Chapter 6: Internal Control

Question 1

Which of the following best describes an internal auditor’s purpose in reviewing the organization’s existing governance, risk management, and control processes?

a. To help determine the nature, timing, and extent of tests necessary to achieve engagement objectives.
b. To ensure that weaknesses in the internal control system are corrected.
c. To provide reasonable assurance that the processes will enable the organization’s objectives and goals to be met efficiently and economically.
d. To determine whether the processes ensure that the accounting records are correct and that financial statements are fairly stated.

Answer 1

C is the best answer. Answer A is incorrect because it is a purpose of audit planning. Answer B is incor-rect because correcting control weaknesses is a function of management, not of the internal auditor. Answer D is incorrect because it is a basic objective from a financial accounting and auditing perspec-tive, but it is not broad enough to cover the internal auditor’s entire purpose for review.

Question 2

What is residual risk?

a. Impact of risk.
b. Risk that is under control.
c. Risk that is not managed.
d. Underlying risk in the environment.

Answer 2

C is the best answer. Residual risk is the risk that is left over after all controls and risk management techniques have been applied. Answer A is incorrect because the impact of risk is its consequence. Answer B is incorrect because risk that is under control is managed risk. Answer D is incorrect because the underlying risk is the absolute risk.

Question 3

The requirement that purchases be made from suppliers on an approved vendor list is an example of a:

a. Preventive control.
b. Detective control.
c. Compensating control.
d. Monitoring control.

Answer 3

A is the best answer. Preventive controls are actions taken prior to the occurrence of transactions with the intent of stopping errors from occurring. Use of an approved vendor list is a control to prevent the use of unacceptable suppliers. Answer B is incorrect because a detective control identifies errors after they have occurred. Answer C is incorrect because compensating controls are designed to supplement key controls that are either ineffective or cannot fully mitigate risks by themselves to acceptable levels. Answer D is incorrect because monitoring controls are designed to ensure the quality of the control system’s performance over time.

Question 4

An effective system of internal controls is most likely to detect a fraud perpetrated by a:

a. Group of employees in collusion.
b. Single employee.
c. Group of managers in collusion.
d. Single manager.

Answer 4

B is the best answer. An effective system of internal controls is likely to expose a fraud if it is perpe-trated by one employee without the aid of others. Answer A is incorrect because a group has a better chance of successfully perpetrating an irregularity than does an individual employee. Answers C and D are incorrect because management can often override controls, singularly or in groups.

Question 5

The control that would most likely ensure that payroll checks are written only for authorized amounts is to:

a. Conduct periodic floor verification of employees on the payroll.
b. Require the return of undelivered checks to the cashier.
c. Require supervisory approval of employee time cards.
d. Periodically witness the distribution of payroll checks.

Answer 5

C is the best answer. The employee’s supervisor would be in the best position to ensure payment of the proper amount. Answer A is incorrect because employees may be properly included on payroll, but the amounts paid may be unauthorized. Answer B is incorrect because undelivered checks provide no evi-dence regarding validity of the amounts. Answer D is incorrect because witnessing a payroll distribu-tion would not assure that amounts paid are authorized.

Question 6

An internal auditor plans to conduct an audit of the adequacy of controls over investments in new financial instruments. Which of the following would not be required as part of such an engagement?

a. Determine whether policies exist that describe the risks the treasurer may take and the types of instruments in which the treasurer may invest.
b. Determine the extent of management oversight over investments in sophisticated instruments.
c. Determine whether the treasurer is getting higher or lower rates of return on investments than treasurers in comparable organizations.
d. Determine the nature of monitoring activities related to the investment portfolio.

Answer 6

C is the best answer. Although this might be informational, there is no need to develop a comparison of investment returns with other organizations. Indeed, some financial investment scandals show that such comparisons can be highly misleading because high returns were due to taking on a high level of risk. Also, this is not a test of the adequacy of the controls.

Question 7

Appropriate internal control for a multinational corporation’s branch office that has a department responsible for the transfer of money requires that:

a. The individual who initiates wire transfers does not reconcile the bank statement.
b. The branch manager must receive all wire transfers.
c. Foreign currency rates must be computed separately by two different employees.
d. Corporate management approves the hiring of employees in this department.

Answer 7

A is the best answer. Independent reconciliation of bank accounts is necessary for good internal control.

Question 8

Who has primary responsibility for the monitoring component of internal control?

a. The organization’s independent outside auditor.
b. The organization’s internal audit function.
c. The organization’s management.
d. The organization’s board of directors.

Answer 8

C is the best answer. The organization’s management has primary responsibility for the monitoring component of internal control.

Question 9

Reasonable assurance, as it pertains to internal control, means that:

a. The objectives of internal control vary depending on the method of data processing used.
b. A well-designed system of internal controls will prevent or detect all errors and fraud.
c. Inherent limitations of internal control preclude a system of internal control from providing absolute assurance that objectives will be achieved.
d. Management cannot override controls, and employees cannot circumvent controls through collusion.

Answer 9

C is the best answer. Inherent limitations of internal control do, in fact, preclude a system of inter-nal control from providing absolute assurance that objectives will be achieved.

Question 10

Which of the following best exemplifies a control activity referred to as independent verification?

a. Reconciliation of bank accounts by someone who does not handle cash or record cash transactions.
b. Identification badges and security codes used to restrict entry to the production facility.
c. Accounting records and documents that provide a trail of sales and cash receipt transactions.
d. Separating the physical custody of inventory from inventory accounting.

Answer 10

A is the best answer. A reconciliation performed by someone not otherwise involved in processing a transaction is an example of an independent verification control activity.

Question 11

The risk assessment component of internal control involves the:

a. Independent outside auditor’s assessment of residual risk.
b. Internal audit function’s assessment of control deficiencies.
c. Organization’s identification and analysis of the risks that threaten the achievement of its objectives.
d. Organization’s monitoring of financial information for potential material misstatements.

Answer 11

C is the best answer. The risk assessment component of internal control involves an organization’s identification and analysis of the risk that threaten the achievement its objectives.

Question 12

COSO’s Internal Control Framework consists of five internal control components and 17 principles for achieving effective internal control. Which of the following is/are (a) principle(s)?

I. The organization demonstrates a commitment to integrity and ethical values.

II. Monitoring activities.

III. A level of assurance that is supported by generally accepted auditing procedures and judgments.

IV. A body of guiding principles that form a template against which organizations can evaluate a multitude of business practices.

V. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

a. II only.
b. I and V only.
c. II and IV only.
d. I, II, III, IV, and V.

Answer 12

B is the best answer. I is principle 1 under Control Environment. V is principle 16 under Monitoring Activities. II is one of the five elements. III is the definition of reasonable assurance. IV is the definition of a framework.

Question 13

When assessing the risk associated with an activity, an internal auditor should:

a. Determine how the risk should best be managed.
b. Provide assurance on the management of the risk.
c. Update the risk management process based on risk exposures.
d. Design controls to mitigate the identified risks.

Answer 13

B is the best answer. The other choices reflect activities that should be performed by management.

Question 14

Determining that engagement objectives have been met is ultimately the responsibility of the:

a. Internal auditor.
b. Audit committee.
c. Internal audit supervisor.
d. CAE.

Answer 14

D is the best answer. The CAE has ultimate responsibility for all activities performed by the internal audit function. Internal auditors and internal audit supervisors do not have the same level of responsi-bility as the CAE. The audit committee doesn’t have this level of responsibility.

Question 15

An adequate system of internal controls is most likely to detect an irregularity perpetrated by a:

a. Group of employees in collusion.
b. Single employee.
c. Group of managers in collusion.
d. Single manager.

Answer 15

B is the best answer. To be designed adequately and operating effectively, ICFR should address the concepts of initiation, authorization, recording, processing, and reporting. Seeking is not addressed by ICFR

Question 16

How does COSO define internal control?

Answer 16

COSO defines internal control as “. . . a process, effected by an entity’s board of directors, manage-ment, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.”

Question 17

What are objectives?

Answer 17

Objectives are what an organization strives to achieve.

Question 18

What three categories of objectives are set forth in the COSO framework?

Answer 18

■ Operations objectives, which pertain to effectiveness and efficiency of the entity’s operations, including operational and financial performance goals, and safeguarding assets against loss.
■ Reporting objectives, which pertain to internal and external financial and nonfinancial reporting and may encompass reliability, timeliness, transparency, or other terms as set forth by regulators, standard setters, or the entity’s policies.
■ Compliance objectives, which pertain to adherence to laws and regulations to which the entity is subject.

Question 19

What are the five components of internal control covered in the COSO framework?

Answer 19

The five components of internal control covered in the COSO framework are:
■ Control environment.
■ Risk assessment.
■ Control activities.
■ Information and communication.
■ Monitoring activities

Question 20

What does the control environment comprise?

Answer 20

Per COSO, “The control environment comprises the integrity and ethical values of the organization; the parameters enabling the board of directors to carry out its governance oversight responsibilities; the organizational structure and assignment of authority and responsibility; the process for attracting, developing, and retaining competent individuals; and the rigor around performance measures, incentives, and rewards to drive accountability for performance.”

Question 21

What does risk assessment involve?

Answer 21

Per COSO, “Risk assessment involves a dynamic and iterative process for identifying and assessing risks to the achievement of objectives. Risks to the achievement of these objectives from across the entity are considered relative to established risk tolerances. Thus, risk assessment forms the basis for determining how risks will be managed.

Question 22

What are control activities?

Answer 22

Control activities are the actions taken by management, the board, and other parties to mitigate risk and increase the likelihood that established objectives and goals will be achieved.

Question 23

What types of control activities are present in a well-designed system of internal controls?

Answer 23

Control activities present in a well-designed system of internal controls include:
■ Performance reviews and follow-up activities.
■ Authorizations (approvals).
■ IT access control activities.
■ Documentation (rigorous and comprehensive).
■ Physical access control activities.
■ IT application (input, processing, output) control activities.
■ Independent verifications and reconciliations.

Question 24

What is high-quality information?

Answer 24

High-quality information is relevant, accurate, and timely.

Question 25

Why must high-quality information be communicated?

Answer 25

Individuals at all levels of an organization need high-quality information to run the business effectively. It supports the achievement of their operating, reporting, and compliance responsibilities

Question 26

What is inherent risk?

Answer 26

Inherent risk is the combination of internal and external risks in their pure, uncontrolled state. Said another way, inherent risk is the gross risk that exists assuming there are no internal controls in place.

Question 27

What is controllable risk?

Answer 27

Controllable risk is that portion of inherent risk that management can directly influence and reduce through day-to-day business activities.

Question 28

What is residual risk?

Answer 28

Residual risk is the portion of inherent risk that remains after mitigating all controllable risks.

Question 29

What does “limitations of internal control” mean?

Answer 29

Limits of internal control are the confines that relate to the limits of human judgment, resource con-straints and the need to consider the cost of controls in relation to expected benefits, the reality that breakdowns can occur, and the possibility of collusion or management override.

Question 30

How do entity-level controls differ from process-level and transaction-level controls?

Answer 30

Entity-level controls are very broadly focused and deal with the organizational environment or atmosphere. They are designed to directly mitigate risks that exist at the organizationwide level. Process-level and transaction-level controls, on the other hand, are more detailed in focus and are designed by process owners to mitigate risks that threaten processes, activities, tasks, and transac-tions.

Question 31

What is a key control?

Answer 31

A key control is designed to reduce key risks associated with business objectives. Failure to imple-ment adequately designed and effectively operating key controls can result in the failure of the organization not only to achieve critical business objectives but to survive.

Question 32

What is a secondary control?

Answer 32

A secondary control is designed to either 1) mitigate risks that are not key to business objectives, or 2) partially reduce the level of risk when a key control does not operate effectively. Secondary controls reduce the level of residual risk when key controls do not operate effectively, but are not adequate, by themselves, to mitigate a particular key risk to an acceptable level.

Question 33

What is a compensating control?

Answer 33

A compensating control is designed to supplement a key control that is either ineffective or cannot fully mitigate a risk or group of risks by itself to an acceptable level. Compensating controls also can back up or duplicate multiple controls and may operate across multiple processes and risks.

Question 34

What is the difference between a preventive and a detective control?

Answer 34

A preventive control is designed to deter unintended events from occurring in the first place. A detective control is designed to discover undesirable events that have already occurred.