Chapter 5

Question 1

What is collusion?

Answer 1

An inherent risk of internal control.

2 or more people may collude or management may override internal control.

Question 2

Is human judgement considered an inherent risk in internal control?

Answer 2

Yes, because human judgement is faulty and controls may fail because of simple errors /or mistakes.

Question 3

Internal controls are designed to provide reasonable insurance that?

Answer 3

material errors or fraud will be prevented, or detected and corrected, within a timely period by employees in the course of performing their assigned duties.

Question 4

Which test will be best to assess auditor concern about management override as a limitation of internal control?

Answer 4

auditor should compare actual expenditures with budgeted amount to determine whether management has overridden approvals.

Question 5

What is a control deficiency?

Answer 5

The lowest level of deficiency in the AU-C265 standards.

A control deficiency may arise either in the design or operation of the control.

Question 6

What results in a design deficiency?

Answer 6

1. when a necessary control is missing, or

2. A control operating as designed does not meet the control objective.

Question 7

What results in an operating deficiency?

Answer 7

1. when a properly designed control does not function as designed.
2. The person performing the control does not have the authority or competence to perform it effectively.

Question 8

What is the primary objective of procedures performed to obtain an understanding of internal control?

Answer 8

To provide an auditor with knowledge necessary for audit planning.

Audit plan describes:

1. Risk assessment procedures
2. Further audit procedures at the assertion level
3. Other procedures required by GAAS

Question 9

What are the 5 components of internal control?

Answer 9

1. control environment
2. risk assessment process
3. control activities
4. information systems
5. monitoring

Question 10

When may manual controls be suitable?

Answer 10

where judgment and discretion is required:

1. for large, unusual, nonrecurring, transactions.
2. for circumstances where misstatements are difficult to define, anticipate, or predict..
3. in changing circumstances that require a control response outside the scope of an existing automated control, and
4. In monitoring the effectiveness of automated controls.

Question 11

What is the control environment of internal control?

Answer 11

Control environment provides discipline and structure, sets the tone of the organization, and influences the control consciousness of the employees.

Question 12

What are the components of the control environment of internal control?

Answer 12

1. participation of those charged with governance.
2. integrity and ethical values
3. organizational structure
4. management philosophy and operating style
5. assignment of authority and responsibility
6. Human Resources policies and practices.
7. commitment to competence

Question 13

Which is one of the overriding principles of internal control?

Answer 13

Responsibility for the performance of duty must be fixed.

Fixing the responsibility for each duty makes it easier to trace problems to the persons responsible, and hold them accountable for their actions.

Question 14

How may effective internal control be obtained?

Answer 14

By decentralization of duties and responsibilities.

Question 15

Should one person be responsible for Authorization, recording, and custody of related assets?

Answer 15

No. one person should not be responsible for all phases of a transaction.

These duties should be performed by separate individuals to reduce the opportunities to allow any person to be in a position both to perpetrate and conceal fraud or error in the normal course of his or her duties.

Question 16

Why may the understanding of IT in an attest engagement may most likely be required by the auditor?

Answer 16

To :

1. determine the effect of IT on the audit
2. understand its controls, and
3. design and perform test of IT controls and substantive procedures.

Question 17

In obtaining an understanding of the manufacturing entity’s internal control concerning inventory balances, an auditor most likely would:

Answer 17

Review the entity’s description of the inventory policies and procedures.

Auditor should obtain an understanding of internal control to plan the audit, Including knowledge about the design of relevant controls and whether they have been implemented.

Question 18

What is the most logical order the audit step is performed?

Answer 18

1. Evaluate the design of relevant controls and determine whether they have been implemented.
2. Assess the RMM’s
3. Design further audit procedures.
4. Test controls

Question 19

What is obtaining an understanding of internal control and then assessing RMMs used to do?

Answer 19

design further audit procedures (test of controls and substantive procedures).

Question 20

What does test of controls do?

Answer 20

1. Determine the operating effectiveness of controls.

Question 21

Why is substantive procedures performed?

Answer 21

for all relevant assertions related to material classes of transactions, balances, and disclosures.

But the nature, timing, and extent of substantive procedures depend on the operating effectiveness of controls

Question 22

What should the auditor document in an audit?

Answer 22

1. The understanding of the entity and its environment and the components of internal control.
2. The sources of information regarding the understanding,
3. The risk assessment procedures performed.

The form and extent of the documentation are influenced by the nature and complexity of the entity’s controls.

Question 23

in obtaining an understanding of each of the five components of internal control sufficient to plan the audit, how is an understanding obtained?

Answer 23

By performing risk assessment procedures to evaluate the design of controls relevant to the audit and to determine whether they have been implemented.

Question 24

The auditor uses the understanding of internal control and the assessment of the RMMs to design…?

Answer 24

Further audit procedures.

These include:
Test of control, if relevant, and substantive procedures

Question 25

What is a decision table?

Answer 25

It identifies the contingencies considered in the description of a problem, and the appropriate actions to be taken relative to those contingencies.

Decision tables are logic diagrams presented in matrix form.

Flow charts DO NOT present the sequence of actions described

Question 26

What is a system flowchart?

Answer 26

a visual representation of a series of sequential processes, that is, of a flow of documents, data, and operations.

Question 27

Why might a flowchart be preferred over a questionnaire?

Answer 27

Because a picture is more easily comprehended.

Question 28

Documentation of internal control of a complex information system may include?

Answer 28

questionnaires, flowcharts, or decision tables.

Question 29

What is the sequence of documents and operations on a well prepared systems flowchart

Answer 29

top to bottom and left to right

Question 30

What is a system flowchart?

Answer 30

A symbolic representation of the flow of documents and procedures through a series of steps in the accounting process of the client’s organization.

Question 31

When is a hot site used?

Answer 31

When fast recovery backup is critical.

Hot site includes all software , hardware, and other equipment necessary for a company to carry out operations.

Hot sites are expensive to maintain

Question 32

Name the computer program that appears to be legitimate, but performs some illicit activity when it runs.

Answer 32

Trojan Horse.

Eg.
A game appearing friendly, but actually contains an application destructive to the computer system

Question 33

What is Preformatting?

Answer 33

An online data entry control to avoid data entry errors.

The display of a document, with blanks for data items to be entered by the terminal operator

Question 34

What is validity check?

Answer 34

tests identification numbers or transaction codes for validity by comparison with items already known to be correct or authorized.

eg.

validity check identify a transmission for which the control fields value did not match a pre-existing record in a file.

Question 35

What is a hash total?

Answer 35

a control total without a defined meaning, such as total employees numbers, or invoice numbers, that is used to verify the completeness of data.