The single biggest error candidates make on CGFM Exam 3 is treating it like an accounting test. It’s actually a management consulting exam disguised with government acronyms, and if you approach it with a pure debits-and-credits mindset, you will fail.
CGFM Exam 3 tests your judgment on Governmental Financial Management and Control. Key topics include internal control (GAO Green Book/COSO), auditing (GAO Yellow Book), financial management systems, and performance measurement. These 10 practice questions cover that blueprint and include detailed explanations to build your analytical skills.
CGFM Exam 3 at a Glance (2026)
- Exam Name: CGFM Exam 3: Governmental Financial Management and Control
- Official Body: Association of Government Accountants (AGA)
- Number of Questions: 115 multiple-choice questions
- Time Limit: 2 hours and 55 minutes (175 minutes)
- Key Topics: Internal Control, Auditing, Financial Management Systems, Performance Measurement
- Primary Standards: GAO Green Book (Internal Control), GAO Yellow Book (Auditing)
The Association of Government Accountants (AGA) reports that the cumulative pass rate for all three CGFM exams hovers around 60% (AGA), making targeted practice essential for success.
Why These Practice Questions Will Help You Pass
This isn't just a random list of questions. I've designed this 10-question quiz to simulate the logic and difficulty of the real CGFM Exam 3. These questions are calibrated to mirror the blueprint weighting for key areas like internal control, auditing standards, and performance reporting.
Studying for CGFM? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
You will find questions that require you to:
- Identify the appropriate type of audit for a given scenario.
- Evaluate the effectiveness of internal controls based on the GAO Green Book.
- Apply performance measurement concepts to a government program.
- Distinguish between the different types of audit findings.
This is your first diagnostic. It’s a chance to see if you’re thinking like a manager or still stuck in the weeds of technical accounting. Don't just rush for the answer. For each question, ask yourself why the correct answer is correct and, more importantly, why the other choices are tempting but wrong. For a deeper diagnostic, you can try VoraPrep's adaptive CGFM question bank after this quiz.
CGFM Exam 3 Practice Questions & Explanations
Take your time and read each question carefully. Choose the best possible answer. The real learning happens in the detailed explanations that follow.
Question 1
A federal agency is implementing a new grants management system. Management wants to ensure that access to the system is restricted to authorized personnel and that duties are properly segregated to prevent fraud. Which of the following activities represents the strongest preventive control?
This is a classic question that tests your understanding of control types. The examiner wants to see if you can distinguish between controls that stop an error before it happens (preventive) and those that find it after it happens (detective).
- Choice C is correct because requiring two levels of approval is a classic preventive control. It is a system-enforced rule designed to stop an improper payment from being made in the first place.
- Choice A (reconciliations) finds discrepancies after the fact. The money has already been disbursed incorrectly.
- Choice B (auditing logs) is also detective. It reviews past activity to find unauthorized access that has already occurred.
- Choice D (data analytics) identifies unusual payments that have already been processed, flagging them for later review.
The key is timing. Preventive controls are built into the process workflow before the transaction is finalized. Detective controls happen after the transaction or period has closed.
Question 2
An auditor for a state agency is conducting a performance audit of the Department of Transportation's new highway maintenance program. The audit objective is to determine "whether the new automated pothole-patching machine is operating more cost-effectively than the previous manual method." Which of the following is the most appropriate audit criterion to assess this objective?
This question tests a core concept of performance auditing: the relationship between an audit objective and the criteria used to measure it. The objective is about cost-effectiveness. You need a criterion that measures both cost and output.
- Choice C is correct because "cost per square foot" is a unit cost metric. It directly measures efficiency (output per dollar) and allows for a meaningful comparison against a benchmark (neighboring states), which is a key part of establishing criteria in a performance audit.
Let's break down why the others are wrong:
- Choice A (budget) is an input, not a measure of effectiveness or efficiency. An agency could spend its entire budget and be incredibly inefficient.
- Choice B (number of potholes) measures output but ignores the cost side of the "cost-effective" objective. The machine could patch more potholes but at a ridiculously high cost.
- Choice D (internal policy) relates to quality or compliance, not cost-effectiveness. The machine could meet all quality standards while still being more expensive than the manual method.
The examiner is testing if you can connect the specific language in the audit objective ("cost-effectively") to a specific, measurable, and relevant criterion.
Question 3
According to Government Auditing Standards (the "Yellow Book"), which of the following threats to independence is created when an audit organization has been auditing the same client for a long and continuous period?
This is a direct test of your knowledge of the GAO Yellow Book's conceptual framework for independence. You must know the specific categories of threats.
- Choice B is correct. A familiarity threat is the threat that, due to a long or close relationship with a client, auditors will become too sympathetic to the client's interests or too accepting of their work. A long-term audit relationship is the textbook example of a situation that creates a familiarity threat.
Here’s why the other threats are less applicable in this specific scenario:
- A) Self-interest threat: This arises from a financial or other interest, like owning stock in the audited entity or having a loan from them. It's not the primary threat from a long relationship.
- C) Undue influence threat: This occurs when external pressures from management or other parties attempt to sway the auditor's judgment. While possible, it's not the inherent threat created by the long relationship itself.
- D) Management participation threat: This arises when the auditor takes on a role that is considered a management function, such as designing or implementing the client's internal control system. The length of the audit relationship doesn't create this threat.
Question 4
The City of Springfield's finance department has a single employee who is responsible for receiving cash payments from citizens, recording the payments in the accounting system, and preparing the daily bank deposit. The absence of which of the following principles creates the most significant internal control deficiency?
This is a foundational internal control question. The scenario describes a classic failure to separate incompatible duties.
- Choice B is correct. Segregation of duties is the principle that no single individual should have control over two or more phases of a transaction or operation. In this case, one employee has custody of an asset (cash), authorization/recording responsibility (entering payments), and reconciliation (preparing the deposit). This combination creates a high risk of undetected fraud or error.
- Custody: They have the $100 cash.
- Recording: They could record only $50 in the system.
- Reconciliation: They deposit only $50 and pocket the other $50.
Because they control all three steps, there is no independent check to catch the theft. If one person recorded the payment and a different person prepared the bank deposit based on the system records, the discrepancy would be immediately obvious.
- Choice C (Independent internal verification) is the detective control that would identify this problem. In smaller entities where perfect segregation of duties isn't practical, strong independent verification can act as a compensating control to mitigate the risk. However, the root cause of the deficiency itself remains the lack of segregation.
- Choices A and D are relevant but not the primary issue. Responsibility is established (it's all on one person), and documentation might exist, but it's not reliable if the same person controls everything.
Question 5
A federal agency is required to have its financial statements audited under the Chief Financial Officers (CFO) Act. The agency's Inspector General (IG) decides to contract with a public accounting firm to perform the audit. According to Government Auditing Standards, who is ultimately responsible for ensuring the audit complies with the Yellow Book?
This is a tricky question about responsibility and oversight in government auditing. It's easy to get lost in the different roles.
- Choice D is correct. Even when an audit is contracted out, the audit organization that procured the audit (the IG's office) retains ultimate responsibility for the quality of the work and for ensuring compliance with all applicable standards, including the Yellow Book. The IG's office must provide adequate supervision and review the work of the contracted firm.
- Choice B (agency head) is responsible for the financial statements themselves, but not for the conduct of the audit.
- Choice C (GAO) sets the standards (the Yellow Book) but is not responsible for ensuring compliance on every single federal audit. That responsibility lies with the engaging audit organization.
Question 6
The GAO's "Green Book" adapts the COSO framework for a government environment. The framework is built on five integrated components of internal control: Control Environment, Risk Assessment, Control Activities, Information & Communication, and...?
This is a pure recall question, but a critical one. You simply must have the five components of the COSO/Green Book framework memorized. There's no way to reason through it if you don't know them.
- Choice A is correct. Monitoring Activities is the fifth component. It involves ongoing evaluations, separate evaluations, or some combination of the two used to ascertain whether each of the five components (and the 17 underlying principles) is present and functioning.
The other choices are related concepts but are not one of the five primary components:
- B) Auditing Procedures are used to evaluate controls, but they are not a component of the control system itself.
- C) Performance Measurement is a broader management activity, not a COSO component.
- D) Segregation of Duties is an example of a Control Activity, which is just one of the five components. This is a common distractor that tries to trick you into picking a specific control instead of a main component.
Question 7
An audit finding has four essential elements: Criteria, Condition, Cause, and Effect. An auditor for a city government finds that the city's vehicle fleet has a maintenance cost per mile that is 30% higher than in comparable cities. Which element of the finding does this statement represent?
This question tests your ability to deconstruct an audit finding into its constituent parts, a key skill for CGFM 3.
- Choice B is correct. The Condition is the "what is"—the situation that exists. The statement that maintenance costs are 30% higher than the benchmark is a factual description of the current state. It is the problem or deficiency the auditor has identified.
Let's place it in context with the other elements:
- A) Criteria: This is the "what should be." The criteria would be the benchmark itself, e.g., "Maintenance costs in comparable cities average $0.50 per mile."
- C) Cause: This is the "why it happened." The cause might be "The city has not followed its preventive maintenance schedule, leading to more expensive repairs."
- D) Effect: This is the "so what"—the consequence of the condition. The effect could be "The city overspent its vehicle maintenance budget by $500,000 in the last fiscal year."
The examiner will give you one piece of a finding and ask you to classify it. You must be able to distinguish the problem (Condition) from the standard (Criteria), the reason (Cause), and the outcome (Effect).
Question 8
The Single Audit Act requires entities that expend more than a certain threshold of federal awards in a year to undergo a specific type of audit. What is the expenditure threshold that triggers this requirement for fiscal years beginning on or after October 1, 2024?
This is a specific knowledge question that tests your regulatory currency. The Single Audit threshold is one of the most important hard numbers you must know for CGFM 3.
- Choice C is correct. The Office of Management and Budget (OMB) issued updates to the Uniform Guidance (2 CFR 200) in 2024. For fiscal years beginning on or after October 1, 2024, the threshold for requiring a single audit was raised from $750,000 to $1,000,000 in federal award expenditures.
The other choices are incorrect. The threshold is a fixed dollar amount and does not vary by program type for the purpose of triggering the audit requirement itself.
Question 9
A state legislature wants to know if a new job training program is successfully placing participants in long-term employment. Which of the following is an example of an outcome measure for this program?
This question drills down on the difference between inputs, outputs, and outcomes, a critical concept in government performance measurement.
- Choice C is correct. An outcome is the result, effect, or consequence of a program. It measures the actual impact on the target population or the problem being addressed. The goal of a job training program is not just to train people; it is to get them employed. Therefore, the employment rate after one year is a direct measure of the program's success in achieving its ultimate objective.
Let's classify the wrong answers:
- A) The number of participants who completed the course is an output. It measures what the program produced (trained people), but not what effect it had.
- B) The percentage of budget spent on salaries is an input. It measures the resources consumed by the program.
- D) The average score on the final exam is arguably an output or an intermediate outcome. It shows that participants learned something, but it doesn't tell you if that learning translated into the desired real-world result (a job).
The examiner is testing if you can look past the immediate activities of a program (outputs) and focus on its intended purpose (outcomes).
Question 10
Which of the following types of audits are primarily concerned with expressing an opinion on whether an entity's financial statements are presented fairly, in all material respects, in accordance with a specified financial reporting framework?
This is a definitional question that ensures you understand the fundamental purpose of different types of engagements covered in the Yellow Book.
- Choice C is correct. This is the textbook definition of a financial audit. Its objective is to provide reasonable assurance about whether the financial statements are free of material misstatement, allowing the auditor to express an opinion.
Here is a quick comparison to clarify the other types:
| Audit/Engagement Type | Primary Objective | Example |
|---|---|---|
| Financial Audit | Express an opinion on the fairness of financial statements. | Auditing a city's annual comprehensive financial report (ACFR). |
| Performance Audit | Assess program effectiveness, economy, and efficiency. | Auditing whether a new recycling program is reducing landfill costs. |
| Attestation Engagement | Issue a report on a subject matter that is the responsibility of another party. | Examining an agency's assertion about its compliance with a specific grant condition. |
| Compliance Audit | Determine if an entity has adhered to specific laws, regulations, or agreements. | Auditing whether federal grant funds were spent only on allowable costs. |
Understanding this table is non-negotiable for passing CGFM 3. You will absolutely see questions that require you to differentiate between these engagement types.
Calculate Your CGFM Score & Study Hours by Domain
Adjust your practice scores across official CGFM blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How to Interpret Your Score
How did you do? Don't worry about the raw number as much as the pattern of your mistakes. This is a diagnostic, not a final exam.
Scored 0-4 Correct?
You have some significant knowledge gaps in the foundational concepts. You might be confusing control types, audit objectives, or the core components of the Green Book framework. Your first step is to stop answering questions and go back to the source material to build a solid base. This is fixable, but it requires a structured approach.Scored 5-7 Correct?
You likely have a decent grasp of the main ideas but struggle with application. Your mistakes were probably on questions that tested the best choice among several plausible options. This is where massive question practice becomes critical. You need to see hundreds of variations to hone your judgment.Scored 8-10 Correct?
Excellent work. You have a strong command of the material. Your challenge is not knowledge but consistency and speed under pressure. Your focus should be on taking full, timed practice exams to build stamina and identify any remaining niche topics. Review the full CGFM exam format breakdown to prepare for exam day logistics.A Smarter Way to Prepare for CGFM Exam 3
Regardless of your score, you can see that passing CGFM 3 requires judgment, not just memorization. Passive video lectures and static PDFs from outdated providers are not enough to build that skill.
VoraPrep is a complete, interactive course designed to actively train your critical thinking. Instead of just giving you information, our platform helps you apply it. Our adaptive question bank, with over 1,600+ CGFM questions, learns your weak spots and gives you targeted practice. If you get stuck, our 24/7 tutor, Vory, can walk you through the logic step-by-step. It's a modern, efficient system for busy professionals.
For an honest comparison, see our guide: VoraPrep vs. AGA for CGFM: 2026 Pricing, Questions & Pass Rate Comparison.