Most candidates think the CPP Audits section is a checklist of rules. This is the #1 reason they fail this part of the exam. The test doesn't care if you can memorize a control; it tests if you can identify a broken one under pressure and explain the financial risk. It's a test of judgment, not memory.
Quick answer
The CPP Audits section (CPP6) tests your ability to apply internal control and audit principles within a payroll context, focusing on data integrity, fraud prevention, and financial reporting accuracy. It requires you to analyze scenarios using concepts from the COSO framework, segregation of duties, account reconciliation, and Sarbanes-Oxley (SOX).
Key facts
- Official Body
- PayrollOrg
- Exam Domain
- CPP6, Internal Control and Audit, is approximately 8% of the exam.
- Question Format
- 190 multiple-choice questions (165 scored, 25 pre-test).
- Exam Length
- 4 hours.
- Passing Score
- A scaled score of 300 on a 100-500 scale.
- Pass Rate
- The pass rate fluctuates by testing window, but PayrollOrg reports it generally averages between 60% and 65%.
Why Is the COSO Framework a Secret Weapon for CPP Audits?
The CPP exam doesn't just ask you to define controls. It expects you to understand their purpose within a larger system. The COSO Internal Control framework is that system. While you won't be asked to name the five components directly, knowing them helps you analyze any audit scenario the exam presents.
- Control Environment: The "tone at the top." Does management value integrity and ethics?
- Risk Assessment: How does the company identify and analyze risks to its objectives (like accurate payroll)?
- Control Activities: These are the policies and procedures themselves (reconciliations, approvals, segregation of duties). This is where most candidates focus, but it's only one piece.
- Information & Communication: How is information about controls shared throughout the company?
- Monitoring Activities: How does the company ensure controls are working over time (e.g., internal audits)?
When you see a scenario question, think: which of these five components is breaking down? This framework turns a confusing situation into a structured problem.
Free 5-Min Diagnostic
Studying for CPP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
How Do You Differentiate Control Types Under Pressure?
The exam will give you a scenario and ask you to classify the control. Getting this right depends on understanding the timing of the action. Use this table as a mental model.
| Control Type | Purpose | Timing | Payroll Example |
|---|---|---|---|
| Preventive | To stop an error or fraud before it happens. | Before the transaction | A system rule blocking a manager from approving their own timesheet. |
| Detective | To find an error or fraud after it has happened. | After the transaction | A monthly report listing all employees with pay rate changes. |
| Corrective | To fix an error after it has been detected. | After detection | Processing an adjusting entry to fix a miscoded payroll tax deposit. |
Can You Solve These 2026 CPP Audit Practice Questions?
The following problems are calibrated to the difficulty and style of the real CPP exam's Internal Control and Audit section. They force you to apply rules, not just recite them. Your performance here will reveal exactly where you need to focus your study time.
If you find yourself struggling, it's a signal to dive deeper. The VoraPrep CPP course includes over 1,600 adaptive practice questions with detailed explanations that break down every step. Try VoraPrep's free CPP practice questions to see the full platform.
1. A payroll manager implements a system rule that prevents a payroll administrator from processing a final paycheck for themselves. This is an example of what type of internal control?
A. Detective
B. Corrective
C. Preventive
D. Directive
2. During a quarterly review, an internal auditor pulls a report of all employees who received a bonus greater than $10,000 to verify against the approved bonus list signed by the department head. This activity is an example of:
A. A preventive control
B. A detective control
C. A corrective control
D. A compliance control
3. Which of the following is the BEST example of proper segregation of duties in the payroll process?
A. The Payroll Director has the authority to both add new hires to the system and approve the final payroll register.
B. The payroll clerk who enters time data also prints and distributes the physical paychecks.
C. One employee is responsible for recording payroll transactions in the GL, while another reconciles the bank account.
D. The HR Manager can change employee pay rates and also process manual check requests for adjustments.
4. At the end of the month, a company's payroll bank account statement shows a balance of $155,000. The company's general ledger cash account for payroll shows a balance of $125,500. There are $3,500 in deposits in transit and no bank errors. What is the value of the outstanding checks?
A. $26,000
B. $29,500
C. $33,000
D. $36,500
5. Under the Sarbanes-Oxley Act (SOX), which section requires the CEO and CFO of a publicly traded company to personally certify the accuracy of their company's financial statements and the effectiveness of their internal controls?
A. Section 302
B. Section 404
C. Section 409
D. Section 906
6. A payroll supervisor discovers that a terminated employee was accidentally paid for two weeks after their departure. The supervisor initiates a process to reverse the direct deposit and adjusts the company's payroll tax filings. This entire process is an example of what type of control?
A. Preventive
B. Detective
C. Corrective
D. Segregation of duties
7. An external auditor is testing the effectiveness of a company's internal controls over financial reporting for payroll. Their primary focus will be based on the requirements of:
A. The Fair Labor Standards Act (FLSA)
B. The company's employee handbook
C. Sarbanes-Oxley (SOX) Section 404
D. The Health Insurance Portability and Accountability Act (HIPAA)
8. When reconciling the payroll liability general ledger account, the staff accountant notices the balance is significantly lower than expected. Which of the following is the most likely cause?
A. An employee was overpaid and the gross wages were too high.
B. The payroll tax deposit was recorded as a debit to the liability account twice.
C. The accrual entry for the final payroll of the month was not posted.
D. Federal income tax withholding rates were recently increased.
9. Which of the following describes the primary purpose of a payroll bank account reconciliation?
A. To ensure the company has enough cash to make payroll.
B. To identify errors or discrepancies between the bank's records and the company's records.
C. To calculate the total payroll tax liability for the quarter.
D. To verify that all employees have cashed their paychecks.
10. A key control for preventing "ghost employees" is:
A. Requiring direct deposit for all employees.
B. Performing a monthly reconciliation of the payroll register to the HR master file.
C. Using a third-party payroll provider.
D. Conducting background checks on all new hires.
Answers & Explanations
1. Correct Answer: C) Preventive Explanation: This control is preventive because it is designed to stop an undesirable action (an employee paying themselves) before it happens. The system physically blocks the transaction.- A) Detective: A detective control would identify the action after it occurred, such as a report listing all payments processed by an administrator for themselves.
- B) Corrective: A corrective control would fix the problem after it was detected, like reversing the unauthorized payment.
- D) Directive: Directive controls are actions taken to cause or encourage a desirable event, such as training or policy documentation.
- A) A preventive control: A preventive control would be a system requirement for a second approval on any bonus over $10,000 before it could be paid.
- C) A corrective control: A corrective control would be the action taken to recover the funds if an unapproved bonus was found.
- D) A compliance control: This is a tempting distractor. While the control's goal is compliance, its mechanism is detective. The CPP exam requires the most precise classification of the control's function, which in this case is to detect issues after the fact.
Exam trap: The other options describe scenarios where duties are dangerously combined.
- A and D are incorrect because they give one person power over both changing pay data (HR function) and processing payments (payroll function). This creates a significant risk for creating ghost employees or inflating pay.
- B is incorrect because combining data entry with check distribution allows someone to potentially enter a fraudulent payment and intercept the check.
Worked example:
The goal is to make the adjusted bank balance equal the adjusted book (GL) balance. The formula is: Bank Balance + Deposits in Transit – Outstanding Checks = Book Balance. You need to solve for Outstanding Checks.
Step 1: Set up the formula
Bank Balance + Deposits in Transit – Outstanding Checks = Book Balance
Step 2: Plug in the known values
$155,000 (Bank) + $3,500 (DIT) – Outstanding Checks = $125,500 (Book)
Step 3: Simplify the equation
$158,500 – Outstanding Checks = $125,500
Step 4: Isolate and solve for Outstanding Checks
Outstanding Checks = $158,500 – $125,500
Outstanding Checks = $33,000The tempting wrong answers come from adding or subtracting the numbers in the wrong order. For example, answer A ($26,000) comes from incorrectly subtracting the deposits in transit from the bank balance before solving.
- B) Section 404: This is the most common distractor. Section 404 requires management to produce an internal control report as part of the annual report, and it requires the external auditor to attest to the accuracy of that management assessment. It's about the detailed report and audit, not the personal certification by the CEO/CFO.
- C) Section 409: Deals with real-time disclosure of material changes in financial condition.
- D) Section 906: Contains criminal penalties for certifying a misleading or fraudulent financial report. Section 302 is the requirement to certify; Section 906 is the penalty for certifying falsely.
- A) Preventive: A preventive control would have been a better cross-check between HR termination records and the active payroll file before the payroll was run.
- B) Detective: The detective control was whatever process or report allowed the supervisor to discover the error in the first place. The action of fixing it is corrective.
- D) Segregation of duties: This is a type of preventive control, not a response to an error.
- A) FLSA: The FLSA governs wage and hour laws (minimum wage, overtime). While auditors check for compliance, SOX 404 specifically governs the audit of the control processes themselves.
- B) Employee handbook: This is a company policy document, not the legal or regulatory framework for a financial statement audit.
- D) HIPAA: HIPAA deals with protected health information and is not the primary driver for a financial audit of payroll controls.
- C) Not posting the accrual: This is another strong possibility and a common real-world error that also results in a lower balance. However, a double-posting is a direct transactional error that creates a significant, often non-rounded discrepancy that reconciliations are designed to catch. Both are valid audit concerns, but the double-debit is a classic accounting error tested on exams.
- A) Overpaying an employee: This would increase liabilities, leading to a higher balance.
- D) Increased withholding rates: This would also increase the liability accrued, leading to a higher balance.
- A) Ensuring enough cash: This is part of cash management, which is related but not the purpose of the reconciliation itself. You could have enough cash but still have errors.
- D) Verifying checks are cashed: While the reconciliation process reveals which checks are outstanding, its primary goal is not just to track employee cashing habits but to validate the company's cash balance.
- A) Requiring direct deposit: While this can make fraud more difficult, a fraudster can simply set up a bank account in a fake name. It doesn't prevent the ghost from being on the payroll in the first place.
- C) Using a third-party provider: This can help, but it doesn't absolve the company of its responsibility. The company must still provide accurate data to the vendor. A ghost can be added to the data sent to the provider.
- D) Background checks: This is a control for vetting real employees, not for finding fake ones that have been added to the system.
✨ Free Interactive Calculator
Open CPP Score Calculator →Calculate Your CPP Score & Study Hours by Domain
Adjust your practice scores across official CPP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Does Your Score Mean for Your Study Plan?
Be honest with yourself. This isn't about getting a perfect score today; it's about being ready on exam day.
- If you scored 8/10 or higher: You have a strong grasp of the core concepts. Your next step is to work on speed and application. Use a high-quality question bank to drill yourself with timed quizzes on complex, multi-step scenarios that combine reconciliation with SOX implications.
- If you scored 5-7/10: You understand the basics but are getting tripped up by details, like the difference between SOX 302 and 404 or the specific steps of reconciliation. Go back to your study materials and create a "cheat sheet" specifically for CPP6. The VoraPrep CPP course includes interactive lessons that walk you through these concepts step-by-step.
- If you scored below 5/10: This is a fixable problem. You have a foundational knowledge gap, and simply doing more questions won't help yet. You need to stop and learn the material from the ground up. Start with the COSO framework for internal controls. This section is highly conceptual, and you must understand the "why" behind the rules before you can tackle exam questions.
Get a Complete CPP Prep System with VoraPrep
A short quiz is a great start, but passing the CPP requires sustained, targeted practice. The real exam has 190 questions, and you need the stamina and confidence to handle all of them.
VoraPrep is a full 6-pillar course designed to get you pass-ready efficiently.
- Textbook-Grade Lessons: We replace passive video lectures with interactive lessons that teach you the concepts behind the questions.
- Adaptive Practice: Our engine learns your weak spots. If you're struggling with SOX questions, it will serve you more until you master them. With over 1,600+ questions, you will see it all.
- 1:1 Exam Simulators: Take full-length, timed mock exams that perfectly replicate the look and feel of the real CPP exam.
- Spaced-Repetition Flashcards: Drill key terms and formulas with our smart flashcard system that schedules reviews based on memory science.
- Personalized Study Plan: Enter your exam date, and our system builds a daily study calendar to keep you on track.
- Vory, Your 24/7 Tutor: Stuck on a reconciliation problem at 2 AM? Ask Vory. Our tutor provides instant, Socratic-style explanations for any question.
Legacy courses charge $1,500+ for outdated video bundles. VoraPrep provides a complete, modern, and interactive learning experience for just $25/month. It's everything you need to study, practice, and pass.