GARP 2016-FRR Exam Prep Course (Premium File)
AI-Powered Financial Risk and Regulation (FRR) Series Exam - Pass on Your First Try

Question 418:

• Correct answer: D. Code review

• Why: Verifying application program controls means checking that the software itself enforces the designed controls (e.g., input validation, authorization, processing integrity). A code review directly examines the program logic and control implementation to confirm these controls exist and are correctly applied.

• Why the others are less appropriate:

• Note: Code reviews are often complemented by testing and documentation, but for verifying program controls, code review is the most appropriate technique.

Question 401:
Answer: A. The integrity of data processed by end user tools.
Why this is correct:

• EUC tools (like spreadsheets) often bypass centralized change controls. If the data they produce is unreliable, any conclusions or reports from those tools can be false, regardless of other controls.
• When planning an EUC assessment, the auditor focuses on data quality, accuracy, completeness, and traceability of inputs/outputs from end-user tools.

• Inclusion of end user tools in the IT balanced scorecard: useful for governance visibility but doesn’t address the fundamental risk to data reliability.
• Identification of IT owners for each end user tool: governance and accountability are important, but without data integrity, ownership alone offers limited assurance.
• Training program curriculum for key end users: important for capability, but data integrity issues exist regardless of training.

• Inventory critical EUC tools and data flows.
• Assess data sources, input validation, formulas, and reconciliation with trusted data.
• Review version control, change management, and access controls for EUC tools.

Question 392:

• Correct answer: D – Examine project change request logs

• Why: A post-implementation review (PIR) assesses ongoing governance and how changes are managed after go-live. Examining change request logs verifies that changes to the application are properly documented, authorized, tracked, and aligned with policy. It also helps assess the effectiveness of change control, including back-outs and impact analysis.

• Why the other options are less appropriate for PIR:

• Audit tips: sample change entries, verify approvals, check for adherence to the change management process, review emergency changes, and ensure there’s evidence of testing and rollback plans.

Question 356:

• Answer: B Understanding the data classification levels

• Explanation: In a data classification program, the first and most critical step is defining the classification levels and the criteria for each level. This framework drives which controls, labeling, access, retention, and protection measures apply to data. Without clear levels, planning (storage), ownership roles, and privacy policy cannot be effectively aligned to risk and regulatory requirements. The other options are important but depend on having established classification levels.

Question 312:

• Correct answer: Post-implementation review phase.

• Why: Benefits realization analysis assesses whether the project actually delivered the expected business value after it is implemented and in operation. This phase uses real metrics (KPIs, ROI, cost savings, user adoption) to compare actual results against the business case and baseline.

• Why not other phases:

• What to do in post-implementation:

• ISACA relevance: aligns with governance and value delivery, ensuring the IT investment actually delivers planned benefits.

Question 302:

• Correct answer: C — based on the results of an organization-wide risk assessment.

• Data classification standards should reflect the organization’s risk landscape. A risk assessment identifies which information assets are most sensitive or critical and the potential impact if they are compromised.
• This ensures classification levels (e.g., public, internal, confidential) align with actual risk, not just subjective notions of confidentiality or other single factors.

• A: Focusing only on confidentiality ignores impacts on integrity and availability and may misclassify data.
• B: Segregation of duties relates to roles/access control, not how data should be classified.
• D: Authentication requirements pertain to user identity controls, not the data’s classification framework.

Question 293:

• Correct answer: C. Evidence of population completeness is not maintained.

• A: Sampling only from the current period can introduce bias, but it’s a narrower issue than lacking population completeness.
• B: Removing auditor judgment is a concern, but automation can be designed with safeguards; it’s not the single greatest risk here.
• D: Manual validation before loading data adds effort but doesn’t inherently threaten the validity of the sampling frame itself.

Question 291:

• Correct answer: B. focus the team on internal controls.

• A: Providing solutions for control weaknesses is not the facilitator’s main role; solutions typically come from the team or auditors after the assessment.
• C: Reporting on weaknesses is generally done by the CSA team or management after findings are developed.
• D: Conducting interviews to gain background information is part of data gathering, but not the primary role—the focus should remain on controls throughout the CSA.

Question 287:

• Correct answer: D

• Why: The lack of a formal recertification process means inventory data may become stale and inaccurate over time. Without periodic verification, ownership, statuses, risk rankings, and contact details can change, undermining asset management, compliance, and change control.

• Why not the others:

• Takeaway: For an IT asset inventory, implementing a formal recertification process is key to maintaining accurate, up-to-date data and effective governance.

Question 286:

• Correct answer: B

• Why: The post-implementation review should verify that the system satisfies the business requirements. UAT results show whether users validated that the system meets their needs, and sign-off from users provides formal evidence that the requirements have been met.

• Why not the others:

• Takeaway: In post-implementation reviews, evidence of requirement fulfillment from end users (UAT results and sign-off) is the most direct indication that the application meets business needs.