This is the MOST CONFUSING topic for CMA & CIA - But 6-8 Questions are 100% from here in both exams. Here is *Complete Case-Based Pack for AIS Cycles* as per CIA Part 1 + CMA Part 1 New Syllabus.
PART A: MANUFACTURING BUSINESS - DEPARTMENT, RISK OWNER, DUTIES
Department Risk Owner Main Duties Key Risk if fails
**Sales & Marketing** Sales Manager Takes customer order, credit check request, pricing Fictitious sales, wrong price
**Credit Dept** Credit Manager Approves credit limit - INDEPENDENT from Sales Bad debts, sales to bad customer
**Warehouse / Inventory** Warehouse Manager Stores, picks, packs, updates inventory records Theft, stock-out, obsolescence
**Shipping / Logistics** Shipping Manager Ships goods, prepares Bill of Lading Shipment error, revenue before shipment
**Production** Production Manager Manufacturing, Quality control, BOM Wastage, quality failure
**HR Department** HR Manager Hiring, termination, salary rate approval Ghost employees, wrong pay rate
**Timekeeping** Timekeeping Supervisor Records time worked - Independent from Payroll Buddy punching, inflated hours
**Payroll Dept** Payroll Manager Calculates payroll, deductions, prepares payroll register Miscalculation, unauthorized payments
**Purchasing** Purchasing Manager Issues PO, selects vendor, price negotiation Kickbacks, overpricing, fictitious vendors
**Receiving** Receiving Manager Counts, inspects goods, prepares Receiving Report - Independent from Purchasing Accepting damaged goods, collusion
**Accounts Payable** AP Manager 3-way match, processes payment Duplicate payment, paying for not received
**Accounts Receivable / Billing** AR Manager Invoicing, collections, AR ledger Lapping, misstatement of revenue
> *Golden Rule for EXAM: Authorization + Custody + Recording must be SEPARATE. That's SOD - Segregation of Duties.*
---
PART B: 35 CASE-BASED MCQs - CYCLES + DOCUMENTS + CONTROLS
*CYCLE 1: REVENUE CYCLE - O2C - Order to Cash*
*Documents Chain - MUST REMEMBER:* Customer PO -> Sales Order -> Credit Approval -> Pick List -> Shipping Doc/Bill of Lading -> Sales Invoice -> AR Ledger -> Cash Receipt
*Q1. Case:* Salesman takes order, approves credit of his friend, and also edits AR ledger to hide bad debt. Which control fails?
A) Input control
B) Segregation of Duties - Credit approval must be independent from Sales - P10 Control Activities - Risk Owner: Credit Manager, not Sales
C) Output control
D) No failure
*Ans:
*Q2. Case:* Warehouse ships goods without approved Sales Order. Shipping clerk uses verbal instruction. Deliverable at risk?
A) No risk
B) Unauthorized shipment - Missing document: Approved Sales Order - Control: All shipments must match approved SO + Pick list
C) Payroll risk
D) Production risk
*Ans:
*Q3. Case:* Goods shipped on Dec 31, but invoice created on Jan 2 next year. Revenue recognized in Jan.
A) Correct - Invoice date matters
B) Wrong - Violation of Cut-off - Revenue must be recognized when shipment occurs - Document: Bill of Lading date is evidence of transfer of title - Risk Owner: AR/Billing Manager + Shipping
C) No control
D) Payroll cut-off
*Ans:
*Q4. Case:* System allows invoice creation without matching shipping document.
A) Preventive control failure - Application Control - Must have automated 2-way match: Shipping doc vs Sales Order before invoicing - P11 General Controls
B) Detective control
C) No failure
D) Payroll control
*Ans
*Q5. Case:* Customer pays $10,000. Cashier pockets money and writes off as bad debt. Which control missing?
A) Segregation - Cash handling and AR write-off authorization must be separate - Cashier should not have access to AR ledger - Lapping risk - Risk Owners: Cashier vs AR Manager vs Credit Manager for write-off approval
B) Input control
C) No control
D) Payroll control
*Ans:
*Q6. AIS Control Case:* Customer master file - Salesperson creates new customer "ABC Ltd" which is his own shell company. No approval workflow.
A) Failure of Master File Change Control - Application Control - New customer must be approved by Credit Manager independent - Document: Customer Master Change Request
B) Correct process
C) Input control only
D) No risk
*Ans:
*CYCLE 2: PROCUREMENT CYCLE - P2P - Procure to Pay - HIGHEST FRAUD RISK*
*Documents Chain:* Purchase Requisition -> Purchase Order PO -> Vendor Selection -> Receiving Report / GRN -> Inspection Report -> Vendor Invoice -> 3-Way Match -> AP Ledger -> Payment Voucher -> Check / EFT
*Q7. Case:* Production dept needs raw material. Production supervisor directly calls vendor, receives goods, and asks AP to pay without PO.
A) Correct - Production needs material urgently
B) Control failure - No Purchase Requisition, No PO, No receiving segregation - Duties: Requester cannot be buyer. Must have approved PR -> PO by Purchasing Manager - Risk Owner: Purchasing Manager
C) No failure
D) Payroll issue
*Ans:
*Q8. Case:* Same person in Purchasing creates vendor, issues PO to that vendor, and also is Receiving manager who confirms receipt.
A) No issue if trusted
B) Major SOD failure - Vendor creation must be independent from Purchasing + Receiving must be independent from Purchasing - Fictitious vendor fraud possible - Risk Owner: Vendor master = AP/Finance independent, Purchasing = Purchasing Manager, Receiving = Receiving Manager
C) Only payroll risk
D) Detective control enough
*Ans
*Q9. Case:* AP clerk pays invoice of $15,000 without checking Receiving Report. Later found goods never received.
A) Failure of 3-Way Match Control - Preventive Application Control - Must match PO + Receiving Report + Vendor Invoice - All 3 must agree in qty, price - Risk Owner: AP Manager owns 3-way match deliverable
B) No failure
C) Revenue control
D) Payroll control
*Ans:
*Q10. Case:* PO price is $10 per unit, but Vendor Invoice is $12 per unit, but AP pays $12 because vendor is relative of AP clerk.
A) Failure of Price check - Processing control - System should flag price variance - Also conflict of interest - P1 Control Environment Ethics + P10 Control Activity
B) Correct
C) No control
D) Timekeeping control
*Ans:
*Q11. Case:* Receiving clerk receives 100 units but records 120 units to help vendor get more payment, and shares kickback.
A) Collusion + Need for independent inspection + Count - Control: Blind receiving - Receiving clerk should not know ordered qty - Document: Blind copy of PO - Risk Owner: Receiving Manager
B) No control can prevent
C) Correct
D) Only detective
*Ans:
*Q12. Case:* Which document is evidence that liability should be recorded?
A) PO
B) Receiving Report / GRN - Once goods received and inspected, liability incurred - GRN triggers accrual
C) Purchase Requisition
D) Payment voucher
*Ans:
*Q13. Case:* Vendor master file - Who should own / approve new vendor creation?
A) Purchasing
B) Independent from Purchasing - Finance / AP or Vendor Master team after due diligence - To prevent fictitious vendor
C) Receiving
D) Sales
*Ans:
*CYCLE 3: PAYROLL CYCLE - H2P - Hire to Pay*
*Documents Chain:* Hiring Authorization -> HR Master -> Time Card / Time Sheet -> Approved Time -> Payroll Rate Authorization -> Payroll Register -> Deduction Authorization -> Paycheck / Direct Deposit -> Payroll Tax Filing
*Q14. Case:* HR manager hires ghost employee "Ramesh Kumar", approves timecard, and also is payroll clerk who issues paycheck to his own account.
A) Major SOD failure - Hiring + Timekeeping + Payroll + Distribution must be separate - Duties: HR = Hiring, Timekeeping = Independent attendance, Payroll = Calculation, Treasurer = Distribution - Risk Owner: HR Manager, Timekeeping Supervisor, Payroll Manager
B) No failure if manager is senior
C) Only revenue risk
D) Correct process
*Ans:
*Q15. Case:* Factory supervisor approves timecards of his team, inflates hours to earn overtime for friends.
A) SOD failure - Supervisor should not approve his own team's time without independent timekeeping check - Use biometric / Badge system + Timekeeping dept independent - Deliverable: Approved time sheet by Timekeeping, not just supervisor
B) Correct
C) No risk
D) Procurement control
*Ans:
*Q16. Case:* Payroll clerk changes pay rate from $20/hr to $30/hr without authorization, increases his own salary.
A) Failure of Pay Rate Authorization Control - Pay rate changes must be approved by HR Manager, not Payroll - HR owns HR Master deliverable - System should have access control - P11 IT Controls
B) No failure
C) Revenue control
D) Receiving control
*Ans:
*Q17. Case:* Which is BEST control against ghost employees?
A) Reconciliation of payroll register to HR master by independent person + Surprise payroll distribution + Biometric attendance + Mandatory vacation
B) Only timecard
C) Only PO
D) No control needed
*Ans:
*Q18. Case:* Timecards are paper-based, no approval, payroll processes whatever is submitted.
A) Failure of Input Validation + Authorization - Need automated time system + Supervisor approval + Timekeeping approval
B) Correct
C) No risk
D) Procurement risk
*Ans
*Q19. Case:* Payroll taxes not deposited on time, penalty incurred. Whose duty?
A) Sales Manager
B) Payroll Manager owns compliance deliverable: Payroll Tax Filing + Deposit - Requires calendar control + Review by Finance Manager
C) Receiving
D) Purchasing
*Ans:
*Q20. Case:* Overtime not authorized in advance, but payroll pays it because timecard shows overtime.
A) Preventive control failure - Overtime must be pre-approved by Production Manager + HR - Document: Overtime Authorization Form
B) Correct
C) No control
D) 3-way match
*Ans:
*CYCLE 4: AIS + INTERNAL CONTROL + CONTROL APPLICATION - COMMON FOR BOTH EXAMS*
*Q21. Case:* Which is Application Control vs General IT Control?
A) Input validation, sequence check, limit check, check digit = Application Control; Access to program, change management, backup = General IT Control - GITC affects all applications
B) Same
C) Application is general
D) None
*Ans:
*Q22. Case:* Check digit on customer account number - What control type?
A) Preventive Application - Input Control - Detects transposition errors
B) General control
C) Detective
D) Corrective
*Ans:
*Q23. Case:* Exception report of all payroll changes >10% - Reviewed by HR Manager weekly.
A) Detective Application Control + Monitoring - P16 - Review of exception report is monitoring
B) Preventive
C) No control
D) General control
*Ans:
*Q24. Case:* System allows user to enter sales order date as Feb 30.
A) Failure of Format check / Validity check - Application Input Control - P10
B) Correct
C) General control
D) Monitoring
*Ans:
*Q25. Case:* Database administrator can directly edit payroll table in production to fix error.
A) Severe P11 violation - Direct data file change should NEVER be allowed - Must go through application with audit trail - Risk Owner: IT Manager / DBA
B) Allowed for efficiency
C) Application control
D) No risk
*Ans:
*Q26. Case:* During revenue cycle, which risk owner approves credit memo for returned goods?
A) Salesperson
B) Credit Manager + Receiving confirms goods returned + Inspection - Document: Credit Memo + Receiving Report for returns
C) Warehouse
D) Payroll clerk
*Ans:
*Q27. Case:* Batch total of hours entered is 500 hrs, but system calculated payroll for 550 hrs. What control detects?
A) Batch total / Hash total / Record count - Input control that sums to ensure completeness
B) No control
C) General control
D) Monitoring
*Ans:
*Q28. Case:* All 3 cycles: Who is ultimate owner of internal control?
A) Internal Auditor
B) Management - CEO owns, Board oversees, Internal Audit evaluates - As per COSO and IIA
C) External auditor
D) AP clerk
*Ans:
*Q29. Case:* In ERP, user has access to both create PO and approve payment - System shows SOD conflict but IT says "we have small team, can't segregate"
A) Must have compensating control - e.g., independent manager review of all transactions by that user + exception report review - P10 + P12 - Cannot just ignore - Must document compensating control
B) Acceptable to ignore
C) No control needed
D) Payroll control
*Ans:
*Q30. Case:* Which cycle has highest inherent fraud risk per ACFE?
A) Revenue
B) Procurement/Purchasing - Corruption, kickbacks, fictitious vendors - Most common in manufacturing
C) Payroll
D) None
*Ans:
*... And 5 more super exam-oriented cases:*
*Q31.* Document that triggers AP liability? *Ans: Receiving Report / GRN.*
*Q32.* Document that triggers revenue recognition? *Ans: Bill of Lading / Shipping Document, not Invoice.*
*Q33.* Risk owner for Vendor Master? *Ans: Finance / AP Manager independent of Purchasing.*
*Q34.* Payroll cycle - Best preventive for inflated hours? *Ans: Independent Timekeeping + Biometric + Pre-approved overtime.*
*Q35.* AIS - Which control ensures completeness of revenue? *Ans: Sequence check on pre-numbered shipping docs and invoices + Reconcile shipping log to invoice log daily - Deliverable: Daily Sales-Shipment Reconciliation by AR Manager.*
www.gmsisuccess.in
No comments:
Post a Comment