MISTAKES FROM RUNNING REVIEW TEST B1-B2 Flashcards
Prioritize findings is part of________________ phase of monitoring internal controls
assess and report phase
Tone at the top is part of the______________________ of the integrated framework
control environment component
Identify controls is a part of the ________________________component of the integrated framework
Control Activities
Prioritize risks occurs in the _____________________ component of the integrated framework.
Risk Assessment
Findings occur as a result of ________________________.
monitoring internal controls
According to COSO’s enterprise risk mgmt framework:
A “commitment to core values” is an essential element and one of the principles underlying __________________ established as part of ERM.
governance and culture
Which of the following is not a goal of an Enterprise Risk Management framework
(ERM)?
A. Avoid adverse publicity and damage to the entity’s reputation.
B. Achieve financial and performance targets.
C. Provide reasonable expectation that company objectives and goals are
achieved and problems and surprises are minimized.
D. Assess risks continuously and identify the steps to take and resources to
allocate to overcome or mitigate risk.
Choice “A” is correct. Avoiding adverse publicity and damage to the entity’s reputation is a public relations function, not a function of ERM.
Choice “B” is incorrect. ERM focuses on numerous goals including achievement of
financial and performance targets.
Choice “C” is incorrect. ERM focuses on numerous goals including providing reasonable
expectation that objectives and goals are achieved.
Choice “D” is incorrect. ERM focuses on numerous goals including risk assessment and mitigation
Which of the following would be considered a detective control over standing data?
A. Access and authorization control
B. Change control
C. Reconciliation of changes to the data
D. Read-only rights
Choice “C” is correct. Periodic reconciliation of changes to the data is considered a
detective control because it reviews changes. This control helps to verify that any changes made to the data follow the established policies and procedures, including appropriate review and approval.
Choices “A”, “B”, and “D” are incorrect. All these controls are considered preventive
controls.
According to COSO, which of the following identifies the group directly responsible for the implementation and development of the enterprise risk management framework?
A. External auditors
B. The board of directors
C. Management
D. Internal auditors
Choice “C” is correct. It is incumbent on management to determine how the inevitable risks that an entity faces must be balanced with the desire to grow stakeholder value. Management is responsible for developing and implementing the enterprise risk
management framework and process
Choice “A” is incorrect. External auditors will come in to evaluate the risk management process, along with internal controls and many other operational and reporting functions. External auditors are not tasked with developing and implementing an entity’s risk management framework.
Choice “B” is incorrect. The board of directors is responsible for the oversight of
management, which includes assessing the work it is doing from an enterprise risk
management standpoint and holding management accountable for its work.
Choice “D” is incorrect. Internal auditors are employees of an entity who serve to
operate similarly to external auditors from an evaluation standpoint; they are not
tasked with developing and implementing a risk management framework
The ability of an entity to withstand the impact of large-scale events refers to:
A. Risk capacity.
B. Risk inventory.
C. Risk profile.
D. Organizational sustainability.
Choice “D” is correct. Organizational sustainability is the ability of an entity to
withstand the impact of large-scale events
Choice “A” is incorrect. Risk capacity is the
maximum amount of risk that an entity is able to absorb in the pursuit of strategy and business objectives
Choice “B” is incorrect. Risk inventory is all risk that could impact an entity
Choice “C” is incorrect. . Risk profile is the composite view of the risk assumed at a particular level of the entity or aspect of the business that positions management to consider the types, severity, and interdependencies of risk and how they may affect performance relative to the strategy and business objectives.
Generally, an organization will not operate beyond the limits of its risk appetite. Risk
appetite has generally been exceeded when:
A. The likelihood and impact of positive events are significantly below residual
risk.
B. The likelihood and impact of positive events are within the residual risk.
C. The likelihood and impact of negative events significantly exceed residual
risks.
D. The likelihood and impact of negative events exceed residual risks.
Choice “C” is correct. Generally, an organization’s risk appetite has been exceeded when the combined likelihood and impact of negative events significantly exceed residual risk. Residual risk represents the risk that remains after management has taken actions to mitigate negative events. If the likelihood and impact of those negative events significantly exceed the residual risk, the operation is likely to exceed the organization’s risk appetite.
COSO’s enterprise risk management framework encompasses each of the following,
except:
A. Enhancing risk response decisions.
B. Decreasing inherent risk appetite.
C. Seizing opportunities.
D. Improving deployment of capital.
Choice “B” is correct. Inherent risk is the risk that exists to an entity when management takes no action to alter the severity of the risk. Decreasing a company’s inherent risk appetite is not a component of ERM. Managing risk such that it aligns with risk appetite is an appropriate component of the framework.
Choice “A” is incorrect. Enhancing risk response decisions is a critical component of the enterprise risk management framework.
Choice “C” is incorrect. A company developing a framework that will allow it to take advantage of opportunities as they arise is included in an enterprise risk management framework.
Choice “D” is incorrect. Improving the deployment of capital, while taking into account potential risks, is a key component of the framework.
According to the COSO, the presence of a written code of conduct provides for a
control environment that can:
A. Encourage teamwork in the pursuit of an entity’s objectives.
B. Override an entity’s history and culture.
C. Verify that information systems are providing persuasive evidence of the
effectiveness of internal controls.
D. Ensure that competent evaluators are implementing and monitoring internal
controls.
Choice “A” is correct. A written code of conduct helps management set the tone for the organization; its existence promotes (among other things) honest/ethical conduct, teamwork, compliance, and appropriate disclosure.
Choice “B” is incorrect. Overriding history and culture definitely is not the intent of
having a code of conduct.
Choice “C” is incorrect. Information systems are addressed independently, outside of a
written code of conduct.
Choice “D” is incorrect. A code of conduct will not help to ensure that a company has
competent evaluators implementing and monitoring internal controls.
Using the statistical ranking methodology, how are the risks ordered?
From largest to smallest.
Note: Severity * likelihood % = item risk
Order from riskiest (largest #) to least risky (smallest #).
A threat to an information system with a total potential dollar-loss impact of $7 million has been discovered. The risk of loss to the identified threat is currently 10 percent. The following four proposed controls are under consideration to mitigate the risk of loss:
Cntrl Nme / Rsk of Loss /Implementation Cost
W 8% 100,000
X 6% 250,000
Y 4% 350,000
Z 2% 500,000
Based on a cost-benefit analysis, which control provides the greatest net benefit?
A. Control W
B. Control Z
C. Control Y
D. Control X
Choice “C” is correct. In the Enterprise Risk Management framework, the assessment of the severity of risk is contained within the performance component. Assessing risk severity includes the likelihood of the risk occurring and the impact if it does occur.
Each of the four proposed controls identified in this question will help reduce the risk of loss from 10 percent to a lower number. The net benefit calculation involves comparing the benefit from a lower risk of loss to the cost associated with implementing the
control.
* Control W: $7 million × (10% − 8%) = $140,000 benefit
$140,000 benefit − $100,000 cost = $40,000 net benefit
* Control X: $7 million × (10% − 6%) = $280,000 benefit
$280,000 benefit − $250,000 cost = $30,000 net benefit
* Control Y: $7 million × (10% − 4%) = $420,000 benefit
$420,000 benefit − $350,000 cost = $70,000 net benefit
* Control Z: $7 million × (10% − 2%) = $560,000 benefit
$560,000 benefit − $500,000 cost = $60,000 net benefit
Of the options provided, Control Y provides the highest net benefit at $70,000.
Choice “A” is incorrect. Control W’s net benefit of $40,000 is not as high as the net
benefits for either Control Y or Control Z.
Choice “B” is incorrect. Control Z’s net benefit is not as high as the net benefit for
Control Y.
Choice “D” is incorrect. Control X’s net benefit is the lowest of the four options provided.
Net benefit calculation for risk controls
total potential dollar-loss impact * (original risk of loss - new risk of loss) = benefit
Then:
Benefit - implementation cost of control = Net benefit.
What are the steps for calculating effective interest rate for a loan when there is an interest bearing compensation balance?
Step 1: Calculate ACTUAL FINANCE CHARGE
Actual interest = (P x Rate x Time)
Ex/ $500,000 x 8% x 1yr = $40k
Step 2: Subtract any interest earned from compensating balance (if any) to get NET INTEREST COST:
Comp balance x rate x time = additional interest earned.
Ex/ Actual int earned $50k x .03 = $1500
NET INT COST = $40,000 [from step 1] - $1500 = $38,500
Step 3: Get EFFECTIVE INTEREST RATE by dividing Net interest cost by total loan proceeds.
formula:
NET INTEREST COST / TOTAL LOAN PROCEEDS = effective interest rate
Loan proceeds company has use of:
Usable proceeds = Total loan amount - required additional compensating balance.
Ex/ $500k - $50k = $450,000
Ex/ $38,500 / $450,000 = 8.555% = 8.56% periodic rate.
The CFO of Lang Inc. wants to earn a higher return on the company’s cash holdings. Which of the following comparable maturity marketable securities will earn Lang the highest expected return?
A. Banker’s acceptances.
B. U.S. Treasury Bills.
C. Negotiable CDs.
D. Commercial paper.
Choice D - Commercial Paper
Risk = Highest expected return
Order of Riskiest to Safest of these choices:
Commercial Paper (riskiest, no secondary market)
Banker’s Acceptance (has a lrg secondary market, multiple maturities, yield is higher than T bill)
Negotiable Cds
US Treasury Bills (safest aka lowest expected return)
An issuer’s board of directors would ordinarily participate in each of the following activities, EXCEPT:
A. Supervising and monitoring the quality-control testing upon the installation of
a new information technology system.
B. Maintaining awareness of current technology used by the organization to
assure its efficiency and effectiveness for financial reporting.
C. Establishing long-term strategy and objectives to which their information
technology system should be aligned.
D. Ensuring that suitable information technology resources and skills are
available to meet the company’s strategic objectives.
Choice “A” is correct
SUPERVISION AND MONITORING OF QUALITY-CONTROL TESTING ARE TASKS MORE APPROPRIATELY ASSIGNED TO IT MANAGERS AND IT STAFF IN THE FIELD.
Establishing strategies and objectives, ensuring that appropriate resources and skills are in place, and maintaining awareness of current technology are
all appropriate responsibilities of the board.
The control environment component of the Internal Control—Integrated Framework includes which of the following principles?
A. The identification and analysis of risks.
B. The selection and development of control activities.
C. The appropriate communication of internal control deficiencies.
D. The independence and oversight responsibilities of the board of directors.
Choice “D” is correct. The establishment of the board as a unit independent from
management and its responsibilities for overseeing the development/performance of internal controls is a principle within the control environment component of the
Integrated Framework.
What is the formula for the discounted cash flow method?
K = D/P + G =
K - Cost of retained earnings
D - Dividend
P - Stock Price
G - Expected Growth Rate
__________________ is a state of not knowing how or whether events may occur and the impact they may have on an organization if they do occur. Every entity exists to provide value to its individual stakeholders while managing inevitable ___________, which may create or erode value.
Uncertainty
The commercial paper market advantages/disadvantages:
ADVANTAGES:
A. Avoids the expense of maintaining a compensating balance with a commercial
bank.
B. Provides a broad distribution for borrowing.
C. Accrues a benefit to the borrower because its name becomes more widely known.
DISADVANTAGE:
There are restrictions as to the type of corporation that can enter into the commercial paper market for short-term financing, since the use of the open
market is restricted to a comparatively small number of the most credit-worthy large corporations.
A response to risk that involves the diversification of product offerings rather than elimination of product offerings is called _______________.
reduction
Which one of the following is most relevant to a manufacturing equipment replacement
decision?
A. Disposal price of the old equipment.
B. A lump-sum write-off amount from the disposal of the old equipment.
C. Gain or loss on the disposal of the old equipment.
D. Original cost of the old equipment.
Choice “A” is correct. The disposal price of the old equipment is most relevant because it is an expected future inflow that will differ among alternatives. If this old equipment is replaced, there will be a cash inflow from the sale of the old equipment. If the old
equipment is kept, there will be no cash inflow from the sale of the old equipment.