Chapter 7 Flashcards
A risk-based auditing approach is deemed to be a top-down approach because
Select one:
A. It involves review of each department’s dependence on financial controls, compliance with federal statutes and audit history.
B. It involves identifying and analyzing material risks to the achievement of the organization’s objectives and then determining how the risks should be managed.
C. It involves an external review of known potential threats to the organization and then developing an organizational response to those threats.
D. It involves review of the current financial controls and compliance to regulations as determined by external auditors
B. It involves identifying and analyzing material risks to the achievement of the organization’s objectives and then determining how the risks should be managed.
One internal control integrated framework consists of five essential components: the control environment, risk assessment, control activities, information and communication, and monitoring activities. When these components are applied across the organization, they create a “cube.” This framework is the
Select one:
A. Financial Accounting Standards Board’s (FASB’s) Internal Control Standard.
B. International Organization for Standardization’s (ISO’s) framework.
C. Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) framework.
D. Institute of International Auditors (IIA) International Standards for the Practice of International Auditing.
C. Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) framework.
Colossal Casualty Insurance Company decided to conduct an internal audit of the company’s operations. As part of the internal audit, several fictitious claims were submitted to the claims department to see if the claims would be approved and paid. Which one of the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) components of internal control was examined by this internal audit test?
A. Monitoring activities.
B. Risk assessment.
C. Information and communication.
D. Control environment.
D. Control environment.
Which one of the following best describes why the Institute for Internal Auditors (IIA) has designed standards addressing the need for internal audit to evaluate the effectiveness of risk management?
Select one:
A. Audits may be self-serving to an organization depending on the experience level of an auditor. By indicating specific criteria, an auditor should be able to conduct a valid audit.
B. Audits are objective and independent of the politics of an organization. A pronouncement assists the auditor by defining review criteria.
C. Audits are conducted under diverse legal and cultural environments. Requiring an auditor to validate particular points ensures that auditors and their activities meet their responsibilities.
D. Audits are conducted annually in many organizations. Requiring an auditor to validate the findings of prior years provides a comfort level to stakeholders.
C. Audits are conducted under diverse legal and cultural environments. Requiring an auditor to validate particular points ensures that auditors and their activities meet their responsibilities.
The Auditing Standard No. 5 (AS 5) calls for a specific fraud assessment because
Select one:
A. Fraud within an organization remains the most serious threat to the economic well-being of society.
B. The failure to prevent or detect fraudulent misstatements is higher than the risk of failing to prevent or detect other types of errors.
C. Of the financial scandals of the late twentieth century; there is now an obligation to detect fraud.
D. Failure to detect fraud through regular transactions in an organization remains the highest risk.
B. The failure to prevent or detect fraudulent misstatements is higher than the risk of failing to prevent or detect other types of errors.
Which one of the following statements is true with regard to the application of emerging technologies such as artificial intelligence and machine learning to internal auditing of an organization?
Select one:
A. There should be no improvement given that the same practices are subject to internal audit with or without the application of emerging technology.
B. Deviations from desired practices and procedures will be more quickly identified by emerging technologies, and auditors can focus on designing and implementing new systems.
C. Although such techniques are applicable to the risk management function, they are not applicable to internal audit.
D. While the application of such technologies may be beneficial, the cost of implementation makes the use of emerging technologies unrealistic.
B. Deviations from desired practices and procedures will be more quickly identified by emerging technologies, and auditors can focus on designing and implementing new systems.
Which one of the following best describes an effective way to construct internal controls?
Select one:
A. The controls should be system based with oversight by one or two individuals.
B. The controls should lend themselves to true risk management concerns.
C. The controls should be quantitative and include segregation and transfer options.
D. The controls should be linear and create checks and balances.
D. The controls should be linear and create checks and balances.
Which one of the following best describes if it is within the scope of duties for an internal auditor to assist the company’s enterprise risk management (ERM) program?
Select one:
A. It is not within the scope. Assisting the ERM program is outside of the functions of internal audit and can compromise the objectivity of internal audit.
B. It is within the scope. Assisting with the management of key risks, including effectiveness of controls lend support to the ERM program.
C. It is within the scope. Assisting with implementation of new controls and providing feedback on controls will lend support to the ERM program.
D. It is not within the scope. Assisting with review of key risks, identification and evaluating risks compromises the overall functions of internal audit.
B. It is within the scope. Assisting with the management of key risks, including effectiveness of controls lend support to the ERM program.
Many banks are using technology to search for and detect cyber-security threats locally and in the cloud. This application of technology, in which machines learn from humans, illustrates the use of
Select one:
A. Risk management information systems.
B. Artificial intelligence.
C. Data analytics.
D. Machine learning.
B. Artificial intelligence.
Cheryl Babson works in internal control at Software Company. She contacted company security and asked them to immediately go to the office of a software engineer and to detain him. As part of the internal control process, Cheryl had scanning software installed at the company that randomly searched all e-mails and text messages sent from on-site, searching for key words. The scanning software detected the words: “gun,” “bomb,” “revenge,” and “kill” in communications sent from the engineer’s office. Company security found a loaded assault rifle, two loaded handguns, and a pipe bomb in the engineer’s office. He confessed to planning a workplace attack at the company cafeteria later that day. The emerging technology Cheryl deployed is called
Select one:
A. Radio frequency identification.
B. Computer simulation.
C. Data analytics.
D. Natural language processing.
D. Natural language processing.
Which one of the following best describes how internal audit compliments a risk management initiative?
Select one:
A. Risk managers identify, assess and prioritize risks. Internal audit develops a risk-based auditing plan that addresses material risks to an organization.
B. Risk managers identify, assess and prioritize risks with the assistance of internal audit. Internal audit requires that the controls for the risks are tested.
C. Internal audit tests controls for risks identified by risk managers. Risk management and internal audit are similar in that they are both charged with protecting the assets of an organization.
D. Internal audit tests the controls initiated by the risk management team. The risk management team reviews the results and responds to internal audit on the control assessment.
A. Risk managers identify, assess and prioritize risks. Internal audit develops a risk-based auditing plan that addresses material risks to an organization.
It is necessary to define functions that should be performed by internal audit rather than the enterprise risk management (ERM) team because
Select one:
A. Internal audit and risk managers share responsibilities for governance and compliance for the organization.
B. ERM is all encompassing and if not controlled will absorb internal audit functions.
C. The Institute of Internal Auditors (IIA) guidelines are used to avoid confusion in an organization and clarify financial compliance issues.
D. Clarification of functions helps avoid redundancy and foster a strong working relationship.
D. Clarification of functions helps avoid redundancy and foster a strong working relationship.
Developing a risk-based audit plan requires a risk assessment. Under the model of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework, which one of the following explains how risk assessment is addressed?
Select one:
A. It is essentially the same as the traditional model, but is codified in steps that are reported.
B. It expands the risk assessment concept by comparing it to competitor audits.
C. It is narrower and it provides concrete steps which are recommended and differ by industry.
D. It expands the risk assessment concept by identifying five interrelated components of internal control.
D. It expands the risk assessment concept by identifying five interrelated components of internal control
Preventive controls assist the overall control environment of an organization by
A. Reducing risk of unauthorized actions.
B. Comparing different sets of data and investigating any differences.
C. Detecting errors or inconsistencies after they occur.
D. Addressing reconciliation of accounting errors.
A. Reducing risk of unauthorized actions.
Martin Pruitt was hired by Regional Bank Company (RBC) to strengthen the company’s internal control efforts. Martin implemented a computer scanning program to detect fraud. The scanning program flagged a suspicious account. When Martin investigated the account, he learned that someone in the bank’s technology department had created the account. When the bank credits monthly interest on depositor accounts, any fractional cents are rounded-down to the nearest cent. The technology department official programmed the system so that any fractional cents lost due to rounding were deposited to the account owned by the technology department official. The scanning program Martin Pruitt implemented used computers to learn from the data analyzed. This application of emerging technology illustrates the use of
Select one:
A. Computer simulation.
B. Machine learning.
C. Artificial intelligence
B. machine learning
