Corporate Governance

Question 1

What is the most true assessment of internal control objectives of information systems?

Answer 1

Internal control provides reasonable, not absolute, assurance. An IT system may have inherent risks and cost-benefit trade-offs.

Question 2

What are the five major components of an internal control system?

Answer 2

1. Control Environment
2. Risk Assessment
3. Information & Communication
4. Monitoring
5. Control Activities

Question 3

What is the most fundamental component of internal control?

Answer 3

Control Environment. Core or foundation of any system of internal control.

Question 4

What are the three main objectives of COSO?

Answer 4

1. Operations Objectives
2. Reporting Objectives
3. Compliance Objectives

Question 5

Describe operations objectives.

Answer 5

Pertains to effectiveness and efficiency of entity’s operations. Includes operational and financial performance goals and safeguarding assets.

Question 6

Describe reporting objectives.

Answer 6

Pertains to internal and external financial and non-financial reporting. Encompasses reliability, timeliness, transparency, and other terms set by regulators and standards.

Question 7

Describe compliance objectives.

Answer 7

Pertains to adherence of LAWS and regulations applicable to the entity.

Question 8

Organizational objectives relate to which fundamental component of internal control?

Answer 8

Risk assessment. Since objectives help to define the risks that are to be assessed.

Question 9

What are the three types of internal control deficiencies?

Answer 9

1. Control Deficiency (Least Serious)
2. Significant Deficiency
3. Material Weakness (Most Serious)

Question 10

According to COSO Internal Control Framework, when activities are outsourced to an outside party, are responsibilities transferred over?

Answer 10

No, responsibilities never transfer to outside party. Management is never relieved of internal control responsibilities.

Question 11

According to COSO, a primary purpose of monitoring internal control is to verify that the internal control system remains adequate to address changes in?

Answer 11

Risks. This is the primary purpose of monitoring internal control.

Question 12

COSO indicates that evaluators monitoring internal controls must have two qualities?

Answer 12

Competence & Objectivity.

Question 13

What is a compensating control?

Answer 13

A control that accomplishes the same objective as another control.

Question 14

Which component of COSO is designed to ensure that internal control are continuing to operate effectively?

Answer 14

Monitoring. It is core, underlying control component in the COSO ERM model. Ensuring that internal controls continue to operate effectively is the primary purpose of monitoring.

Question 15

What is direct information?

Answer 15

Info that directly substantiates the operation of controls and is obtained by observing them or performing them in operation. Highly persuasive. Monitor more important risks using direct info.

Question 16

What is indirect information?

Answer 16

Relevant information to assess if controls are operating effectively and risk is mitigated. Not provide explicit evidence if controls are operating effectively. Monitor less important risks w/ indirect information.

Question 17

What are four parts of monitoring for change continuum in order?

Answer 17

1. Establish control baseline - Initial assessment to gain understanding of controls and risk. Baseline understanding of control effectiveness.
2. Identify changes - Ongoing monitoring and separate evaluations to identify & address potential changes in control effectiveness.
3. Change management - Verify controls remain effective despite identified changes in controls.
4. Revalidate Control Baseline - When monitoring procedures use highly persuasive information. Conclude controls are effective to maintain control baseline. When using less persuasive information, monitoring will need to revalidate control operation through separate evaluations using persuasive info.

Question 18

The materials manager of a warehouse is given a new product line to manage with new inventory control procedures. Does this impact control baseline and change management?

Answer 18

Yes, this is substantial change so it will effect both control baseline and change management.

Question 19

Describe methods for reviewing control processes.

Answer 19

1. Reviewing process - flowcharts, and control documentation
2. Benchmarking assessments - Comparing organization controls w/ best practices
3. Questionnaires
4. Focus groups and interviews

Question 20

What are the three parts of COSO model: control Monitoring Process?

Answer 20

1. Establish a foundation for monitoring - tone at the top, organizational structure.
2. Design and execute monitoring procedures. Focused on persuasive info about operation of key controls. Prioritize and address meaningful risk to organization.
3. Assess and report control evaluation results. Prioritize findings, report results to appropriate level, and take corrective action.

Question 21

What is change control?

Answer 21

Process used to request, review, specify, plan, approve, implement, and monitor change to a system.

Question 22

1. Evaluating internal controls procedures in the primary responsibility of who?
2. Designing or implementing control procedures is primary responsibility of who?

Answer 22

1. Internal audit staff reporting to Board of Directors.

2. Accounting management who reports to CFO.

Question 23

Describe continuous, self, and supervisory monitoring.

Answer 23

1. Continuous - A computer system that frequently monitors controls.
2. Self - A human monitoring himself
3. Supervisory - A human supervisor monitoring controls.

Question 24

A change control process should include several things such as?

Answer 24

Change request forms, approval process for changes, and appropriate documentation.

Question 25

List reasons why COSO control systems fail.

Answer 25

1. They are not designed or implemented properly.
2. They are properly designed but environmental changes overrides them and make them ineffective.
3. They are properly designed but the way they operate has changed making them ineffective.

Question 26

According to COSO, the use of ongoing and separate evaluations to establish a new baseline after changes have been made can best be accomplished in which of the following stages of the monitoring-for-change continuum?

Answer 26

Change management. stage involves evaluating the design and implementation of changes and establishing a new baseline.

Question 27

What is a limitation for all control systems no matter how effectively designed/implemented they are?

Answer 27

Management override of controls

Question 28

Which COSO component is related to proper measurement of transaction?

Answer 28

Information and communication