M1 Internal Control Frameworks

Question 1

An independent private sector initiative that was initially established in the mid-1980s to study the factors that lead to fraudulent financial reporting

Answer 1

COSO (Committee of Sponsoring Organizations);

Sometimes referred to as the Treadway Commission

Question 2

to assist organizations in developing comprehensive assessments of internal control effectiveness

Answer 2

COSO - Internal Framework

Question 3

a process that is designed and implemented by an organization’s management, BOD, and other employees to provide reasonable assurance that the organization will achieve its operating, reporting and compliance objectives

Answer 3

Internal Control

Question 4

What are the 3 categories of objectives within the COSO framework?

Answer 4

ORC = Operating, reporting and compliance

Question 5

COSO objectives that relate to the effectiveness and efficiency of an entity’s operations as well as ensuring that the assets of the organization are adequately safeguarded

Answer 5

Opeartions (O in ORC)

Question 6

COSO objective that pertains to the reliability timeliness and transparency of an entity’s external and internal financial and nonfinancial reporting as established by regulators

Answer 6

Reporting (R in ORC)

Question 7

COSO objective that ensure the entity is adhering to all applicable laws and regulations

Answer 7

Compliance (C in ORC)

Question 8

What are the 5 components of internal control?

Answer 8

“CRIME” (Control Environment, Risk assessment, Information & Communication, Monitoring, Existing control activities)

Question 9

Component of internal control that includes the processes, structures and standards that provide the foundation for an entity to establish a system of internal control “tone at the top”

Answer 9

Control environment (EBOCA)

Question 10

What are the five principles related to the control environment (C in CRIME)

Answer 10

EBOCA - Ethics and integrity, Board independence, Organizational structure, Commitment to competence, Accountability

Question 11

component of internal control that is an entity’s identification and analysis of risks to the achievement of its objectives

Answer 11

Risk assessment (R in CRIME)

Question 12

What are the four principles related to risk assessment (R in CRIME)

Answer 12

SAFR (Specify objectives, identify and ASSESS Changes, consider potential for FRAUD, identify and analyze RISKS)

Question 13

Component of internal control that support the identification, capture, and exchange of information in a timely and useful manner

Answer 13

Information and Communication (I in CRIME)

Question 14

What are the 3 principles related to information and communication (I in CRIME)

Answer 14

OIE (Obtain and use information, Internally communicate information, and communicate with External parties)

Question 15

Component of internal control that is the process of assessing the quality of internal control performance over time by assessing the design and operation of controls on at timely basis and taking the necessary corrective actions

Answer 15

Monitoring Activities (M in CRIME)

Question 16

What are the 2 principles related to monitoring activities?

Answer 16

SO D

Ongoing and Separate evaluations, communication of Deficiencies

Question 17

Component of internal control set forth by an entity’s policies and procedures to ensure that the directives initiated by management to mitigate risks are performed

Answer 17

Existing control activities (E in CRIME)

Question 18

What are the three principles related to existing control activities (E in CRIME)

Answer 18

CA T P (select and develop Control Activities; select and develop Technology controls; deployment of Policies and Procedures)

Question 19

Represents a material IC deficiency or combination of deficiencies that significantly reduces the likelihood that an organization can achieve its objectives

Answer 19

Major deficiency

Question 20

Missed MC: According to COSO, a primary purpose of monitoring IC is to verify that the IC system remains adequate to address changes in

Answer 20

Risks

Question 21

Missed MC: Considers the manner in which management monitors and authorizes changes to a variety of IT matters including software application programs

Answer 21

Change control

Question 22

Missed MC: Which of the following components of IC integrated framework addresses an entity’s financial reporting objectives?

Answer 22

Risk Assessment