Free IMA CMA Part 1 (Financial Planning, Performance, and Analytics) Internal Controls Practice Questions
Internal Controls on CMA Part 1 covers the COSO Internal Control and Enterprise Risk Management frameworks, control activities and limitations, internal audit standards, systems controls and security measures, and the regulatory landscape including Sarbanes-Oxley §302 and §404, GDPR, and SOC reports. Risk identification and mitigation is the recurring theme.
Sample Questions
Question 1
Easy
A compensating control is BEST described as a control that:
Solution
B is correct. A compensating control is a secondary control that mitigates risk when a primary control cannot operate as designed or is absent. For example, when a small accounting department cannot fully segregate cash receipts from recordkeeping, a daily supervisory review of the deposit slip against the cash receipts journal can serve as a compensating control that reduces the residual risk to an acceptable level.
Question 2
Medium
Which of the following is an example of an IT general control rather than an application control?
Solution
B is correct. IT general controls (ITGCs) operate across the IT environment and include logical access security, change management, and computer operations. Restricting programmer or user access to production systems is a logical access control, a classic ITGC that supports the integrity of every application running in that environment. The other items are embedded in the input or processing logic of a specific application, making them application controls.
Question 3
Hard
A manufacturer is implementing a new ERP system. The internal audit team is designing controls across the application layer (input, processing, output) and the general IT controls (GITC) layer. Which of the following mappings of control to category and objective is correct?
Solution
C is correct. A check digit is an algorithmic validation embedded in an input field (such as a customer or account number) that detects transposition and transcription errors at the point of data entry. It is an input application control whose objective is data accuracy at the application level.