Deck 3: Internal Controls

Question 1

ANF Corporation's company procedures manual is available to all employees on the corporate network, while RSP Corporation distributes a hard copy of its company procedures manual to all new employees. Which of the following statements is most true?

A)Because the procedures manual would be reported as an asset on the balance sheet, RSP is doing a better job safeguarding its assets.
B)Because the procedures manual would be reported as an asset on the balance sheet, ANF is doing a better job safeguarding its assets.
C)ANF employees are more likely to comply with management directives than RSP employees.
D)The method of distributing the procedures manual is unlikely to be related to ensuring financial statement reliability.

Answer 1

D

Question 2

Violating the provisions of the Foreign Corrupt Practices Act most directly subjects an organization to what kind of risk from Brown's taxonomy?

A)Financial
B)Operational
C)Strategic
D)Inherent

Answer 2

C

Question 3

According to COSO, internal control is a:

A)Process.
B)Set of rules.
C)Responsibility of employees only.
D)Requirement only for publicly-traded firms.

Answer 3

A

Question 4

Internal control is designed to provide:

A)Certainty.
B)Freedom from fraud.
C)Reasonable assurance.
D)Truth.

Question 5

Shawn is an accountant at LNT Corporation. He maintains the company's accounting data on his computer's local hard drive, but does not back it up on any regular schedule. LNT Corporation's risk is most related to which purpose of internal control?

A)Safeguarding assets
B)Ensuring financial statement reliability
C)Encouraging compliance with management directives
D)Properly backing up data every day

Question 6

Internal control relates to an organization's achievement of objectives in three major categories. Which of the following best pairs one of the categories with a specific example?

A)Reliability of financial reporting, reconciling the bank statement at least monthly
B)Reliability of financial reporting, following the COSO internal control framework
C)Compliance with all known laws and regulations, following the COSO internal control framework
D)Compliance with all known laws and regulations, fulfilling the requirements of the Foreign Corrupt Practices Act

Question 7

Internal control has four major purposes in organizations. Ways to achieve at least one of the four include: (i) requiring supervisory review of how complex transactions are recorded in the journal, (ii) using general ledger software such as Peachtree.

A)I only.
B)II only.
C)Both I and II.
D)Neither I nor II.

Question 8

Bumble Beasley was making a presentation on internal control to a group of prospective clients. Which of the following statements is the least appropriate for Bumble to make?

A)Responsibility for internal control should be shared throughout the organization.
B)All companies must use the COSO definition of internal control as a guide.
C)Internal controls are not designed specifically to prevent fraud.
D)Part of internal control is ensuring that a company is making the best possible use of its resources.

Question 9

Internal control has four major purposes in organizations. Ways to achieve at least one of the four include: (i) keeping cash in a bank, (ii) conducting a new employee orientation.

A)I only.
B)II only.
C)Both I and II.
D)Neither I nor II.

Question 10

CPY Corporation replaces one third of its computers every year; SLP Corporation replaces its computers when employees submit a request, but no more frequently than once every four years. Which of the following statements is most true?

A)CPY's replacement policy does a better job safeguarding assets.
B)SLP's replacement policy does a better job safeguarding assets.
C)Neither replacement schedule helps achieve the internal control purpose of safeguarding assets, but replacing a computer may help promote operating efficiency.
D)Neither replacement schedule helps achieve the internal control purpose of safeguarding assets because information is not an asset reported on the balance sheet.

Question 11

According to the COSO definition, internal control should address objectives in all of the following categories except:

A)Company operations.
B)Legal matters.
C)External reporting.
D)Fraud.

Question 12

According to the COSO definition, internal control should promote ___ in financial reporting.

A)Truth
B)Accuracy
C)Both A and B
D)Neither A nor B

Question 13

A well-designed set of internal controls helps a company achieve four main purposes. Which of the following best pairs two controls related to a single purpose?

A)Restrictive endorsements and bank reconciliations
B)Restrictive endorsements and pre-numbered documents (such as checks)
C)Bank reconciliations and background checks
D)Pre-numbered documents and background checks

Question 14

Omar is a general manager at FRD Corporation. He recently attempted to reorganize FRD from three departments of ten people each to six departments of five people each. Which purpose of internal control is most likely to be impacted by the change?

A)Safeguarding assets
B)Ensuring financial statement reliability
C)Promoting operational efficiency
D)Uncovering fraud

Question 15

Internal control relates to an organization's achievement of objectives in three major categories. Which of the following pairs gives an example of two controls that fulfill a single category?

A)Fulfilling the requirements of the Foreign Corrupt Practices Act, developing a clear job description for each position in the company
B)Developing a clear job description for each position in the company, calculating profits on the accrual basis
C)Fulfilling the requirements of the Foreign Corrupt Practices Act, calculating profits on the accrual basis
D)Ensuring that plant assets are listed on the balance sheet at their net book value, listing appropriate assets at their current market value

Question 16

In Brown's taxonomy, systems risk is a form of:

A)Financial risk
B)Operational risk
C)Strategic risk
D)Hazard risk

Question 17

Internal control relates to an organization's achievement of objectives in three major categories. Which of the following best pairs one of the categories with a specific example?

A)Effectiveness & efficiency of operations, fulfilling the requirements of the Foreign Corrupt Practices Act
B)Effectiveness & efficiency of operations, listing appropriate assets at their current market value
C)Reliability of financial reporting, fulfilling the requirements of the Foreign Corrupt Practices Act
D)Reliability of financial reporting, listing appropriate assets at their current market value

Question 18

Purposes of internal control include:

A)Safeguarding assets.
B)Ensuring financial statement reliability.
C)Promoting operational efficiency.
D)All of the above.

Question 19

Internal control relates to an organization's achievement of objectives in three major categories. All of the following are examples of at least one category except:

A)Promoting compliance with the Sarbanes-Oxley Act.
B)Ensuring that plant assets are listed on the balance sheet at their net book value.
C)Developing a clear job description for each position in the company.
D)Providing conclusive proof that fraud has occurred.

Question 20

A well-designed set of internal controls helps a company achieve four main purposes. Which of the following best pairs two controls related to a single purpose?

A)Adequate documentation and user training
B)Adequate documentation and bank reconciliations
C)User training and bank reconciliations
D)Firewalls and employee bonding

Question 21

Dale is an employee of Big State University who also does some independent consulting to supplement income. Because consulting engagements are infrequent, Dale has not purchased insurance for the company. If Dale requires consulting clients to pay in cash, which of the following risk exposures is most serious?

A)Directors' and officers' liability risk
B)Systems risk
C)Credit risk
D)Consulting risk

Question 22

COSO's Internal Control-Integrated Framework comprises a total of ___ categories.

A)Three
B)Four
C)Five
D)Six

Question 23

Consider the following examples of risk: i. A corporation is unable to issue bonds because its credit rating is too low.ii. A U.S. auto manufacturer tries to market a car in Mexico. The car does not sell because the Spanish translation of its name means "it doesn't go."
Iii) An employee receives insufficient training in how to use specialized software.iv. Due to employee theft, a corporation spends more money than anticipated buying new tools.Which pair of risks belongs to the same category in Brown's risk taxonomy?

A)I and II
B)II and III
C)I and III
D)I and IV

Question 24

Similarities between legal & regulatory risk and directors' and officers' liability risk in Brown's taxonomy include:

A)The cause of the risk.
B)The things directly affected by the risk.
C)Both A and B.
D)Neither A nor B.

Question 25

An airline pilot could not get landing instructions at an airport because the air traffic controller was asleep. In a risk/control matrix related to that situation, the phrase "require annual physicals" is most likely to appear in which column?

A)First
B)Third
C)Fourth
D)Fifth

Question 26

Consider the following list of items that might appear in a risk / control matrix: i. At least twice a week
Ii) Corrective
Iii) Human error
Iv) Inability to access class materials due to network outage
V) Insufficient time to study
Vi) Local data backup
Vii) Maximum budget = $50
Viii. Preventive
Ix) Systems
X) Time management software
Which of the following items are most likely to be grouped on a single row?

A)I, II, III, IV, V
B)I, III, VII, VIII, X
C)III, V, VII, VIII, X
D)III, VI, VII, VIII, X

Question 27

A speech by the company president about the role of internal control is an example of ___ in COSO's Internal Control-Integrated Framework.

A)Control environment
B)Control activity
C)Information and communication
D)Risk assessment

Question 28

The risk / control matrix illustrated in the chapter contains five columns. Which of the following is not one of them?

A)Risk
B)Risk category
C)COSO category
D)Internal control

Question 29

Hewlett-Packard is a publicly traded corporation whose principal activity is making and selling computers. Customers can buy an HP computer directly from HP online if they pay with a bank credit card (such as Visa or Mastercard). HP's risk exposures therefore include all of the following except:

A)Market risk
B)Systems risk
C)Credit risk
D)Human error risk

Question 30

Consider the following examples of risk: i. A corporation is unable to issue bonds because its credit rating is too low.ii. A U.S. auto manufacturer tries to market a car in Mexico. The car does not sell because the Spanish translation of its name means "it doesn't go."
Iii) An employee receives insufficient training in how to use specialized software.iv. Due to employee theft, a corporation spends more than anticipated buying new tools
The risks listed above contain examples of all the categories in Brown's risk taxonomy except:

A)Financial
B)Operational
C)Strategic
D)Hazard

Question 31

A department manager at TRS Corporation attended a seminar on internal control; afterward, the manager formed a five-person departmental team to create an internal control plan for the department. After a one-day off-site meeting, the team produced a document titled "Departmental Internal Control Plan." It was formatted as a risk/control matrix. One member of the team commented that, although the work was interesting, the team was glad the task was complete and wouldn't have to be redone. Which element of COSO's internal control framework does the department's plan lack?

A)Risk assessment
B)Control activities
C)Information and communication
D)Monitoring

Question 32

Raj, an employee at TRS Corporation, was preparing a risk / control matrix related to the steps in the accounting cycle. The first row of the matrix contained the following entries: Adequate training. Assets that should be reported at historical cost are reported at market value. Human error. Internal audits. Which two items would appear in the same column in the matrix?

A)Adequate training and human error
B)Human error and internal audits
C)Adequate training and internal audits
D)None. For a given risk, each column can have only one entry.

Question 33

An airline pilot could not get landing instructions at an airport because the air traffic controller was asleep. In a risk / control matrix related to that situation, which of the following items is most likely to appear in the second column?

A)Human error
B)Preventive
C)Require annual physicals
D)Work with a partner

Question 34

Raj, an employee at TRS Corporation, was preparing a risk / control matrix related to the steps in the accounting cycle. The first row of the matrix contained the following entries: Adequate training. Assets that should be reported at historical cost are reported at market value. Human error. Internal audits. All the columns in the risk / control matrix are represented by those items except:

A)Comments
B)Internal control
C)Risk
D)Risk category

Question 35

Differences between legal & regulatory risk and directors' & officers' liability risk in Brown's taxonomy include:

A)The cause of the risk.
B)The things directly affected by the risk.
C)Both A and B.
D)Neither A nor B.

Question 36

Consider the following list of items that might appear in a risk / control matrix: i. At least twice a week
Ii) Corrective
Iii) Human error
Iv) Inability to access class materials due to network outage
V) Insufficient time to study
Vi) Local data backup
Vii) Maximum budget = $50
Viii. Preventive
Ix) Systems
X) Time management software
Which of the following items are most likely to be grouped on a single row?

A)I, II, III, IV, V
B)I, II, IV, VI, IX
C)II, III, IV, V, VI
D)VI, VII, VIII, IX, X

Question 37

Ray has worked in the mailroom at MNG Corporation for five years, and is widely respected throughout the organization. Jon, the chief financial officer, started working at MNG six months ago after holding a similar position with one of MNG's competitors. Which of the following statements is most true?

A)Both Ray and Jon can help establish a strong control environment, but only Jon can effectively identify risks and suggest control activities.
B)Both Ray and Jon can effectively identify risks and suggest control activities, but only Ray can help establish a strong control environment.
C)Neither Ray nor Jon should participate in the development of an internal control plan.
D)Both Ray and Jon can influence most aspects of an internal control plan for MNG.

Question 38

A risk / control matrix has five columns, the last of which is labeled "comments." Which of the following statements is most true?

A)Because it is part of a risk / control matrix, the "comments" column is a control activity.
B)Because it is part of a risk / control matrix, the "comments" column is a tool for risk assessment.
C)If the comments are written by a department manager, they are part of establishing a strong control environment.
D)Although the "comments" column may not align directly with one of the five elements of the COSO framework, including it in the risk / control matrix is a good idea.

Question 39

The risk / control matrix illustrated in the chapter contains five columns. Which of the following items is most likely to appear in the third column?

A)Downloading a virus
B)Preventive
C)Systems
D)Virus protection software

Question 40

A department manager at TRS Corporation attended a seminar on internal control; afterward, the manager formed a five-person departmental team to create an internal control plan for the department. After a one-day off-site meeting, the team produced a document titled "Departmental Internal Control Plan." It was formatted as a risk/control matrix. One member of the team commented that, although the work was interesting, the team was glad the task was complete and wouldn't have to be redone. Which of the following statements is most true?

A)A risk / control matrix is inappropriate, since risk assessment and control activities must be done separately according to the COSO framework.
B)A department manager cannot establish a proper control environment.
C)The team member's comment indicates a weakness in monitoring.
D)Information and communication should always happen in at least two ways.

Question 41

Internal controls can prevent, detect or correct a problem. Which of the following groups includes controls that will fulfill all three with respect to the risk of an employee embezzling money by forging a manager's signature on a check?

A)Separation of duties, internal audit, employee bonding
B)Physical security of cash, pre-numbered documents, restrictive endorsements
C)Separation of duties, pre-numbered documents, restrictive endorsements
D)Physical security of cash, internal audit, employee bonding

Question 42

A company's accountant was able to approve payment of invoices and write company checks to a family member, with whom the accountant would split the proceeds. The accountant covered up the theft with journal entries in the AIS. Which duties should be separated to prevent such problems in the future?

A)Authorization and custody
B)Custody and recordkeeping
C)Authorization and recordkeeping
D)Control environment and control activities

Question 43

PRL Corporation's internal control plan includes five items: (i) conducting ongoing evaluations of internal control during the normal course of operations, (ii) hiring accountants who understand the importance of strong internal control, (iii) including a segment in new employee orientation on the importance of strong internal control, (iv) periodic employee surveys that identify new issues that require internal controls, (v) a quarterly newsletter explaining elements of the internal control plan. Which of the following most appropriately groups two items from PRL's plan with a component of the COSO framework?

A)I and II, monitoring
B)II and III, control environment
C)IV and V, information and communication
D)I and V, risk assessment

Question 44

A Place to Rest is a retreat center located just outside Los Angeles; the center's management is interested in developing an internal control plan using the COSO framework. For each item listed below, indicate the framework element that most clearly applies; you must use each element of the COSO framework exactly one time.
A. Conducting focus groups where employees talk about problems they observe at the center
b. Designating a three-person committee to review and update the plan annually
c. Filling out a risk / control matrix
d. Inviting a guest speaker to talk to employees about the importance of internal control
e. Sending out a monthly e-mail describing some aspect of the center's internal control plan

Question 45

When employees of the City of Fenris need supplies, they fill out a purchase requisition and send it to the city's purchasing department. The purchasing agents consolidate requisitions for similar supplies and prepare a purchase order to send to a vendor. The vendor ships the supplies directly to the purchasing department and then bills the city. Accounting clerks pay vendor invoices within thirty days. Within the context of that business process, which of the following best pairs a risk with an internal control that will address the risk?

A)Purchasing supplies from an unauthorized vendor, separation of duties
B)Paying for supplies that were not received, document matching
C)Receiving supplies that were not ordered, limit checks
D)Requisitioning supplies that are not needed, pre-numbered purchase requisitions

Question 46

Sam and Dan are the owners of the International School for Computer Training (ISCT), a for-profit educational institution that provides computer-related education in several short-term programs. As a first step in developing an internal control plan, they have identified two risks:
(a) employees steal supplies for personal use and
(b) failure to attract a sufficient number of students. Based on those two risks, prepare a risk-control matrix using the format illustrated in the chapter.

Question 47

Carlos is the vice president of finance at PLP Corporation. When he joined the company five years ago, the finance division was organized in two departments: operating transactions and non-operating transactions. Each department had two employees and a manager. The operating transactions department handled all aspects of transactions dealing with inventory, supplies, payroll and other operating expenses; the non-operating transactions department handled all aspects of transactions dealing with short-term investments, long-term debt and shareholders. Any transactions that did not fit one of the two groups were handled by the vice president of finance. The finance division had its own procedures manual, organized into three chapters: operating transactions, non-operating transactions, other transactions. Within the operating transactions department, one employee handled payroll only, while the other employee handled all aspects of non-payroll transactions. Within the non-operating transactions department, one employee handled transactions related to short-term investments. The other employee handled long-term debt transactions, while the department manager handled all aspects of transactions dealing with shareholders. Based on the narrative, identify five risk exposures for the finance division at PLP Corporation. For each risk exposure, use Brown's taxonomy to identify both the broad category and the specific type of risk within the category.

Question 48

Consider the list of risks and internal controls in the table below. For each row, indicate whether the internal control addresses the risk. If it does, indicate whether it is primarily preventive, detective or corrective in nature.

Question 49

PRL Corporation's internal control plan includes five items: (i) conducting ongoing evaluations of internal control during the normal course of operations, (ii) hiring accountants who understand the importance of strong internal control, (iii) including a segment in new employee orientation on the importance of strong internal control, (iv) periodic employee surveys that identify new issues that require internal controls, (v) a quarterly newsletter explaining elements of the internal control plan. Based on those five items alone, which element of PRL's internal control plan is weakest?

A)Risk / control matrix
B)Control activities
C)Information and communication
D)Monitoring

Question 50

Bonnie is the owner of Doggie Day Care, a pet-sitting service. Pet owners bring their dogs to Bonnie's facility, where they are either given private accommodations or are put in a large pen with other dogs. (Private accommodations are more expensive.) Bonnie and her employees feed the dogs twice a day; those dogs in private accommodations are also given two exercise periods per day. Owners pay half the daily fee at the start of the day, and the other half when they pick up the dog at the end of the day; owners must also certify that their dogs have had all required vaccinations. As Bonnie's company is a day care service, no dogs stay the night in her facility. Bonnie accepts cash, checks and major credit cards in payment. Bonnie is interested in developing a comprehensive internal control plan for Doggie Day Care; she has approached you, as a consultant, for assistance. Use the COSO internal control framework to develop an internal control plan for Bonnie. Ensure that your plan includes sufficient detail that Bonnie can implement it as you intend.

Question 51

Carlos is the vice president of finance at PLP Corporation. When he joined the company five years ago, the finance division was organized in two departments: operating transactions and non-operating transactions. Each department had two employees and a manager. The operating transactions department handled all aspects of transactions dealing with inventory, supplies, payroll and other operating expenses; the non-operating transactions department handled all aspects of transactions dealing with short-term investments, long-term debt and shareholders. Any transactions that did not fit one of the two groups were handled by the vice president of finance. The finance division had its own procedures manual, organized into three chapters: operating transactions, non-operating transactions, other transactions. Within the operating transactions department, one employee handled payroll only, while the other employee handled all aspects of non-payroll transactions. Within the non-operating transactions department, one employee handled transactions related to short-term investments. The other employee handled long-term debt transactions, while the department manager handled all aspects of transactions dealing with shareholders. Based on the narrative, identify three risk exposures for the finance department at PLP Corporation. For each risk exposure, suggest two internal controls that would address it. Use the outline below to record your responses.1) Risk exposure: _____________________________________________
A. Control: ________________________________________________
b. Control: ________________________________________________
2) Risk exposure: _____________________________________________
A. Control: ________________________________________________
b. Control: ________________________________________________
3) Risk exposure: _____________________________________________
A. Control: ________________________________________________
b. Control: ________________________________________________

Question 52

Bonnie is the owner of Doggie Day Care, a pet-sitting service. Pet owners bring their dogs to Bonnie's facility, where they are either given private accommodations or are put in a large pen with other dogs. (Private accommodations are more expensive.) Bonnie and her employees feed the dogs twice a day; those dogs in private accommodations are also given two exercise periods per day. Owners pay half the daily fee at the start of the day, and the other half when they pick up the dog at the end of the day; owners must also certify that their dogs have had all required vaccinations. As Bonnie's company is a day care service, no dogs stay the night in her facility. Bonnie accepts cash, checks and major credit cards in payment. List and discuss three to five risk exposures Bonnie's company faces. For each risk you identify, explain where it fits within Brown's taxonomy of risk.

Question 53

Internal controls can prevent, detect or correct a problem. Which of the following groups includes controls that will fulfill all three with respect to the risk of an employee stealing tools from a company warehouse?

A)Random searches, video surveillance, insurance
B)Random searches, physical security, video surveillance
C)Lockbox systems, video surveillance, limit checks
D)Lockbox systems, limit checks, insurance

Question 54

Pauline was injured on the job and applied for workers' compensation insurance; she was initially authorized for eight weeks of benefits. Although her doctor released her to return to work after six weeks, Pauline did not go back to work until the full eight weeks had elapsed. Internal controls to address this situation would include: (i) insurance and bonding, (ii) internal audits.

A)I only
B)II only
C)Both I and II
D)Neither I nor II

Question 55

COSO's Internal Control-Integrated Framework comprises five interrelated elements. List and briefly discuss each of the five elements.

Question 56

Carlos is the vice president of finance at PLP Corporation. When he joined the company five years ago, the finance division was organized in two departments: operating transactions and non-operating transactions. Each department had two employees and a manager. The operating transactions department handled all aspects of transactions dealing with inventory, supplies, payroll and other operating expenses; the non-operating transactions department handled all aspects of transactions dealing with short-term investments, long-term debt and shareholders. Any transactions that did not fit one of the two groups were handled by the vice president of finance. The finance division had its own procedures manual, organized into three chapters: operating transactions, non-operating transactions, other transactions. Within the operating transactions department, one employee handled payroll only, while the other employee handled all aspects of non-payroll transactions. Within the non-operating transactions department, one employee handled transactions related to short-term investments. The other employee handled long-term debt transactions, while the department manager handled all aspects of transactions dealing with shareholders. Risk exposures for the finance division at PLP include:
a) Cash dividends being sent to the wrong shareholders
b) Dividend miscalculations
c) Embezzlement of cash
d) Missed payments on long-term debt
e) Payroll checks issued to employees no longer working for PLP
f) Payroll miscalculations
g) Poor choices for short-term investments
h) Purchasing supplies and inventory from unauthorized vendors
i) Theft of supplies
To address those risks, PLP might institute the following internal controls: adequate supervision, segregation of duties, appropriate use of information technology. Divide the risk exposures listed into three groups based on the internal control that would best address the risk; each group must have no fewer than two and no more than four risk exposures. Each risk exposure must be associated with exactly one internal control.

Question 57

Jared is a loan officer at a bank whose responsibilities include taking applications from prospective borrowers. Jared also makes an initial recommendation regarding each loan, although final approval requires the authorization of both a branch manager and a loan specialist at the bank's corporate headquarters. Within the context of a loan transaction, which of the following best pairs a risk with an internal control that will address the risk?

A)Approving a loan for a friend who does not meet the criteria, limit checks
B)Including false or misleading information on the loan application, preformatted data entry screen
C)Submitting an incomplete loan application, preformatted data entry screen
D)Submitting an incomplete loan application, limit checks.

Question 58

A company controller set up a fictitious subsidiary office to which he shipped inventories and then approved the invoice for payment. The inventories were sold and the proceeds deposited to the controller's personal bank account. Which of the following internal controls would be most effective in preventing that situation?

A)Separation of duties
B)Bank reconciliations
C)Conflict of interest policy
D)Limit checks

Question 59

Bumble Beasley was recently hired as a marketing manager at ATI Corporation. When approached by the accounting manager regarding the development of an internal control plan for the marketing department, Bumble said: "Internal control? I'm not even really sure I know what that is. And even if I did, I had the impression that it was all the responsibility of you accounting types." In the role of the accounting manager, explain to Bumble in your own words what internal control is. Also explain, in your own words, the basic purposes of internal control.

Question 60

After being laid off from his job, Dale applied for unemployment benefits. During his initial interview to establish eligibility, the interviewer explained his benefits would last no more than ten weeks; Dale later consulted the official web site and learned that, under the right circumstances, his unemployment benefits could last up to six months. Which of the following internal controls is least likely to address this situation?

A)Adequate supervision
B)Adequate documentation
C)Employee bonding
D)Preformatted data entry screen

Question 61

Bonnie is the owner of Doggie Day Care, a pet-sitting service. Pet owners bring their dogs to Bonnie's facility, where they are either given private accommodations or are put in a large pen with other dogs. (Private accommodations are more expensive.) Bonnie and her employees feed the dogs twice a day; those dogs in private accommodations are also given two exercise periods per day. Owners pay half the daily fee at the start of the day, and the other half when they pick up the dog at the end of the day; owners must also certify that their dogs have had all required vaccinations. As Bonnie's company is a day care service, no dogs stay the night in her facility. Bonnie accepts cash, checks and major credit cards in payment. Bonnie has approached you, as a consultant, with concerns about the risks her company faces and how she might address them. Explain the concept of a risk / control matrix to Bonnie, then design such a matrix for three risks Bonnie's company must address.