ARM 400 Chapter 7

Question 1

Define control environment.

Answer 1

The degree of importance a board of directors and management place on the organization’s internal control system and their related actions.

Question 2

Describe the Sarbanes-Oxley Act of 2002

Answer 2

A federal statutory law governing corporate directors in the areas of investor protection, internal controls, and penalties, both civil and criminal.

Question 3

Define management controls.

Answer 3

A system of specified standards or objectives against which an organization’s management measures performance.

Question 4

Define preventative controls.

Answer 4

Controls designed to prevent errors or inconsistencies.

Question 5

Define detective controls.

Answer 5

Controls designed to detect errors or inconsistencies.

Question 6

What are some examples of how internal controls support organizational objectives?

Answer 6

• Safeguarding and protecting assets.
• Ensuring legal and regulatory compliance.
• Improving internal and external reporting reliability.
• Preserving shareholders’ or stakeholders’ interests.

Question 7

What are some examples of how internal controls support transactional objectives?

Answer 7

• Promoting operational efficiency and effectiveness.
• Ensuring adherence to policies and procedures.
• Guaranteeing accurate record keeping.

Question 8

According to the FERMA guidance on Internal Control Best practices, the audit committee should assure that it’s agenda includes periodic review of?

Answer 8

• The internal audit charter and independence of the internal audit function.
• Internal Audit plans and allocated resources, including audit risk assessment criteria.
• Professional competence of the internal audit function: providing advice to the CEO regarding performance evaluation, compensation changes, hiring, dismissal of the head of internal audit.
• Quality assessment reviews in accordance with the International Standards for the Professional Practice of Internal Auditing, including outside assessments.

Question 9

The Federation of European Risk Management Associations (FERMA) and the European Commission of Institutes of Internal Auditing, established the Three Lines of Defense Model to help clarify roles in an internal control system. What is the First Line of defense?

Answer 9

It is the operational management who is responsible for assessing, controlling and mitigating risks as well as maintaining effective internal controls.

Question 10

The Federation of European Risk Management Associations (FERMA) and the European Commission of Institutes of Internal Auditing, established the Three Lines of Defense Model to help clarify roles in an internal control system. What is the Second Line of defense?

Answer 10

This line of defense is where the risk management function supports and monitors operational management’s implementation of risk management practices. The compliance function of the model monitors compliance risk such as nonconformity withs laws.

Question 11

The Federation of European Risk Management Associations (FERMA) and the European Commission of Institutes of Internal Auditing, established the Three Lines of Defense Model to help clarify roles in an internal control system. What is the Third Line of defense?

Answer 11

Internal audit provides assurance to the board and senior management on organizational effectiveness of risk management and assessment efforts.

Question 12

The Federation of European Risk Management Associations (FERMA) and the European Commission of Institutes of Internal Auditing, established the Three Lines of Defense Model to help clarify roles in an internal control system. What is the unofficial forth Line of defense?

Answer 12

External audits because they provide independent assurance to various stakeholders.

Question 13

The Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’S) Internal Control - Integrated framework acts as an internal control by doing what?

Answer 13

It sets common standards that are designed to increase effectiveness and efficiency of operations as well as reliability of financial reporting while ensuring compliance with applicable laws.

Question 14

What are the 5 components of the COSO control cube?
(HINT: CRCIICM)

Answer 14

• Control environment
• Risk assessment
• Control activities
• Information & Communication -
• Monitoring

Question 15

What does the International Organization for Standardization (ISO) 9000 series and ISO/IEC 27000 series do in relation to internal controls?

Answer 15

Sets international standards to ensure that organizations meet the needs of customers and stakeholders while complying with statutory and regulatory requirements.
ISO 9000 focuses on quality management.
ISO/IEC focuses on information security.

Question 16

What framework does the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing privide?

Answer 16

It is a framework for auditors to provide independent , objective and reasonable assurances that management has adopted a system of controls that is effective and is functioning as intended.

Question 17

In regards to the COSO cube, what does the Control environment do?

Answer 17

Sets the tone for internal control by providing resources, discipline and structure.

Question 18

In regard to the COSO cube, what does Risk Assessment do?

Answer 18

Identifies and measures risks that threaten the organization’s objectives.

Question 19

In regard to the COSO cube, what do Control Activities refer to?

Answer 19

It is a collection of policies, procedures, and practices enacted to carry out the management objectives and risk mitigation goals.

Question 20

In regard to the COSO cube, what does the Information and communication section refer to?

Answer 20

The systems or processes that communicate control responsibilities in a manner that enables responsibilities to be met.

Question 21

In regard to the COSO cube, what does the Monitoring Activities section do?

Answer 21

This part of the COSO cube refers to the external oversight or internal application of independent methodologies such as customized procedures or standard checklists to reinforces adherence to rules put in place.

Question 22

In addition to the five components of the COSO cube, the cube also addresses what 3 types of objectives?

Answer 22

Operations - speaks to the efficiency of the organizations operations and how successfully the approach the stated goals.

Reporting - pertains to internal and external reports, whether tracking progress towards goals or meeting regulatory requirements.

Compliance - is referring to any goals dealing with laws or regulations.

Question 23

Because audits are conducted in diverse legal and cultural environments, _________ has designed standards to ensure that the auditor’s responsibilities are met.

Answer 23

Institute of Internal Auditors (IIA)

Question 24

In regard to IIA standards, what is an attribute standard?

Answer 24

This refers to a standard that defines the attributes of an organizations and individuals performing internal auditing.

Question 25

In regard to IIS standards, what is a performance standard?

Answer 25

This is referring to a standard that defines the nature of internal auditing and providing quality criteria against which the performance of these services can be measured.

Question 26

Based upon the standards set forth by IIA, the internal auditor is required to validate which key areas?

Answer 26

• That the objectives support and align with the organization’s mission.
• That significant risks are identified and assessed.
• That appropriate responses align risks with the organization’s risk appetite.
• Relevant risk information is captured and communicated in a timely manner.

Question 27

What is risk-based auditing?

Answer 27

This is auditing that prioritizes the use of an organization’s limited internal audit resources to this areas that pose the greatest risk.

Question 28

The accuracy of financial statements is a key area of focus for any internal audit approach, including those that are risk-based. What does the Auditing Standard No. 5 (AS 5) do?

Answer 28

This auditing standard was issued by the Public Company Accounting Oversight Board (PCAOB) and it applies when an auditor is engaged to audit management’s assessment of the effectiveness of internal control over financial reporting.

Question 29

How does Auditing Standard # 5 (AS5) support a risk-based approach?

Answer 29

• Focus internal control audits on the most important matters.
• Eliminate unnecessary audit procedures.
• Match the audit scope to the size and risk model of the enterprise.
• Offer simplified implementation guidance from prior standards.

Question 30

According to the Auditing Standard # 5 (AS5), failing to prevent or detect fraudulent misstatements is a greater risk for internal financial-reporting control than failing to prevent or detect any other error. This requires a specific fraud risk assessment with what types of controls?

Answer 30

• Controls over significant , unusual transactions.
• Controls over journal entries and adjustments made in the period-end of the financial reporting process.
• Controls over transactions between related parties.
• Controls related to significant management estimates.
• Controls that mitigate incentives for management to falsify or inappropriately manage financial results.

Question 31

Why does involving internal auditors in an organization’s risk management efforts create a win-win situation?

Answer 31

Because they serve as a resource to support the risk managers’ work as well as aid efforts to develop risk-based auditing plans because they may have a higher understanding of pertinant risks.

Question 32

Who develops the risk management policy?

Answer 32

The board of directors, who also determine the amount and types of risk the organization wants to pursue, retain, reduce or avoid.

Question 33

What are a few of the key items that Risk Management focuses on in it’s role?

Answer 33

• Design and implement risk management plan and tools to use.
• Works with the business managers to establish internal risk management controls.
• Monitors risk levels within the organization.
• Identifies and quantifies new, emerging risks and recommends appropriate responses.
• Is accountable for whether the risk management plan is effective.

Question 34

What are few of the key items that Internal Audit focuses on in relation to risk management?

Answer 34

• Reviews and critiques the implementation of the risk management plan.
• Audits internal risk controls to ensure that they are in place and functioning as designed.
• Monitors risk levels within the organization to determine whether the risk management plan and internal risk controls are effectively managing risk as expected.
• Identifies and quantifies new and emerging risks.