Horizon Tech-Solutions Ltd. (HTSL) is a prominent, unlisted public company specializing in providing end-to-end cloud infrastructure and digital…

CA Final · Advanced Auditing, Assurance and Professional Ethics · PYQS · May 2026
Horizon Tech-Solutions Ltd. (HTSL) is a prominent, unlisted public company specializing in providing end-to-end cloud infrastructure and digital transformation services. M/s. JK & Associates, Chartered Accountants were the Statutory Auditors, with CA Vicky as the engagement partner for third consecutive year. HTSL's operations are highly decentralized, with its primary revenue driver being the 'HR-Flow' platform. To maintain cost efficiency, HTSL has outsourced its entire data processing and payroll calculation engine to Data-Sync Private Ltd. (DSPL). During the audit planning phase in October 2025, the CFO, Mr. Rane, received an urgent email from an address nearly identical to the Group Chairman's, requesting a 'discreet' $50,000 wire transfer for an undisclosed project. Simultaneously, several junior staff members in the accounts department reported receiving urgent SMS alerts claiming their corporate login credentials had expired and providing a link to a 'Security Portal' to prevent account lockout. Later, in December 2025, the IT Manager was contacted by a person claiming to be from the Company's telecom provider, who successfully convinced him to reveal the administrative password for the VoIP gateway over a recorded 'verification call'. As the audit progressed into the finalization stage, HTSL provided CA Vicky with a Type 2 Report for DSPL. This report covered the description, design and operating effectiveness of controls at DSPL. CA Vicky's audit assistant, noting that payroll costs constitute 68% of the total expenditure, drafted an unmodified audit report including a paragraph stating: "Our opinion is based in part on the report of the service organization's auditor, which confirms the effectiveness of the payroll processing engine." To meet the reporting deadline, CA Vicky decided to utilize the internal audit function. He assigned them to trace transaction flows from the CRM to the general ledger and to attend the physical verification of high-value hardware at four remote data centers. However, he also asked them to 'independently evaluate' whether the Management's assessment of the Company's ability to continue as a going concern was 'reasonable' given a recent loss of a major contract. Meanwhile, CA Anaya, a senior partner at the firm, was offered the role of 'Whole-time Director' at a reputable non-profit educational Trust. While she has no financial interest in the Trust, the role involves significant administrative responsibilities and a fixed monthly honorarium. Based on the above facts, answer the following Q. Nos. 6 to 9 by choosing the most appropriate option:
(A) The Chairman impersonation email represents Whaling; the SMS credential reset alerts represent Smishing; and the password extraction through the verification call represents Vishing.
(B) The Chairman impersonation email represents Spear-phishing; the SMS alerts represent Smishing; and the phone-based credential extraction represents Vishing.
(C) The Chairman impersonation email and the phone-based password extraction both represent Whaling due to targeting employees in sensitive control positions, while the SMS alerts represent Smishing.
(D) All three incidents represent targeted Spear-phishing attempts using different communication channels.

Suggested Answer and Working Notes:

Correct Answer: Option (A)

The Chairman impersonation email represents Whaling; the SMS credential reset alerts represent Smishing; and the password extraction through the verification call represents Vishing.

Topics: Standard on Auditing (SA), Group Audits, Reporting

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic