Deck 6: Introduction to Internal Control Systems and Risk Management

Question 1

Risk response represents a series of actions taken by management to implement a desired risk management strategy.

Answer 1

True

Question 2

A good internal control system will contribute towards detecting accidental errors made by employees.

Answer 2

True

Question 3

For a specific internal control to be effective, both the preventive and the detective aspect of the control must exist and be interrelated.

Answer 3

True

Question 4

The separation of duties control would not be violated if a company's cashier was also responsible for recording cash transactions.

Question 5

Risk portfolio represents the amount and type of risk that an organization is willing to accept in pursuit of its goals and objectives.

Question 6

The five components of internal control articulated in the 2013 COSO Report include Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

Question 7

An effective approach for maintaining a good audit trail for cash disbursements is to utilize a voucher system with coins and currency issued for each disbursement.

Question 8

A company's control environment is unimportant when developing an internal control system.

Question 9

Controls that specifically encourage operating efficiency are often called preventive controls.

Question 10

Risk assessment is an important component of an internal control system.

Question 11

COSO did not change its definition of enterprise risk management when it released the 2017 COSO ERM Report.

Question 12

Within COSO's 2017 ERM Report, Risk Governance and Culture represents the organization's tone toward the design, implementation, execution and oversight of risk management activities.

Question 13

The separation of duties control does not completely eliminate the possibility of embezzlement by employees.

Question 14

An audit trail problem associated with computerized data processing is that certain financial data processed by the computer may never be seen by the company's management.

Question 15

The personnel subsystem has the important function of matching job qualifications to people qualifications.

Question 16

COBIT 5 deals exclusively with internal control within an IT context.

Question 17

The 2004 COSO ERM Report differs from the 2017 COSO ERM Report, in that the former adopted a components- and principles-based approach to risk management.

Question 18

Timely performance reports contribute towards achieving the monitoring component of an internal control system.

Question 19

A good audit trail is an important element within a company's internal control system.

Question 20

According to the 2017 COSO ERM Report, management is responsible for exercising oversight over strategy and risk management activities.

Question 21

Which of the following statements is true regarding preventive control procedures and detective control procedures?

A)They should be interrelated
B)If preventive controls exist, detective controls are unnecessary
C)If detective controls exist, preventive controls are unnecessary
D)Preventive controls should be cost effective, but detective controls do not need to be cost effective

Question 22

Control activities and monitoring are one and the same.

Question 23

A general rule that should be followed when developing control procedures for a company's assets is:

A)The cost of the control procedure will likely exceed the procedure's benefit
B)The procedure should not be designed and implemented unless an asset's cost exceeds $5,000
C)The more liquid an asset is, the greater the risk of its misappropriation
D)The procedure should not be designed and implemented in situations where a risk assessment has been previously performed

Question 24

Control procedures that provide feedback to management regarding the achievement of operational efficiency and adherence to prescribed managerial policies are called:

A)Corrective controls
B)Preventive controls
C)Policy controls
D)Detective controls

Question 25

A control procedure that may be established within the sales department of a company's marketing subsystem is the addition of the sales invoice amounts before these invoices are sent to the information processing subsystem.This control total of invoice amounts is called a:

A)Checksum
B)Random total check
C)Redundant control amount
D)Batch control total

Question 26

With respect to risk response strategies, which of the following would be a "risk avoidance" approach?

A)XYZ company enters the market as a provider of car insurance to high credit risk clients; however, they diversify their portfolio by targeting 40% of their marketing efforts to traditional "safe credit" customers.
B)LGW Communications employs a series of manual and automated controls to manage inventory shrinkage (inventory going missing due to damage or theft)in an effort to keep inventory costs in line with industry standards.
C)JLW Industries is a holding company with a division that specializes in high-risk offshore oil drilling.Given the recent Gulf oil spill and vicious backlash from consumers and politicians, JLW decides to divest itself of the oil drilling division.
D)XYZ company is concerned that they do not have the capability to bring a new product to market, so they enter into a joint venture with ABC company; XYZ will handle design and marketing of the new product, while ABC will handle manufacturing and logistics.

Question 27

Assume that a company designs and implements a control procedure whereby the accountant that is responsible for recording cash receipts transactions does not have access to the cash itself.This control procedure is an example of a:

A)Detective control
B)Preventive control
C)Corrective control
D)Feedback control

Question 28

Which of the following fundamental concepts is stressed by the 2013 COSO Report?

A)Internal control is not affected by people
B)Internal control is geared to the achievement of a company's objectives in the financial reporting area only
C)Internal control is designed to detect all errors and irregularities that occur within a company's system
D)Internal control is a process

Question 29

Regarding the cost-benefit concept, which of the following statements is true?

A)Every control procedure that offers benefits to a company should be implemented into the company's system
B)An optimal internal control package is developed for a company's system by implementing a standardized package of control procedures
C)A control procedure is considered cost effective if it can be determined that the cost of operating the procedure will be cheaper in the current period compared to the previous period
D)A control procedure is considered cost effective when its anticipated benefits exceed its anticipated costs

Question 30

Due to data errors occurring from time to time in processing the Albert Company's payroll, the company's management is considering the addition of a data validation control procedure that is projected to reduce the risk of these data errors from 13% to 2%.The cost of the payroll reprocessing is estimated to be $11,000.If the data validation control procedure is implemented, the cost of this procedure is expected to be $700 per pay period (employees are paid biweekly).Based on the above data, which of the following statements is true?

A)The data validation control procedure should be implemented because its net estimated benefit is $1,210
B)The data validation control procedure should be implemented because its net estimated benefit is $510
C)The data validation control procedure should not be implemented because the $700 expected cost per pay period exceeds the procedure's expected benefit
D)The data validation control procedure should not be implemented because its net estimated benefit is a negative $1,210, thereby causing the control procedure to fail in terms of being cost effective

Question 31

Three objectives of a company's internal control system should be safeguarding assets, checking the accuracy and reliability of accounting data, and promoting operational efficiency.A fourth objective of a company's internal control system should be:

A)Preventing embezzlement of assets
B)Encouraging adherence to prescribed managerial policies
C)Avoiding the payment of overtime to company employees
D)Revising standards for production costs on a weekly basis

Question 32

The control environment is a component of a company's internal control system that:

A)Influences the control awareness of a company's employees
B)Stresses the development of control procedures in a company
C)Directly affects the accuracy and reliability of a company's accounting data
D)Can be ignored when establishing a company's internal control system

Question 33

With respect to COBIT 5, which of the following is true :

A)COBIT 5 is designed to be the authoritative governance, risk management and control framework within an organization, and is incompatible with other frameworks
B)COBIT 5 treats governance and risk management as one and the same
C)COBIT 5 is concerned primarily with internal, IT-focused stakeholders
D)COBIT 5 articulates a series of enablers that facilitate the achievement of organizational objectives.

Question 34

COBIT 5's principles guide effective management and governance of IT within the enterprise.

Question 35

Those control procedures that are designed to remedy problems discovered through detective controls are called:

A)Corrective controls
B)Preventive controls
C)Before-the-fact controls
D)Management-by-exception controls

Question 36

____ is defined as "the culture, capabilities, and practices, integrated with strategy and execution, that organizations rely on to manage risk in creating, preserving and realizing value."

A)Control environment
B)Risk culture
C)Internal control
D)Enterprise risk management

Question 37

Which of the following statements is true?

A)The 2013 COSO Report failed to define internal control
B)The 2013 COSO Report emphasized that an internal control system is a tool of management
C)SAS 78 rejected the definition of internal control provided in the COSO report
D)COBIT 5 concluded that a company's management is not responsible for establishing and monitoring a company's internal control system

Question 38

The preventative controls within a company's internal control system:

A)Form the foundation for all of a company's other internal control components
B)Focus on management's philosophy and operating style
C)Ignore the risk factor associated with a company's control procedures
D)Relate to safeguarding a company's assets and checking the accuracy and reliability of the company's accounting data

Question 39

Which of the following components from the 2017 COSO ERM Report would provide guidance on risk assessment and risk response activities?

A)Risk Governance and Culture
B)Risk, Strategy, and Objective-Setting
C)Risk in Execution
D)Risk Information, Communication and Reporting No.94

Question 40

The maintenance of backup copies of a company's important transaction and master files is an example of a:

A)Preventive control procedure
B)Detective control procedure
C)Corrective control procedure
D)Management-by-exception control procedure

Question 41

The 2013 COSO Report identifies five components for an effective internal control system.These are:

A)Control environment, risk assessment, control activities, information and communication, and monitoring
B)Control environment, control procedures, control activities, communication, and monitoring
C)Control procedures, control activities, information, communication, and monitoring
D)Control procedures, risk assessment, control activities, information and communication, and monitoring

Question 42

At a movie?theater box office, all tickets are prenumbered.At the end of each day, the beginning ticket number is subtracted from the ending number to give the number of tickets sold.Cash is counted and compared with the number of tickets sold.

A)The box office gives too much change
B)The ticket taker admits his friends without a ticket
C)The manager gives theater passes for personal expenses, which is against company policy
D)A test check of customers entering the theater does not reconcile with ticket sales
E)Tickets from a previous day are discovered in the ticket taker's stub box despite the fact that tickets are stamped "Good on Date of Purchase Only"

Question 43

A responsibility that should be assigned to a specific employee and not shared jointly is that of:

A)Access to the company's safe deposit box
B)Placing orders and maintaining relationships with a prime supplier
C)Attempting to collect a particular delinquent account
D)Custodianship of the petty cash fund

Question 44

If the same employee is responsible for authorizing a business transaction and recording the transaction in the accounting records, this indicates a weakness in which element of a company's internal control system?

A)A good audit trail
B)Separation of duties
C)Internal review of controls
D)Competent employees

Question 45

Both cash and credit customers are educated to expect a sales ticket.Tickets are serially numbered.All numbers are accounted for daily.

A)Customers complain that their monthly bills contain items that have been paid
B)Some customers have the correct change for the merchandise purchased; they pay and do not wait for a sales ticket
C)Customers complain that they are billed for goods they did not purchase
D)Customers complain that goods ordered are not received
E)Salesclerks destroy duplicate sales tickets for the amount of cash stolen

Question 46

The component of an internal control system that concerns itself with the way a company's management assigns authority and responsibility is called:

A)Monitoring
B)Control environment
C)Risk assessment
D)Information

Question 47

An approach used by many companies to reduce the risk of loss caused by the theft of assets by employees is to:

A)Utilize polygraphs
B)Acquire arbitrage loss protection
C)Acquire fidelity bond coverage
D)Institute punitive management

Question 48

The voucher system requires that invoices be compared with receiving reports and express bills before a voucher is prepared and approved for payment.

A)Unrecorded checks appear in the bank statement
B)The treasurer takes funds by preparing a fictitious voucher charging "Miscellaneous General Expenses"
C)An employee in the purchasing department sends through fictitious invoices and receives payment
D)A cash shortage is covered by underfooting outstanding checks on the bank reconciliation
E)A cash shortage is covered by omitting some of the outstanding checks from the bank reconciliation

Question 49

Which of the following statements is true regarding timely performance reports?

A)In many companies, these reports are the major means of providing information to management concerning the actual operations of the companies' internal control systems
B)These reports should only include monetary data
C)Since these reports fail to provide feedback to management on the operations of previously implemented internal control procedures, other techniques are needed to provide this feedback to managers
D)The complexity that a computer introduces into a company's information system will typically prevent the preparation of timely performance reports for the company's management

Question 50

The duties of cashier and accounts?receivable bookkeeper should be separated.

A)There are two cashiers.At the end of a certain day, there is a sizable cash shortage; each cashier blames the other and it is impossible to fix responsibility
B)A cash shortage is covered by overfooting (overadding)cash in transit on the bank reconciliation
C)A cash shortage is covered by charging it to "Miscellaneous General Expenses"
D)Customers who paid their accounts in cash complain that they still receive statements of balances due
E)The accounts?receivable bookkeeper charges off the accounts of friends to "Allowance for Uncollectible Accounts"

Question 51

Which of the following control procedures provides physical protection for a company's cash asset?

A)Majority of authorized cash disbursements made by check
B)Daily cash receipts deposited intact at bank
C)Voucher system for cash disbursements
D)all of the above

Question 52

With respect to risk response strategies, which of the following would be a "risk sharing" approach?

A)XYZ company enters the market as a provider of car insurance to high credit risk clients; however, they diversify their portfolio by targeting 40% of their marketing efforts to traditional "safe credit" customers.
B)LGW Communications employs a series of manual and automated controls to manage inventory shrinkage (inventory going missing due to damage or theft)in an effort to keep inventory costs in line with industry standards.
C)JLW Industries is a holding company with a division that specializes in high-risk offshore oil drilling.Given the recent Gulf oil spill and vicious backlash from consumers and politicians, JLW decides to divest itself of the oil drilling division.
D)XYZ company is concerned that they do not have the capability to bring a new product to market, so they enter into a joint venture with ABC company; XYZ will handle design and marketing of the new product, while ABC will handle manufacturing and logistics.

Question 53

Freije Refrigeration Company has an inventory of raw materials and parts consisting of thousands of different items which are of small dollar value individually but significant in total.A fundamental control requirement of Freije's inventory system is that:

A)Perpetual inventory records be maintained for all inventory items
B)The taking of physical inventories be conducted on a cycle basis rather than at year?end
C)The storekeeping function not be combined with the production and inventory record?keeping functions
D)Material requisitions be approved by an officer of the company

Question 54

The 2013 COSO Report stresses that:

A)Internal control is a process
B)An internal control system, if properly designed, can become a substitute for management
C)People only at high levels of an organization are an important part of an internal control system
D)An internal control system should consist of three interrelated components: the control environment, risk assessment, and control activities

Question 55

Regarding a company's audit trail, which of the following statements is true?

A)Because of the complexities involved in establishing an audit trail, a good audit trail normally makes it more difficult for an individual to follow the flow of a company's business transactions through the company's information system
B)In actuality, the audit trail established within a company's information system is an unimportant element of the company's internal control system
C)When a company's audit trail becomes more difficult to follow, this causes an increase in the risk of errors or irregularities taking place in the processing of accounting transactions and not being detected
D)A company's policies and procedures manual should not be part of its audit trail since confidential information is included within this manual

Question 56

The sales department bookkeeper has been crediting house?account sales to her brother-in?law, an outside salesman.Commissions are paid on outside sales but not on house-account sales.This might have been prevented by requiring that:

A)Sales order forms be prenumbered and accounted for by the sales department bookkeeper
B)Sales commission statements be supported by sales order forms and approved by the sales manager
C)Aggregate sales entries be prepared by the general accounting department
D)Disbursement vouchers for sales commissions be reviewed by the internal audit department and checked to sales commission statements
In each one of the following four questions (questions 50?53), you are given a well?recognized procedure of internal control.You are to identify the irregularity that will be discovered or prevented by each procedure.

Question 57

_________________ describes the policies, plans, and procedures implemented by a firm to protect its assets.

A)Internal control
B)SAS No.94
C)SOX, Section 404
D)Enterprise risk management

Question 58

The 2013 COSO Report identifies five components for an effective internal control system.Which of those five establishes the tone of a company and influences the control awareness of the company's employees?

A)Control procedures
B)Control environment
C)Control activities
D)Information and communication

Question 59

For control purposes, the quantities of materials ordered may be omitted from the copy of the purchase order which is:

A)Forwarded to the accounting department
B)Retained in the purchasing department's files
C)Returned to the requisitioner
D)Forwarded to the receiving department

Question 60

The 2013 COSO Report identifies five components for an effective internal control system.Which of those five includes the methods used to record, process, summarize, and report a company's transactions?

A)Control procedures
B)Control environment
C)Control activities
D)Information and communication

Question 61

When assessing a company's internal control structure policies and procedures, the primary consideration is whether they

A)Prevent management override
B)Relate to the control environment
C)Reflect management's philosophy and operating style
D)Affect the financial statement assertions

Question 62

When management of the sales department has the opportunity to override the system of internal controls of the accounting department, a weakness exists in

A)Risk management
B)Information and communication
C)Monitoring
D)The control environment

Question 63

Which one of the following types of audits would be most likely to focus on objectives related to the efficient use of resources?

A)Compliance audit
B)Information systems audit
C)Independent audit
D)Operational audit

Question 64

Which of the following personnel policies would be the most useful in mitigating fraud or embezzlement?

A)Fidelity bonds for key employees
B)Careful hiring procedures for key employees
C)Having a Code of Conduct
D)Required vacations for key employees

Question 65

Suppose a company established training programs that teach employees to perform their job functions more efficiently and effectively.This is an example of which type of control?

A)Detective
B)Preventive
C)Corrective
D)none of the above

Question 66

Segregation of duties is a fundamental concept in an effective system of internal control.Nevertheless, the internal auditor must be aware that this safeguard can be compromised through

A)Lack of training of employees
B)Collusion among employees
C)Irregular employee reviews
D)Absence of internal auditing

Question 67

The purpose of ________________ is to identify organizational risks, analyze their potential in terms of costs and likelihood of occurrence, and install those controls whose projected benefits outweigh their costs.

A)Internal controls
B)A control environment
C)Risk assessment
D)Management consultants

Question 68

Many organizations have an internal audit function that makes periodic reviews of each department within the organization.The focus of these reviews is to:

A)Conduct an investigation of each department to be sure fraud is not taking place
B)Evaluate the efficiency and effectiveness of the department
C)Evaluate the performance of the manager of the department
D)Report to the organization's top managers and board of directors

Question 69

Which one of the following methods for the distribution of employees' paychecks would provide the best internal control for the organization?

A)Delivery of the paychecks to each department supervisor, who in turn would distribute paychecks directly to the employees in his/her department
B)Direct deposit in each employee's personal bank account
C)Distribution of paychecks directly to each employee by a representative of the Human Resource department
D)Distribution of paychecks directly to each employee by the payroll manager

Question 70

The Enterprise Risk Management (ERM)framework in the 2004 COSO Report was based on the 1992 COSO report and adds three additional components for an effective internal control system.Which of the following is not one of those three?

A)Objective setting
B)Event identification
C)Control assessment
D)Risk response

Question 71

Which one of the following functions performed in an organization is a violation of internal control?

A)A mail clerk opening the mail compares the check received with the source document accompanying the payment, noting the amount paid, then forwards the checks daily (along with a listing of the cash receipts)to the Cashier for deposit
B)A mail clerk opening the mail compares the check received with the source document accompanying the payment, noting the amount paid, then forwards the source documents that accompany the payments (along with a listing of the cash receipts)to Accounts Receivable, on a daily basis, for posting to the subsidiary ledger
C)At the end of the week the Cashier prepares a deposit slip for all of the cash receipts received during the week
D)The General Ledger clerk compares the summary journal entry, received from the Cashier for cash receipts applicable to outstanding accounts, with the batch total for posting to the Subsidiary Ledger by the Accounts Receivable clerk

Question 72

Which of the following factors best describes the "control environment" of a firm?

A)The integrity, ethical values, and competence of employees
B)Management's philosophy and operating style
C)The way management assigns authority and responsibility
D)The direction and attention provided by the board of directors
E)all of the above

Question 73

Which one of the following would be most effective in deterring the commission of fraud?

A)Policies of strong internal control, segregation of duties, and requiring employees to take vacations
B)Policies of strong internal control and punishments for unethical behavior
C)Employee training, segregation of duties, and punishment for unethical behavior
D)Hiring ethical employees, employee training, and segregation of duties