Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Internal Auditing > Internal control > Flashcards

Internal control Flashcards

1
Q

Why does management uses strategic plan?

A

As point of departure in developing organisational operational direction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define structure

A

The way in which the organisation or elements thereof, is arranged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define policy

A

Guideline or statement of position with respect to a given topic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define process

A

Big picture of what must be done

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define procedure

A

A fixed, step by step sequences of activities or course of action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define system

A

A tool(s) used to facilitate the procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define law

A

National legal requirement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define regulation

A

Additional guidance and rules - based documentation for a specific need

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

True or False

Internal auditors need a sound understanding of organisational structure term and application within the engagement client’s environment.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who is responsible to ensure governance, risk management and control are established within the organisation to meet business and stakeholders needs.

A

Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The performance standards describe which internal audit service?

A

The nature of work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does the nature of work of internal audit work/service consist of?

A
  • organisational terms
  • standards (GRC)
  • definition of control
  • objectives of control
  • COSO framework
  • responsibility for internal control
  • advantages and disadvantages
  • controls in IT environment`
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Explain 2100 Nature of work

A

The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach. Internal audit credibility and value are enhances when auditors are proactive and their evaluations offer new insight and consider future impact.
The nature of work of IAA consists mainly of providing assurance and consulting services on governance, risk management and control processes, or related fields.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

State 2110 Governance

A

The IAA must assess and make appropriate recommendations to improve the organization’s governance processes for:
- making strategic and operational decisions
- overseeing risk management and control
- promoting appropriate ethics and value within the organization
- ensuring effective organizational performance management and accountability
- communicating risk and control information to appropriate areas of the organization
- coordinating the activities of, and communicating information among, the board, external and internal auditors, other assurance providers, and management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Disclose 2110. A1 Governance

A

The IAA must evaluate the design, implementation and effectiveness of the organization’s ethics-related objectives, programms, and activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

State 2110. A2

A

The IAA must assess whether the IT governance of the organization sustains and supports the organization’s strategies and objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

State 2120 Risk management

A

The IAA must evaluate the effectiveness and contribute to the improvement of risk management processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How should 2120 risk management be interpretated?

A

Judgement results from assessment:
- organizational objectives support and align with the organization’s mission
- significant risks are identified and assessed
- appropriate risk responses are selected that align risks with the organization’s risk appetite
- relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How is risk management processes monitored according to 2120 risk management interpretation?

A

Through ongoing management activities, separate evaluations, or both

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

State 2120.A1

A

The IAA must evaluate the adequacy and effectiveness of controls in responding to risks within the organization’s governance, operations, and information systems, regarding the:
- achievement of the organization’s strategic objectives
- reliability and integrity of financial and operational information
- effectiveness and efficiency of operations and program
- safeguarding of assets
- compliance with laws, regulations, policies, procedures, and contracts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

State 2120.A2

A

The IAA must evaluate the potential for the occurrence of fraud and how the organization manage fraud risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Explain 2130 control

A

The IAA must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is control aim according to 2130 control?

A

To support the organisation in the management of risks that threaten the achievement of its objectives and should amongst others, ensure:
- financial and operational information is reliable and possesses integrity
- operations are performed efficiently and achieve established objectives
- assets are safeguard
- actions and decisions of the organization are in compliance with laws, regulations and contracts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the CAE role according to 2130 control?

A

Should form an overall opinion on the adequacy and effectiveness of the control processes by considering whether significant discrepancies or weaknesses were discovered, corrections or improvement were made after the discoveries, and the discoveries and their potential consequences led to a conclusion that a pervasive condition exists resulting in an unacceptable level of risk.
The IA plan should make provisions for the evaluation of the adequacy and effectiveness of the organization’s control processes. The CAE should report at least once a year on the organization’s control processes to senior management and the board

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is internal control according to COSO?

A

Is a process, affected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is internal control according to IPPF?

A

Any action taken by management, the board and other parties to manage risk and increase the likelihood that established objectives and goal will be achieved. Management plans, organises and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is internal control according to SAICA?

A

Internal control measures are those methods and procedures which have been accepted by the management of an entity to help in the achievement of management’s goal to ensure that the business of the entity is properly conducted in an orderly and efficient manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the general assumption about internal control derived from all of regulatory bodies?

A
  • Control is either a process or action taken
  • Management is responsible for implementing internal control, but other parties may also be involved
  • Controls are implemented to minimise risks, thus ensuring that an organization’s objectives are met. However, only reasonable assurance in the minimization of risks and the achievement of objectives can be provided by effective internal controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does COSO standard for?

A

Committee of Sponsoring Organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Explain the COSO framework?

A

The framework incorporates all the essential aspects that need to be present in order to implement an effective and efficient internal control structure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

State the COSO control framework components

A
  • Monitoring
  • Information and communication
  • Control activities
  • Risk assessment
  • Control environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which COSO control framework component is the foundation and provides the atmosphere in which people conduct their activities and carry out their control responsibilities in the organization?

A

The control environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Disclose the various elements of control environment

A
  • The philosophy and style of senior management
  • The organizational structure (hierarchy)
  • Methods used to communicate tasks and responsibilities to personnel
  • Human resources management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What does the control environment represent?

A

The collective effect of various factors on establishing, enhancing, or mitigating the effectiveness of specific policies and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Where does the control environment have direct influence?

A

The way activities are structured, objectives are established and risk is addressed, and therefore affects the control consciousness of people performing their day to day activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Disclose the fundamental management principles of philosophy and style of senior management elements

A
  • Planning
  • Organising
  • Directing
  • Controlling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What does planning included according to the philosophy and style o senior management?

A

Establishing objectives, developing strategies, determining policies and procedures, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Explain organising in terms of philosophy and style of senior management

A

The coordination of people and plans in order to execute the planning.

39
Q

What does organizing include according to the philosophy and style of senior management?

A

Responsibility, authority, delegation, decentralization, committees, and structure

40
Q

Explain directing in terms of Phy and style of SM

A

The process of allocating resources to ensure objectives are met.

41
Q

What does directing include in terms of phy and style of SM?

A

Elements of leadership, motivation and communication

42
Q

Discuss controlling in relation to phy and style of SM/

A

The process of ensuring that the directed actions have been executed as planned to ensure that objectives are achieved

43
Q

Which factors should internal auditors consider that might influence the risk with reference to the philosophy and operating style of management?

A
  • a single person dominating the operating and financial decisions making process
  • aggressive management in an environment of poor internal control activities
  • a high turnover of management
  • an unduly aggressive approach of management to financial reporting
  • management having a poor reputation in the business community
  • management placing excessive emphasis on obtaining profit forecasts
  • a significant part of remuneration of management being based on operating results
  • pressure on management
  • future existence of the org resting on obtaining finance from outside sources
44
Q

True or false

The integrity and ethical value of SM don’t play an important part in phy and style.

A

False

45
Q

True or false

Understanding the concept of integrity and ethical standards might be easy as well as the application of the concept

A

False

Understanding the concept of integrity and ethical standards might be but the application of the concept can be complicated exercise

46
Q

What is the most effective way to transmit a message of ethical behaviour?

A

By example, as a personnel are likely to develop the same attitudes about what is right and what is wrong as those shown by SM

47
Q

True or false

Senior management should communicate the organization’s values and behavioural standards to personnel

A

True

48
Q

True or false

Communicating ethical values by way of an impressive document does ensure that they are being followed

A

False

Communicating ethical values by way of an impressive document does not ensure that they are being followed

49
Q

Management must act on violations of the code of conduct, as messages sent by their actions in these situations quickly becomes embodied in the organizational culture.

How is this achieved?

A
  • Penalties for personnel who violate the code
  • mechanisms to encourage personnel report suspected violations
  • disciplinary actions against personnel who fail to report violations
50
Q

What does the organization’s hierarchical structure overall framework provide?

A

Planning, organizing, directing and controlling operations

51
Q

What factors should be taken into consideration when evaluating the organizational structure?

A
  • The organizational structure should be suitable for the type of org
  • ## grouping of activities
52
Q

What should be considered when forming an organizational structure?

A

The form and nature of an organization’s business units, related management functions and reporting relationships

53
Q

What are the ideal effect of the organizational structure?

A

The organizational structure should be able to provide the necessary information to the managers enable them to manage the organization

54
Q

Explain grouping of activities

A

In the functional approach, the org is structured along the lines of the major functions such as production, marketing, personnel and finance.
The benefits of specialized concentration of authority that flows down through the various organizational values.
The disadvantage is that key decisions must be coordinated made at the top, restricting the possibility of more urgently needed responses at field level

55
Q

State the factors that should be considered when discussing methods used to communicate tasks and responsibilities to personnel

A
  • organizational policy regarding such matters as acceptable business practices, conflicts of interest and other code of conduct
  • assignment of responsibility and delegation of authority to deal with such matters as organizational goals and objectives, operating functions and regulatory requirements
  • job descriptions delineating specific duties, reporting relationships, and constraints
  • computer system documentation indicating the procedures for authorising transactions and approving systems changes
56
Q

Its important for internal auditors to realize that personnel can only execute their duties if they know what is expected of them.

State the methods to communicate these authorities and responsibilities.

A
  • an organizational code of conduct
  • memorandums from SM, setting out the importance of control related activities
  • formal organizational and operational plans
  • a manual on accounting policies and procedures
  • an organizational chart
  • job descriptions
  • clear boundaries of authority
57
Q

What does the human resources management affect?

A

The organization’s ability to appoint adequate, competent personnel in order for the organizations to achieve its objective

58
Q

What does the humans resources management include?

A

The rules of the org regarding the appointment, training, evaluation, promotion and remuneration of personnel, and the supply of sufficient resources to the personnel which they may need in order to carry out their responsibilities

59
Q

Personnel practices can be categorised how in terms of human resources management?

A
  • The appointment and evaluation of personnel
  • personnel scheduling
  • regular rotation of duties, within limits
  • career path possibilities
  • the formalisation of personnel practices
  • exercising psychological control by striving to maintain a high morale amongst personnel
60
Q

Explain the appointment and evaluation of personnel in terms of human resources management

A

When appointing personnel, a formal evaluation process should be followed. Personnel should be evaluated periodically to determine their progress and to identify opportunities for further training

61
Q

Explain personnel scheduling in terms of human resources

A

Regular scheduling of personnel in respect of task should take place. Also, he assignment of personnel’s tasks and duties should take the annual leave of personnel into consideration

62
Q

Explain regular rotation of duties, within limits

A
  • Combat fraud
  • Allow for the alternation in tasks to be promoted, rotation of duties should be implemented
  • Rotation of duties should be applied with great caution, as personnel must have the necessary level of training in order to perform the various tasks and not to create any further opportunity for fraud to take place
63
Q

Explain career path possibilities

A

Clear career path possibilities must be made known to the personnel in order to create promotion possibilities

64
Q

Explain the formalization of personnel practicess

A

Personnel practices should be contained in a formal document so that personnel are made aware of intolerable practices

65
Q

Explain exercise psychological control by striving to maintain a high morale amongst personnel

A

Management may not be responsible for the psychological well being of every individual in the work place but the way personnel are treated, can all play an important role in the morale amongst personnel

66
Q

Disclose the classifications of internal control activities

A
  • Preventative controls
  • Detective controls
  • Corrective controls
67
Q

Explain preventative controls

A

When built into a system, preventative controls forestall errors and thereby avoid the cost of correction.
Most cost-effective than other controls

68
Q

What are included in preventative controls?

A
  • trustworthy, competent people
  • segregation of duties to prevent intentional wrongdoing
  • proper authorization to prevent improper use of organizational resources
  • adequate documentation and records as well as proper record keeping procedures to deter improper transactions
  • a physical control over assets to prevent their improper conversion or use
69
Q

Explain detective controls

A
  • usual more expensive than preventative control
  • measure the effectiveness of the preventative controls
  • some errors cannot be effectively controlled through system of preventation, they must be detected when they occur.
  • detection include reviews and comparisons
70
Q

Explain corrective controls

A
  • take over when improper outcomes occur and are detected
  • documentation and reporting structures keep problems under management surveillance until they have been solved or the defect corrected
  • correction close the lop that starts with prevention and passes through detection to correction
71
Q

State the general types of internal control activities

A
  • segregation of duties
  • proper authorization of transactions and activities
  • adequate documents and records
  • safeguarding of assets and information
  • independent checks
72
Q

What is the principle purpose of segregation of duties?

A

To reduce the opportunities for an individual to make and then conceal errors or irregularities while performing a task.

73
Q

How can segregation of duties be achieved?

A

*No individual should be responsible for more than one of the following?
- authorising the transactions
- recording the transactions
- executing the transactions or having custody of assets

74
Q

True or false

An individual is less likely to attempt to commit an irregularity if they must obtain another personnel member’s consent

A

True

75
Q

Why should the personnel responsible for recording transactions should not also have the responsibility for authorising the transactions?

A

The org wants yo ensure that only valid authorised transactions take place.
If the personnel member responsible for recording may authorise a transaction, they could create and authorise fake transactions, in order to balance the accounts

76
Q

Why should personnel who have access to or control physical assets should not be able to authorise transactions?

A

The same person should not be able to authorise a payment to a supplier and sign the cheque, as the money in the bank is a form of asset

77
Q

Should there be a segregation of custody of assets from the recording function?

A

Yes, to prevent the personnel member from disposing of asset for personal gain and then adjusting the records to cover the fraudulent action

78
Q

True or false

Every transaction must be properly authorised and any transaction should be executed and recorded if controls are to be satisfactory

A

False

Every transaction must be properly authorised and only valid transaction should be executed and recorded if controls are to be satisfactory

79
Q

Explain the distinction between authorization and approval

A
  • General authorization : management establishes policies for the org to follow. The policies and procedures required for authorising transactions are often documented in a manual.
  • Specific authorization has to do with individual transactions. These are normally more significant transactions and require authorization from a higher level of management
80
Q

Discuss adequate documents and records

A
  • Source documents should be:
  • sequentially pre-numbered to facilitate control over completeness of recording, unused/ missing documents
  • prepared at the time the transation takes place to increase the likelihood of accurately recording details of the transaction
  • designed to obtain sufficient details, in certain order, to fulfil business and accounting needs
  • sufficiently simple to complete to ensure that they are understood and accurately completed
  • have space for signature(s) to identify responsibility for the preparation and/or authorization of the document
  • be designed for multiple use, whenever possible, to minimise the number of forms and the times the information must be copied. Here multiple coloured copies work well
81
Q

Explain safeguarding of assets and information

A

Asset, accounting records and other information and documentation must be physically protected and there should be limited access to these. The use of physical precautions has proved to be effective safeguarding for assets.
Providing off sufficient insurance is another form of safeguarding the assets.

82
Q

Explain independent reviews

A

Is the careful and continuous review of the other 4 control activities by independent senior management and IA.
Personnel are likely to forget or intentionally fail to follow procedures, / become careless unless someone observes and evaluates their perfomance.

83
Q

What is an essential characteristics of the person(s) performing internal verification activities? (Independent reviews)

A

Is independence from the individuals originally responsible for preparing the data

84
Q

State the internal control responsibility of management

A

Management designs and implement control activities and is accountable to the board in this regard. Management has to keep in mind the objectives of internal control when designing an internal control structure.

85
Q

What is the external auditors internal control responsibility?

A

To express an opinion on the reasonableness of financial statements. When performing a financial audit, they only exam these controls that relate to the financial statements, therefore, the focus is on the evaluation of financial records, accounting systems and related internal controls

86
Q

What is the internal control responsibility of internal auditors?

A
  • The internal audit activity should assist the organisation in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement.
  • Internal auditing must identify what nay go wrong, preventing the org from achieving its objectives, and whether the controls in place will prevent these from occurring, before it can assess the effectiveness of the control implemented by management
87
Q

State the advantages of internal control

A
  • Internal control can assist an org to:
  • achieve its goals for profitability and outputs
  • prevent resource losses
  • promote reliable financial reporting
  • ensure compliance with legislation and regulation
  • prevent the reputation of the org becoming tarnished and the related results
88
Q

State the disadvantages/limitations of internal control

A
  • Internal control cannot do either of the following:
  • Ensure an org’s success
  • Ensure the reliability of financial reporting and compliance with legislation and regulations
89
Q

Why cannot internal controls ensure an org’s success?

A

Cannot change management from bad to good.
Factors such as government policy and economic factors are beyond the scope of internal control activities

90
Q

Why cannot internal controls ensure the reliability of financial reporting and compliance with legislation and regulations

A
  • Certain limitations are inherent to all structures of internal control, such as:
  • faulty judgement being applied in the decision making process
  • ordinary errors being made
  • collusion between two or more persons invalidating the structure of internal control
  • management having the ability to override the structure
  • the design of a system of internal control being limited by available resources, so that the advantages arising from the control have to be compared to the cost
91
Q

State the two divisions of IT control

A
  • General controls
  • Application controls
92
Q

Define general controls (IT controls)

A

As having pervasive effects, meaning that they are weak or absent, they may negate the effects of the application controls.
These controls are not software specific, and control the environment in which system and application software operates

93
Q

What does general controls include?

A
  • organisational controls related to IT personnel
  • standard operating procedures for systems
  • system documentation controls
  • system development and program change controls
  • hardware and software controls
  • security controls related to IT
94
Q

Explain application controls (IT controls)

A

Relates to specific software programs and systems in the org.
These controls are designed to ensure completeness, accuracy, authorization and validity of data captured and processed.
Edit checks are checks (controls) programmed into a system or software program to ensure that errors in data will be detected.
Application controls are divided into input, processing and output controls.

Internal Auditing (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions