orphan records. Uniquely identifying rows within a table is the role of the primary key.

Question 40Paper 1.2 BMIS

A company wants a single sign-on arrangement so that staff authenticate once and gain access to several business applications. Which risk is most directly increased by this arrangement?

  1. The applications will be unable to produce audit logs.
  2. Backup copies of the applications will become unnecessary.
  3. Staff will need to remember more passwords than before.
  4. Compromise of one set of credentials may give an attacker access to all the linked applications. Correct answer.

Explanation

Single sign-on concentrates risk: a stolen credential unlocks every connected system rather than one. Strong authentication and monitoring therefore become more important, not less.

Question 41Paper 1.2 BMIS

A business information system produces a daily exception report listing all sales invoices where the discount granted exceeds the approved limit. What is the main purpose of this report?

  1. To provide a complete listing of all invoices for statutory audit filing.
  2. To direct management attention to unusual transactions that may indicate error or abuse. Correct answer.
  3. To confirm that every invoice has been physically despatched.
  4. To calculate the total revenue for the general ledger.

Explanation

Exception reporting filters routine data and highlights items that breach a defined threshold, allowing managers to focus on risk. It does not replace the full transaction listing or the despatch records.

Question 42Paper 1.2 BMIS

Which of the following is the most appropriate treatment of a system development project that has failed to deliver the expected benefits after two years of expenditure?

  1. Continue the project because the money already spent must be recovered.
  2. Double the budget so that the original spending is justified.
  3. Reassess the business case, including sunk costs being ignored, and decide whether continuing the project still yields positive future benefits. Correct answer.
  4. Abandon the project immediately because past spending cannot be recovered.

Explanation

Sunk costs are irrecoverable and should not influence the forward-looking decision. The relevant test is whether the remaining costs are justified by the expected future benefits.

Question 43Paper 1.2 BMIS

Which of the following best describes the purpose of a service level agreement (SLA) when IT services are outsourced?

  1. It guarantees that the provider will never experience a system failure.
  2. It replaces the need for the customer to monitor the provider's performance.
  3. It defines measurable performance standards and remedies that the provider must meet. Correct answer.
  4. It transfers all legal liability for data loss to the customer.

Explanation

An SLA sets out the agreed service levels, such as availability and response times, together with measurement and remedies for shortfall. It provides a basis for managing the relationship rather than eliminating risk.

Question 44Paper 1.2 BMIS

A company processes customer payments through a third-party payment gateway. Which control most directly protects the integrity of the payment data while it is in transit?

  1. Encryption of the data using a secure transmission protocol such as TLS. Correct answer.
  2. Storing the payment data on a server in a locked room.
  3. Requiring staff to sign an acceptable use policy.
  4. Taking a nightly backup of the payment database.

Explanation

Encryption in transit protects data from interception or alteration while it travels between systems. Physical security and backups protect other aspects of the data but not the transmission path.

Question 45Paper 1.2 BMIS

An auditor wishes to test whether a program correctly applies the current tax rate to all sales invoices. Which approach provides the strongest evidence?

  1. Inspect the source code without executing the program.
  2. Use test data with known inputs and expected tax outputs and compare the results with the program's output. Correct answer.
  3. Review the program's user manual for the tax section.
  4. Ask the finance manager to confirm verbally that the program is correct.

Explanation

Test data with predetermined expected results provides direct evidence that the program processes transactions as intended. Verbal assurance, manuals and static code review are weaker because they do not demonstrate actual processing behaviour.

Question 46Paper 1.2 BMIS

A company plans to migrate its accounting records to a cloud-based system hosted by a provider in another country. Which issue is most important for the company to resolve before the migration?

  1. Whether the provider's staff use the same spreadsheet software as the company.
  2. Whether the provider's office is located in a prestigious district.
  3. Whether the transfer and storage of data in that country complies with applicable data protection requirements. Correct answer.
  4. Whether the provider's logo appears on the company's invoices.

Explanation

Cross-border storage of personal and financial data raises legal obligations about transfer, retention and protection. Compliance must be established before data is moved, since remedies afterwards are limited.

Question 47Paper 1.2 BMIS

A system uses a hash total of employee numbers in a batch of timesheets. Which error is this control primarily designed to detect?

  1. An employee being paid at the wrong hourly rate.
  2. A timesheet record being lost or duplicated during processing. Correct answer.
  3. A timesheet containing an implausible number of hours.
  4. A user accessing the payroll system without authorisation.

Explanation

A hash total sums a field that has no arithmetic meaning, such as employee numbers, and compares the result before and after processing. A difference signals that records were lost, added or altered in the batch.

Question 48Paper 1.2 BMIS

An organisation allows departments to build their own spreadsheet models for budgeting. Which control best addresses the risk that a critical model contains an undetected formula error?

  1. Ensuring all spreadsheets use the same font and layout.
  2. Restricting all spreadsheet use to the finance department.
  3. Independent review and documented testing of models that feed key decisions or external reporting. Correct answer.
  4. Requiring every spreadsheet to be printed and filed.

Explanation

The key risk with end-user models is undetected error, so independent review and testing of the models that matter most is the proportionate response. Formatting and filing requirements do not test whether the calculations are right.

Question 49Paper 1.2 BMIS

A company discovers that a former employee's system account remained active for three months after departure. Which control would most effectively have prevented this?

  1. A stronger password complexity rule for all users.
  2. Encryption of the user database at rest.
  3. A leaver process that promptly disables accounts, supported by periodic review of active user accounts against the payroll list. Correct answer.
  4. More frequent full backups of the user database.

Explanation

Timely revocation of access on leaving, reinforced by reconciliation of active accounts with current staff, directly addresses orphaned accounts. Password rules and encryption do not remove an account that should no longer exist.

Question 50Paper 1.2 BMIS

Which of the following best describes the function of a transaction processing system (TPS) in an organisation?

  1. It summarises long-term trends to support strategic decision making by senior management
  2. It stores unstructured documents such as contracts and correspondence for later retrieval
  3. It captures and records the routine day-to-day transactions that keep the business operating Correct answer.
  4. It provides tools for designing and testing new software applications before release

Explanation

A transaction processing system is concerned with capturing, validating and recording the high-volume routine events of a business, such as sales, purchases and payments. It sits at the operational level of the information system hierarchy and feeds data upwards to management information and executive systems.