AI in SOX Controls Testing Quiz

Answers and explanations appear as you take the quiz.

1. A tool produces a polished purchase-to-pay narrative from a recorded interview. Why is that not a completed walkthrough under AS 2201?
   • AS 2201 prohibits recording interviews
   • A walkthrough follows a transaction and combines inquiry with observation, inspection or re-performance
   • Narratives must be written by the engagement partner
   • Only management can document walkthroughs
2. In a well-designed evidence-review pipeline, what role should the language model play?
   • Deciding whether each control passes or fails
   • Replacing the IT general controls over the ERP
   • Extracting structured fields, with deterministic rules applying the test
   • Setting sample sizes for the auditor
3. Why should a segregation-of-duties analysis in SAP look at authorization objects rather than role names?
   • Role names can hide powerful access that only the underlying permissions reveal
   • Role names are encrypted and cannot be read
   • Auditors are forbidden from reviewing role names
   • Authorization objects change every day
4. Management uses an AI model to perform a monthly reconciliation review control. What does that model now need?
   • Nothing, because AI tools are outside ICFR
   • Approval from the SEC
   • A new COSO component
   • IT general controls such as change management over the model and its configuration
5. A test uses a system-generated list of all vendor master changes. What must be established about that list?
   • That it was exported by the CFO
   • That it is complete and accurate
   • That it has fewer than 1,000 rows
   • That it was produced by an AI tool
6. What condition allows benchmarking of an automated application control under AS 2201?
   • Effective IT general controls and evidence that the control has not changed
   • A vendor certificate stating the control works
   • Testing the control only in the fourth quarter
   • Using AI to re-perform the control every day
7. An analysis finds users who can both create vendors and release payments. What is the usual next step?
   • Automatically delete the users' accounts
   • Report every conflict as a material weakness
   • Ignore the conflicts if the users are managers
   • Check whether mitigating controls cover each conflict and whether the access is needed
8. Which statement about automation in SOX testing does the guide present as a misconception?
   • Automation can widen coverage from a sample to the whole population
   • Low-confidence extractions should go to human review
   • Automating a test makes the underlying control effective
   • Emergency access logs need review