Webclass 70: How can SOD help us in Risk Assessments/ IA planning?

Q1. Why might an external audit firm write that the report does not cover all risks that could be the result of collusion between employees and/or third-parties?

Because if two employees collude then the principle of separation of duties is broken

Correct Incorrect Correct answer

Because employees can be friends with third-parties

Correct Incorrect Correct answer

Q2. What type of automated information can we get from SOD dashboards?

We can find out who has access to what and who actually did what

Correct Incorrect Correct answer

We can estimate the value of the risk to the organization

Correct Incorrect Correct answer

Q3. During the webclass what three columns do we add for each SOD risk that could help auditors with their planning work?

– Interview questions – Documentation – Data questions

Correct Incorrect Correct answer

– When to conduct the audit – Which people need to be interviewed – Which transactions need to be obtained

Correct Incorrect Correct answer

Q4. If a user has access to enter a supplier invoice and a supplier payment, which interview questions could we ask?

– Which types of invoices can be entered without purchase orders? – What are the three-way-match controls? – Are there mitigating controls for those with more access than expected? – Is there a derrogation from management for users that have more access?

Correct Incorrect Correct answer

– What was the total value of invoices without purchase orders? – How many people have access to enter invoices and payments?

Correct Incorrect Correct answer

Q5. If a user has access to enter a supplier invoice and a supplier payment, which data questions could we ask?

– What is the total value/ frequency of invoices that are entered by users that also enter the payments per user/ date/ supplier? – Of these invoices, what value/ proportion do not have purchase orders? – Of these, are htere cases of suppliers working with only one member of purchasing?

Correct Incorrect Correct answer

– Are there people who have access to enter invoices and payments? – What are the policies for entering invoices and payments?

Correct Incorrect Correct answer

Q6. What is the difference between the dashboard “Who has access to what?” and the dashboards “Who did what?”

– For "Who has access to what", we do not know whether or not the user actually used the transactions that are in conflict

Correct Incorrect Correct answer

– For "Who has access to what" we see which transaction codes were actually used

Correct Incorrect Correct answer

Q7. Why might we want to combine the dashboards “Who has access to what”, with “Who did what”, as well as with the recommended audit questions for the audit plan?

– So that we can see on one page the users that actually used the transactions that are in conflict and then decide which audit areas it would be good to audit

Correct Incorrect Correct answer

– So that we can plan out our audit based on who has access to which transaction codes

Correct Incorrect Correct answer

Q8. When we combine the data from different sources in QLIK, how do we ensure that QLIK creates a star model out of the data?

By adding key fields to the data tables, during the data load

Correct Incorrect Correct answer

By drawing the data model on the screen

Correct Incorrect Correct answer

Q9. Why would we rather use a QLIK data model to view the data, rather than using the Excel downloads on separate Excel sheets with VLOOKUP?

Because with VLOOKUP, the Excel cell will show only the first value that it finds, whereas with a QLIK dashboard we can see all the corresponding values (especially if there is a many-many relationship)

Correct Incorrect Correct answer

Because with Excel, you need to look at each individual sheet to get the information

Correct Incorrect Correct answer

Webclass 70: How can SOD help us in Risk Assessments/ IA planning?

Webclass 70: How can SOD help us in Risk Assessments/ IA planning?

admin June 9, 2026

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question