Certified Public Accountant Technology & Digital Applications 5 — Questions and Answers
Question 1: A CPA advising a client on digital transformation notes the client plans to use APIs to integrate its ERP with a third-party payment processor. The MOST important control to recommend is:
- A colorful user interface for the payment screen
- API authentication tokens with expiration and least-privilege access scopes (Correct answer)
- Unlimited API call quotas
- Synchronous processing only
Correct answer: API authentication tokens with expiration and least-privilege access scopes
API security requires authenticated, scoped tokens with expiration so that only authorized systems can initiate transactions and compromised tokens have limited lifespan and capability.
Question 2: In a SOC 1 Type II engagement, the service auditor's report covers which of the following?
- The user entity's internal controls over financial reporting
- The service organization's controls over financial reporting relevant to user entities' ICFR, tested over a specified period (Correct answer)
- The service organization's marketing and sales practices
- Only the design of controls without testing their operation
Correct answer: The service organization's controls over financial reporting relevant to user entities' ICFR, tested over a specified period
A SOC 1 Type II report describes and tests the operating effectiveness of a service organization's controls relevant to user entities' internal control over financial reporting over a defined period.
Question 3: Which of the following represents a 'preventive' IT control rather than a 'detective' IT control?
- Exception reports flagging duplicate payments
- User access restrictions preventing unauthorized transactions from being entered (Correct answer)
- Audit logs recording all system changes
- Reconciliation reports comparing system totals to ledger balances
Correct answer: User access restrictions preventing unauthorized transactions from being entered
Preventive controls stop problems before they occur; restricting access prevents unauthorized users from entering transactions, while detective controls identify issues after the fact.
Question 4: A company implements multi-factor authentication (MFA) for all financial system logins. This control PRIMARILY mitigates which risk?
- Calculation errors in spreadsheet models
- Account takeover through compromised passwords alone (Correct answer)
- System downtime during peak processing
- Incorrect depreciation schedules
Correct answer: Account takeover through compromised passwords alone
MFA requires a second verification factor beyond a password, so stolen or guessed credentials alone are insufficient for an attacker to gain access.
Question 5: When auditing a company that uses machine learning models to estimate the allowance for doubtful accounts, the CPA's MOST important procedure is to:
- Verify the programming language used to build the model
- Assess the model's inputs, assumptions, and validation testing to evaluate the reasonableness of the output (Correct answer)
- Confirm the model was built by a third-party vendor
- Ensure the model runs on cloud infrastructure
Correct answer: Assess the model's inputs, assumptions, and validation testing to evaluate the reasonableness of the output
The auditor must understand and challenge the ML model's inputs and assumptions because biased training data or flawed logic can produce materially misstated accounting estimates.
Question 6: The concept of 'data governance' in an organization MOST directly supports financial reporting quality by:
- Reducing the number of accounting staff needed
- Establishing accountability, quality standards, and ownership for data used in financial processes (Correct answer)
- Automating the preparation of tax returns
- Increasing network bandwidth
Correct answer: Establishing accountability, quality standards, and ownership for data used in financial processes
Data governance defines who owns data, what quality standards apply, and how data is maintained, all of which directly affect the accuracy and completeness of financial reporting inputs.
Question 7: A CPA discovers that a client's IT department can deploy code changes to the production financial system without any approval or testing documentation. This MOST directly indicates:
- An efficient agile development process
- A deficiency in change management controls that could allow unauthorized modifications to financial data (Correct answer)
- A cost-saving best practice
- Evidence of a strong DevOps culture
Correct answer: A deficiency in change management controls that could allow unauthorized modifications to financial data
Unauthorized deployment capability bypasses the authorization, testing, and documentation requirements of change management, creating significant risk of undetected errors or fraud in financial systems.
Certified Public Accountant Technology & Digital Applications 5
A CPA advising a client on digital transformation notes the client plans to use APIs to integrate its ERP with a third-party payment processor.
The MOST important control to recommend is: