5.1 Flashcards
An auditor is evaluating a client’s internal controls. Which of the following situations would be the most difficult internal control issue for an auditor to detect?
Two employees, who work in different departments, are circumventing an internal control.
Because of its inherent limitations, internal control can provide only reasonable assurance that the entity’s objectives are met. Thus, manual or automated controls can be circumvented by collusion of two or more people or by management override (AU-C 315). Fraud perpetrated by collusion may be difficult to detect because of schemes designed to conceal it.
Which of the following factors is most likely to affect the extent of the documentation of the auditor’s understanding of a client’s system of internal controls?
The degree to which information technology is used in the accounting function.
As internal control becomes more sophisticated, the documentation becomes more complex and extensive.
It is important for the auditor to consider the competence of the audit client’s employees, because their competence bears directly and importantly upon the
Achievement of the objectives of internal control.
The control environment is the foundation of internal control. A commitment to competence is one of the factors in the control environment.
Although substantive tests may support the accuracy of underlying information used in monitoring, these tests may provide no affirmative evidence of the effectiveness of monitoring controls because
The information used in monitoring may be accurate even though it is subject to ineffective control.
When obtaining an understanding of each of the five components of internal control (including monitoring), the auditor must perform procedures to understand the design of relevant controls and must determine whether controls have been implemented. If (s)he intends to rely on the controls, (s)he must also determine their effectiveness. However, when controls based on monitoring leave no audit trail, for example, documentation of design or operation, evidence about effectiveness of design or operation may be obtained only by inquiries, observations, and computer-assisted audit methods. Moreover, substantive procedures likewise may provide no affirmative evidence of the effectiveness of monitoring controls because the information may be accurate even though controls over its creation are ineffective. Thus, the ineffectiveness of monitoring would not be revealed by substantive procedures unless the detection of material misstatements resulted in performance of additional audit procedures directed at the controls.
An entity should consider the cost of a control in relationship to the risk. Which of the following controls best reflects this philosophy for a large dollar investment in heavy machine tools?
Imprinting a controlled identification number on each tool.
A controlled identification number on each tool and periodic checking allow for an effective control at reasonable cost.
An entity has many employees who access a database with numerous access points. The database contains sensitive information about the customers of the entity. Access controls prevent employees from entry to those areas of the database for which they have no authorization. All salespersons have certain access permission to customer information. Which of the following is a true statement about the nature of the controls and risks?
A salesperson’s access to customer information should extend only to what is necessary to perform his or her duties.
Internal control risks vary with the nature and characteristics of IT usage. Employees should be allowed access to systems only to the extent necessary for them to carry out their responsibilities.
In obtaining an understanding of a manufacturing entity’s internal control concerning inventory balances, an auditor most likely would
Review the entity’s descriptions of inventory policies and procedures.
The auditor should obtain an understanding of the internal control components to plan the audit, including knowledge about the design of relevant controls and whether they have been implemented. Reviewing the entity’s descriptions of inventory policies and procedures helps the auditor understand their design.
An auditor anticipates relying on the operating effectiveness of controls in a computerized environment. Under these circumstances, on which of the following activities would the auditor initially focus?
General controls.
Relying on controls involves (1) identifying specific controls that are suitably designed to prevent, or detect and correct, material misstatements in relevant assertions; (2) performing tests of controls; and (3) assessing the RMMs. Some computer controls relate to all computer activities (general controls), and some relate to specific tasks (application controls). Because general controls have pervasive effects, they should be tested before application controls. If the general controls are ineffective, tests of the application controls over input, processing, and output are unlikely to permit the auditor to rely on controls.
Which of the following constitutes a potential risk associated with the use of information technology in an entity’s internal control structure?
Unauthorized changes to systems.
Use of IT creates specific risks to internal control. They include unauthorized (1) access to data (e.g., recording of unauthorized, inaccurate, or nonexistent transactions), (2) changes in data, and (3) changes in systems or programs.
First Federal S&L has an online, real-time system, with terminals installed in all of its branches. This system will not accept a customer’s cash withdrawal instruction in excess of $1,000 without the use of a “terminal audit key.” After the transaction is authorized by a supervisor, the bank teller then processes the transaction with the audit key. This control can be strengthened by
Online recording of the transaction on an audit override sheet.
Control over large cash withdrawals can be improved further by separately recording these transactions. The additional documentation provides an audit trail that the auditor may follow to determine whether the special procedures have been followed.
Which of the following best describes an inherent limitation that should be recognized by an auditor when considering the potential effectiveness of internal control?
Controls, whether manual or automated, whose effectiveness depends on segregation of duties can be circumvented by collusion.
One of the inherent limitations of internal control is that it can be circumvented by collusion among persons both within and outside the entity. Thus, a control based on segregation of duties will be ineffective if a person in a position to commit fraud colludes with a person who can conceal it.
Which of the following factors is most relevant when an auditor considers the client’s organizational structure in the context of the risks of material misstatement
The suitability of the client’s lines of reporting.
Lines of reporting can determine the ability of management or other employees to circumvent implemented controls. Reporting lines are part of the organizational structure and affect the auditor’s assessment of the RMMs.
One of the major problems in a computer system is that incompatible functions may be performed by the same individual. One compensating control is the use of
A computer access log.
A computer (console) access log is a record of computer and software usage usually produced by the operating system. Proper monitoring of the log is a compensating control for the lack of segregation of duties. For example, the log should list operator interventions.
In order to obtain an initial understanding of internal control sufficient to assess the risk of material misstatement of the financial statements, an auditor would most likely perform which of the following procedures?
Risk-assessment procedures to evaluate the design of relevant controls.
In all audits, the auditor should obtain an understanding of the components of internal control to identify and assess the RMMs and to design further audit procedures. An understanding is obtained by performing risk assessment procedures to evaluate the design of controls relevant to the audit and determine whether they have been implemented. Risk assessment procedures performed to obtain evidence about the design and implementation of relevant controls include (1) inquiries, (2) observation of the application of specific controls, (3) inspection of documents and reports, and (4) tracing transactions. Inquiries alone are not sufficient.
Which of the following components of internal control includes development and use of training policies that communicate prospective roles and responsibilities to employees?
Control environment.
The control environment sets the tone of an organization. It includes human resource policies and practices relative to hiring, orientation, training, evaluating, counseling, promoting, compensating, and remedial actions.
