Auditing Principles & Procedures Flashcards

Which audit procedure is most effective for detecting unauthorized access to a fintech platform's core banking APIs?

Answer: Review of API gateway access logs and OAuth token issuance records

API gateway logs and OAuth token records provide a direct trail of who accessed which endpoints and when, making them the primary evidence for detecting unauthorized access.

In a fintech audit, 'control risk' is best described as:

Answer: The risk that internal controls will fail to prevent or detect material misstatements

Control risk is the probability that a client's internal controls will not prevent or detect a material misstatement, regardless of auditor procedures.

A fintech auditor is assessing the adequacy of a company's disaster recovery plan. Which procedure provides the most reliable evidence?

Answer: Observing a live DR drill and comparing results to RTO/RPO targets

Observing a live drill and comparing outcomes against established RTO/RPO targets provides direct, independent evidence of whether controls operate as designed.

Which of the following is an example of a substantive analytical procedure in a fintech audit?

Answer: Comparing month-over-month payment transaction volumes to identify anomalies

Substantive analytical procedures involve comparing financial or operational data to expected patterns to identify material misstatements or anomalies.

Under PCAOB standards, when is it appropriate for an auditor to use the work of an internal audit function?

Answer: When the internal audit function has sufficient competence and objectivity, and the work is relevant

PCAOB AS 2605 permits external auditors to use internal audit work when they evaluate and conclude that the internal auditors have sufficient competence and objectivity.

A robo-advisory platform generates automated investment recommendations. From an audit perspective, which risk deserves the highest attention?

Answer: Algorithm bias or errors causing systematically unsuitable recommendations to clients

Algorithmic errors or bias can cause widespread harm at scale, creating material misstatement risk in disclosures and regulatory compliance failures across the entire client base.

Which type of audit opinion would be issued if a fintech company's financial statements contain a material misstatement that is pervasive?

Answer: Adverse opinion

An adverse opinion is issued when misstatements are both material and pervasive, meaning the financial statements as a whole do not present fairly.