Question 1100
Reviewers flag a possible false insolvency schedules issue. Their preliminary finding is: Customer confirmations and creditor support contradict filed values. Which test would best confirm or refute the concern?
- Independently confirm material receivables and liabilities against the filed schedules.
- Trace inventory purchases, resale proceeds and pre-filing management communications.
- Review appointment orders, estate ledgers and independent disposal evidence.
- Compare the proposed plan with liquidity forecasts and creditor treatment.
Explanation
Correct Answer
A:For the False insolvency schedules concern, the procedure tests source evidence behind this observation: Customer confirmations and creditor support contradict filed values. This matters because false asset and debt statements distort the administration of the insolvency estate; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
B:This comparison primarily addresses Bankruptcy bust-out credit buying, in which a planned bust-out extracts value from vendors through deliberate nonpayment and asset diversion; because the present question instead concerns False insolvency schedules, reviewers should independently confirm material receivables and liabilities against the filed schedules rather than apply a check designed for Bankruptcy bust-out credit buying.
C:This comparison primarily addresses Trustee and receiver accountability, in which a trustee or receiver acts within a defined legal appointment to administer assets, not as an unrestricted owner; because the present question instead concerns False insolvency schedules, reviewers should independently confirm material receivables and liabilities against the filed schedules rather than apply a check designed for Trustee and receiver accountability.
D:This comparison primarily addresses Liquidation versus reorganization, in which reorganization aims to preserve or restructure the enterprise; liquidation ordinarily realizes assets for distribution; because the present question instead concerns False insolvency schedules, reviewers should independently confirm material receivables and liabilities against the filed schedules rather than apply a check designed for Liquidation versus reorganization.
Question 1101
An examination of unbundled procedure billing begins with this observation: Claim lines repeatedly contain component codes that belong to a bundled service. Which follow-up procedure gives the most direct evidence?
- Compare documentation and procedure descriptions with claim-code requirements.
- Match encounter claims to scheduling, patient attestations and clinical documentation.
- Confirm patient identity and compare provider records with genuine insured-person statements.
- Review code combinations against current payer bundling rules and medical records.
Explanation
Correct Answer
D:For the Unbundled procedure billing concern, the procedure tests source evidence behind this observation: Claim lines repeatedly contain component codes that belong to a bundled service. This matters because splitting a bundled service into extra claim lines can produce unjustified reimbursement; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
A:This comparison primarily addresses Medical service upcoding, in which upcoding inflates payment by assigning a code for a more expensive service than was delivered; because the present question instead concerns Unbundled procedure billing, reviewers should review code combinations against current payer bundling rules and medical records rather than apply a check designed for Medical service upcoding.
B:This comparison primarily addresses Phantom patient encounters, in which billing nonexistent visits extracts payment for services not rendered; because the present question instead concerns Unbundled procedure billing, reviewers should review code combinations against current payer bundling rules and medical records rather than apply a check designed for Phantom patient encounters.
C:This comparison primarily addresses Medical identity misuse, in which an unauthorized patient exploits a real person's insurance entitlement; because the present question instead concerns Unbundled procedure billing, reviewers should review code combinations against current payer bundling rules and medical records rather than apply a check designed for Medical identity misuse.
Question 1102
Two separate review files raise different issues. File A: A borrower submits altered payslips to qualify for a loan beyond demonstrated repayment capacity. File B: A property investor applies for owner-occupied financing while intending immediate rental use. Which pairing accurately classifies both files?
- File A: Falsified borrower income; File B: Fraudulent new bank account.
- File A: Occupancy-misrepresented mortgage; File B: Falsified borrower income.
- File A: Mortgage straw-buyer scheme; File B: Occupancy-misrepresented mortgage.
- File A: Falsified borrower income; File B: Occupancy-misrepresented mortgage.
Explanation
Correct Answer
D:File A is Falsified borrower income because borrower misrepresentation distorts credit assessment even before any default, while File B is Occupancy-misrepresented mortgage because misstated intended use can improperly obtain lending terms reserved for a primary residence. The evidence chains differ: for File A, reviewers should verify stated earnings directly from reliable third-party employment records; for File B, they should compare application occupancy statements with objective property-use evidence.
Incorrect Answers
A:File B is misidentified as Fraudulent new bank account instead of Occupancy-misrepresented mortgage. With the proposed pairing Falsified borrower income / Fraudulent new bank account, the distinction is substantive: File A shows that income evidence conflicts with independent employer or tax records, whereas File B shows that lease listings and other residence records contradict the declared occupancy. For these Falsified borrower income and Occupancy-misrepresented mortgage files, choosing the pair Falsified borrower income / Fraudulent new bank account would misdirect the review away from at least one of these mechanisms.
B:File A is misidentified as Occupancy-misrepresented mortgage instead of Falsified borrower income; File B is misidentified as Falsified borrower income instead of Occupancy-misrepresented mortgage. With the proposed pairing Occupancy-misrepresented mortgage / Falsified borrower income, the distinction is substantive: File A shows that income evidence conflicts with independent employer or tax records, whereas File B shows that lease listings and other residence records contradict the declared occupancy. For these Falsified borrower income and Occupancy-misrepresented mortgage files, choosing the pair Occupancy-misrepresented mortgage / Falsified borrower income would misdirect the review away from at least one of these mechanisms.
C:File A is misidentified as Mortgage straw-buyer scheme instead of Falsified borrower income. With the proposed pairing Mortgage straw-buyer scheme / Occupancy-misrepresented mortgage, the distinction is substantive: File A shows that income evidence conflicts with independent employer or tax records, whereas File B shows that lease listings and other residence records contradict the declared occupancy. For these Falsified borrower income and Occupancy-misrepresented mortgage files, choosing the pair Mortgage straw-buyer scheme / Occupancy-misrepresented mortgage would misdirect the review away from at least one of these mechanisms.
Question 1103
A process owner is assessing safeguards for business email payment diversion. The mechanism is: The payment is authorized for a real invoice but settlement instructions are fraudulently replaced. Which control addresses it most directly?
- Validate direct-debit authorizations and monitor abnormal return rates.
- Require callback verification for payment instruction changes regardless of email familiarity.
- Protect public payment codes against tampering and display verified payee names.
- Monitor load velocity and impose appropriate risk controls on suspicious funding.
Explanation
Correct Answer
B:The control directly addresses the failure point in Business email payment diversion, since the payment is authorized for a real invoice but settlement instructions are fraudulently replaced. A subsequent independent review could verify beneficiary changes independently and inspect message headers and login records to identify exceptions that bypassed the safeguard.
Incorrect Answers
A:This safeguard is directed primarily at Unauthorized ACH debit rather than Business email payment diversion, because the debit exploits the payment rail without the payer's required consent. Unlike the control for Unauthorized ACH debit, the more direct design for Business email payment diversion is to require callback verification for payment instruction changes regardless of email familiarity; a different safeguard cannot substitute for it.
C:This safeguard is directed primarily at Fraudulent merchant QR redirect rather than Business email payment diversion, because payment redirection changes the destination encoded in a legitimate-looking payment prompt. Unlike the control for Fraudulent merchant QR redirect, the more direct design for Business email payment diversion is to require callback verification for payment instruction changes regardless of email familiarity; a different safeguard cannot substitute for it.
D:This safeguard is directed primarily at Prepaid card load-and-drain rather than Business email payment diversion, because prepaid value can be used to convert unauthorized payments into quickly transferable balances. Unlike the control for Prepaid card load-and-drain, the more direct design for Business email payment diversion is to require callback verification for payment instruction changes regardless of email familiarity; a different safeguard cannot substitute for it.
Question 1104
An examination of mfa-push fatigue attack begins with this observation: Many denied push prompts precede an approved login from an unfamiliar device. Which follow-up procedure gives the most direct evidence?
- Compare remote session logs, privileged access records and transfer activity.
- Inspect extension inventory, permissions and network destinations.
- Decode reported QR destinations and correlate with identity-provider events.
- Correlate challenge frequency and user responses with session details.
Explanation
Correct Answer
D:For the MFA-push fatigue attack concern, the procedure tests source evidence behind this observation: Many denied push prompts precede an approved login from an unfamiliar device. This matters because repeated prompts exploit human approval fatigue rather than cracking the second factor; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
A:This comparison primarily addresses Remote desktop credential intrusion, in which valid-looking remote sessions can conceal misuse of stolen administrator access; because the present question instead concerns MFA-push fatigue attack, reviewers should correlate challenge frequency and user responses with session details rather than apply a check designed for Remote desktop credential intrusion.
B:This comparison primarily addresses Malicious browser extension, in which browser extensions can misuse broad page-access permissions without a classic email attachment; because the present question instead concerns MFA-push fatigue attack, reviewers should correlate challenge frequency and user responses with session details rather than apply a check designed for Malicious browser extension.
C:This comparison primarily addresses QR-code phishing campaign, in which qR phishing hides a malicious URL within an image instead of a visible hyperlink; because the present question instead concerns MFA-push fatigue attack, reviewers should correlate challenge frequency and user responses with session details rather than apply a check designed for QR-code phishing campaign.
Question 1105
A finance team is reviewing the accuracy of gross-profit calculation. Relevant accounting principle: Gross profit isolates direct goods margin rather than the final earnings after all operating and other costs. Which procedure best supports reliable treatment?
- Compute gross profit as net sales less cost of goods sold under the applicable reporting framework.
- Separate principal movements from operations and apply the relevant framework to interest classification.
- Reconcile assets, liabilities and equity before releasing the statement of financial position.
- Document the applicable IFRS or national GAAP requirements and reconcile consolidation adjustments.
Explanation
Correct Answer
A:The control directly addresses the failure point in Gross-profit calculation, since gross profit isolates direct goods margin rather than the final earnings after all operating and other costs. A subsequent independent review could match recorded sales and corresponding inventory costs before analyzing gross margin to identify exceptions that bypassed the safeguard.
Incorrect Answers
B:This safeguard is directed primarily at Financing cash-flow classification rather than Gross-profit calculation, because financing activities describe changes in funding from lenders and owners; classifications of interest can vary by accounting framework. Unlike the control for Financing cash-flow classification, the more direct design for Gross-profit calculation is to compute gross profit as net sales less cost of goods sold under the applicable reporting framework; a different safeguard cannot substitute for it.
C:This safeguard is directed primarily at Equity reconciliation rather than Gross-profit calculation, because equity is the residual interest in assets after deducting liabilities, not a bank balance or revenue figure. Unlike the control for Equity reconciliation, the more direct design for Gross-profit calculation is to compute gross profit as net sales less cost of goods sold under the applicable reporting framework; a different safeguard cannot substitute for it.
D:This safeguard is directed primarily at Accounting-framework selection rather than Gross-profit calculation, because iFRS and national GAAP are accounting frameworks; their use depends on reporting requirements, not the invoice currency. Unlike the control for Accounting-framework selection, the more direct design for Gross-profit calculation is to compute gross profit as net sales less cost of goods sold under the applicable reporting framework; a different safeguard cannot substitute for it.
Question 1106
A process owner is assessing safeguards for contactless payment relay. The mechanism is: Relay attacks extend a credential's communication path rather than physically duplicating the card. Which control addresses it most directly?
- Require callback verification for payment instruction changes regardless of email familiarity.
- Validate direct-debit authorizations and monitor abnormal return rates.
- Apply applicable contactless transaction protections and device anomaly monitoring.
- Use secure delivery and payee-positive-pay checks where available.
Explanation
Correct Answer
C:The control directly addresses the failure point in Contactless payment relay, since relay attacks extend a credential's communication path rather than physically duplicating the card. A subsequent independent review could analyze terminal traces and transaction authentication logs for relay characteristics to identify exceptions that bypassed the safeguard.
Incorrect Answers
A:This safeguard is directed primarily at Business email payment diversion rather than Contactless payment relay, because the payment is authorized for a real invoice but settlement instructions are fraudulently replaced. Unlike the control for Business email payment diversion, the more direct design for Contactless payment relay is to apply applicable contactless transaction protections and device anomaly monitoring; a different safeguard cannot substitute for it.
B:This safeguard is directed primarily at Unauthorized ACH debit rather than Contactless payment relay, because the debit exploits the payment rail without the payer's required consent. Unlike the control for Unauthorized ACH debit, the more direct design for Contactless payment relay is to apply applicable contactless transaction protections and device anomaly monitoring; a different safeguard cannot substitute for it.
D:This safeguard is directed primarily at Check-washing alteration rather than Contactless payment relay, because check washing modifies a valid instrument to redirect its value. Unlike the control for Check-washing alteration, the more direct design for Contactless payment relay is to apply applicable contactless transaction protections and device anomaly monitoring; a different safeguard cannot substitute for it.
Question 1107
The team is assessing a potential false sustainability disclosures discrepancy. Initial observation: External sustainability claims disagree with underlying meter and assurance records. Which verification step is most informative?
- Trace public environmental claims to primary data, methodology and validation evidence.
- Compare business activities and compensation against applicable regulator registrations.
- Analyze account turnover, costs, broker control and trading justifications.
- Join employee transaction records with confidential order timestamps and market prices.
Explanation
Correct Answer
A:For the False sustainability disclosures concern, the procedure tests source evidence behind this observation: External sustainability claims disagree with underlying meter and assurance records. This matters because nonfinancial representations can deceive securities investors when inaccurate or unsupported; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
B:This comparison primarily addresses Unregistered brokerage solicitation, in which securities-related compensation and solicitation can trigger registration obligations under relevant laws; because the present question instead concerns False sustainability disclosures, reviewers should trace public environmental claims to primary data, methodology and validation evidence rather than apply a check designed for Unregistered brokerage solicitation.
C:This comparison primarily addresses Excessive-account churning, in which excessive trading for broker compensation can constitute churning when control and other relevant elements are present; because the present question instead concerns False sustainability disclosures, reviewers should trace public environmental claims to primary data, methodology and validation evidence rather than apply a check designed for Excessive-account churning.
D:This comparison primarily addresses Broker front-running client order, in which misusing confidential customer-order knowledge for personal gain creates market-abuse and conflict risks; because the present question instead concerns False sustainability disclosures, reviewers should trace public environmental claims to primary data, methodology and validation evidence rather than apply a check designed for Broker front-running client order.
Question 1108
The review team observes the following: Contractor access exceeds project need and coincides with unexplained lab photography. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?
- Diagnostic: Review visitor sponsorship, badge events and camera policy exceptions; safeguard: Use phishing-resistant authentication and validate external file requests.
- Diagnostic: Compare CRM export histories with approved business uses and data loss alerts; safeguard: Train researchers to use lawful public sources and respect access restrictions.
- Diagnostic: Review visitor sponsorship, badge events and camera policy exceptions; safeguard: Apply contractor screening and least-privilege physical and information access.
- Diagnostic: Correlate identity-provider login records, phishing artifacts and file access; safeguard: Restrict sensitive bulk exports and revoke access promptly at departure.
- Diagnostic: Verify public provenance and access conditions for the collected information; safeguard: Apply contractor screening and least-privilege physical and information access.
Explanation
Correct Answer
C:The test addresses Corporate espionage by infiltration by targeting this observation: Contractor access exceeds project need and coincides with unexplained lab photography. The accompanying safeguard—apply contractor screening and least-privilege physical and information access—counters the same opportunity, so both checking and prevention concern one cause.
Incorrect Answers
A:The diagnostic correctly examines Corporate espionage by infiltration by having reviewers review visitor sponsorship, badge events and camera policy exceptions, but the safeguard is for Spear-phishing product drawings. That prevention step responds to a different mechanism: Deceptive credential collection enables unauthorized access to proprietary engineering data.
B:The evidence test relates to Trade-secret client-list theft, whereas the proposed safeguard protects against Lawful public competitive intelligence; neither directly resolves Corporate espionage by infiltration. Unlike the Trade-secret client-list theft test and Lawful public competitive intelligence safeguard, the investigation of Corporate espionage by infiltration requires reviewers to review visitor sponsorship, badge events and camera policy exceptions, followed by assessment of the matching control point.
D:The evidence test relates to Spear-phishing product drawings, whereas the proposed safeguard protects against Trade-secret client-list theft; neither directly resolves Corporate espionage by infiltration. Unlike the Spear-phishing product drawings test and Trade-secret client-list theft safeguard, the investigation of Corporate espionage by infiltration requires reviewers to review visitor sponsorship, badge events and camera policy exceptions, followed by assessment of the matching control point.
E:The proposed safeguard is relevant to Corporate espionage by infiltration, but the diagnostic tests Lawful public competitive intelligence rather than the identified anomaly. That test is aimed at records involving research source logs show only publicly accessible, lawfully obtained material; the specified case instead calls for reviewers to review visitor sponsorship, badge events and camera policy exceptions.
Question 1109
An examination of loan-stacking applications begins with this observation: Multiple recent inquiries and fresh obligations exceed declared indebtedness. Which follow-up procedure gives the most direct evidence?
- Correlate session identifiers, device changes and outbound wire instructions.
- Independently review valuation methods, comparable sales and appraiser relationships.
- Check updated credit-bureau information and simultaneous application patterns.
- Review dormant-account transactions, access logs and beneficiary links.
Explanation
Correct Answer
C:For the Loan-stacking applications concern, the procedure tests source evidence behind this observation: Multiple recent inquiries and fresh obligations exceed declared indebtedness. This matters because hidden parallel borrowing makes the applicant's repayment capacity appear stronger than it is; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
A:This comparison primarily addresses Financial-account takeover, in which the account is legitimate but control of its credentials or session has been stolen; because the present question instead concerns Loan-stacking applications, reviewers should check updated credit-bureau information and simultaneous application patterns rather than apply a check designed for Financial-account takeover.
B:This comparison primarily addresses Inflated real estate appraisal, in which artificial collateral values lead lenders to advance more credit than the asset justifies; because the present question instead concerns Loan-stacking applications, reviewers should check updated credit-bureau information and simultaneous application patterns rather than apply a check designed for Inflated real estate appraisal.
D:This comparison primarily addresses Insider customer-account embezzlement, in which an insider exploits entrusted bank access to misappropriate depositor funds; because the present question instead concerns Loan-stacking applications, reviewers should check updated credit-bureau information and simultaneous application patterns rather than apply a check designed for Insider customer-account embezzlement.
Question 1110
Reviewers flag a possible charity donation skimming issue. Their preliminary finding is: Donor acknowledgment totals exceed the logged and deposited contributions. Which test would best confirm or refute the concern?
- Match donor confirmations and sealed-envelope counts against bank deposits.
- Recount the fund unexpectedly and inspect replenishment vouchers.
- Compare price lists and independent customer receipts with cash register line data.
- Match refund authorizations to returned-stock records and original receipt identifiers.
Explanation
Correct Answer
A:For the Charity donation skimming concern, the procedure tests source evidence behind this observation: Donor acknowledgment totals exceed the logged and deposited contributions. This matters because a donation stolen before entry may leave no accounting shortage unless outside records are used; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
B:This comparison primarily addresses Cash-safe theft, in which theft of cash on hand depletes a recorded fund without necessarily involving a sales transaction; because the present question instead concerns Charity donation skimming, reviewers should match donor confirmations and sealed-envelope counts against bank deposits rather than apply a check designed for Cash-safe theft.
C:This comparison primarily addresses Cash-sale understatement, in which the portion never entered in the till is skimmed even though a partial sale appears in the books; because the present question instead concerns Charity donation skimming, reviewers should match donor confirmations and sealed-envelope counts against bank deposits rather than apply a check designed for Cash-sale understatement.
D:This comparison primarily addresses Concealment through false refunds, in which a false refund creates an apparently authorized cash outflow, unlike an off-record cash receipt theft; because the present question instead concerns Charity donation skimming, reviewers should match donor confirmations and sealed-envelope counts against bank deposits rather than apply a check designed for Concealment through false refunds.