I85PREP
⌘ K
III IC-28 study materials
III IC-28 study resources

III IC-28 practice questions

One question at a time. Build your III IC-28 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IC-28 syllabus content (domains not enumerated in source)

Under the IC-28 framework, which document typically serves as the primary instrument for establishing the audit universe and defining the scope of an internal control review?

  1. The organization's marketing plan
  2. The engagement charter or scope memorandum Correct answer.
  3. The vendor contract register
  4. The prior year's management letter

Explanation

IC-28 practice treats the engagement charter or scope memorandum as the authoritative document that defines what the internal control review covers and how the audit universe is bounded. Supporting records such as prior findings inform but do not establish scope.

Question 2IC-28 syllabus content (domains not enumerated in source)

In IC-28 terminology, the 'control environment' component is best described as which of the following?

  1. The set of automated application edits applied at data entry
  2. The tone set by leadership, including integrity, ethics, and governance structures Correct answer.
  3. The inventory of physical access badges
  4. The schedule of periodic reconciliation procedures

Explanation

The control environment is the foundation component covering governance, integrity, ethical values, and the tone set by those charged with governance. Automated edits, reconciliations, and badge inventories are specific control activities rather than the environment itself.

Question 3IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer documents a control that requires dual authorization before a payment above a threshold is released. This control is best classified as which type?

  1. Directive
  2. Corrective
  3. Detective
  4. Preventive Correct answer.

Explanation

Dual authorization stops an improper payment before it occurs, which is the defining characteristic of a preventive control. Detective controls identify problems after the fact, corrective controls remediate, and directive controls guide behavior without blocking transactions.

Question 4IC-28 syllabus content (domains not enumerated in source)

When an IC-28 assessor rates a control as 'operating effectively', what has most directly been established?

  1. The control is designed appropriately on paper
  2. The control operated consistently throughout the review period as intended Correct answer.
  3. The control has never produced an exception
  4. The control has been approved by the external auditor

Explanation

Operating effectiveness addresses whether the control functioned consistently and as designed across the period under review, supported by testing evidence. Design adequacy and external approval are separate considerations.

Question 5IC-28 syllabus content (domains not enumerated in source)

In IC-28 risk assessment, 'inherent risk' refers to which concept?

  1. Risk before considering the effect of controls Correct answer.
  2. Risk introduced by the internal audit function
  3. Risk remaining after controls are applied
  4. Risk transferred to a third-party insurer

Explanation

Inherent risk is the exposure that exists before any mitigating controls are taken into account. Residual risk is the exposure remaining after controls, and transferred risk relates to risk-sharing arrangements.

Question 6IC-28 syllabus content (domains not enumerated in source)

An IC-28 review finds that a key spreadsheet used for regulatory reporting is maintained by one analyst with no backup and no version control. Which risk is most directly indicated?

  1. The regulatory threshold is set too low
  2. Segregation of duties is excessive
  3. The reporting process is over-automated
  4. The control relies on an unmitigated key-person and integrity risk Correct answer.

Explanation

Single-person ownership without backup or version control concentrates dependence on one individual and undermines data integrity, both of which are control weaknesses. Excessive segregation, over-automation, and threshold levels are not indicated by these facts.

Question 7IC-28 syllabus content (domains not enumerated in source)

Which of the following best describes the purpose of a walkthrough in an IC-28 control review?

  1. To replace substantive testing of account balances
  2. To benchmark the entity against industry peers
  3. To recalculate the organization's entire general ledger balance
  4. To confirm the control as designed is understood by tracing a transaction through the process Correct answer.

Explanation

A walkthrough traces one or a few transactions through the process to confirm the reviewer's understanding of the design and flow of controls. It is not a substitute for substantive testing and does not perform full recalculations or benchmarking.

Question 8IC-28 syllabus content (domains not enumerated in source)

An IC-28 assessor identifies a deficiency that, while not material to the financial statements, merits attention from management. This is best classified as which of the following?

  1. Material weakness
  2. Fraud indicator
  3. Significant deficiency
  4. Deficiency in internal control Correct answer.

Explanation

A deficiency in internal control exists when a control is missing or does not operate as designed; the less severe category is a deficiency, while significant deficiencies and material weaknesses represent escalating severity. Fraud indicators are a distinct concept.

Question 9IC-28 syllabus content (domains not enumerated in source)

In IC-28 sampling for control testing, what is the primary purpose of defining the population before selecting a sample?

  1. To guarantee that no exceptions will be found
  2. To ensure every item has a chance of selection and results can be projected Correct answer.
  3. To eliminate the need for professional judgment
  4. To reduce the number of controls that must be documented

Explanation

Defining a complete and appropriate population ensures each item has a known chance of selection so that sample results can be projected to the population. It does not remove judgment or alter documentation requirements.

Question 10IC-28 syllabus content (domains not enumerated in source)

Which of the following is the most appropriate evidence source for concluding that an IT general control over user access provisioning operated throughout the year?

  1. The organization's organizational chart
  2. The IT policy manual dated three years ago
  3. A verbal assurance from the IT manager
  4. A sample of access approval tickets and system logs across the period Correct answer.

Explanation

Operating effectiveness requires evidence that the control functioned across the period, which contemporaneous approval tickets and system logs provide. An outdated policy, verbal assurance, and an org chart speak to design or structure rather than ongoing operation.

Question 11IC-28 syllabus content (domains not enumerated in source)

IC-28 guidance emphasizes that 'tone at the top' is assessed primarily because it does which of the following?

  1. Determines the exact number of controls the entity must implement
  2. Influences whether other controls are respected and enforced throughout the organization Correct answer.
  3. Sets the fee charged by the external auditor
  4. Replaces the need for segregation of duties

Explanation

Leadership tone shapes whether staff at all levels adhere to and enforce controls, making it a foundational driver of control effectiveness. It does not prescribe control counts, substitute for segregation, or determine audit fees.

Question 12IC-28 syllabus content (domains not enumerated in source)

A reviewer finds that a detective reconciliation control is performed monthly but exceptions are not investigated or cleared. How should the reviewer evaluate this control?

  1. Effective, because the reconciliation is performed on schedule
  2. Ineffective, because detection without resolution does not mitigate the risk Correct answer.
  3. Effective, provided the reconciliation is signed
  4. Not applicable, because reconciliation is not a control

Explanation

A detective control only mitigates risk when detected exceptions are investigated and resolved; performing the reconciliation without follow-up leaves the underlying exposure unaddressed. Scheduling and sign-off alone do not establish effectiveness.

Question 13IC-28 syllabus content (domains not enumerated in source)

In IC-28 documentation standards, which element is essential when describing a control for testing purposes?

  1. The budget allocated to the finance department
  2. The control objective, the procedure performed, its frequency, and the owner Correct answer.
  3. The list of all employees in the organization
  4. The name of the person who designed the control's predecessor

Explanation

A testable control description identifies the objective, the procedure, how often it operates, and who performs it, so the reviewer can test occurrence and consistency. Budgets, full staff lists, and historical designer names do not support control testing.

Question 14IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer notes that the same employee both initiates vendor payments and reconciles the bank account. Which conclusion is most defensible?

  1. The arrangement eliminates the need for bank reconciliations
  2. The arrangement strengthens control because one person has full visibility
  3. The arrangement creates a segregation-of-duties conflict that should be remediated Correct answer.
  4. The arrangement is acceptable if the employee is experienced

Explanation

Combining transaction initiation with reconciliation places custody and detection in the same hands, allowing errors or irregularities to go unnoticed. Experience does not cure the conflict, and reconciliation remains necessary.

Question 15IC-28 syllabus content (domains not enumerated in source)

Which of the following best characterizes the relationship between risk assessment and control design in IC-28?

  1. Identified risks drive the selection of controls proportionate to their significance Correct answer.
  2. Risk assessment is performed only after controls fail
  3. Controls and risks are unrelated processes
  4. Controls are designed first, then risks are identified to match them

Explanation

Risk assessment identifies and prioritizes exposures, and controls are then selected and designed to address those risks in proportion to their significance. Designing controls before identifying risks inverts the logic of the framework.

Question 16IC-28 syllabus content (domains not enumerated in source)

A control tested with a sample of 25 items yields two exceptions. What is the most appropriate IC-28 response?

  1. Increase the sample to 1,000 items automatically
  2. Conclude the control is effective because exceptions were few
  3. Investigate the cause and evaluate whether the deviation rate undermines reliance Correct answer.
  4. Ignore the exceptions if they were corrected later

Explanation

Exceptions must be investigated to determine their cause and whether the observed deviation rate supports reliance on the control. Automatic expansion without analysis or dismissal because items were later corrected are not sound responses.

Question 17IC-28 syllabus content (domains not enumerated in source)

Which of the following is a valid reason for an IC-28 reviewer to conclude that a control cannot be relied upon even though it is well designed?

  1. The control owner attended a training course
  2. The control is documented in a policy manual
  3. The control uses an approved software platform
  4. The control was implemented halfway through the review period Correct answer.

Explanation

A control implemented partway through the period cannot provide coverage for the entire period under review, limiting reliance. Training, documentation, and approved platforms support rather than undermine reliance.

Question 18IC-28 syllabus content (domains not enumerated in source)

In IC-28, 'compensating controls' are best understood as which of the following?

  1. Controls that eliminate all residual risk
  2. Controls that replace the primary control with an identical duplicate
  3. Controls that only apply during external audits
  4. Alternative controls that reduce risk when the primary control is absent or weak Correct answer.

Explanation

Compensating controls are alternative measures that mitigate risk when a primary control is missing or ineffective. They are not identical duplicates, are not limited to audit periods, and cannot eliminate all residual risk.

Question 19IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer is evaluating whether a control activity addresses the completeness assertion for revenue. Which control is most relevant?

  1. Reviewing the marketing expense account
  2. Comparing the sales ledger to the prior year's budget
  3. Matching shipping documents to recorded sales invoices Correct answer.
  4. Confirming the balance of the petty cash fund

Explanation

Completeness for revenue concerns whether all sales that occurred were recorded, which matching shipping documents to recorded invoices tests. Budget comparisons, expense review, and petty cash confirmation do not address revenue completeness.

Question 20IC-28 syllabus content (domains not enumerated in source)

A reviewer must decide whether a deficiency in an IT change-management control is a material weakness. Which consideration is most decisive under IC-28?

  1. The date the control was first documented
  2. The number of employees who complained about the control
  3. The likelihood and potential magnitude of misstatement arising from the deficiency Correct answer.
  4. The cost of remediating the control

Explanation

Material weakness classification turns on whether the deficiency creates a reasonable possibility of material misstatement, judged by likelihood and potential magnitude. Employee complaints, remediation cost, and documentation dates are not the decisive criteria.

Question 21IC-28 syllabus content (domains not enumerated in source)

In designing a test of a manual three-way match control, which approach best supports an IC-28 conclusion about operating effectiveness across the year?

  1. Selecting a representative sample spread across the period with defined selection criteria Correct answer.
  2. Testing all transactions in a single month
  3. Asking the controller to describe the control once
  4. Reviewing only the control's written procedure

Explanation

A representative sample distributed across the period, selected using defined criteria, supports inference about consistent operation throughout the year. Single-month testing, a one-time inquiry, and procedure review alone cannot support a period-wide conclusion.

Question 22IC-28 syllabus content (domains not enumerated in source)

Which situation most clearly indicates an IC-28 deficiency in the information and communication component?

  1. The entity uses a chart of accounts with numeric codes
  2. Key control performance results are never reported to the managers responsible for oversight Correct answer.
  3. The entity documents its accounting policies
  4. The entity holds quarterly board meetings

Explanation

The information and communication component requires that relevant control information reach those who need it for oversight; failing to report control results breaks that flow. Numeric account codes, board meetings, and documented policies support the component rather than indicate a deficiency.

Question 23IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer must determine whether reliance on a control is appropriate when the control's design changed mid-period. Which approach is most defensible?

  1. Test both designs separately and evaluate reliance for each period Correct answer.
  2. Defer the conclusion until the following year
  3. Assume the redesign was an improvement and conclude effective
  4. Test only the new design and ignore the earlier period

Explanation

When a control's design changes during the period, each design must be tested for the portion of the period it operated so that reliance can be evaluated period by period. Testing only one design or assuming improvement would leave part of the period unsupported.

Question 24IC-28 syllabus content (domains not enumerated in source)

Which of the following best explains why IC-28 distinguishes design effectiveness from operating effectiveness?

  1. Design effectiveness always guarantees operating effectiveness
  2. A control can be well designed yet fail to operate consistently in practice Correct answer.
  3. Operating effectiveness is assessed only when design fails
  4. Design effectiveness applies only to automated controls

Explanation

The distinction exists because a control may be appropriately designed but still be performed inconsistently or not at all. Design effectiveness does not guarantee operation, and both dimensions apply across manual and automated controls.

Question 25IC-28 syllabus content (domains not enumerated in source)

Under IC-28, when a reviewer identifies a significant deficiency, to whom should the finding ordinarily be communicated?

  1. To the vendor whose transaction triggered the finding
  2. To the general public in the annual report
  3. To management and those charged with governance Correct answer.
  4. Only to the external auditor

Explanation

Significant deficiencies are communicated in writing to management and those charged with governance so that oversight bodies are informed. Communication to external parties, the public, or individual vendors is not the ordinary channel.

Question 26IC-28 syllabus content (domains not enumerated in source)

In IC-28, which component of internal control provides the foundation for the other components by establishing standards, processes, and structures?

  1. Control environment Correct answer.
  2. Monitoring activities
  3. Risk assessment
  4. Information and communication

Explanation

The control environment is the set of standards, processes, and structures that provides the basis for carrying out internal control across the organization. It sets the tone at the top and establishes expectations that shape how the other components operate. The remaining components build on this foundation rather than serving as it.

Question 27IC-28 syllabus content (domains not enumerated in source)

An IC-28 team is mapping an organization's internal control system to the five widely recognized components. Which component covers the policies and procedures that help ensure management directives are carried out?

  1. Information and communication
  2. Risk assessment
  3. Monitoring activities
  4. Control activities Correct answer.

Explanation

Control activities are the actions established through policies and procedures that help ensure management directives to mitigate risk are carried out. They include approvals, reconciliations, verifications, and segregation of duties. Risk assessment and monitoring are distinct components that surround control activities.

Question 28IC-28 syllabus content (domains not enumerated in source)

Under IC-28, which of the following best describes the role of the board of directors in an organization's internal control system?

  1. Preparing the detailed control documentation used by auditors
  2. Executing the risk assessment on behalf of operational staff
  3. Independently overseeing management's design and operation of internal control Correct answer.
  4. Performing daily transaction-level reconciliations

Explanation

The board, often through its audit committee, provides independent oversight of management's internal control responsibilities. This oversight is a key element of the control environment's tone at the top. Boards do not perform day-to-day control execution or prepare control documentation.

Question 29IC-28 syllabus content (domains not enumerated in source)

In IC-28 terminology, what does the term 'deficiency' refer to when evaluating internal control?

  1. A control that is designed but not yet implemented
  2. A planned improvement to an otherwise effective control
  3. An observation that has no bearing on the reliability of reporting
  4. A shortfall such that a control does not allow management to prevent or detect misstatements on a timely basis Correct answer.

Explanation

A deficiency exists when the design or operation of a control does not allow management or personnel to prevent or detect misstatements on a timely basis. Deficiencies can arise from design flaws or from operating failures. This is distinct from a planned enhancement or an unimplemented design.

Question 30IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer is documenting the control environment. Which of the following observations most directly supports a strong control environment?

  1. Performance incentives are tied solely to short-term revenue
  2. Management overrides controls when quarterly results are below target
  3. Written codes of conduct are communicated and acknowledged by all employees Correct answer.
  4. Control responsibilities are assigned informally during busy periods

Explanation

A communicated and acknowledged code of conduct demonstrates commitment to integrity and ethical values, a core element of the control environment. Formal communication and acknowledgment show that expectations are established and reinforced. The other observations undermine the control environment.

Question 31IC-28 syllabus content (domains not enumerated in source)

In IC-28, the risk assessment component requires management to consider which of the following when setting objectives?

  1. Risks identified solely by the external auditor
  2. Only external risks, excluding internal process risks
  3. Tolerance for risk and the entity's ability to manage it Correct answer.
  4. Only risks that have already resulted in reported losses

Explanation

Risk assessment involves specifying objectives with sufficient clarity and considering the entity's tolerance for risk and its ability to manage it. Management evaluates both internal and external risks across the organization. Risk tolerance informs how much risk the entity is willing to accept.

Question 32IC-28 syllabus content (domains not enumerated in source)

An IC-28 assessor is reviewing how an organization gathers and shares information relevant to internal control. Which situation best evidences effective information and communication?

  1. Relevant control information is captured and communicated to those who need it on a timely basis Correct answer.
  2. Information flows only upward, with no dissemination to operational staff
  3. Control policies are stored in a system that no employee is trained to use
  4. Employees learn about control changes only through informal hallway conversations

Explanation

The information and communication component requires that relevant information be identified, captured, and communicated in a form and timeframe that enables people to carry out their responsibilities. Timely communication to the right people is the hallmark of effectiveness. Informal, inaccessible, or one-directional flows weaken the component.

Question 33IC-28 syllabus content (domains not enumerated in source)

Under IC-28, monitoring activities are best described as which of the following?

  1. Performing the daily reconciliations that detect errors
  2. Documenting the control environment at inception
  3. Designing new controls to address emerging risks
  4. Ongoing evaluations and separate evaluations that assess whether controls are functioning Correct answer.

Explanation

Monitoring activities consist of ongoing evaluations and separate evaluations, or a combination of both, used to ascertain whether each component of internal control is present and functioning. Monitoring is distinct from the execution of controls themselves. It provides feedback for corrective action.

Question 34IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer is assessing whether a control is properly classified as preventive or detective. Which of the following controls is preventive in nature?

  1. A system edit check that blocks a sales order exceeding the customer's credit limit Correct answer.
  2. A year-end physical inventory count compared to recorded balances
  3. A monthly reconciliation of the general ledger to the subledger
  4. A quarterly review of journal entries for unusual items

Explanation

A preventive control stops an error or irregularity before it occurs; a system edit check that blocks an order exceeding the credit limit operates before the transaction is processed. Reconciliations, reviews, and physical counts are detective because they identify problems after the fact. Classifying controls correctly informs how they are tested.

Question 35IC-28 syllabus content (domains not enumerated in source)

An IC-28 team is evaluating the design of a control that requires supervisor approval of purchase orders above a threshold. Which element is most critical to conclude the design is effective?

  1. The approval is documented and the supervisor has the authority and information to evaluate the purchase Correct answer.
  2. The approval is performed only when the supervisor remembers to review the queue
  3. The supervisor also prepares the purchase orders being approved
  4. The threshold is set at the same level as the prior year

Explanation

Design effectiveness requires that a control, as designed, is capable of addressing the relevant risk. For an approval control, the approver must have the authority and the information needed to evaluate the transaction, and the approval must be evidenced. Without these, the control cannot operate as intended.

Question 36IC-28 syllabus content (domains not enumerated in source)

In an IC-28 review, an assessor finds that a key control over inventory valuation is performed by the controller, who is also responsible for preparing the inventory schedules. Which conclusion is most appropriate?

  1. The control design is deficient because it lacks segregation of duties Correct answer.
  2. The control is effective because the controller is senior
  3. The control is unnecessary because inventory is not material
  4. The control should be tested with a larger sample to compensate

Explanation

When the same person prepares the underlying information and performs the review, the review lacks independence and does not provide a genuine check. This is a segregation-of-duties weakness in the control's design. Increasing the sample size cannot remedy a design flaw.

Question 37IC-28 syllabus content (domains not enumerated in source)

An IC-28 assessor is determining whether a control operated throughout the period under review. Which evidence most directly supports that conclusion?

  1. A complete population of control evidence showing performance at each required interval Correct answer.
  2. A management assertion that the control was performed
  3. A single instance of the control performed at year-end
  4. A description of the control in the policy manual

Explanation

Concluding that a control operated throughout the period requires evidence of performance across the full period at the required frequency. A complete population with evidence at each interval supports that conclusion. A single instance, a management assertion, or a policy description does not demonstrate consistent operation.

Question 38IC-28 syllabus content (domains not enumerated in source)

In IC-28, when a reviewer identifies a deficiency, the severity classification generally depends on which two factors?

  1. The number of employees involved and their tenure
  2. The age of the accounting system and its vendor
  3. The frequency of board meetings and audit committee size
  4. The likelihood of misstatement and the potential magnitude of misstatement Correct answer.

Explanation

Severity of a deficiency is assessed based on the likelihood that the control failure could result in a misstatement and the potential magnitude of the resulting misstatement. Together these determine whether a deficiency is significant or a material weakness. Employee tenure, system age, and governance cadence are not the defining factors.

Question 39IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer is evaluating whether a compensating control mitigates a segregation-of-duties conflict in a small finance team. Which condition is essential for the compensating control to be credible?

  1. It exists only in the policy manual with no evidence of performance
  2. It is performed annually by the external auditor
  3. It is independent, performed timely, and directly addresses the risk created by the conflict Correct answer.
  4. It is performed by the same person who creates the conflict

Explanation

A credible compensating control must be independent of the conflicting duties, performed on a timely basis, and targeted at the specific risk the conflict creates. If the same person performs it or it is only documented, it does not compensate. External auditor procedures are not a substitute for the entity's own control.

Question 40IC-28 syllabus content (domains not enumerated in source)

An IC-28 team is testing an automated control that calculates depreciation. Which approach best addresses the risk that the control logic itself is flawed?

  1. Testing the configuration and logic of the automated calculation, including changes to it Correct answer.
  2. Relying solely on the absence of errors in prior years
  3. Increasing the sample of manual journal entries
  4. Interviewing the controller about the calculation method

Explanation

For automated controls, the primary risk is that the programmed logic is incorrect or has been improperly changed. Testing the configuration and logic, together with controls over program changes, addresses that risk. Sampling outputs alone may not reveal a logic flaw that produces consistently wrong but plausible results.

Question 41IC-28 syllabus content (domains not enumerated in source)

In IC-28, which of the following best explains why documentation of internal control should be updated when processes change?

  1. Outdated documentation can cause reviewers and staff to rely on controls that no longer exist as described Correct answer.
  2. Documentation length is a regulatory requirement regardless of accuracy
  3. Updates are needed only when the external auditor requests them
  4. Documentation is a one-time exercise completed at implementation

Explanation

Documentation must reflect the control system as it actually operates; otherwise reviewers and personnel may rely on descriptions of controls that have changed or been removed. Keeping documentation current supports accurate risk assessment and testing. Documentation is not a one-time exercise, and accuracy matters more than length.

Question 42IC-28 syllabus content (domains not enumerated in source)

An IC-28 assessor observes that management routinely reviews a monthly variance report but takes no documented action when variances exceed thresholds. Which conclusion is most appropriate?

  1. The review is effective because the report is prepared monthly
  2. The control should be reclassified as preventive
  3. The control is effective because management is aware of the variances
  4. The control is not operating effectively because exceptions are not resolved Correct answer.

Explanation

A review control is effective only when identified exceptions are investigated and resolved. Preparing a report and reviewing it without following up on threshold breaches means the control does not achieve its objective. Awareness alone is not remediation.

Question 43IC-28 syllabus content (domains not enumerated in source)

In IC-28, which of the following is the most appropriate way to treat a control that management has designed but not yet placed into operation as of the assessment date?

  1. Exclude it from consideration entirely
  2. Assume it will operate effectively in the next period
  3. Test it as if it operated for the full period
  4. Conclude it is not operating effectively because it has not operated Correct answer.

Explanation

A control that has not been placed into operation cannot be concluded to be operating effectively during the period. It may be documented as designed, but the assessor cannot rely on it for the period under review. Future operation is a matter for subsequent assessment.

Question 44IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer is assessing the reliability of evidence obtained from a walkthrough of a purchasing process. Which limitation is most important to recognize?

  1. A walkthrough proves operating effectiveness for the entire period
  2. A walkthrough is only useful for automated controls
  3. A walkthrough replaces the need for any other testing
  4. A walkthrough confirms understanding of the process but is not sufficient alone to conclude on operating effectiveness Correct answer.

Explanation

A walkthrough builds the reviewer's understanding of the process and confirms that the control is designed and has been placed in operation. It does not, by itself, provide sufficient evidence that the control operated effectively throughout the period. Additional testing is needed for that conclusion.

Question 45IC-28 syllabus content (domains not enumerated in source)

Under IC-28, which of the following best describes the relationship between the five components of internal control and the achievement of entity objectives?

  1. Only the control activities component is relevant to reporting objectives
  2. Each component operates independently and addresses only one objective category
  3. The components apply only to large public entities
  4. The components work together in an integrated manner to support operations, reporting, and compliance objectives Correct answer.

Explanation

The five components are interrelated and work together in an integrated system to support the achievement of operations, reporting, and compliance objectives. No single component addresses only one objective category. The framework applies to entities of all sizes, though implementation varies.

Question 46IC-28 syllabus content (domains not enumerated in source)

An IC-28 assessor finds that a significant deficiency exists in the revenue recognition process. Which factor most strongly influences whether it escalates to a material weakness?

  1. The number of revenue transactions processed annually
  2. The length of the revenue recognition policy document
  3. Whether the deficiency could result in a misstatement of the financial statements that would not be prevented or detected timely Correct answer.
  4. The seniority of the employee who discovered the deficiency

Explanation

A deficiency rises to a material weakness when there is a reasonable possibility that a material misstatement would not be prevented or detected timely. This depends on the likelihood and potential magnitude of misstatement relative to the financial statements. Transaction volume, discoverer seniority, and policy length are not the determining criteria.

Question 47IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer must decide whether to rely on a control that operates at a low frequency, such as an annual policy review. Which consideration is most relevant to the reliability of that reliance?

  1. Low-frequency controls provide more evidence per instance than high-frequency controls
  2. The small number of instances limits the evidence available, so corroborating evidence of performance is important Correct answer.
  3. Low-frequency controls never require testing
  4. Frequency has no bearing on the sufficiency of evidence

Explanation

Controls performed infrequently yield few instances, so the evidence from testing them is limited. Reviewers often corroborate performance with other evidence, such as minutes or approvals, to support reliance. Frequency directly affects the sufficiency of evidence obtained from the control itself.

Question 48IC-28 syllabus content (domains not enumerated in source)

An IC-28 team is evaluating an entity that outsourced a key processing function to a service organization. Which approach best supports the assessor's conclusion about the related controls?

  1. Assuming the service organization's controls are effective because it is a specialist
  2. Relying solely on the entity's contract with the service organization
  3. Obtaining and evaluating evidence about the service organization's controls, such as an independent assurance report Correct answer.
  4. Ignoring the outsourced function because it is outside the entity

Explanation

When a key process is outsourced, the entity's internal control system still depends on controls at the service organization. The assessor should obtain and evaluate evidence about those controls, commonly through an independent assurance report covering the relevant period. Assumptions, contracts, and exclusion are not adequate substitutes.

Question 49IC-28 syllabus content (domains not enumerated in source)

An IC-28 reviewer observes that a control's design changed partway through the period under review. Which approach best supports a conclusion about operating effectiveness for the full period?

  1. Test both the old and new designs across their respective periods of operation Correct answer.
  2. Assume the old design was effective because it was replaced
  3. Test only the old design because it covered more of the period
  4. Test only the new design and conclude for the full period

Explanation

When a control's design changes mid-period, evidence is needed for each design during the period it operated. Testing only one design leaves a gap in coverage for the other portion of the period. Conclusions about full-period effectiveness therefore require testing both versions in their respective periods.

Question 50IC-28 syllabus content (domains not enumerated in source)

An IC-28 assessor is evaluating whether a deficiency in an IT general control over program changes could be a material weakness. Which combination of factors is most relevant to that judgment?

  1. The frequency of software vendor meetings
  2. The number of IT staff and the age of the servers
  3. The extent of unauthorised changes possible and the significance of affected applications to financial reporting Correct answer.
  4. The physical location of the data center and its security guards

Explanation

The severity of an IT general control deficiency depends on how it could affect the reliability of application controls and data, and on the significance of the affected applications to financial reporting. The potential for unauthorized changes and the importance of impacted systems drive the likelihood and magnitude assessment. Staff counts, server age, physical security, and vendor meetings are not the defining factors.