CH 2 Governance & COSO Flashcards
The objective of safeguarding of assets is a subset of which of the following objectives? Reporting. Compliance. Fraud. Operations.
Operations.
There are a number of internal control frameworks used as benchmarks. The most commonly used framework in the U.S. is Internal Control—Integrated Framework developed by COSO. According to COSO internal control is:
A process, effected by the entity’s board of directors, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.
As can be seen from the definition, internal control has three objectives: (1) reliability of reporting, (2) efficiency and effectiveness of operations, and (3) compliance with applicable laws and regulations. When internal control is determined to be effective senior management and the board of directors have the following reasonable assurance with respect to the objectives:
(7) Operations objectives—the organization achieves effective and efficient operations when significant external events can be predicted and their potential effects mitigated, or the organization understands the extent to which operations can be managed when the effects of significant events cannot be mitigated. The operations category of objectives also includes safeguarding of assets.
(8) Reporting objectives—the organization prepares internal and external financial and nonfinancial reports in conformity with applicable laws, rules, regulations, standards, and internal policies.
(9) Compliance objectives—the organization complies with applicable laws, rules and regulations.
Under the COSO framework internal control can be viewed as including five components: (1) the control environment, (2) risk assessment, (3) control activities, (4) information and communication, and (5) monitoring activities. Seventeen principles are incorporated within the 5 components.
The COSO definition of internal control considers control activities a(n):
Component of internal control.
Control objective.
Element of the control environment.
Portion of information and communication.
Auditing Standards divide internal control into five interrelated components as follows: (1) control environment, (2) risk assessment, (3) control activities, (4) information and communication, and (5) monitoring.
According to the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing, the chief audit executive should
Establish a risk-based approach to determine audit priorities.
Manage audit activities to ensure that all major areas receive coverage over the course of the year.
Establish audit priorities solely based on management’s priorities.
Establish audit priorities that have no overlap with external audit priorities.
Establish a risk-based approach to determine audit priorities.
The International Standards for the Professional Practice of Internal Auditing, much like generally accepted auditing standards, include rules and interpretations. They cover the two types of services that internal auditors perform, assurance services and consulting services. Assurance services involve providing an independent assessment of governance, risk management, or control processes of an organization. Consulting services involve advisory related services to improve an organization’s governance, risk management, or control processes. The internal auditing standards are broken down into attribute standards (related to the characteristics of the internal audit activity) and performance standards (related to the quality of internal audit activities). Aspects of the International Standards for the Professional Practice of Internal Auditing that relate particularly to corporate governance include
(1) The purpose, authority, and responsibility of the internal audit activity should be formally defined in the internal audit charter. The internal audit charter should recognize the need to adhere to the Code of Ethics and International Standards for the Professional Practice of Internal Auditing.
(2) The internal audit activity must be independent and internal auditors must be objective in performing their work. Independence for the internal auditor activity is achieved by organizational independence, which means auditors cannot be influenced by the management of the functional areas that they audit. Accordingly, the chief audit executive should report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. For effective organizational independence, the chief audit executive ideally should report functionally to the audit committee and administratively to the chief executive officer of the corporation. This helps to prevent their work from being influenced by management of the corporation. In addition, individual internal auditors must have an impartial, unbiased attitude and avoid conflicts of interest. For example, individual internal auditors cannot be independent in auditing activities for which they made operating decisions. If independence is impaired, the details of the impairment should be disclosed to appropriate parties.
(3) Internal audit engagements must be performed with proficiency and due professional care. Proficiency means that the internal auditors must possess the knowledge, skills, and competencies needed to perform their individual responsibilities. This includes a sufficient knowledge of key IT risks and controls, and IT audit techniques, and a sufficient knowledge to evaluate fraud risk.
(4) Internal auditors must enhance their skills with continuing professional development and the chief audit executive must develop and maintain a quality assurance and improvement program.
(5) The internal audit activity must evaluate the effectiveness and contribute to the improvement of the corporation’s risk management processes, and assist the management in maintaining effective controls by evaluating their effectiveness and efficiency and promoting continuous improvement.
(6) The chief audit executive must establish risk-based plans to determine audit priorities.
(7) The chief audit executive must establish and maintain a system to monitor the disposition of audit results communicated to management.
Which of the following is not one of the attributes of a financial expert as required in the SEC rules regarding audit committees?
An understanding of generally accepted auditing standards.
An understanding of internal controls and procedures for financial reporting.
An understanding of audit committee functions.
An understanding of generally accepted accounting principles.
The Sarbanes-Oxley Act provides that at least one member should be a “financial expert.” The names of the financial experts must be disclosed. If the firm does not have a financial expert, it must provide an explanation. A financial expert is one that possesses all of the following attributes:
1] An understanding of generally accepted accounting principles and financial statements
2] Experience in preparing, auditing, analyzing, or evaluating financial statements of the breadth and complexity expected to be encountered with the company
3] An understanding of internal controls and procedures for financial reporting
4] An understanding of audit committee functions
These attributes would be acquired through (1) education and experience as a principal financial officer, controller, public accountant, or equivalent, (2) experience supervising an individual in one of the positions in (1), (3) experience overseeing or assessing the performance of companies or public accountants with respect to preparing, auditing, or evaluating financial statements, or (4) other relevant experience.
The definition of internal control developed by the Committee of Sponsoring Organizations (COSO) includes the objectives of reporting, compliance with laws and regulations and:
Incorporation of ethical business practice standards.
Effectiveness and efficiency of operations.
Safeguarding of entity assets.
Effectiveness of prevention of fraudulent occurrences.
Effectiveness and efficiency of operations.
Close
B. Internal Controls
There are a number of internal control frameworks used as benchmarks. The most commonly used framework in the U.S. is Internal Control—Integrated Framework developed by COSO. According to COSO internal control is:
A process, effected by the entity’s board of directors, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.
Which of the following disclosures is required by the Dodd-Frank Act of 2010?
Disclosure of who appoints the external auditors.
Disclosure of why or why not the chairman of the board is also the chief executive officer.
Disclosure of what committee sets compensation policy.
Disclosure of the number of inside directors on the board.
Officers operate the company based on the authority delegated to them by the board of directors. An officer of the corporation is an agent that can bind the corporation within the scope of his or her authority. Corporations are not bound by acts of an officer acting beyond the scope of his or her authority. The officers of the corporation are responsible for the fair presentation of the corporation’s financial reports, including the financial statements. Officers, employees, or major stockholders who are on the board of directors are referred to as inside directors. The Wall Street Reform and Consumer Protection (Dodd-Frank) Act of 2010 requires public corporations to disclose why or why not the chairman of the board is also the chief executive officer.
Which of the following components of internal control encompass policies and procedures that ensure that management’s directives are carried out?
The control environment.
Monitoring.
Control activities.
Information and communication.
This answer is correct. Control activities encompass policies and procedures that ensure that management’s directives are carried out.
An important benefit of an enterprise risk management system is
Alignment of shareholder returns with management returns.
Alignment of management risk taking with employee risk appetite.
Alignment of management risk taking with shareholder risk appetite.
Alignment of management risk taking with creditor risk appetite.
Alignment of shareholder returns with management returns.
Enterprise Risk Management
In addition to an internal control framework, COSO has also developed a framework for enterprise risk management (ERM). The framework defines ERM as follows:
Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in a strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.
ERM helps align the risk appetite of the organization with its strategy, enhances risk response decisions, reduces operational surprises and losses, identifies and manages cross-enterprise risks, provides integrated responses to multiple risks, helps the organization seize opportunities, and improves the deployment of capital.
A key aspect of ERM is the identification and management of events that have a negative impact, positive impact, or both. Events with negative impact represent risks. Events with positive impact may offset negative impacts or represent opportunities.
Everyone in the organization has some responsibility for ERM. The best run organizations have a culture of risk management that is understood by every employee. Many organizations assign a risk officer, financial officer, and/or internal auditor with key support responsibilities. The internal control of the organization is an integral part of the organization’s ERM system.
Which of the following tasks would be included in a document flowchart for processing cash receipts?
Compare control and remittance totals.
Record returns and allowances.
Authorize and generate an invoice.
Authorize and generate a voucher.
This answer is correct because comparing control and remittance totals is one of the activities involved in processing cash receipts. The requirement is to identify the task that would be included in a document flowchart for processing cash receipts.
Which of the following is not required of corporations that are listed on the New York Stock Exchange (NYSE)?
External auditors must report directly to the audit committee of the board of directors.
One member of the audit committee of the board of directors must be a financial expert.
The principle executive officer must disclose all significant internal control deficiencies.
The chairman of the board of directors cannot also serve as the chief executive officer.
This answer is correct. This is not a requirement of the NYSE. Dodd-Frank indicates that a corporation must disclose why or why not the chairman is also the CEO.
New York Stock Exchange (NYSE) & NASDAQ Rules Related to Corporate Governance and Director Independence. Among other items, the NYSE and NASDAQ require listed corporations to
(1) Have a majority of independent directors on their boards.
(2) Make determination of independence of members and provide information to investors about the determination. Specific NYSE and NASDAQ rules that make a director not independent include
(a) A director is not independent if s/he has been an employee of the corporation or an affiliate in the last 5 years (3 years for NASDAQ).
(b) A director is not independent if a family member has been an officer of the corporation or affiliate in the last 5 years (3 years for NASDAQ).
(c) A director is not independent if s/he was a former partner or employee of the corporation’s external auditor in the last 5 years (3 years for NASDAQ).
(d) A director is not independent if s/he or a family member in the last 3 years received more than $120,000 (for a twelve-month period) in payments from the corporation other than for director compensation.
(e) A director is not independent if s/he is an executive of another entity that receives significant amounts of revenue from the corporation.
(3) Identify certain relationships that automatically preclude a board member from being independent.
(4) Have nonmanagement directors meet at regularly scheduled executive sessions.
(5) Adopt and make publically available a code of conduct applicable to all directors, officers and employees, and disclose any waivers of the code for directors or executive officers.
(6) Have an independent audit committee. In addition, nominating/corporate governance and compensation decisions must be made by independent committees (or a majority of independent directors for NASDAQ).
According to the IIA International Standards for the Professional Practice of Internal Auditing, the internal audit charter should include all of the following except:
The purpose of the internal audit activity.
The responsibility of the internal audit activity.
The scope of the internal audit activity.
The authority of the internal audit activity.
This answer is correct. The scope of the activity should not be included in the charter.
Close
The purpose, authority, and responsibility of the internal audit activity should be formally defined in the internal audit charter. The internal audit charter should recognize the need to adhere to the Code of Ethics and International Standards for the Professional Practice of Internal Auditing.
The Dodd-Frank Act of 2010 established a requirement that
All members of the compensation committee of the board of directors be independent.
All members of the audit committee of the board of directors be independent.
All members of the corporate governance committee of the board of directors be independent.
All members of the board of directors be independent.
he compensation committee (1) reviews and approves CEO compensation based on meeting performance goals, (2) makes recommendations to the board with respect to incentive and equity-based compensation plans, and (3) attempts to align incentives with shareholder objectives and risk appetite. The Dodd-Frank Act of 2010 established a requirement that all members of the compensation committee of public companies must be independent. In addition, shareholders must be allowed a nonbinding vote on executive compensation at least every three years, and a vote at least every six years as to whether the vote on compensation should be held more often. Finally, the act also requires a nonbinding vote by shareholders on “golden parachutes” to be provided to executives as a result of major transactions.
Which of the following forms of compensation is more likely to result in shirking by management? Fixed compensation. Base salary and bonus. Base salary and stock options. Base salary and stock grants.
This answer is correct. With fixed compensation management may not be inclined to work hard or take appropriate risks.
According to COSO, the use of ongoing and separate evaluations to identify and address changes in internal control effectiveness can best be accomplished in which of the following stages of the monitoring-for-change continuum?
A.
Control baseline
Correct B.
Change identification
C.
Change management
D.
Control revalidation/update
The baseline understanding of internal control effectiveness is the starting point. Monitoring identifies changes in the environment or internal control system and the entity’s ability to manage those changes. To “identify and address changes” is part of change identification.
The control baseline is limited to the controls in effect before the change is identified. Change management is the process of implementing needed changes, not identifying them. Control revalidation is a later part of the process after the need for control changes has been identified.
The manager of a production line has the authority to order and receive replacement parts for all machinery that require periodic maintenance. The manager typically pays for the parts using a corporate credit card (that bills to the company). The internal auditor received an anonymous tip that the manager ordered substantially more parts than were necessary from a family member in the parts supply business. The unneeded parts were never delivered. Instead, the manager processed receiving documents and charged the parts to machinery maintenance accounts. The manager processed payments for the undelivered parts through the company’s credit card and those payments were sent to the family-member supplier. After the supplier received the money, it was divided between the manager and the family member.
An internal auditor is conducting an audit of the use of corporate credit cards by employees and the supplies ordering process. Which of the following are major audit concerns regarding these issues?
Segregation of duties is insufficient. The purchasing function is impaired. Cards may be used for personal benefit. The company is required to make one large payment instead of many small ones. A. II and IV only
B.
III only
C.
I, II, III, and IV
Correct D.
I and III only
The segregation of duties is insufficient as there should be another person to process the receiving documents. In the absence of effective monitoring, credit cards could easily be used for personal benefit.
Which of the following is necessary to be an audit committee financial expert according to the criteria specified in the Sarbanes-Oxley Act of 2002?
A.
A limited understanding of generally accepted auditing standards
B.
Education and experience as a certified financial planner
Correct C.
Experience with internal accounting controls
D.
Experience in the preparation of tax returns
The Sarbanes-Oxley Act of 2002 explains that a financial expert must have experience with internal accounting controls, an understanding of generally accepted accounting standards, and experience with the preparation or auditing of financial statements of generally comparable issuers.
he Sarbanes-Oxley Act changed the way financial reports are treated. What section of the act requires the CEO to review the financial statements?
A.
Section 202
Correct B.
Section 302
C.
Section 102
D.
Section 402
Section 302 of the Sarbanes-Oxley Act requires that CEOs and CFOs certify that the periodic statutory financial statements were reviewed before being signed.
Which of the following positions best describes the nature of the board of directors of XYZ Co.’s relationship to the company?
A.
Agent
B.
Executive
Correct C.
Fiduciary
D.
Representative
The board of directors of XYZ Co.’s relationship to the company is a fiduciary relationship. To understand why, you must first define “fiduciary.” A fiduciary relationship is a legal or ethical relationship of trust between two people, organizations, or other such parties.
A written policy and procedure manual should contain:
A.
a formal job description.
B.
an employee training program.
C.
corporation budgets.
Correct D.
proper business practices.
Policies and procedures help the employee understand the organization’s policies for operation and the procedures that are followed to meet the policies. The policies and procedures include such things as the proper business practices, the purpose of the organization, responsibilities, and definitions.
Each of the following statements is correct regarding the existence and implementation of codes of conduct, except:
A.
employees understand what behavior is acceptable or unacceptable and know what to do if they encounter improper behavior.
B.
the codes of conduct are comprehensive, addressing conflicts of interest, illegal or other improper payments, anticompetitive guidelines, and insider trading.
C.
the codes of conduct are periodically acknowledged by all employees.
Correct D.
the codes of conduct must be in writing and displayed in public areas, such as a break room.
Answer A is incorrect because a code of conduct is only effective if employees understand the limits on behavior contained in the code and are able to take appropriate action when improper behavior is encountered.
Answer B is incorrect because a code of conduct that omitted any of these topics would be incomplete and unable to meet its objectives.
Answer C is incorrect because it is important that employees periodically review the code of conduct and acknowledge agreement to its ethical restrictions.
Answer D is correct because there are numerous ways to make a code of conduct available to employees, such as distributing written handbooks or presenting the code of conduct on the entity’s web site.
What does the audit committee of the board of directors oversee?
A.
Formal job descriptions for employees in an organization
Correct B.
The financial reporting process in an organization
C.
The responsibilities assigned to employees
D.
The creation of standards
The audit committee of the board of directors oversees the following:
Financial reporting
Financial disclosure
Compliance with standards
A company implements an enterprise resource planning application to help improve its financial and operational reporting, while gaining other efficiencies related to sales and inventory management. For the implementation, the company hires an individual specializing in preparing the company for the changes through documenting new policies and procedures and developing new training. This is an example of:
Correct A.
change management.
B.
a social event.
C.
segregation of duties.
D.
an economic event.
Answer A is correct because implementing an ERP application is a change to the entity’s internal controls and documenting the change is part of the process of managing the change.
Answer B is incorrect because documenting an application is part of the entity’s internal controls, not a social event.
Answer C is incorrect because segregating one duty from another is an example of a control. It is not related to documentation of policies or training.
Answer D is incorrect because this is the implementation of a change in the financial reporting system, not an economic event.
To be effective, analytical procedures in the overall review stage of an audit engagement should be performed by which of the following?
A.
The managing audit partner who has responsibility for all audit engagements at that practice office
Correct B.
An audit manager or partner who has a comprehensive knowledge of the client’s business and industry
C.
The CPA firm’s quality control manager or partner who has responsibility for the firm’s peer review program
D.
The staff accountant who performed the substantive auditing procedures
An audit manager or partner should perform the analytical procedures in the overall review stage because they have a more thorough understanding of the client and the industry when compared to other individuals who have less knowledge of the client and the industry.
The objective of analytical procedures used in the overall review stage of the audit is to assist the auditor in assessing the conclusions reached and in the evaluation of the overall financial statement presentation.
