91 MCQ S91 *SURGENT MCQ Flashcards

Question

The fixed assets and related depreciation of a company are currently tracked on a password-protected spreadsheet. The information technology governance committee is considering investing in an enterprise resource planning (ERP) system and needs to determine whether the current fixed-asset process should be included because the current system seems to be working properly. What long-term solution should the committee recommend? Continuing to use the current spreadsheet process because there have been no issues in this area Developing a new fixed-asset system to manage the assets and related depreciation Purchasing a standalone fixed-asset program for managing the assets and related depreciation Adopting the fixed-asset module of the new system for integration

Answer 1

Adopting the fixed-asset module of the new system for integration The correct answer is “adopting the fixed-asset module of the new system for integration.” An ERP system is intended to include financial records of the entire entity, so the depreciation records should become part of the new system. ERP systems integrate all aspects of a company's operations with its traditional information system. The other answer choices are incorrect: “Continuing to use the current spreadsheet process because there have been no issues in this area”: This option has limitations such as potential errors, scalability issues, and lack of robust reporting capabilities, which may not be suitable for a long-term solution. “Developing an in-house system can be time-consuming, expensive, and require ongoing maintenance”: It may also lack the features and support offered by dedicated software. “Purchasing a standalone fixed-asset program for managing the assets and related depreciation”: This option can be costly, and while it offers pre-built features, it may not be as customized as needed for the company's specific requirements. | ERM Planning ## Footnote Relevant Terms Data Enterprise Resource Planning (ERP) System Information System Reference 7112.01 7112.02 7112.03 7112.04

Answer 2

**ERP systems are customizable to align with an organization’s specific needs.** The correct answer is "ERP systems are customizable to align with an organization’s specific needs." ERP systems offer customization options, enabling organizations to tailor the software to their unique business processes and requirements. Customization can increase efficiency and alignment with specific organizational needs, which may not be as easily achieved with multiple independent systems. The other answer choices are incorrect: * “ERP systems have separate and decentralized sources of information for various departments": The strength of ERP systems lies in their integration, providing a unified source of information for various departments. This option describes a weakness rather than an advantage of ERP systems. * "ERP systems enhance data entry redundancy as a feature, fostering comprehensive data integration”: Data entry redundancy is generally considered a drawback, not an advantage, as it can lead to inefficiencies and errors. * "ERP systems require less cost for implementation than multiple independent functional systems": Implementing an ERP system can often be a significant investment, including software licensing, hardware infrastructure, training, and customization costs. While the long-term benefits of integration may justify the cost for many organizations, the upfront implementation costs of ERP systems are often higher than those of multiple independent functional systems. | ERM Planning

Answer 3

***Variability in employee benefits and deductions due to frequent legal changes*** The correct answer is “variability in employee benefits and deductions due to frequent legal changes.” Discrepancies between the documented payroll process and the actual payroll process are most likely to occur when there are frequent legal changes affecting employee benefits and deductions. Changes in employment laws, tax regulations, and benefits policies can lead to discrepancies, as the documented process may not always immediately reflect these legal changes. Adapting to and implementing these legal changes can cause misalignment between the documented and actual processes in the payroll department. The other answer choices are incorrect: * Robust employee training and development programs can improve adherence to documented procedures but are not the primary source of discrepancies. * Manual recordkeeping of employee hours can lead to errors and discrepancies, but it does not primarily cause misalignment between documented and actual processes. * Regular and timely updates to the payroll system software are important for maintaining compliance with changing regulations, but a lack of regular and timely updates is not the most likely factor causing discrepancies between documented and actual processes. | Reconciling AIS Practices to Documented Processes ## Footnote Relevant Terms Documentation Reference 7112.20 7112.21

Answer 4

Data security and privacy Data security and privacy is the most significant concern because payroll data contains highly sensitive employee information. Data security and privacy are crucial to prevent data breaches and unauthorized access, which can lead to identity theft, fraud, and legal issues. The other answer choices are incorrect: * While important, cost optimization is a financial consideration that, although significant, does not take precedence over data security and privacy. * Service-level agreements (SLAs) are important but serve as a framework for performance expectations. Data security should be the primary concern, even though SLAs play a role. * Ensuring process efficiency is valuable, but it is not the most significant concern when compared to data security and privacy in sensitive processes like payroll handling. | Improving AIS Performance ## Footnote Relevant Terms Computer Security Privacy Reference 7112.18 7112.19

Answer 5

*Ensure data consistency and accuracy in financial transactions * The primary objective of integrating an AIS with an ERP system is to ensure data consistency and accuracy in financial transactions. This integration allows real-time financial data updates for financial compliance and reporting. The other answer choices are incorrect: Enhance customer relationship management: Integrating an AIS and ERP primarily focuses on financial processes, not customer relationship management. Streamline human resources management: Although ERPs often include HR (human resources) modules, the primary objective of integrating with an AIS is related to financial data, not HR. Optimize supply chain operations: While ERP systems can also manage supply chain operations, the primary objective of AIS integration is to enhance financial processes. | ERM Planning ## Footnote Relevant Terms Accounting System Enterprise Resource Planning (ERP) System Reference 7112.01 7112.05 7112.10

Answer 6

An AIS is designed to centralize financial and accounting data and support various accounting functions, including auditing and financial reporting. The other answer choices are incorrect: “To primarily support human resources management activities”: This is incorrect because an AIS is primarily designed for accounting and financial data management, not for human resources (HR) management activities. AIS serves as a tool to streamline financial processes, not HR-related functions. “To replace auditors in the financial reporting process”: This is incorrect because AIS systems do not replace auditors. Instead, they assist auditors by providing accurate and well-organized financial data, making the auditing process more efficient. Auditors play a crucial role in assessing and verifying financial data for accuracy and compliance. “To serve as a tool for strategic planning and decision making within an organization”: This is partially incorrect because while AIS systems can provide data that is valuable for decision making, their primary purpose is to manage and report financial and accounting data. Strategic planning is not their primary function, but they can support it by providing financial information for decision-making processes. | AIS ## Footnote Relevant Terms Accounting System Reference 7112.05 7112.06 7112.07 7112.08

Answer 7

Control Activities Using smart contracts or similar mechanisms to ensure transaction accuracy and completeness falls under the Control Activities component of the COSO Internal Control Framework. This component involves putting specific controls and procedures in place to ensure that transactions are complete, accurate, and authorized in the context of blockchain. The other answer choices are incorrect: * The Control Environment component primarily evaluates management's technical competency and ethical values to understand and manage technologies like blockchain. It ensures that human behavior aligns with integrity and ethics but may not directly involve using smart contracts or similar mechanisms. * Risk Assessment in the COSO Framework evaluates the risks associated with blockchain implementation, such as technological, compliance, and operational risks. While assessing these risks in blockchain is essential, using smart contracts to ensure transaction accuracy and completeness is more closely related to Control Activities. * Monitoring Activities evaluate the tools for monitoring blockchain activities and performing internal and external audits. While monitoring is crucial for blockchain, using smart contracts or similar mechanisms to ensure transaction accuracy and completeness is more of a proactive control that falls under Control Activities. | Blockchain ## Footnote Relevant Terms Blockchain COSO Information and Communication Integrity (IT) Reference 7112.11 7112.17 Authorities COSO Internal Control - Integrated Framework

Answer 8

The correct answer is “addressing whether a system achieves its purpose (i.e., delivers the right data at the right price at the right time).” In the context of SOC 2 and the Trust Services Criteria (TSC), processing integrity is primarily concerned with ensuring that a system's processing functions are carried out accurately, completely, and in a timely manner, and that it delivers the expected and intended results. This control addresses the core aspect of processing integrity. The other answer choices are incorrect: “Monitoring the system and taking action to maintain compliance with its defined policies” refers to compliance monitoring, which is more related to the security and compliance criterion. It ensures that the system adheres to its defined security and compliance policies. It is not the primary focus of processing integrity, which is about the accuracy and completeness of data processing. “Implementing policies to improve network performance, site failover, and security incident handling” aligns more with the security criterion within SOC 2 reports. It involves security and risk management aspects, including network performance and site failover (availability), not specifically processing integrity. “Communicating defined policies to responsible parties and authorized users of the system” is more related to the communication criterion in SOC 2 reports, which deals with effectively communicating policies and procedures to relevant stakeholders. CHATGPT The control that ensures processing integrity, as defined in the Trust Services Criteria (TSC) of a SOC 2® report, is: "Addressing whether a system achieves its purpose (i.e., delivers the right data at the right price at the right time)." Processing integrity focuses on ensuring that data processing is accurate, complete, and timely. This control is specifically related to verifying that the system accomplishes its intended purpose, which includes delivering accurate and timely data. It helps to prevent errors, omissions, or unauthorized changes during data processing, thus ensuring the integrity of the processing itself. The other controls mentioned in the options are relevant to other aspects of a SOC 2 report (e.g., security, availability, and confidentiality), but they do not directly address processing integrity. | SOC 2 ## Footnote Reference 7112.22 7310.05 Authorities Trust Services Criteria

Answer 9

***Evaluate the blockchain's data integrity loss risk.*** This directly pertains to the evaluation of the Information and Communication risk, ensuring the integrity of data within the blockchain. The other answer choices are incorrect: “Assess if there are adequate controls over who has access to the blockchain data and to what extent”: While important, this is related to control activities and access control rather than Information and Communication risk. “Assess if the blockchain technology's level of transparency is appropriate for financial reporting”: This focuses on the suitability of blockchain's transparency, which is important but does not directly address Information and Communication risk. “Evaluate if sufficient tools for monitoring blockchain activities are relevant to financial reporting”: This primarily concerns monitoring activities to ensure adequate controls, including those addressing Information and Communication risk. ## Footnote Relevant Terms Blockchain COSO Information and Communication Integrity (IT) Reference 7112.11 7112.17 Authorities COSO Internal Control - Integrated Framework

Answer 10

***Onboarding new finance internees in the payment department*** The correct answer is “onboarding new finance internees in the payment department.” Discrepancies between the documented payment validation process and the actual process are most likely to occur when onboarding new finance interns in the payment department. New and inexperienced personnel may not fully understand or adhere to the documented procedures, leading to deviations and potential discrepancies in the payment validation process. The other answer choices are incorrect: * “Delay in issuance of checks to employees and vendors”: While delays can be an issue, they do not typically create discrepancies between the documented process and the actual process. * “Proper review of payment requests by the finance department”: Proper review aligns with the documented process and would not typically lead to discrepancies. * “Lack of communication between the finance department and the requesting employees or vendors”: While communication is important, it is less likely to be the primary cause of discrepancies compared to onboarding new personnel who may not fully understand the process. | Not sure

Answer 11

Record transactions at proper fair market value The correct answer is “record transactions at a proper fair market value” because it is not considered a primary objective of the accounting information system by the AICPA. According to the AICPA, an accounting information system (AIS) has five primary objectives: * Identify and record all valid transactions * Properly classify transactions * Record transactions at their proper monetary value, not fair market value * Record transactions in the proper accounting period * Properly present transactions and related disclosures in the financial statements (Failing to disclose a lawsuit or a contingent liability could mislead the reader of a financial statement.) | Information Systems ## Footnote Relevant Terms Fair Market Value (FMV) Financial Statements Information System Reference 7112.24 Authorities AICPA

Answer 12

Record transactions at proper fair market value The correct answer is “record transactions at a proper fair market value” because it is not considered a primary objective of the accounting information system by the AICPA. According to the AICPA, an accounting information system (AIS) has five primary objectives: Identify and record all valid transactions Properly classify transactions Record transactions at their proper monetary value, not fair market value Record transactions in the proper accounting period Properly present transactions and related disclosures in the financial statements (Failing to disclose a lawsuit or a contingent liability could mislead the reader of a financial statement.) | Information Systems ## Footnote Relevant Terms Fair Market Value (FMV) Financial Statements Information System Reference 7112.24 Authorities AICPA

Answer 13

*Addressing whether a system achieves its purpose (i.e., delivers the right data at the right price at the right time)* The correct answer is “addressing whether a system achieves its purpose (i.e., delivers the right data at the right price at the right time).” In the context of SOC 2 and the Trust Services Criteria (TSC), processing integrity is primarily concerned with ensuring that a system's processing functions are carried out accurately, completely, and in a timely manner, and that it delivers the expected and intended results. This control addresses the core aspect of processing integrity. The other answer choices are incorrect: * “Monitoring the system and taking action to maintain compliance with its defined policies” refers to compliance monitoring, which is more related to the security and compliance criterion. It ensures that the system adheres to its defined security and compliance policies. It is not the primary focus of processing integrity, which is about the accuracy and completeness of data processing. * “Implementing policies to improve network performance, site failover, and security incident handling” aligns more with the security criterion within SOC 2 reports. It involves security and risk management aspects, including network performance and site failover (availability), not specifically processing integrity. * “Communicating defined policies to responsible parties and authorized users of the system” is more related to the communication criterion in SOC 2 reports, which deals with effectively communicating policies and procedures to relevant stakeholders. | SOC 2 ## Footnote Relevant Terms Processing Integrity (Trust Services Criteria) SOC 2 Type 1 Report SOC 2 Type 2 Report System and Organization Controls (SOC) Reports Trust Services Reference 7112.22 7310.05 Authorities Trust Services Criteria

Answer 14

Transaction processing, internal controls, audit trails, and financial statements The correct answer is “transaction processing, internal controls, audit trails, and financial statements” because these services are accurate representations of what accounting information systems (AIS) typically provide. AIS systems are designed for transaction processing, implementing internal controls, maintaining audit trails, and compiling financial data for generating periodic financial statements. The other answer choices are incorrect: * “Transaction processing, financial forecasting, and customer relationship management”: This choice is incorrect because while AIS handles transaction processing, it does not typically involve financial forecasting or customer relationship management. These functions are often associated with other types of systems or software. * “Internal controls, data encryption, and supply chain management”: This choice is incorrect because while AIS involves internal controls, data encryption and supply chain management are not typically its primary functions. Data encryption is more related to security, and supply chain management is a different business process. * “Audit trails, inventory management, and data visualization”: This choice is incorrect because while AIS includes audit trails, it does not typically handle inventory management or data visualization. Inventory management is a separate function, and data visualization is often associated with business intelligence (BI) tools, not AIS. | AIS ## Footnote Relevant Terms Accounting System Audit Trail (Audit Log) Financial Statements Internal Control Transaction Processing System Reference 7112.05 7112.07

Answer 15

*Verifying that controls are proportionate to identified risks and objectives* The correct answer is “verifying that controls are proportionate to identified risks and objectives.” In a SOC 2 engagement, controls related to processing integrity should be designed proportionately to the risks and control objectives identified. This ensures that controls effectively mitigate risks while not overburdening the organization with unnecessary controls. Therefore, the auditor primarily assesses whether controls are appropriately designed based on a risk-based approach. The other answer choices are incorrect: Ensuring all controls are designed identically for all the Trust Services Criteria (TSC) principles is not the primary focus because controls should be tailored to the specific TSC principle being assessed, and they may differ in design depending on the principle. Evaluating the speed and efficiency of control operations is an important consideration but is more relevant during the assessment of control operating effectiveness, not design. Checking for compliance with industry-specific regulations only is not the primary focus because SOC 2 assessments consider compliance with the TSC principles, which may go beyond industry-specific regulations. Control design should align with the TSC principles and control objectives.

Answer 16

To identify gaps and areas for process improvement The primary benefit of reconciling the actual sales process in an AIS with the documented process is identifying gaps and areas for process improvement. This reconciliation helps in recognizing where the actual process deviates from the documented one, which, in turn, allows the organization to make necessary improvements for increased efficiency, accuracy, and compliance. The other answer choices are incorrect: To create a new sales process from scratch: Reconciliation aims to align existing processes, not necessarily start from scratch. To understand the deficiency in the AIS: While reconciliation may reveal deficiencies, it is primarily focused on process alignment rather than AIS assessment. To reduce errors in invoice generation: Reducing invoice errors is a potential outcome of the reconciliation, but it is not the primary benefit; the primary aim is to identify and address discrepancies between documented and actual processes.

91 MCQ S91 *SURGENT MCQ Flashcards

(40 cards)