Corporate Governance Flashcards

Question

Control Environment

Answer 1

The control environment created by management sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. To foster an organizational culture based on integrity and ethical values, management should encourage and reward honesty; actively teach and practice integrity; establish policies that clearly and explicitly describe honest and dishonest behaviors, especially for uncertain (i.e., gray areas) or unclear issues such as conflicts of interest and accepting gifts; thoroughly investigate all dishonest acts; promptly dismiss and/or prosecute employees found guilty of dishonesty; and require employees to report any incidents of dishonest, illegal, or unethical acts and discipline employees who knowingly fail to report violations. Establishing an effective tone at the top is not related to adherence to fiscal budgets and goals. According to AU-C 315.A78, the control environment is as follows: The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.

Answer 2

The board of directors is the governing body of a corporation, elected by and accountable to the shareholders in a business. and has a Duty of Loyalty Duty of loyalty is a fiduciary obligation to place the interest of the corporation above personal interests. The Board of Directors should maintain an attitude of independence from top management in order to help with the checks and balances on the actions taken by the CEO and CFO. The Board is usually organized into committees to accomplish: a. setting up compensation for board members and corporate officers. b. establish and communicate a code of conduct. c. reviewing significant management decisions. d. designing and enforcing effective internal control procedures. e. managing internal and external audits.

Answer 3

Risk assessment is a systematic process of evaluating the potential risks that are involved in an audit or attestation engagement. Risk assessment is one of the five components of internal control and the second level of the COSO pyramid depicting the structure of internal control. It is the identification and analysis of the risks that an entity faces in achieving its objectives and the determination of how those risks will be managed. All entities face risks from both internal and external sources. To be able to perform a risk assessment, the entity must have established its objectives.

Answer 4

There are two types of risk. Inherent risk is the risk that exists before management takes any steps to control the likelihood or impact of a risk. Residual risk is the risk that remains after management reacts to the risk, such as by implementing internal controls. An internal control risk assessment has six steps and is performed as follows. Identify threats. Companies face the following types of threats: a. Strategic (doing the wrong things) b. Operating (doing the right things, but in the wrong way) c. Financial (financial resources are lost, wasted, or stolen; inappropriate liabilities are incurred) d. Information (incorrect input data, faulty or irrelevant stored information, an unreliable system, incorrect or misleading reports)

Answer 5

Estimate risk, which is a measure of how likely an error is to occur. Errors are more likely than fraud. Estimate exposure, which is a measure of the magnitude of an error. For example, there is a small risk of an earthquake, but the exposure is enormous if it destroys the information system.

Answer 6

To “identify and address changes” is part of change identification even on an ongoing basis.

Answer 7

a written policy and procedures manual that: (1) explains proper business practices. (2) documents how transactions and errors are to be processed and handled. (3) contains the chart of accounts. (4) contains example copies of forms and documents. (5) can be used to train new and existing employees.

Answer 8

Enforces Accountability.. High-level corporate executives should make individual departments or individuals responsible for specific business objectives or processes and then hold them accountable. They can do this with: a. formal job descriptions. b. a formal code of conduct that covers ethical behavior standards, conflicts of interest, acceptable business practices, and regulatory requirements. c. a written policy and procedures manual that: (1) explains proper business practices. (2) documents how transactions and errors are to be processed and handled. (3) contains the chart of accounts. (4) contains example copies of forms and documents. (5) can be used to train new and existing employees. d. employee training programs. e. operating plans, schedules, and budgets.

Answer 9

According to the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the internal control structure provides reasonable assurance that business objectives are achieved in three areas: operations, financial reporting, and compliance with applicable laws and regulations, which fits the answer choice “to maintain a safe level of carbon dioxide emissions during production.” OSHA regulations requiring a safe workplace cover the maintenance of a safe level of emissions to protect workers. The other answer choices refer to the COSO objectives of operating effectiveness/efficiency and financial statement reliability.

Answer 10

It expands on the elements of the internal control integrated framework and is much more comprehensive. The objective is to achieve all the goals of the control framework and help the organization to: a. attain reasonable assurance that company objectives and goals are achieved and problems and surprises are minimized, b. continuously assess risks and identify the appropriate action to take and the resources to allocate to overcome or mitigate risk, c. achieve its financial and performance targets, and d. avoid adverse publicity and damage to the entity's reputation.

Answer 11

There are eight components of COSO's ERM framework: 1. Internal environment. The people in a business and the environment in which they operate are the foundation for all other ERM components. 2. Objective setting. Management must put into place a process to formulate objectives in order to help the company assess and respond to risks. 3. Event identification. Certain events can affect the company's ability to implement its strategy and achieve its objectives. Management must identify these events and determine whether they represent risks or opportunities. 4. Risk assessment. Identified risks are evaluated to determine how they affect the company's ability to achieve its objectives and how to manage them. Both qualitative and quantitative methods are used to assess risks. 5. Risk response. Management can choose to avoid, reduce, share, or accept risks after careful analysis. 6. Control activities. To ensure that management's risk responses are effectively carried out, policies and procedures should be implemented. 7. Information and communication. Information about ERM components needs to be communicated through all levels of the company and with external parties. 8. Monitoring. ERM processes must be monitored, deficiencies reported to management, and modifications performed when required.

Answer 12

Internal auditors are required by the International Standards for the Professional Practice of Internal Auditing (set forth by the IIA, Institute of Internal Auditors) to assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement. Internal auditors do not act as management by implementing control activities. In fact, they are prohibited from doing so and must remain independent. Internal auditors cannot assess operations for which they have been responsible. They can evaluate internal control effectiveness They can evaluate internal control efficiency They can promote continuous improvement They CANNOT implement internal controls.

Answer 13

The four categories of entity objectives in the enterprise risk management framework are: strategic (high-level goals, aligned with and supporting the entity’s mission), operations (effective and efficient use of its resources), reporting (reliability of reporting), and compliance (compliance with applicable laws and regulations). The actual implementation of internal controls is not one of the entity objectives.

Answer 14

"Monitoring"of controls assesses the quality of internal control performance over time, including assessing the design and operation of controls on a timely basis and taking necessary corrective actions.

Answer 15

To define lines of authority, Organizational structures help no one unless they are well-defined. The structure helps define lines of authority, so an organization does not have too many people in management. This structure creates working relationships between the various employees in the organization.

Answer 16

uses same data again with the same software provides no new information.

Answer 17

Input validation is a control that improves the accuracy of data entry, but does not provide information about control effectiveness.

Answer 18

Giving assurance that the risks of the organization are properly evaluated. Evaluating the risk-management process. Coordinating ERM activities. In large organization the IA will report directly to BOD.