multiple-choice questions covering Budgetary Control, Variance Analysis, Performance Measurement, Responsibility Centers, Divisional Performance (ROI/RI), Segment Reporting, and Goal Congruence, drawn from US CMA Part 1 style and sources

multiple-choice questions covering Budgetary Control, Variance Analysis, Performance Measurement, Responsibility Centers, Divisional Performance (ROI/RI), Segment Reporting, and Goal Congruence, drawn from US CMA Part 1 style and sources.

Section A:

📊 Budgetary Control

1. Which of the following is a key benefit of using a flexible budget rather than a static budget?

A) It simplifies the budgeting process by using fixed inputs.

B) It provides a detailed analysis of variances based on actual activity levels.

C) It ensures that budgeted costs remain constant regardless of changes in activity levels.

D) It eliminates the need for variance analysis.

Correct Answer: 

2. The major objectives of budgeting are to:

A) Foster planning, provide a framework for performance evaluation, and promote communication and coordination.

B) Facilitate the identification of blame for missed budget predictions and ensure goal congruence.

C) Define responsibility centers and ensure goal congruence.

D) Eliminate the need for variance analysis.

Correct Answer:

📈 Variance Analysis

**3. A company isolates its raw material price variance in order to provide the earliest possible information to the manager responsible. Budgeted material usage: 150,000 units × 3 lbs/unit × $2.00/lb = $900,000. Actual results: Finished goods produced 160,000 units; raw materials purchased 500,000 lbs; raw materials used 490,000 lbs; cost per pound $2.02. The raw material price variance is:**

A) $9,600 unfavorable

B) $9,800 unfavorable

C) $10,000 unfavorable

D) $20,000 unfavorable

**Correct Answer:.

4. A company's standard cost for direct materials is 3 pounds per unit at $4.00 per pound. During the period, the company produced 5,000 units and used 16,000 pounds of material at a total cost of $62,400. What is the total direct materials variance (price plus quantity)?

A) $2,400 unfavorable

B) $2,400 favorable

C) $3,000 unfavorable

D) $1,600 unfavorable

Correct Answer:

🎯 Performance Measurement & Responsibility Centers

5. Which of the following best describes an investment center?

A) A center where managers are responsible only for costs.

B) A responsibility center whose manager is accountable for revenues, costs, and the capital (asset) investment used by the segment.

C) A center where managers are responsible only for revenues.

D) A center that focuses solely on quality control.

Correct Answer

6. All of the following could impair divisional comparison EXCEPT:

A) Age of the divisions’ assets.

B) Business environment of each division.

C) Accounting policies.

D) Remuneration policies.

Correct Answer:

💰 Divisional Performance: ROI & RI

7. A firm earning a profit can increase its return on investment (ROI) by:

A) Increasing sales revenue and operating expenses by the same dollar amount.

B) Decreasing sales revenues and operating expenses by the same percentage.

C) Increasing investment and operating expenses by the same dollar amount.

D) Increasing sales revenues and operating expenses by the same percentage.

Correct Answer:.

8. Which one of the following statements pertaining to ROI as a performance measurement is false?

A) When the average age of assets differs substantially across segments, ROI may not be appropriate.

B) ROI relies on financial measures that are capable of being independently verified, while other forms of performance measures are subject to manipulation.

C) The use of ROI may lead managers to reject capital investment projects that can be justified using discounted cash flow models.

D) The use of ROI can make it undesirable for a skillful manager to take on troubleshooting assignments.

Correct Answer:.

9. The main argument for the use of residual income (RI) as a measure of performance for investment centres, as opposed to ROI, is that:

A) RI will not cause managers to reject investment alternatives that generate a return greater than the cost of capital, but lower than the division’s average ROI.

B) RI is a more equitable way to compare different size divisions and different aged divisions.

C) Since RI is an absolute amount, rather than a percentage, the problems associated with choosing a denominator (gross book value or net book value etc.) are eliminated.

D) RI is simply easier to calculate than ROI.

Correct Answer:

📑 Segment Reporting & Goal Congruence

10. What is the primary purpose of segment reporting?

A) To hide unprofitable divisions from shareholders.

B) To provide information about different business units (product lines, regions) to assess risk and performance.

C) To reduce the company's tax burden.

D) To calculate EPS.

Correct Answer:

11. A company uses negotiated transfer prices between divisions. All of the following are advantages of this type of transfer pricing model EXCEPT that negotiated transfer prices:

A) Achieve goal congruence.

B) Are simple and quick to implement.

C) Preserve subunit autonomy.

D) Provide performance evaluation information.

Correct Answer:

12. Goal congruence in performance measurement refers to:

A) Ensuring that all divisions have identical performance metrics.

B) Aligning the goals of individual managers and subunits with the overall goals of the organization.

C) Maximizing short-term profits at the expense of long-term value.

D) Reducing the need for a balanced scorecard.

Correct Answer: 

Section B...

Here is a set of case-based multiple-choice questions covering performance measurement topics, structured around realistic business scenarios for the US CMA Part 1 exam.

🏢 Case 1: NovaTech Manufacturing – Responsibility Centers & Segment Reporting

NovaTech Manufacturing has three divisions: Components, Assembly, and Services. The Components division manager is evaluated on the controllable margin of her unit. The company allocates a portion of common head office costs to each division based on revenue. The Services division is treated as an investment center, while the Components and Assembly divisions are profit centers.

1. Which of the following costs would be considered a non-controllable cost for the Components division manager?

A) Direct materials used in production

B) Depreciation on a machine the manager decided to purchase last year

C) Allocated share of head office rent

D) Overtime wages approved by the manager

Correct Answer:

2. When evaluating the segment profit of the Components division, which of the following should be subtracted from the segment contribution margin?

A) Only variable costs

B) Traceable fixed costs but not allocated common costs

C) Allocated common costs but not traceable fixed costs

D) Both traceable fixed costs and allocated common costs

Correct Answer:

3. The Components division manager is evaluated on controllable margin. Which of the following is the most appropriate measure of the manager’s short-term performance?

A) Segment profit

B) Net operating income after common cost allocation

C) Contribution margin minus controllable fixed costs

D) Return on investment (ROI)

Correct Answer:

💰 Case 2: Atlas Division – ROI & Residual Income

Atlas Division has net operating income of $400,000 and average operating assets of $2,000,000. The company’s required rate of return (cost of capital) is 12%. The division is considering a new project that requires an investment of $500,000 and is expected to generate additional operating income of $70,000 per year.

4. What is Atlas Division’s current Return on Investment (ROI)?

A) 12%

B) 20%

C) 25%

D) 8%

Correct Answer:

5. What is Atlas Division’s current Residual Income (RI)?

A) $160,000

B) $240,000

C) $400,000

D) $100,000

Correct Answer

6. If the manager is evaluated solely on ROI, will she accept the new project?

A) Yes, because the project’s ROI (14%) is above the cost of capital.

B) No, because the project’s ROI (14%) is below the division’s current ROI (20%).

C) Yes, because the project increases absolute operating income.

D) No, because the project’s RI is negative.

Correct Answer: 

7. Which performance measure would better align the manager’s interests with those of the company’s owners?

A) ROI, because it is a percentage and easy to compare

B) Residual Income, because it encourages acceptance of any project earning above the cost of capital

C) Segment profit, because it includes all allocated costs

D) Sales growth, because it reflects market expansion

Correct Answer:

🔄 Case 3: Vertex Corporation – Centralization vs. Decentralization

Vertex Corporation is considering moving from a centralized structure to a decentralized one, giving division managers more decision-making authority. Top management is concerned about maintaining goal congruence across the organization.

8. Which of the following is a potential disadvantage of decentralization that Vertex should consider?

A) Slower response to local market changes

B) Duplication of costs across divisions

C) Reduced training opportunities for lower-level managers

D) Increased burden on top management for daily decisions

Correct Answer:

9. Which of the following best describes goal congruence in the context of Vertex’s performance measurement system?

A) Ensuring all divisions use the same accounting policies

B) Aligning the goals of division managers with the overall goals of the corporation

C) Maximizing the ROI of each division regardless of corporate strategy

D) Centralizing all decision-making at the top level

Correct Answer: 

10. Vertex’s top management wants to reduce the risk of suboptimization. Which of the following actions would best achieve this?

A) Evaluating division managers solely on divisional ROI

B) Using residual income (RI) for investment decisions and performance evaluation

C) Allocating all common costs equally across divisions

D) Centralizing all capital investment decisions at headquarters

Correct Answer: 

📊 Case 4: Meridian Mills – Operational Excellence & Benchmarking

Meridian Mills is a textile manufacturer striving for operational excellence. The company has set targets to reduce waste, improve machine utilization, and benchmark its performance against competitors.

11. Meridian Mills compares its fuel consumption per ton of fabric with that of a leading logistics company to learn best practices. This is an example of:

A) Internal benchmarking

B) Competitive benchmarking

C) Functional benchmarking

D) Generic benchmarking

Correct Answer: 

12. The company measures efficiency by the ratio of actual output to standard input. Which of the following statements best distinguishes efficiency from effectiveness?

A) Efficiency is about achieving goals; effectiveness is about minimizing resources.

B) Efficiency is about minimizing resources to achieve a given output; effectiveness is about achieving the desired outcome.

C) Efficiency and effectiveness are synonymous in manufacturing.

D) Efficiency relates only to financial measures; effectiveness relates only to non-financial measures.

Correct Answer

13. Meridian’s manager wants to improve economy in the procurement of raw materials. Which action best reflects an improvement in economy?

A) Reducing the defect rate in production

B) Negotiating lower prices for cotton from suppliers

C) Increasing the selling price of finished fabric

D) Launching a new advertising campaign

Correct Answer

⚖️ Case 5: Halcyon Industries – Leverage & Risk

Halcyon Industries has a high degree of financial leverage (significant debt in its capital structure) but a low degree of operating leverage (relatively low fixed operating costs). The company is considering a major investment in automated machinery, which would increase its fixed operating costs.

14. Halcyon’s current strategy of using debt to amplify returns to equity shareholders is known as:

A) Operating leverage

B) Trading on equity

C) Working capital management

D) Capital budgeting

Correct Answer: 

15. If Halcyon invests in automated machinery, what will be the likely effect on its operating leverage and financial risk?

A) Operating leverage will decrease; financial risk will increase.

B) Operating leverage will increase; financial risk will remain unchanged if debt is not used.

C) Both operating leverage and financial risk will decrease.

D) Operating leverage will remain unchanged; financial risk will decrease.

Correct Answer

📈 Case 6: Pinnacle Retail – Segment Contribution & Customer Analysis

Pinnacle Retail has two product lines: Standard and Premium. The company is preparing a segment contribution report to evaluate the profitability of each line and its customers.

16. In a contribution margin income statement, which of the following is deducted from the segment contribution margin to arrive at segment profit?

A) Variable selling expenses

B) Traceable fixed costs

C) Allocated common head office costs

D) Income tax expense

Correct Answer:

17. Pinnacle discovers that a major customer, although generating high sales revenue, is unprofitable after accounting for all customer-specific costs. Which analysis tool would best help Pinnacle rank customers from most to least profitable?

A) The balanced scorecard

B) The whale curve

C) A flexible budget

D) Residual income analysis

Correct Answer:

💡 Summary of Key Distinctions

Concept Key Takeaway

ROI vs. RI ROI can cause goal incongruence (rejecting profitable projects); RI aligns manager and owner interests.

Segment profit Contribution margin – traceable fixed costs (excludes allocated common costs).

Controllable cost Costs the manager can significantly influence; often not synonymous with variable cost.

Centralization vs. Decentralization Decentralization improves responsiveness but risks duplication and goal incongruence.

Economy, Efficiency, Effectiveness Economy = low-cost resource acquisition; Efficiency = least resources for output; Effectiveness = achieving goals.

Trading on equity Using fixed-cost debt to amplify equity returns when ROI > cost of debt.

Benchmarking types Internal (within firm), Competitive (direct rivals), Functional (other industries/processes), Generic (best-in-class across all industries).

These case-based questions reflect the analytical and decision-making emphasis of the US CMA Part 1 exam. For further practice, I will upload computational questions involving ROI/RI with changing asset bases, segment reporting with and without common cost allocations, and identifying goal congruence issues in performance evaluation.

📚 Suggested Study Focus

These questions cover high-yield areas for CMA Part 1. For further practice, focus on:

· Computational variance analysis (price, quantity, mix, yield variances).

· ROI and RI calculations with different asset bases.

· Responsibility center classification and controllable vs. non-controllable costs.

· Segment reporting criteria (10% tests, 75% revenue test).

· Goal congruence issues in transfer pricing and performance evaluation.

www.gmsisuccess.in

CISA Domain 1 – Case-Based MCQs Mocktest Tuesday 27 Oct 2026 Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

CISA Domain 1 – Case-Based MCQs Mocktest Tuesday 27 Oct 2026 Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

CISA Domain 1 – Case-Based MCQs Mocktest Tuesday 27 Oct 2026

Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

Prepared for GMSiSuccess students — these original, exam-style practice questions are designed to develop the application and judgment skills needed for the CISA examination.

section a:

Case Study 1: IT Audit vs. IT Assessment

A financial services company plans to introduce a cloud-based customer management system. Before implementation, management asks an IT risk consultant to evaluate security controls, identify vulnerabilities, and recommend improvements. The consultant issues a report describing the current control environment and areas requiring corrective action.

Question 1

What best distinguishes this engagement from a formal audit?

A. An assessment is always performed without documented procedures.

B. An assessment generally evaluates a situation and identifies gaps, while an audit follows a defined audit process and provides an independent conclusion based on sufficient evidence.

C. An assessment provides higher assurance than an audit because it focuses on risks.

D. An assessment and an audit are identical in purpose, scope, and assurance.

Correct answer:

Question 2

The company's regulator requires independent assurance that its information security controls meet applicable requirements. Which engagement is generally most appropriate?

A. An informal self-assessment by the IT manager.

B. A departmental checklist completed by system administrators.

C. An independent audit performed by suitably qualified and independent auditors.

D. An informal discussion with a cybersecurity consultant.

Correct answer:

Case Study 2: Auditor, Client, and Auditee

A multinational company appoints an external audit firm to review its ERP access controls. The company's audit committee approves the engagement objectives, while the audit firm performs testing and reports its findings. The IT department provides records and explanations during the audit.

Question 3

Who is primarily responsible for performing the audit procedures?

A. The auditee

B. The auditor

C. The IT department manager

D. The system administrator

Correct answer:

Question 4

The IT manager asks the audit firm to exclude privileged-user access from the audit scope because several senior executives use those accounts. What should the auditor do FIRST?

A. Accept the request because the IT manager owns the system.

B. Exclude the accounts to avoid conflict with management.

C. Evaluate the implications for the audit objectives and discuss the proposed scope limitation with the appropriate audit authority.

D. Immediately issue an adverse audit opinion without further investigation.

Correct answer: 

Question 5

During an IT audit, the auditee provides incomplete access logs. Which action is MOST appropriate?

A. Assume that the missing logs contain no exceptions.

B. Document the limitation, seek alternative evidence, and evaluate its impact on the audit conclusion.

C. Ignore the issue if management provides verbal assurance.

D. Automatically conclude that fraud has occurred.

Correct answer:

Case Study 3: Organizational IT Policies

A company has experienced repeated data leakage incidents. The IT department drafts an information security policy covering access control, password management, data classification, and incident reporting. The policy is circulated among employees, but no senior executive formally approves it.

Question 6

Who should have ultimate authority for approving and sponsoring the organization's information security policy?

A. The IT helpdesk supervisor

B. The external auditor

C. Senior management or the appropriate governing authority

D. Any employee who understands information security

Correct answer: 

Question 7

The internal auditor discovers that the security policy has never been formally approved. What is the GREATEST concern?

A. The policy may contain too many technical terms.

B. Employees may not have a clear, formally authorized direction or accountability for compliance.

C. The policy cannot be stored electronically.

D. The policy must have been written by an external consultant.

Correct answer:

Question 8

Management asks the internal auditor to draft the new security policy, approve it, and subsequently audit employee compliance. What is the BEST response?

A. Accept all responsibilities because internal auditors understand controls.

B. Draft and approve the policy, but avoid auditing it.

C. Explain the independence and objectivity risks, and recommend that management own and approve the policy while the auditor retains an appropriate assurance role.

D. Transfer responsibility for the policy to the external auditor.

Correct answer: 

Case Study 4: Auditor Independence and Objectivity

A company's internal audit department is reviewing the implementation of a new financial reporting system. The chief financial officer asks the lead auditor to approve the system's access controls before the system goes live. The same auditor is expected to conduct an independent post-implementation audit.

Question 9

What is the PRIMARY concern with the CFO's request?

A. Internal auditors cannot understand financial systems.

B. Approving management's controls could impair the auditor's objectivity when later auditing those controls.

C. Internal auditors must always report directly to the CFO.

D. Only external auditors can review access controls.

Correct answer: 

Question 10

Which arrangement BEST supports the independence of the internal audit function?

A. The IT manager determines all audit findings.

B. The CFO can suppress any unfavorable audit report.

C. The internal audit function has appropriate organizational independence, with functional reporting to the audit committee or equivalent governing body.

D. The auditor receives a bonus based on the number of satisfactory findings.

Correct answer: 

Question 11

An external audit firm is auditing a company's cybersecurity controls. The lead auditor owns a significant financial interest in the company being audited. What should the firm do?

A. Continue the audit because the auditor works for an external firm.

B. Disclose and evaluate the conflict, and take appropriate action to eliminate or mitigate the independence threat, including replacing the auditor where necessary.

C. Allow the auditor to continue if management agrees.

D. Treat independence as irrelevant because the audit is technical.

Correct answer:

Case Study 5: Assurance Methods and External Reliance

A software company supplies a payment-processing platform to banks. A licensing authority requires independent evidence that the platform meets specified security and control requirements. The company has already completed an internal self-assessment and received a report from its IT department.

Question 12

Which assurance method is generally the MOST appropriate for satisfying a requirement for independent external assurance?

A. Internal self-assessment

B. Informal management review

C. Independent audit meeting the authority's requirements

D. Verbal confirmation from the IT manager

Correct answer

Question 13

The company's management argues that its internal audit report should automatically satisfy the licensing authority because the internal audit team is qualified. Which response is BEST?

A. All internal audit reports are automatically accepted by licensing authorities.

B. The authority's requirements must be checked because internal audit reports may not meet its independence, scope, or reporting criteria.

C. A qualified internal auditor always provides greater assurance than an external auditor.

D. Internal audits cannot provide any assurance.

Correct answer: 

Question 14

A company commissions a consultant to assess its disaster recovery arrangements. The consultant identifies gaps in backup procedures but does not independently test whether the controls operate effectively. Management wants to use the report as proof of compliance.

What is the auditor's or assessor's MOST important consideration?

A. The report's title must contain the word audit.

B. The report should be accepted because the consultant is experienced.

C. The actual scope, procedures, evidence, limitations, and level of assurance must be evaluated before determining whether the report supports the compliance claim.

D. Any written report provides sufficient assurance for external use.

Correct answer:

section b :

6. What is the definition of a standard as compared to a guideline ?
A. Standards are discretionary controls used with guidelines to aid the reader’s decision
process.
B. Standards are mandatory controls designed to support a policy. Following guidelines is
discretionary.
C. Guidelines are recommended controls necessary to support standards, which are
discretionary.
D. Guidelines are intended to designate a policy, whereas standards are used in the
absence of a policy.
7. Which of the following is not defined as a nonaudit role?
A. System designer
B. Operational staff member
C. Auditor
D. Organizational manager
8. Which of the following is the best description of an ongoing audit program for regulatory
compliance?
A. An audit is performed once for the entire year and then repeated by using the same
information for each successive year.
B. An audit may be automated by using audit program software.
C. An audit is a series of unique projects of short duration that add up to cover all the
steps necessary for annual compliance.
D. An audit is a series of assessments performed by the auditee for the purpose of licensing
and regulatory compliance.
9. What is the purpose of ISACA’s professional ethics statement?
A. To clearly specify acceptable and unacceptable behavior
B. To provide procedural advisement to the new IS auditor
C. To provide instructions on how to deal with irregularities and illegal acts by the client
D. To provide advice on when it is acceptable for the auditor to deviate from audit
standards
10. The auditor’s final opinion is to be based on which of the following?
A. The objectives and verbal statements made by management
B. An understanding of management’s desired audit results
C. The audit committee’s specifications
D. The results of evidence and testing

11. What are common types of audits?
A. Forensic, accounting, verification, regulatory
B. Integrated, operational, compliance, administrative
C. Financial, SAS‐74, compliance, administrative
D. Information systems, SAS‐70, regulatory, procedural
12. What is the difference between a policy and a procedure?
A. Compliance to a policy is discretionary, and compliance to a procedure is mandatory.
B. A procedure provides discretionary advice to aid in decision making. The policy
defines specific requirements to ensure compliance.
C. A policy is a high‐level document signed by a person of authority, and compliance is
mandatory. A procedure defines the mandatory steps to attain compliance.
D. A policy is a mid‐level document issued to advise the reader of desired actions in the
absence of a standard. The procedure describes suggested steps to use.
13. What is the purpose of standard terms of reference?
A. To meet the legal requirement of regulatory compliance
B. To prove who is responsible
C. To ensure honest and unbiased communication
D. To ensure that requirements are clearly identified in a regulation
14. Which of the following in a business organization will be held liable by the government for
failures of internal controls?
A. President, vice presidents, and other true corporate officers
B. Board of directors, president, vice presidents, department directors, and managers
C. All members of management
D. Board of directors, CEO, CFO, CIO, and department directors
15. Which of the following is true concerning the roles of data owner, data user, and data
custodian?
A. The data user implements controls as necessary.
B. The data custodian is responsible for specifying acceptable usage.
C. The data owner specifies controls.
D. The data custodian specifies security classification.
Review Questions 55
16. What does fiduciary responsibility mean?
A. To use information gained for personal interests without breaching confidentiality of
the client.
B. To act for the benefit of another person and place the responsibilities to be fair and
honest ahead of your own interest.
C. To follow the desires of the client and maintain total confidentiality even if illegal acts
are discovered. The auditor shall never disclose information from an audit in order to
protect the client.
D. None of the above.
17. How does the auditor derive a final opinion?
A. From evidence gathered and the auditor’s observations
B. By representations and assurances of management
C. By testing the compliance of language used in organizational policies
D. Under advice of the audit committee
18. How should the auditor assist in the remediation of problems found during the audit?
A. The auditor should take ownership of the issue and participate in designing the plan
for fixing the problem.
B. The auditor should decide whether the problem is major or minor and then advise the
auditee with a specific solution after considering the impact to the business.
C. The auditor should help the auditees. The auditor can add value by defining the specific
steps necessary for remediation of the problem.
D. The auditor should never take ownership of problems found. Auditors are encouraged
to provide general advice to the auditee, including an explanation of what to look for
during the audit.
19. The type of audit checks attributes against the design specifications.
A. Process
B. System
C. Compliance
D. Product
20. Why is it necessary to protect audit documentation and work papers?
A. The evidence gathered in an audit must be disclosed for regulatory compliance.
B. A paper trail is necessary to prove the auditor is right and the auditee is wrong.
C. The auditor will have to prove illegal activity in a court of law.
D. Audit documentation work papers may reveal confidential information that should not
be lost or disclosed.

21. What is the difference between the words should and shall when used in regulations?
A. Shall represents discretionary requirements, and should provides advice to the reader.
B. Should indicates mandatory actions, whereas shall provides advisory information
recommending actions when appropriate.
C. Should and shall are comparable in meaning. The difference is based on the individual
circumstances faced by the audit.
D. Should indicates actions that are discretionary according to need, whereas shall means
the action is mandatory regardless of financial impact.
22. The audit may uncover irregularities and illegal acts that require disclosure. The auditor is
obligated to promptly disclose this information to the authorities.
A. True
B. False
23. Which of the following statements is not true regarding the audit committee?
A. Executives inside the organization oversee the audit committee and are responsible for
keeping the committee busy working on compliance programs.
B. Executives can be hired and fired by the audit committee because this committee is
responsible for management oversight.
C. The audit committee is composed of members from the board of directors. This
committee has the authority to hire external auditors, and external auditors may meet
with the committee on a quarterly basis without other executives present.
D. The audit committee provides senior executives a method of bringing problems into a
confidential discussion for the purpose of exploring a resolution.
24. What term simply means the right people of authority looked at the issue, made an
intelligent decision, and took appropriate action?
A. Leadership
B. Corporate responsibility
C. Chain of command
D. Governance
25. What is the difference between a threat and a vulnerability?
A. Threats are the path that can be exploited by a vulnerability.
B. Threats are risks and become a vulnerability if they occur.
C. Vulnerabilities are a path that can be taken by a threat, resulting in a loss.
D. Vulnerability is a negative event that will cause a loss if it occurs.

answer

section c;

*Q1. What is the FIRST step in an IS audit?*

A) Perform risk assessment

B) Understand business objectives and structure

C) Test controls

D) Draft audit report

*Answer:

*Q2. Which audit charter authority is MOST important?*

A) Scope of audit activities

B) Access to records and personnel

C) Reporting line to Audit Committee

D) All of above are equally defined in charter

*Answer:

*Q3. An IS auditor finds material control weakness. What is immediate action?*

A) Ignore if management says will fix

B) Report to auditee first, then include in report

C) Directly report to regulator

D) Stop the audit

*Answer:

*Q4. Inherent Risk vs Control Risk vs Detection Risk. Formula for Audit Risk?*

A) Audit Risk = Inherent Risk + Control Risk + Detection Risk

B) Audit Risk = Inherent Risk x Control Risk x Detection Risk

C) Audit Risk = Inherent Risk x Control Risk / Detection Risk

D) Audit Risk = Control Risk / Detection Risk

*Answer:._

*Q5. Which sampling method provides MOST statistical conclusion?*

A) Judgmental sampling

B) Stratified sampling

C) Haphazard sampling

D) Convenience sampling

*Answer:

*Q6. Best evidence for operating effectiveness of control?*

A) Inquiry with process owner

B) Observation of control performance

C) Re-performance of control

D) Review of policy document

*Answer:

*Q7. When should audit evidence be collected?*

A) Only at year-end

B) Throughout audit after planning

C) Only during fieldwork

D) Before planning

*Answer:

*Q8. What is PRIMARY objective of continuous auditing?*

A) Replace annual audit

B) Provide real-time assurance on controls

C) Reduce audit fees to zero

D) Detect fraud only

*Answer: 

*Q9. Which is NOT part of audit planning?*

A) Determine audit scope and objectives

B) Assign audit staff

C) Issue final audit report

D) Perform preliminary risk assessment

*Answer: 

*Q10. Materiality in IS audit is determined by?*

A) Fixed 5% of revenue

B) Auditor's professional judgment based on business impact

C) Management's wish

D) ISACA standard fixed amount

*Answer

*Q11. What type of audit test checks if controls are correctly designed?*

A) Substantive test

B) Compliance test / Test of controls

C) Walkthrough test of design

D) Analytical test

*Answer: 

*Q12. CAATs is MOST useful when?*

A) Small population, manual records

B) Large population, electronic data

C) No data available

D) Audit without system access

*Answer: 

*Q13. Risk-Based Auditing means?*

A) Audit all areas equally

B) Audit high-risk areas first with more resources

C) Avoid high-risk areas

D) Only audit IT risks

*Answer:

*Q14. Independence of IS auditor is impaired when?*

A) Auditor previously worked as developer of same system being audited

B) Auditor has training in auditing

C) Auditor reports to Audit Committee

D) Auditor uses CAATs

*Answer:

*Q15. Audit program should be approved by?*

A) Auditee

B) Audit Management / Audit Committee

C) CEO

D) External regulator

*Answer:

*Q16. Which document shows sequence of steps auditor will follow?*

A) Audit Charter

B) Audit Program / Audit Plan

C) Engagement Letter

D) Management Representation Letter

*Answer:

*Q17. Follow-up audit is done to?*

A) Verify corrective actions implemented

B) Start new audit

C) Punish auditee

D) Collect fees

*Answer: 

*Q18. In risk assessment, which risk cannot be controlled by organization?*

A) Control Risk

B) Inherent Risk

C) Detection Risk

D) Residual Risk

*Answer: _

*Q19. Generalized Audit Software (GAS) is example of?*

A) Manual audit technique

B) CAATs

C) Physical security control

D) Administrative control

*Answer:

*Q20. MOST important for reliance on work of internal auditor by external IS auditor?*

A) Internal auditor's objectivity, competence, and work quality

B) Internal auditor's salary

C) Number of staff

D) Location of office

*Answer:

Concept	Exam-ready takeaway
Assessment vs. audit	Assessments commonly identify gaps; audits follow a systematic, evidence-based process.
Auditor	Performs audit procedures and evaluates evidence.
Auditee	The person, function, or organization being examined.
Client	The party commissioning or requesting the engagement.
Organizational policies	Require authorization from appropriate senior management or governing authority.
Auditor independence	Protects unbiased judgment and credible assurance.
Internal audit	Provides assurance while avoiding inappropriate management responsibilities.
External assurance	Must meet the intended user's or regulator's specific requirements.
Scope limitation	Investigate, document, and evaluate its impact on the audit conclusion.
Evidence	Conclusions must be supported by sufficient, appropriate evidence.

Exam tip for students: In CISA Domain 1, focus on what the auditor should do FIRST, what is MOST appropriate, and which action best protects independence, objectivity, evidence quality, and governance. These questions test judgment, not just definitions.

www.gmsisuccess.in

*Bonus Exam Tip for GMSISuccess CIA/CISA Students:*

Domain 1 trap = Confusing Test of Controls vs Substantive Test.

- *Test of Controls (Compliance Test):* Does control work? – Sample small.

- *Substantive Test:* Is data correct? – Sample large, direct verification of transaction.

Concept	Exam-ready takeaway
Assessment vs. audit	Assessments commonly identify gaps; audits follow a systematic, evidence-based process.
Auditor	Performs audit procedures and evaluates evidence.
Auditee	The person, function, or organization being examined.
Client	The party commissioning or requesting the engagement.
Organizational policies	Require authorization from appropriate senior management or governing authority.
Auditor independence	Protects unbiased judgment and credible assurance.
Internal audit	Provides assurance while avoiding inappropriate management responsibilities.
External assurance	Must meet the intended user's or regulator's specific requirements.
Scope limitation	Investigate, document, and evaluate its impact on the audit conclusion.
Evidence	Conclusions must be supported by sufficient, appropriate evidence.

Exam tip for students: In CISA Domain 1, focus on what the auditor should do FIRST, what is MOST appropriate, and which action best protects independence, objectivity, evidence quality, and governance. These questions test judgment, not just definitions.

www.gmsisuccess.in

Comprehensive question answers oct25:cma part 1

 

Comprehensive question answers oct25:cma part 1 Here is a comprehensive question interactive mock exam designed specifically to test the core case-based scenarios and principles required for the US CMA Part 1 exam. It spans all key domains: External Financial Reporting Decisions, Planning, Budgeting, and Forecasting, Performance Management, Cost Management, Internal Controls, and Technology and Analytics. 1.A company manufactures heavy equipment and sells a unit on January 1 for $100,000 with a 2-year standard warranty included. Past experience indicates warranty costs average 4% of the sales price. Under US GAAP, how should the company recognize the warranty obligation at the date of sale? A. Recognize a warranty expense of $4,000 and credit cash when actual repairs occur. B. Recognize $4,000 as warranty expense and credit warranty liability in the period of sale. C. Recognize $100,000 in revenue and defer all warranty accounting until year two. D. Record $4,000 as an intangible asset and amortize over 2 years. ANSWER B 2.An entity reclassifies a debt security from available-for-sale (AFS) to trading. Under US GAAP, where should the unrealized holding gain or loss at the date of transfer be recognized? A. Recognized in earnings immediately. B. Recognized in other comprehensive income (OCI). C. Deferred and amortized over the remaining life of the security. D. Ignored until the security is sold to an independent third party. ANSWER A. Recognized in earnings immediately. Correct! Upon transfer from AFS to trading, the unrealized gain or loss is recognized in net income (earnings) at the transfer date. 3.A manufacturing firm uses a normal costing system with overhead applied based on direct labor hours. If actual manufacturing overhead is $150,000 and applied overhead is $142,000, the overhead is: A. Overapplied by $8,000. B. Overapplied by $292,000. C. Underapplied by $8,000. D. Underapplied by $292,000. ANSWER C 4.In a process costing system using the weighted-average method, the calculation of equivalent units of production includes: A. Only units started and completed during the current period. B. Work done in prior periods plus work done in the current period on ending inventory only. C. Work done in the current period only, excluding beginning inventory. D. Units completed and transferred out plus equivalent units in ending work-in-process inventory. ANSWER D 5Q. A company purchases machinery for $100,000 and pays $5,000 for installation. Under US GAAP, what is the initial cost of the machinery? Answer: $105,000, including directly attributable installation costs. Q6. A retailer has inventory costing $80,000 and a net realizable value of $72,000. What amount should be reported if the inventory is measured under the lower-of-cost-and-net-realizable-value rule? Answer: $72,000.   Q7. A company sells goods for $50,000 on credit, and control transfers to the customer on December 28. When should revenue generally be recognized? Answer: In December, when the performance obligation is satisfied and control transfers.   Q8. A company estimates that 2% of its $500,000 credit sales will be uncollectible. What is the estimated bad debt expense? Answer: $10,000, assuming the estimate is based on credit sales.   Q9. A company purchases equipment for $60,000 with a five-year useful life and zero residual value. What is annual straight-line depreciation? Answer: $12,000 per year.   Q10. A company reports a contingent loss that is probable and reasonably estimable at $40,000. What accounting treatment is generally required under US GAAP? Answer: Accrue a $40,000 loss and liability.   Q11. A company receives $24,000 on October 1 for a 12-month service contract. How much revenue should it recognize by December 31 if services are provided evenly? Answer: $6,000.   Q12. A company issues bonds at a discount because the stated interest rate is below the market rate. How is the discount generally treated over the bond's life? Answer: It is amortized as additional interest expense using the effective-interest method.   Q13. A company owns 30% of another company and has significant influence over its operating and financial policies. Which accounting method generally applies? Answer: The equity method.   Q14. A company pays $15,000 for routine equipment maintenance that does not extend useful life or increase capacity. How should it account for the payment? Answer: Recognize the $15,000 as maintenance expense.   Q15. A company reports $200,000 in current assets and $125,000 in current liabilities. What is its working capital? Answer: $75,000.   Q16. A company changes an accounting estimate because new information becomes available about an asset's useful life. How is the change generally reported? Answer: Prospectively in the current and affected future periods.   Section 2: Planning, Budgeting and Forecasting (Questions 13–22) Q17. A company expects to sell 10,000 units and wants ending inventory of 2,000 units; beginning inventory is 1,500 units. How many units should it produce? Answer: 10,500 units (10,000 + 2,000 − 1,500).   Q18. A company expects sales of $400,000, and 70% of sales are collected in the same month. What are current-month collections from these sales? Answer: $280,000.   Q19. A company budgets 5,000 units of production, requiring 3 kilograms of material per unit. How much material is needed for production before inventory adjustments? Answer: 15,000 kilograms.   Q20. A manager deliberately understates expected revenue to make budget targets easier to achieve. What is this behavior called? Answer: Budgetary slack.   Q21. A company updates its budget every month by adding a new month as the previous month ends. What type of budget is this? Answer: A rolling (continuous) budget.   Q22. A business has fixed costs of $60,000 and a contribution margin ratio of 40%. What sales revenue is required to break even? Answer: $150,000 ($60,000 ÷ 40%).   Q23. A company forecasts sales of $500,000 but actual sales are $460,000. What is the sales revenue variance? Answer: $40,000 unfavorable.   Q24. A business has a cash shortage in its budget despite reporting a net profit. What could explain the difference? Answer: Noncash expenses, working-capital increases, capital expenditures, or debt repayments may reduce cash despite accounting profit. Q25. A manufacturer identifies its production capacity as the main constraint on sales. Which budget should be prepared first to reflect the constraint? Answer: The production budget should be developed around the capacity constraint after considering demand.   Q26. A company prepares three forecasts based on optimistic, expected, and pessimistic sales outcomes. Which planning technique is it using? Answer: Scenario analysis.   Section 3: Cost Management and Cost Accounting                                  Q27. A factory incurs $100,000 in fixed costs and produces 20,000 units. What is fixed cost per unit? Answer: $5 per unit.   Q28. Variable cost is $12 per unit, selling price is $20, and fixed costs are $80,000. How many units are needed to break even? Answer: 10,000 units [($80,000) ÷ ($20 − $12)].   Q29. A company has a selling price of $50, variable cost of $30, and fixed costs of $100,000. What is the contribution margin ratio? Answer: 40% [($50 − $30) ÷ $50].   Q30. A company receives a special order for 2,000 units at $18 each. Variable cost is $12 per unit, and there is no additional fixed cost or displacement of regular sales. What is the incremental profit? Answer: $12,000 [(2,000 × ($18 − $12))].   Q31. A company can manufacture a component for $14 per unit, including $4 of allocated fixed overhead. A supplier offers it for $12.50, and the fixed overhead will remain. What is the relevant cost of manufacturing? Answer: $10 per unit, excluding unavoidable fixed overhead.   Q32. A company spends $40,000 on research that has already been completed. Management is deciding whether to launch the resulting product. How should the research expenditure be treated in the decision? Answer: As a sunk cost, which is irrelevant to the future decision.   Q33. A product sells for $100, has variable costs of $60, and uses two machine hours per unit. What is its contribution margin per machine hour? Answer: $20 per machine hour [($100 − $60) ÷ 2].   Q34. A factory applies overhead using machine hours, but one product consumes substantially more setup and inspection activities than another. Which costing method may provide more accurate product costs? Answer: Activity-based costing (ABC).   Q35. A company incurs $200,000 of joint costs before two products become separately identifiable. How should these costs be treated when deciding whether to process one product further? Answer: Joint costs incurred before split-off are sunk for the further-processing decision.   Q36. A company has actual material usage of 5,200 kilograms, standard usage of 5,000 kilograms, and a standard price of $4 per kilogram. What is the direct material usage variance? Answer: $800 unfavorable [(5,200 − 5,000) × $4].   Q37. A company purchases 3,000 kilograms of material at $5.20 per kilogram when the standard price is $5.00. What is the material price variance? Answer: $600 unfavorable [(5.20 − 5.00) × 3,000].   Q38. A worker produces 100 units using 20 labor hours. The standard time is 0.18 hours per unit, and the standard labor rate is $25 per hour. What is the labor efficiency variance? Answer: $50 unfavorable [(20 − 18) × $25].   Q39. A company uses standard costing and finds that actual overhead exceeds applied overhead. What does this indicate before any year-end disposition? Answer: Overhead is underapplied.   Q40. A factory allocates overhead using a predetermined rate of $8 per machine hour and records 12,000 machine hours. How much overhead is applied? Answer: $96,000.   Q41. A company reports beginning work-in-process of 1,000 units, starts 9,000 units, and completes 8,000 units. How many units remain in ending work-in-process? Answer: 2,000 units.   Q42. A manager evaluates a product using only full manufacturing cost, including allocated fixed overhead, even though the decision concerns a short-term special order with unused capacity. What is the main risk? Answer: Rejecting a profitable order because irrelevant allocated fixed costs distort the decision.   Section 4: Performance Management and Measurement                               Q43. A division earns operating income of $150,000 and has average operating assets of $1,000,000. What is its return on investment (ROI)? Answer: 15% ($150,000 ÷ $1,000,000).   Q44. A division earns $200,000 on operating assets of $1,000,000. The minimum required rate of return is 12%. What is residual income? Answer: $80,000 [$200,000 − ($1,000,000 × 12%)].   Q45. A manager's bonus is based solely on quarterly profit, causing the manager to cut employee training and preventive maintenance. What performance measurement problem is illustrated? Answer: Short-termism caused by an overly narrow performance measure.   Q46. A company measures customer satisfaction, employee learning, internal process efficiency, and financial returns. Which framework is it using? Answer: The Balanced Scorecard.   Q47. A company has sales of $800,000 and operating income of $120,000. What is its operating margin? Answer: 15% ($120,000 ÷ $800,000).   Q48. A plant's actual output is 9,000 units, while its budgeted output is 10,000 units. Why should a flexible budget be considered when analyzing variable costs? Answer: It adjusts expected variable costs to actual activity levels, improving the fairness of the comparison.   Q49. A company compares its defect rate with that of a leading competitor to identify improvement opportunities. What is this process called? Answer: Benchmarking.   Q50. A division manager is evaluated on controllable contribution but is charged for corporate headquarters costs the manager cannot influence. What is the problem? Answer: The evaluation includes costs outside the manager's control.   Q51. A company tracks the percentage of products delivered on time. Is this a leading or lagging performance indicator? Answer: Generally a lagging indicator of delivery performance, although it can help predict customer retention.   Q52. A business has sales of $1,000,000 and average accounts receivable of $125,000. What is receivables turnover, assuming all sales are credit sales? Answer: 8 times per year ($1,000,000 ÷ $125,000).   Q53. A company measures units produced per labor hour to monitor factory productivity. What type of measure is this? Answer: An operational efficiency measure.   Q54. A company rewards sales employees only for revenue, and they begin granting excessive discounts. What change would best reduce this behavior? Answer: Include profitability or contribution margin alongside revenue in the incentive system.   Section 5: Internal Controls and Risk Assessment Q55. The same employee receives customer payments, records receipts, and reconciles the bank account. What internal control weakness exists? Answer: Inadequate segregation of duties.   Q56. A company requires two authorized signatures for payments above $50,000. What type of control is this? Answer: A preventive authorization control.   Q57. A bank reconciliation identifies an unexplained difference between the bank balance and the general ledger. What should management do? Answer: Investigate the difference and resolve any errors or irregularities promptly.   Q58. A company installs software that blocks employees from accessing payroll records unless they have approved permissions. What control is this? Answer: An access control designed to prevent unauthorized access.   Q59. An internal auditor reviews transactions after they have been processed to identify errors. What type of control activity is this? Answer: A detective control.   Q60. A company has a high-impact cybersecurity threat but estimates its likelihood as low. How should it assess the risk? Answer: Evaluate both likelihood and impact, then prioritize the risk using the organization's risk criteria and risk appetite.   Q61. A company purchases insurance to transfer part of its exposure to property damage. Which risk response is it using? Answer: Risk sharing or transfer.   Q62. A business stops selling a product because the associated regulatory risk is unacceptable. Which risk response is this? Answer: Risk avoidance.   Q63. A company uses an independent employee to review vendor master-file changes. Which risk does this control primarily address? Answer: Unauthorized or fraudulent changes to vendor information.   Q64. A company backs up critical data daily and tests recovery procedures. Which risk-management objective does this support? Answer: Business continuity and disaster recovery.   Q65. An employee receives an email impersonating the CFO and requesting an urgent wire transfer. What threat is illustrated? Answer: Social engineering, specifically a business email compromise attempt. Q66. An auditor finds that a control is properly designed but is not consistently performed. What is the primary issue? Answer: An operating effectiveness deficiency.   Section 6: Accounting Information Systems and Technology    Q67. A company integrates purchasing, inventory, production, and accounting into one system. What type of system is it using? Answer: An enterprise resource planning (ERP) system.   Q68. A company assigns each transaction a unique reference number to trace it from source document to the general ledger. What is this called? Answer: An audit trail.   Q69. An organization uses role-based permissions so that purchasing staff cannot approve their own payments. What principle is being applied? Answer: Least privilege, supported by segregation of duties.   Q70. A company stores transaction data in structured tables that link customers, invoices, and payments. What technology is being used? Answer: A relational database.   Q71. A company wants to process transactions continuously and update inventory balances immediately after each sale. Which processing approach is appropriate? Answer: Online real-time transaction processing.   Q72. A company records transactions throughout the day but updates the central system in scheduled batches overnight. What is this called? Answer: Batch processing.   Q73. An accounting system validates that an invoice number is not duplicated before accepting a transaction. What type of application control is this? Answer: An input validation or duplicate-check control.   Q74. A company moves its financial reporting applications to a cloud provider. Who remains responsible for appropriate access, configuration, and oversight of the company's financial reporting processes? Answer: Company management retains responsibility, even when cloud services are outsourced.   Q75. A company uses robotic process automation to transfer approved invoice data into its accounting system. What is the principal benefit? Answer: Reduced repetitive manual work and improved processing consistency, subject to appropriate controls.   Q76. A system produces an exception report showing duplicate payments and unusually large transactions. How should management use it? Answer: Investigate flagged transactions and resolve confirmed errors or suspicious activity. Section 7: Data Analytics and Emerging Technology Q77. A financial analyst uses historical sales data to summarize monthly revenue and identify trends. What type of analytics is being used? Answer: Descriptive analytics.   Q78. A company investigates why its operating margin declined compared with the previous quarter. What type of analytics is most relevant? Answer: Diagnostic analytics.   Q79. A company uses historical data and statistical models to forecast next quarter's sales. What type of analytics is this? Answer: Predictive analytics.   Q80. A decision-support model recommends the optimal production mix given capacity and demand constraints. What type of analytics is this? Answer: Prescriptive analytics.   Q81. A data analyst combines dates stored in different formats, removes duplicate records, and corrects inconsistent product codes. What process is being performed? Answer: Data cleaning and transformation.   Q82. A company's dashboard shows revenue increasing by 20%, but the data excludes two major regions. What is the main concern? Answer: Incomplete data may produce a misleading conclusion.   Q83. An analyst observes that advertising expenditure and sales rise together. Can the analyst conclude that advertising caused the increase in sales? Answer: No; correlation alone does not establish causation.   Q84. A company uses machine learning to flag potentially fraudulent journal entries. What is a key limitation management must consider? Answer: False positives, false negatives, and model bias require validation and human oversight.   Q85. A company uses blockchain to maintain a shared, tamper-evident record of transactions. Does blockchain automatically guarantee that every recorded transaction is valid? Answer: No; it protects record integrity but does not guarantee the accuracy or legitimacy of the original input.   Q86. A company finds that a reporting dashboard uses outdated data because the source system refreshes only once per week. What should it evaluate first? Answer: Whether the data refresh frequency meets the reporting and decision-making requirements.   Section 8: Quantitative Methods and Statistics Q87. A company has monthly sales of $10,000, $12,000, and $14,000. What is the three-month arithmetic mean? Answer: $12,000.   Q88. An investment has possible returns of 10% with a 60% probability and 4% with a 40% probability. What is the expected return? Answer: 7.6% [(10% × 60%) + (4% × 40%)].   Q89. A dataset contains several extreme values that distort the arithmetic mean. Which measure of central tendency may better represent a typical observation? Answer: The median. Q90. A company finds that its sales increase by an average of $5,000 for every additional $1,000 spent on advertising in a regression model. What does the estimated slope represent? Answer: The estimated change in sales associated with a one-unit increase in advertising expenditure, according to the model.   Q91. A regression model has an R^2   of 0.80. What does this indicate? Answer: The model explains 80% of the observed variation in the dependent variable within the fitted sample.   Q92. A company wants to estimate the probability that demand exceeds available inventory using a large number of simulated demand outcomes. Which technique is appropriate? Answer: Monte Carlo simulation.   Q93. A manager must choose the best product mix given labor-hour and machine-hour limits. Which quantitative technique is most appropriate?   Answer: Linear programming. Q94. A company studies how changes in selling price, volume, and variable cost affect profit, changing one assumption at a time. What technique is it using? Answer: Sensitivity analysis.   Q95. An investment requires $100,000 today and generates $60,000 at the end of each of the next two years. At a 10% discount rate, is the net present value positive or negative? Answer: Positive; NPV is approximately $4,132 . Q96. A company has net income of $50,000 and average total assets of $500,000. What is its return on assets? Answer: 10% ($50,000 ÷ $500,000).   Q97. A company borrows at an interest rate below its expected return on invested funds. What financial concept describes the potential benefit, assuming the investment return is actually achieved and risk is considered? Answer: Positive financial leverage. Q98. An accounts payable employee creates a fictitious vendor, approves invoices, and processes payments to that vendor. Which internal control is missing? Answer: Segregation of duties between vendor creation, invoice approval, and payment processing.   Q99. A company requires purchase orders to be approved before orders are placed with suppliers. What type of control is this? Answer: A preventive control.   Q100. A supervisor reviews monthly bank reconciliations prepared by an accountant. What type of control is being applied? Answer: A detective control.   Q101. A company requires employees to take mandatory vacations, during which another employee performs their duties. What risk can this control help detect? Answer: Fraud or irregularities concealed through continuous control over a process.   Q102. A cashier collects customer payments and also reconciles the cash receipts ledger. Why is this arrangement risky? Answer: The cashier could conceal misappropriation because incompatible duties are not separated.   Q103. A company uses sequentially numbered sales invoices and investigates missing numbers. What is the primary objective? Answer: To detect missing, duplicated, or potentially unauthorized transactions.   Q104. A manager approves a payment without checking the supporting invoice or purchase order. Which control weakness exists? Answer: Inadequate authorization and verification of supporting documentation.   Q105. A company installs a firewall but does not restrict employees' access to sensitive financial records. What is the weakness? Answer: Network security is present, but application and data access controls remain inadequate.   Q106. A company requires multifactor authentication for employees accessing its financial system remotely. What risk does this primarily reduce? Answer: Unauthorized access resulting from compromised passwords or credentials.   Q107. A company discovers that former employees can still log into its accounting system. Which control failed? Answer: User access termination and periodic access-review controls.   Q108. A company uses an automated system to reject journal entries that do not balance. What type of control is this? Answer: An automated application validation control. Q109. A small business cannot fully segregate duties because it has only three accounting employees. What compensating control could management implement? Answer: Independent owner or senior-manager review of bank reconciliations, journal entries, and payment reports. COSO Framework and Control Environment Q110. A company's CEO pressures employees to manipulate earnings to meet analyst expectations. Which COSO internal control component is most directly weakened? Answer: Control environment, particularly management's integrity and ethical values.   Q111. A company identifies financial reporting fraud as a significant threat and evaluates its likelihood and impact. Which COSO component is involved? Answer: Risk assessment.   Q112. A company establishes approval limits for capital expenditures and requires dual authorization for large payments. Which COSO component does this illustrate? Answer: Control activities.   Q113. Management receives reports on control failures and communicates corrective actions to department heads. Which COSO component is most directly illustrated? Answer: Information and communication.   Q114. An internal audit team periodically evaluates whether controls continue to operate effectively. Which COSO component is this? Answer: Monitoring activities.   Q115 A company documents risks but does not design or implement controls to address them. What is the main deficiency? Answer: Risk identification is not being translated into effective control activities and risk responses.   Q116. A board of directors actively challenges management's financial estimates and oversees the external audit process. What control-environment feature does this demonstrate? Answer: Independent board oversight.   Q117 A company has well-designed policies, but employees frequently ignore them and management does not investigate violations. What does this indicate? Answer: Weak control operation and monitoring, despite documented policies.   Section 3: Risk Assessment and Enterprise Risk Management Q118. A manufacturer identifies a low-probability fire risk that could destroy its entire facility. How should management evaluate this risk? Answer: Assess both likelihood and potential impact, including business-continuity consequences.   Q119. A company faces a high risk of losing customer data but accepts the risk without implementing safeguards or documenting approval. What is the main ERM concern? Answer: The risk may exceed the organization's risk appetite and has not been properly evaluated or authorized.   Q120. A company eliminates a hazardous manufacturing process rather than installing expensive safety controls. Which risk response is this? Answer: Risk avoidance.   Q121 A company installs backup generators to reduce losses from power outages. Which risk response does this represent? Answer: Risk mitigation or reduction.   Q122. A company purchases insurance against warehouse fire losses but retains a deductible. Has it eliminated the risk entirely? Answer: No; it transfers part of the financial exposure while retaining residual risk.   1.    Q126. A company decides to retain a minor financial risk because the cost of mitigation exceeds the expected benefit. Which risk response is this? Answer: Risk acceptance, provided the decision is within approved risk appetite and limits. Q127. A company outsources its payroll processing to a third-party provider. Does outsourcing eliminate management's responsibility for payroll controls? Answer: No; management retains responsibility for appropriate oversight and controls. Q128. A company evaluates the risk of fraud before considering any existing controls. What type of risk is it assessing? Answer: Inherent risk. Q129. After implementing access restrictions and transaction reviews, a company reassesses the risk that remains. What is this called? Answer: Residual risk. Q130. A company estimates a 10% annual probability of a cyberattack causing a $200,000 loss. What is the expected annual loss, assuming the estimates are reliable? Answer: $20,000 (10% × $200,000). Section 4: Fraud, IT Risk and Control Evaluation (Q131–Q140) Q131. An employee alters supplier bank details immediately before a large payment. Which control would most directly reduce this risk? Answer: Independent verification and approval of supplier bank-detail changes. Q132. A company receives repeated invoices just below the $10,000 approval threshold. What risk indicator should management investigate? Answer: Possible transaction splitting to circumvent approval limits. Q133. A company has a disaster recovery plan but has never tested whether its backups can be restored. What is the primary weakness? Answer: Recovery capability has not been validated through testing. Q134. A company allows developers to modify production accounting software directly without independent review. What is the principal risk? Answer: Unauthorized or inadequately tested changes could compromise transaction processing and financial reporting. Q135. An employee clicks a fraudulent link and enters company credentials on a fake login page. What type of attack is this? Answer: Phishing. Q136. A company uses encryption to protect financial information stored on laptops. What control objective does this support? Answer: Confidentiality of data, especially if a device is lost or stolen. Q137. An organization detects unusual journal entries posted late at night by users with privileged access. What should management do? Answer: Investigate the entries, validate authorization, and review privileged-user activity logs. Q138. A company performs regular vulnerability scans but never fixes identified critical vulnerabilities. What is the main control weakness? Answer: Remediation and follow-up controls are ineffective. Q139. An organization maintains a risk register but does not assign owners or deadlines to mitigation actions. What is missing? Answer: Clear accountability and action tracking for risk responses. Q140. An internal auditor discovers that a control failed once because of a human error. Does this automatically prove that the entire internal control system is ineffective? Answer: No; the auditor must assess the failure's cause, significance, likelihood of recurrence, and impact alongside other control evidence. Quick exam revision: Key distinctions Concept Meaning Preventive control Stops or reduces an error or irregularity before it occurs. Detective control Identifies an error or irregularity after it occurs. Corrective control Helps fix a detected problem and restore normal operations. Inherent risk Risk before considering controls or risk responses. Residual risk Risk remaining after controls and risk responses. Risk appetite Amount and type of risk an organization is willing to accept in pursuit of objectives. Risk tolerance Acceptable variation around a specific objective or performance target. Control deficiency A control is missing or not properly designed or operated. Compensating control An alternative control that helps address a weakness in the primary control. Segregation of duties Separating authorization, custody, recordkeeping, and reconciliation where practical. CMA exam tip: Pay special attention to scenario questions asking for the best control, the most significant risk, the appropriate risk response, or the weakest COSO component. These require you to distinguish the immediate control failure from its underlying cause.