Question 1

The WebTrust service requires that a CPA update its testing of the e-commerce aspects of an entity's website at least every

Accepted Answer

The WebTrust service requires that a CPA update its testing of the e-commerce aspects of an entity's website at least every twelve months.

Question 2

What type of SOC report is intended to meet the needs of entities that use service organizations and their auditors, who are responsible for understanding internal controls over financial reporting at service organizations?

Accepted Answer

SOC 1 reports are specifically intended to meet the needs of entities and their auditors who need to understand the internal controls over financial reporting at a service organization. This report is focused on controls that impact the financial statements of the user entities. SOC 2 and SOC 3 reports cover more general controls, including those related to security, availability, processing integrity, confidentiality, and privacy.

Question 3

In a WebTrust attestation engagement the client engages a CPA to provide what level of assurance that the company's website complies with Trust Services categories?

Accepted Answer

In a WebTrust attestation engagement, the client engages a CPA to provide reasonable assurance that the company's website complies with Trust Services categories. This means that the CPA provides a moderate level of assurance that the website's controls are designed and operating effectively to meet the Trust Services criteria. However, it does not provide absolute or limited assurance.

Question 4

As a CPA you have been asked to examine an entity's financial projections. Acceptance of the engagement would be appropriate if distribution is limited to

Accepted Answer

As a CPA, the exam of an entity's financial projections is appropriate if the distribution is limited to a financial institution for which the company is negotiating a loan. It is due to the fact that the purpose of the evaluation is to verify the likelihood of a loan being repaid, and the financial institution has a legitimate interest in receiving this data. The other potential distribution options are inappropriate since stockholders, potential investors, creditors, and the general public do not have a legitimate interest in the financial projections.

Question 5

What type of SOC report is intended to meet the needs of a broad range of users who need information and assurance about controls at a service organization that affect the security, availability, and processing integrity of the systems the service organization uses to process users' data and the confidentiality and privacy of the information processed by these systems?

Accepted Answer

SOC 2 reports are intended to meet the needs of a broad range of users who need information and assurance about controls at a service organization that affect the security, availability, and processing integrity of the systems the service organization uses to process users' data and the confidentiality and privacy of the information processed by these systems. SOC 1 reports are intended for the needs of users who require assurance about internal controls over financial reporting, while SOC 3 reports provide a general overview of the service organization's controls, but may not provide as much detail as a SOC 2 report.

Question 6

The guidance for service auditors has been moved to the attestation standards.

Accepted Answer

In January 2019, the guidance for service auditors was moved from the Statement on Standards for Attestation Engagements (SSAE) to the Attestation Standards section of the AICPA Professional Standards. This change better aligns with the organization of the auditing and attestation standards and does not affect the substance of the guidance.

Question 7

SOC 3 reports are prepared using the Trust Services Criteria.

Accepted Answer

SOC 3 reports are indeed prepared using the Trust Services Criteria, which are a set of predefined criteria formulated by the American Institute of Certified Public Accountants (AICPA) to serve as a basis for evaluating the security, availability, processing integrity, confidentiality, and privacy of a service organization's system. SOC 3 reports are high-level reports that summarize the organization's control environment and can be freely distributed to the public.

Question 8

Who developed the WebTrust service?
 Briefly explain this service.

Accepted Answer

The answer of Who developed the WebTrust service?
 Briefly explain...

Question 9

Which are prospective financial statements that present an entity's financial position, results of operations, and cash flows, to the best of the responsible party's knowledge and belief, given one or more hypothetical assumptions?

Accepted Answer

The answer of Which are prospective financial statements that present...

Question 10

There are five Trust Service categories, including security and viability.

Accepted Answer

The five Trust Service categories are security, availability, processing integrity, confidentiality, and privacy. "Viability" is not one of the categories.

Question 11

Professional standards prohibit which one of the following types of engagements for prospective financial statements from being undertaken?

Accepted Answer

Professional standards prohibit a review engagement for prospective financial statements because reviews are not designed to provide assurance on future-oriented information.

Question 12

WebTrust services are performed under the direction of the SSARS.

Accepted Answer

WebTrust services are performed under the direction of the Statement on Standards for Attestation Engagements (SSAE), not the Statement on Standards for Accounting and Review services (SSARS).

Question 13

In a Type 2 engagement, the service auditor performs tests of the operating effectiveness of the controls, but does not have to perform any of the procedures performed in a Type 1 engagement.

Accepted Answer

In a Type 2 engagement, the service auditor must perform the procedures performed in a Type 1 engagement in addition to testing the operating effectiveness of the controls.

Question 14

Briefly describe each of the five Trust Services Categories.

Accepted Answer

The answer of Briefly describe each of the five Trust...

Question 15

Which are prospective financial statements that present an entity's expected financial position, results of operations, and cash flows, to the best of the responsible party's knowledge and belief?

Accepted Answer

The answer of Which are prospective financial statements that present...

Question 16

The service auditor's Type 2 report contains

Accepted Answer

The Type 2 report includes both the opinions given in a Type 1 report (description and suitability of controls) as well as an additional opinion on the operating effectiveness of controls throughout the period. It does not include an opinion on financial statements or the service company's website.

Question 17

Which of the following is a type of prospective financial statement as defined by the AICPA attestation standards?

Accepted Answer

The answer of Which of the following is a type...

Question 18

Which of the following services is performed under the attestation standards?

Accepted Answer

The answer of Which of the following services is performed...

Question 19

The AICPA has proposed changes to the clarified Statements on Standards for Attestation Agreements. Summarize, if approved, what several of the proposed changes would be effective for reports dated on or after May 1, 2020.

Accepted Answer

The answer of The AICPA has proposed changes to the...

Question 20

Which of the following is not one of the five Trust Services categories?

Accepted Answer

The five Trust Services categories are security, confidentiality, privacy, processing integrity, and availability. The category completeness is not one of them.

Quiz 25: Other Assurance Services