The statement that 'Automated data back-up is an essential component of control testing' is incorrect. Control testing is a process that involves assessing the effectiveness of a control system in mitigating risks. It does not necessarily involve automated data backup. Automated data backup, on the other hand, is a component of control automation. Control automation refers to the use of technology to automate certain control processes, thereby reducing the risk of human error. Automated data backup is a part of this process as it ensures that data is automatically saved and can be recovered in case of any data loss. Therefore, it is a component of control automation and not control testing.

Choice A is incorrect. A key control is indeed a control that can sufficiently mitigate risk on its own. It is a critical part of the internal control system and has a significant impact on the achievement of an entity’s objectives.

Choice B is incorrect. Controls can either be manual or automated in nature. Manual controls are performed by individuals, while automated controls are performed by systems or applications.

Choice C is incorrect. Control automation can transform human error risk into technology and model risk, as it reduces the chance of human errors but introduces risks associated with technology failures or model inaccuracies.

Things to Remember

• Internal controls are processes implemented by an organization to help ensure the achievement of its objectives, including the reliability of financial reporting, compliance with laws and regulations, and the effectiveness and efficiency of operations.
• Key controls are controls that are essential in mitigating significant risks to an acceptable level.
• Control testing involves evaluating the design and operating effectiveness of internal controls to ensure they are functioning as intended.
• Control automation uses technology to streamline and automate control processes.