AICPA Information Technology Flashcards

Which framework is most commonly referenced by CPAs when evaluating IT general controls and IT application controls in a US audit?

Answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) is the primary IT governance framework referenced by CPAs evaluating IT controls in audits.

Under AICPA standards, what is the primary purpose of reviewing IT general controls (ITGCs) during a financial statement audit?

Answer: To assess whether automated application controls can be relied upon

ITGCs provide the foundation for relying on automated application controls; if ITGCs are weak, application controls may not function as intended.

Which type of IT control automatically prevents an invalid transaction from being processed in an accounting system?

Answer: Preventive application control

A preventive application control is embedded in the software and stops an invalid transaction before it is recorded.

An auditor discovers that a company allows programmers to have direct access to the production environment. This is an example of a weakness in which ITGC domain?

Answer: Logical access

Allowing programmers access to the production environment is a segregation-of-duties failure within the logical access ITGC domain.

Under the AICPA's guidance, a Service Organization Control (SOC) 1 report is primarily used to address controls at a service organization that are relevant to:

Answer: User entities' internal control over financial reporting

A SOC 1 report focuses on controls at a service organization that are likely to be relevant to a user entity's internal control over financial reporting.

Which data backup strategy ensures the shortest recovery time objective (RTO) by maintaining a continuously updated copy of the production database?

Answer: Hot site with real-time replication

A hot site with real-time replication keeps a live mirror of production data, enabling near-instant failover and the shortest RTO.