Deck 10: Understanding Internal Controls

Question 1

To minimize the risks associated with on-line entry/batch processing, some companies use memo updating of the master file at the time of data entry.

Answer 1

False

Question 2

To enhance controls, it is normally desirable to have a single employee handle a transaction from beginning to end.

Answer 2

False

Question 3

Legislators and regulators establish minimum statutory and regulatory requirements for the establishment of internal controls by certain entities.

Answer 3

True

Question 4

A company's accounting system should provide a complete "chain of evidence" for every major transaction.

Question 5

All internal control systems are subject to inherent limitations.

Question 6

Computer general controls represent a lower level of controls.

Question 7

Application controls are designed to provide reasonable assurance that IT records, processes, and reports data properly for specific applications.

Question 8

Management's risk assessment for financial reporting purposes is similar to the internal auditor's concern with inherent risks.

Question 9

Internal auditors have primary responsibility for establishing and maintaining internal controls.

Question 10

The Foreign Corrupt Practices Act is administered by the Federal Trade Commission.

Question 11

Under the traditional file method of data organization, transaction files contain the details of individual transactions of the same class such as a day's credit sales or a day's cash disbursements.

Question 12

The database method of data organization is the main alternative to the traditional file method.

Question 13

Utility programs contain instructions that enable the computer to perform specific data processing tasks for the user.

Question 14

Under the Foreign Corrupt Practices Act, management and directors are both subject to fines, penalties, and/or imprisonment.

Question 15

A major focus of the accounting system is on transactions.

Question 16

It is management's responsibility to establish and maintain effective internal controls.

Question 17

The COSO report concludes that a few key people in an organization has some responsibility the organization's internal controls.

Question 18

The auditor's consideration of internal controls relates primarily to nonfinancial objectives.

Question 19

The organizational structure of a company is usually depicted graphically in an organization chart.

Question 20

The accounting records for an asset should normally be maintained by the same individual who controls that asset.

Question 21

Security measures include limiting access to storage areas to authorized personnel.

Question 22

Access controls relate to both the accounting records and the physical assets.

Question 23

Monitoring is a process that assesses the quality of the internal controls performance over time.

Question 24

Parity check involves transmitting data received by an output device back to the source unit for comparison with the original data.

Question 25

Organization and operation controls address risks related to the authorization, completeness, and accuracy of transactions.

Question 26

General controls provide a framework for controlling daily computer operations, minimizing the likelihood of processing errors, and assuring the continuity of operations in the event of a physical disaster of computer failure.

Question 27

Transactions consist of exchanges of assets and services between an entity and outside parties, as well as the transfer or use of assets and services within an entity.

Question 28

A very detailed flowchart would be prepared for the accounting system as a whole.

Question 29

Standardized internal control questionnaires are used on a minority of audits.

Question 30

The risk of misstatement is associated with changes in the content or form of information.

Question 31

The external auditor is not required to test the work of internal auditors that pertains to
obtaining an understanding.

Question 32

General authorization relates to the granting of the authorization on a case by case basis.

Question 33

A before-and-after report shows a summary of the contents of a master file before and after each update.

Question 34

A report that summarizes gross margin by region is an example of a procedure review.

Question 35

Communication includes making sure that personnel involved in the financial reporting system understand how their activities relate to the work of others inside the organization.

Question 36

The echo check involves transmitting data received by an output device back to the source unit for comparison with the original data.

Question 37

Some auditors associate controls related to recording transactions in the correct accounting period with a separate objective identified as the extension objective.

Question 38

In an audit of a small company, a narrative memorandum may serve as the only documentation of the auditor's understanding of internal controls.

Question 39

The auditor would expect a lesser degree of segregation of duties in a small company than in a large company.

Question 40

The IT Manager's primary responsibilities include maintaining custody of systems documentation, programs and files.

Question 41

Which of the following is not one of the fundamental concepts in the COSO report's definition of internal control?

A) Internal control is a process.
B) Internal control is effected by people.
C) Internal control is a guarantee.
D) Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity's management and board.
E) Internal control is geared to the achievement of objectives in the overlapping categories of financial reporting, compliance, and operations.

Question 42

Which one of the following is not an inherent limitation in an entity's internal controls?

A) mistakes in judgment
B) collusion
C) cost versus market
D) breakdowns
E) management override

Question 43

Which of the following control program development, program changes, computer operations, and access to programs and data?

A) general controls
B) application controls
C) access controls
D) process controls
E) system controls

Question 44

With which of the following data processing methods may validation checks be used and data be screened for errors at the time of entry?

A) batch entry/batch processing
B) batch entry/on-line processing
C) on-line entry/on-line processing
D) off-line entry/batch processing
E) on-line entry/batch processing

Question 45

In database management systems, an important documentation control is the data repository.

Question 46

In the example system of cash receipts, the cashier prepares the bank deposit slip and makes the daily bank deposit.

Question 47

From a control standpoint, which one of the following is a benefit of IT systems over manual systems?

A) information in machine-sensible form only
B) decrease in human involvement
C) reduction in documentation
D) consistency in processing
E) a more distinct transaction trail

Question 48

Which of the following is not one of the interrelated components of internal controls identified by the COSO report?

A) control activities
B) control environment
C) information and communication
D) regulating
E) risk assessment

Question 49

Which of the following is not one of the factors that make up the control environment?

A) accounting personnel
B) board of directors and audit committee
C) organizational structure
D) human resource policies and practices
E) assignment of authority and responsibility

Question 50

The use of a transaction log is most commonly associated with which of the following data processing methods?

A) batch entry/batch processing
B) batch entry/on-line processing
C) on-line entry/on-line processing
D) off-line entry/batch processing
E) on-line entry/batch processing

Question 51

Which of the following is not one of the characteristics of management's philosophy and operating style?

A) approach to taking and monitoring business risks
B) monitoring policies for developing and modifying accounting systems
C) conscientiousness and conservatism in developing accounting estimates
D) its attitudes and actions toward financial reporting
E) its attitudes toward information processing and accounting functions and personnel

Question 52

Which of the following systems programs perform common data processing tasks?

A) utility programs
B) operating systems
C) compilers
D) assemblers
E) database management systems

Question 53

Which of the following is a widely used data processing method?

A) batch entry/on-line processing
B) off-line entry/batch processing
C) off-line entry/on-line processing
D) off-line entry/off-line processing
E) on-line entry/batch processing

Question 54

Which of the following is an incorrect quotation from the second field work standard?

A) "A sufficient understanding..."
B) "of the internal control structure is..."
C) "to be obtained to..."
D) "plan the audit and to..."
E) "determine the nature, timing, and extent of compliance tests..."

Question 55

The Foreign Corrupt Practices Act (FCPA) is administered by the:

A) IRS.
B) SEC.
C) CIA.
D) NCFFR.
E) COSO.

Question 56

In order to emphasize the importance of integrity and ethical values among all personnel or an organization, the CEO and other top managers should do all of the following except:

A) set the tone by example.
B) communicate to all employees.
C) send email messages to all employees promoting ethical values.
D) reduce or eliminate incentives and temptations.
E) provide moral guidance to employees.

Question 57

An effective accounting system should identify and record only the valid transaction of the entity that occurred in the current period, which relates to the:

A) rights and obligations assertion.
B) presentation and disclosure assertion.
C) valuation or allocation assertion.
D) existence or occurrence assertion.
E) completeness assertion.

Question 58

Which of the following is not normally a characteristic of batch entry/batch processing in a small system?

A) processing of similar transactions together
B) audit trail in machine readable form only
C) master file update only after batch data accumulation
D) delays in correcting processing errors
E) control totals generated prior to processing

Question 59

Which of the following requires managements of pubic companies to assess the adequacy of internal controls over financial reporting and further requires their auditors to audit management's assessment of internal controls over financial reporting and the actual effectiveness of the system of internal controls?

A) Foreign Corrupt Practices Act
B) Securities Exchange Act of 1934
C) SAS 55, Consideration of the Internal Control Structure in a Financial Statement Audit
D) Section 404 of Sarbanes-Oxley
E) PCAOB Standard No. 9

Question 60

The COSO report identified five interrelated components of internal control. Since then, a sixth category has been identified, which is:

A) monitoring.
B) risk assessment.
C) information and communication.
D) control activities
E) antifraud programs and controls

Question 61

Which of the following is not a hardware and systems software control?

A) echo check
B) read after write
C) data dictionary/directory
D) dual read
E) parity check

Question 62

Which of the following is not a widely recognized type of computer general controls?

A) organization and operation controls
B) hardware and system software controls
C) access controls
D) data and procedural controls
E) information processing controls

Question 63

The least likely procedure to obtain an understanding of internal controls would be:

A) reviewing previous experience with the client.
B) inspecting documents and records.
C) confirming transactions.
D) inquiring of appropriate management.
E) observing entity operations.

Question 64

For planning purposes, obtaining an understanding of internal controls involves performing procedures to understand the design of policies and procedures and:

A) to evaluate their effectiveness.
B) to determine their impact on the audit strategy.
C) to ascertain whether they are operating as described.
D) to determine whether they have been placed in operation.
E) to assess their efficiency.

Question 65

Essential to both management and auditors is a chain of evidence in the accounting system provided by coding, cross references, and documentation connecting account balances and other summary results with original data. This chain of evidence is referred to as the:

A) control trail.
B) vouching or tracing trail.
C) system reference trail.
D) audit or transaction trail.
E) accounting trail.

Question 66

Which one of the following is a key component of a decision table?

A) conditions related to accounting transactions
B) actions taken by the computer operator
C) decision rules that are used to predict results of procedures
D) procedures executed by the computer program
E) functions completed by the accounting system

Question 67

PCAOB standards require the auditor to evaluate the effectiveness of the audit committee as part of understanding the control environment and monitoring. Which of the following is not a factor the auditor should consider in making this evaluation?

A) The audit committee's responsiveness to issues raised by the auditor.
B) The independence of the audit committee from management.
C) Compensation practices with respect to members of the audit committee.
D) The clarity with which the audit committee's responsibilities are articulated.
E) The audit committee's interaction with key members of financial management.

Question 68

When planning an audit of internal controls over financial reporting, the auditor needs a comprehensive knowledge of the company and its environment. This knowledge might include:

A) preliminary judgments about the results of operations.
B) assessments about the efficiency of operations.
C) conclusions about the effectiveness of internal controls.
D) an assessment of the effectiveness of the audit committee.
E) legal or regulatory matters of which the company is aware.

Question 69

The grandfather-father-son concept is an example of a(n):

A) systems development and documentation control.
B) hardware and systems software control.
C) access control.
D) data and procedural control.
E) general control.

Question 70

Which of the following management responsibilities is not established under PCAOB standards?

A) To present a written assessment of the effectiveness of the company's internal control over financial reporting as of the end of the company's most recent fiscal year.
B) To accept responsibility for the effectiveness of the company's internal control over financial reporting.
C) To evaluate the effectiveness of the company's internal control over financial reporting using suitable criteria.
D) To perform cost-benefit analysis with respect to internal controls relating to assertions having a material effect on the financial statements.
E) To support it's evaluation of internal control with sufficient evidence, including documentation.

Question 71

Which of the following is not an example of incompatible duties?

A) the authorized check signer prepares the bank reconciliation.
B) the individual who prepares the bank deposit also takes it to the bank.
C) the individual who approves the vouchers signs and mails the checks.
D) the warehouse manager maintains the perpetual inventory records.
E) the individual who processes cash remittances from customers also has authority to approve and record credits to customers' accounts for sales returns and allowances or write-offs.

Question 72

Input controls include controls over:

A) conversion of input data to machine-sensible form.
B) visual scanning.
C) comparison to source documents.
D) process tracing data.
E) sequence tests.

Question 73

Which of the following is not considered an access control?

A) the use of a librarian
B) management review of computer utilization reports
C) parity check
D) the use of passwords
E) limited access to data files and programs

Question 74

Management's risk assessment should include the following special consideration of the risks that can arise from changed circumstances except:

A) new personnel.
B) rapid growth.
C) new technology.
D) corporate restructurings.
E) domestic operations.

Question 75

Which one of the following is not recognized as one of the types of general controls?

A) processing controls
B) organization and operation controls
C) access controls
D) data and procedural controls
E) hardware and system software controls

Question 76

Incompatible duties are those that allow an irregularity to be perpetrated:

A) and concealed by a single employee.
B) and concealed through collusive actions.
C) by a single employee.
D) by accounting personnel.
E) and concealed by a group of two or more employees.

Question 77

An effective accounting system should measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements, which relates to the:

A) rights and obligations assertion.
B) presentation and disclosure assertion.
C) valuation or allocation assertion.
D) existence or occurrence assertion.
E) completeness assertion.

Question 78

The rekeying of all or a portion of the input data is an example of a:

A) missing data check.
B) verification control.
C) parity check.
D) limit (reasonableness) check.
E) hash total.

Question 79

The auditor's primary interest in the control environment is on the:

A) effectiveness of detailed policies and procedures that have been built into the system.
B) pervasive effects that the attitudes and actions of management may have on the effectiveness of other internal controls.
C) existence of external factors such as absentee owners and/or regulators such as the SEC.
D) impact that the economic environment will have upon client operations.
E) classes of transactions in the entity's operations that are significant to the financial statements.

Question 80

Which one of the following positions maintains custody of systems documentation, programs, and files?

A) IT Manager
B) Programmer
C) Computer Operator
D) Network Administrator
E) Librarian