Practice Test 3

You are the auditor of an issuer in an integrated audit. Management outsourced payroll processing to a third-party service organization and provides the auditor with a SOC 1 Type 2 report, but the auditor observed that internal HR initiates employee master file changes and finance approves funding amounts for each payroll run. The auditor is evaluating and documenting key controls within business processes to assess risk and determine the planned response. Which business process documentation is most critical for risk assessment?

You are the auditor of a nonissuer in a financial statement audit of a construction contractor using percentage-of-completion accounting. Project managers prepare cost-to-complete estimates in spreadsheets, and the controller posts revenue based on those spreadsheets without documented review. Change orders are often approved after work begins. Based on the auditor's analysis, how should the business process be documented?