Deck 8: Internal Control and COSO Framework

Question 1

Distinguish between entity level controls and transactional controls.Give an example of each.

Answer 1

Entity-level controls are controls that are implemented for multiple transaction cycles or for the entire organization.
Entity-level controls contribute to the "tone at the top" and establish expectations in the control environment.Entity-level controls are often less tangible but they form the foundation on which other internal controls are built.Entity-level controls such as controls over management override,period-end reporting,hiring competent staff,and fraud-risk controls have an impact on all other control processes.If these entity-level controls are weak or unreliable,the best designed transaction controls will not be effective in preventing key risks such as management override.
Transaction controls are controls that are implemented for specific transaction risks and are designed to specifically prevent or detect and correct misstatements in classes of transactions,account balances,or disclosures and their related assertions.
The accuracy of the results of the accounting system (the account balances)is heavily dependent upon the accuracy of the inputs and processing (the transactions).For example,if products sold,units shipped,or unit-selling prices are incorrectly billed to customers for sales,both sales and accounts receivable will be misstated.If controls are adequate to ensure that billings,cash receipts,sales returns and allowances,and charge-offs are correct,the ending balance in accounts receivable is likely to be correct.

Question 2

The Sarbanes Oxley Act has had consequences for many areas of corporate activities,including the following impact on the work of the auditor:

A)The auditor is now required to report all fraudulent activities he/she uncovers directly to the Securities and Exchange Commission.
B)The auditor must prepare a report verifying the information in the financial statements.
C)The auditor must monitor how well management is carrying out its financial reporting responsibilities.
D)The auditor is specifically required to assess and report on the effectiveness of internal control over financial reporting.

Answer 2

D

Question 3

Who is responsible to identify and assess the risks and then manage and mitigate those risks by the implementation of a strong system of internal control?

A)management
B)external auditors
C)internal auditors
D)shareholders

Answer 3

A

Question 4

Joan is the owner of a small manufacturing company.In prior years,your firm has conducted a review engagement of the company.However,this year,Joan obtained a loan from the federal business development bank and is required to have an audit of her financial statements.When you started asking about controls and procedures at the company,Joan got pretty upset.
"All you need to be concerned about is the numbers! Why are you asking all of these questions? It takes too much time away from my staff to answer these questions! Just check the numbers and let us get on with our work!"
You calmed her down a bit,and reminded her about the general discussion that occurred with the engagement letter.You have invited her for coffee to briefly explain the following items:
1.Why auditors are concerned about internal controls.
2.Why auditors are required to be concerned about internal controls.
3.What you need to do to understand internal controls.
4.What you will do once you have documented your understanding of internal controls.
Required:
Explain what you will say to Joan.

Question 5

A system of internal control consists of policies and procedures designed to provide management with

A)reasonable assurance that the company achieves its objectives.
B)assurance that fraud will be prevented.
C)reasonable assurance that fraud will be detected.
D)assurance that the firm's resources will be used in the optimal way.

Question 6

Which of the following controls would not be of concern to the auditor?

A)controls over the collection of accounts receivable amounts
B)controls over the entry of payroll wage rates into the computer systems
C)controls over health and safety guidelines compliance by employer
D)controls over the cost of inventory items as recorded in the perpetual inventory system

Question 7

Management's objectives with respect to internal control include

A)having reasonable assurance that the financial statements are in accordance with IFRS or ASPE.
B)ensuring that all policies and procedures are clearly documented to reduce employee training costs.
C)preventing fraud and illegal activities at all costs.
D)providing reasonable assurance that the company can achieve its objectives and goals.

Question 8

Which of the following controls would be of concern to management but not to the auditor?

A)controls over the collection of accounts receivable amounts
B)controls over the entry of payroll wage rates into the computer systems
C)controls over health and safety guidelines compliance by employer
D)controls over the cost of inventory items as recorded in the perpetual inventory system

Question 9

To comply with auditing standards,the auditor need not be concerned with all areas of internal control that apply to management.The auditor's primary concerns are with the system's ability to

A)maintain reliable control systems pertaining to financial transactions.
B)promote efficiency and encourage adherence to policy.
C)prevent and detect financial statement fraud and error.
D)provide reliable data and safeguard assets.

Question 10

Which is one aspect of management's assessment of internal control over financial reporting?

A)Have the external auditors document the internal control over financial reporting.
B)Have the external auditors test the effectiveness the internal control over financial reporting.
C)Evaluate the design of internal control over financial reporting.
D)Evaluate the design of the payroll system.

Question 11

Internal controls can never be regarded as completely effective.Even if systems personnel could design an ideal system,its effectiveness depends on the

A)adequacy of the computer system.
B)proper implementation by management.
C)ability of the internal audit staff to maintain it.
D)competency and dependability of the people using it.

Question 12

The essence of an effectively controlled organization lies in the

A)effectiveness of its auditor.
B)effectiveness of its internal auditor.
C)attitude of its employees.
D)attitude of its management.

Question 13

Carrie is the manager of the Bay Street Pharmacy.Carrie is considering implementing a security tag system to reduce the losses related to stolen goods at their store.The system Carrie is looking at currently costs $60 000 and is expected to be effective for 5 years.In order to justify the implementation of the security tag system,average theft per year should be at least

A)$1000.
B)$12 000.
C)$60 000.
D)Theft should be prevented at all costs.

Question 14

An act of two or more employees to work together to misstate records is called

A)malfeasance.
B)collusion.
C)defalcation.
D)felony.

Question 15

The accuracy of the results of the accounting system (account balances)is heavily dependent upon the

A)knowledge and skills of the auditor.
B)adequacy of the entity-level controls.
C)accuracy of the inputs and processing (the transactions).
D)training provided to the personnel.

Question 16

Which of the following best describes the inherent limitations that should be recognized by an auditor when considering the potential effectiveness of an accounting system?

A)Procedures whose effectiveness depends on segregation of duties can be circumvented by collusion.
B)The competence and integrity of client personnel provides an environment conducive to accounting control and provides assurance that effective control will be achieved.
C)Procedures designed to assure the execution and recording of transactions in accordance with proper authorizations are effective against irregularities perpetrated by management.
D)The benefits expected to be derived from an effective accounting system usually do not exceed the costs of such control.

Question 17

A)Describe the three basic concepts (assumptions)underlying the study of internal control and assessment of control risk.B)Describe the inherent limitations of internal control.

Question 18

The control environment consists of actions,policies,and procedures that

A)reflect the overall attitudes of top management,the directors,and the owners of an entity about control and its importance.
B)govern access to particular applications,such as how employees use passwords to change master file payroll rates.
C)are recorded on the web site (for example,access policies to data).
D)help implement the ethical attitudes at the organization,such as a computer usage policy.

Question 19

A)Describe the four broad objectives of management when designing an effective system of internal control.B)Describe the aspect of internal control that auditors are primarily concerned with for a financial statement audit.

Question 20

Define a system of internal control.How does risk affect a system of internal control?

Question 21

Management safeguards assets by

A)having the internal auditors conduct periodic counts of physical assets.
B)controlling access and by comparing physical items to records.
C)requiring the external auditors to do surprise audits.
D)having management sign a management representation letter.

Question 22

Which of the following duties would indicate a weakness in internal controls?

A)The accounting function is under the controller.
B)The custodianship of cash is the responsibility of the treasurer's function.
C)The internal auditor reports to the board of directors.
D)The custodianship of buildings and equipment is the responsibility of the controller's function.

Question 23

Management assesses risks as a part of designing and operating internal controls to minimize fraud and errors.Auditors assess risks to

A)decide the evidence needed in the audit.
B)fully implement the audit risk model.
C)enable them to assess the completeness of internal controls.
D)make sure that the company will continue to operate over the next year.

Question 24

The chart of accounts is an important control because it provides the framework for determining the information presented to management and other financial statement users.What type of error is the chart of accounts helpful in preventing?

A)errors of occurrence
B)errors of completeness
C)errors of accuracy
D)errors of classification

Question 25

FiddleWare Limited uses a purchased software package to handle the processing of its transactions.An important control that management should implement with respect to information systems is the

A)use of a formal systems development methodology.
B)evaluation of potential new systems against organizational objectives.
C)use of appropriate checkpoints and milestones during development.
D)tracking of routine program maintenance changes.

Question 26

The operational responsibility and the recording of transactions are normally kept separate

A)to centralize activities in order to be more cost efficient.
B)to ensure unbiased information is recorded.
C)because operational personnel rarely have the necessary accounting skills to record transactions.
D)to avoid confusion of responsibilities and duplication of efforts.

Question 27

Bravo Design had IMB consulting provide them with a service center to record the job costs and sales in progress.What process did Bravo Design follow?

A)in-house development
B)systems acquisition
C)outsourcing
D)turnkey software development

Question 28

Which of the following is an example of a general authorization?

A)The highest credit limit allowed for accounts receivable is $50 000.
B)ABC Company has a credit limit of $25 000.
C)Each supervisory wage rate must be approved by the executive manager.
D)Grocery supervisors approve each transaction reversal over five dollars.

Question 29

It is important for the public accountant to consider the competence of the audit clients' employees because their competence bears directly and importantly upon the

A)cost/benefit relationship of internal controls.
B)achievement of the objectives through effective internal controls.
C)comparison of recorded accountability with assets.
D)timing of the tests to be performed.

Question 30

Which one of the following is an example of a specific authorization?

A)The computer systems automatically reorder inventory when quantities fall below the economic order quantity.
B)The highest credit limit allowed for accounts receivable customers is $100 000.
C)Each sales transaction that exceeds the credit limit of a customer must be approved by the controller.
D)Grocery sales clerks may approve returns of goods less than ten dollars in value.

Question 31

An example of general computer control systems that provide reasonable assurance of authorization of application systems is

A)operations and information systems support.
B)systems,acquisition,development,and maintenance controls.
C)organization and management controls.
D)application system control procedures.

Question 32

Why is it important to separate systems development (or acquisition)and program maintenance activities from accounting?

A)Accounting personnel have the expertise to evaluate program changes that have been implemented.
B)Custody of media is important to help ensure ongoing operations.
C)This allows accounting to reconcile transaction totals to transaction details.
D)Lack of separation could result in unauthorized changes to programs and systems.

Question 33

The first step for management in the risk assessment process is to identify factors that may increase risk,for example failure to meet prior objectives.Then,management will

A)assess the likelihood of the risk occurring.
B)make sure that procedures are developed to eliminate the risk.
C)estimate the significance of that risk.
D)develop specific actions to reduce the risk to an acceptable level.

Question 34

A well-designed organizational structure at an entity

A)has operations and programming personnel tasks combined.
B)clearly defines authority and responsibility assignments.
C)requires that wage rates are recorded and tracked by the human resources department.
D)has the internal audit department report to the Chief Financial Officer.

Question 35

An important type of protective measure for safeguarding assets and records is

A)adequate segregation of duties among personnel.
B)proper authorization of transactions.
C)the use of physical precautions.
D)adequate documentation.

Question 36

External auditor Maryann Smith may not rely on the work of internal auditor Raymond Jones unless

A)Jones is certified (CA,CGA,or CMA).
B)Jones is independent of the client.
C)Jones is supervised by Smith.
D)Smith obtains evidence that supports the competence,integrity,and objectivity of Jones.

Question 37

The board of directors is essential for effective corporate governance because it has ultimate responsibility to

A)make sure management implements proper internal control and financial reporting processes.
B)assist management in the preparation of the financial statements.
C)test internal controls and ensure they are working properly.
D)provide a report to the auditor confirming that internal controls are working properly.

Question 38

To help with corporate governance and a positive "tone at the top," the board of directors and its committees,such as the audit committee,should

A)rubber-stamp the financial statements once per year.
B)consist of all members of executive management.
C)follow the policies and procedures approved by management.
D)take an active role in overseeing the company.

Question 39

The methods that management uses to enforce accountability over internal controls are called

A)personnel practices.
B)performance measures.
C)control testing.
D)management's operating style.

Question 40

An essential characteristic of the persons performing internal check procedures is

A)independence from the original data preparer.
B)a thorough knowledge of accounting.
C)an analytical and inquisitive mind.
D)competence in data entry skills.

Question 41

You,a PA,have been assigned as the in-charge auditor of a long-time audit client of your firm,Mikla Tool Inc.(MTI).MTI is owned by George Mikla,an experienced machinist.George established the business over 20 years ago,and it has grown into a $10-million-a-year business with an excellent reputation for high quality machined parts.MTI has regular clients in the automobile parts sector and in the healthcare sector.The company has recently begun producing parts for environmentally friendly products such as recycling containers.The business is versatile in dealing with a variety of metals as well as plastics,using both manually controlled and machine controlled (computerized)equipment.The following description is based on your review of prior files,and planning discussions with personnel at MTI.
Equipment suppliers have helped MTI develop efficient operations by providing sample programs for standard operations and by providing training to employees.One of the suppliers unfortunately sent sample programs that had been infected by a virus.George's daughter,Tiffany,had to cleanse the servers and each of the machines of the malicious software.When contacted,the supplier did not know that the software was infected and apologized profusely.
The company's four CAD/CAM terminals and printers are connected to the company's central local area network.The local area network is maintained by Toni Lee,the owner of a computer shop conveniently located three blocks away.All computer equipment,software,and supplies are now purchased from Mr.Lee,who is responsible for installing and maintaining equipment,upgrading software,and maintaining user profiles on the network.To reduce the amount of Mr.Lee's work as network administrator,he has set up passwords by function.
There is one user identification code (userid)and password for accounting (shared by Tiffany,George,and the accounting clerk,Isabel).The plant supervisors share another userid that is used for production control and to initiate the time-keeping system every morning.A separate userid and password allowing for only enquiry into the job costing system has also been set up and can be used by all employees.
A standard routine has been set up to back up the accounting systems.Either Tiffany or the accounting clerk inserts one of seven tape cartridges into the system at the end of the day (they are labelled with the day of the week),so that the company has a full set of accounting backups for the week.Tiffany keeps the backup files in her office.These are particularly important,since during the last office move,two years ago,the original software for the accounting system was misplaced.
The network has two central servers,eleven user stations,and five printers.The user stations are set up as follows: four CAD/CAM,two time-keeping,two production planning and control,two accounting,and one for George.
A good working relationship is extremely important for satisfying some of the company's larger customers.MTI has paid for computer equipment for each of the supervisors so that they have fully functioning computers at home.If a rush job requires weekend work,these senior personnel can work at home to get the necessary quoting or design work completed.Since the at-home systems are identical to the office systems,Mr.Lee simply copied the MTI systems to the home computers.Files can be easily taken home and then brought back to the office using thumb drives.It is understood that when times are slower,a day off can be taken to compensate for this weekend work.
It has been almost 10 years since Tiffany arranged for the implementation of the network and the purchase of the standard integrated accounting packages (general ledger,order entry/accounts receivable,purchases/payable and payroll),and for the purchase of the job-costing and time-keeping systems.A variety of reports are printed daily,weekly,or monthly from the job-costing system.These reports are used for monitoring employee hours,the status of the jobs,the costs accumulated for particular jobs,and the work-in-progress inventory.
The weekly report of hours from the job-costing system is approved by the production supervisors and is used as an input source for hours worked into the payroll system.The accounting clerk enters the hours into the accounting system so that weekly payroll cheques and reports can be produced.The accounting clerk handles most data entry.
Tiffany is really pleased with their accounting clerk,Isabel,who has been with the company for three years.She insists that fate had a hand in getting Isabel working for MTI.Isabel had been "pounding the pavement," having recently immigrated,and had no Canadian business experience.Her accounting skills were rudimentary but she quickly learned the accounting software and has reorganized the filing systems.Tiffany considers her as indispensable.When Isabel goes on holiday,many things just don't get done! Tiffany can do the payroll in a pinch,but accounts payable and cash disbursements are always done by Isabel.If she's away,suppliers are simply told to wait,or Tiffany issues a manual cheque for recording later.Isabel is very good at clearing queries from suppliers and ensuring that new suppliers are set up properly.The purchasing supervisor and his staff rely on Isabel,as she checks the account allocation of purchases and makes any necessary corrections.
Tiffany or George are signing officers,although Tiffany realizes that she checks supporting materials more thoroughly than George,who usually just queries Isabel verbally about larger purchases.
In the past,MTI's audit has been entirely substantive.However,your partner has decided that with MTI's growth,it is time for the company to consider adding additional internal controls.Accordingly,he has asked you to draft a management letter to be addressed to George and Tiffany.
Required: A)Prepare a draft management letter,clearly identifying the weaknesses (W),impact or implications of the weaknesses (I),and recommendations for improvement (R).
[The following is a theory question that does not require examples from the case,although examples could be used.] B)Explain how the control environment and general IT (information technology)controls are related.Describe the impact of the control environment and of general IT controls on different types of application controls and on the audit process.

Question 42

Public key encryption uses

A)four keys.
B)three keys.
C)one key.
D)two keys.

Question 43

HomeTown Tanning Company is the largest leather tanning operation in Canada.Hides from various animals are stretched and treated,then cut into shapes for shipment to wholesalers.
Computer-assisted operations are important in maintaining temperature,humidity,and proper mix proportions in chemical solutions used for the tanning process.Computer assistance has helped improve the quality of the tanning process,as well as provide a safer environment for employees.Computer operations and backup are supported by the warehouse manager,Joe.
Individual hides are tagged with a bar code and tracked for quality control purposes.The HomeTown Tanning Company uses a centralized microcomputer-based system for its manufacturing and accounting operations.The two owners of the company are active in the business and approve all new hardware and software acquisitions.
The controller is responsible for network upgrades as well as for maintaining passwords and user identification codes on the network.Accounting transactions are entered by accounting staff,although the controller has the ability to review and correct transactions.
Required:
List the six categories of functions that need to be separated from each other.Does HomeTown Tanning have these functions separated? For any functions that are not separated,indicate the potential impact upon controls and upon the audit.

Question 44

For large companies,what is essential for effective monitoring of internal controls?

A)competent external auditors
B)competent fraud department
C)competent accounting department
D)competent internal audit department

Question 45

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by

A)employment of temporary personnel to aid in the segregation of duties.
B)direct participation by the owner of the business in the record-keeping activities of the business.
C)engaging a public accountant to perform monthly "write-up" work.
D)delegation of full,clear-cut responsibility to each employee for the functions assigned to each.

Question 46

Dimple Leather is a chain of retail stores that sells leather clothing and accessories across Canada.Each store has point-of-sale equipment that is linked to a local server.At night,local accounting information is transmitted to the head office computer and any updates to prices or other adjustments are transferred to the local office.
Required:
Define the control environment.List the components of the control environment.For each component,provide an example of a control that might exist at Dimple Leather.

Question 47

A firewall allows the organization to

A)monitor network hot spots for signs of intruders.
B)prevent known spyware and malware from entering the system.
C)support identity management initiatives.
D)prevent unauthorized communication both into and out of the network.

Question 48

As a first time auditor of a small company,what will be your strategy to obtain an understanding of internal controls of the company?

A)as the company is small,defer the procedure to understand internal controls until next year
B)conduct the procedure of understanding internal controls in the current year
C)rely on the verbal assurance from management that internal control exists
D)get the company employees to test the internal controls for you

Question 49

A)List the four types of general computer control systems.B)Adequate segregation of duties is an important control procedure.Describe the specific functions that should be separated for segregation of duties to prevent both intentional and unintentional misstatements that are of significance to auditors.C)Adequate documents and records are important for effective internal control.Five principles dictate the proper design and use of documents and records.One principle is that documents and records should be prenumbered consecutively to facilitate control over missing documents and to aid in locating documents when they are needed at a later date.Discuss each of the other four principles of adequate documents and records.

Question 50

A)Discuss what is meant by the term "control environment" and identify four control environment subcomponents that the auditor should consider.B)List the steps that management follows in assessing risks relevant to the preparation of financial statements in conformity with an applicable financial reporting framework.C)How does the auditor obtain knowledge about management's risk assessment process? D)Explain how management's risk assessment process differs from the auditor's risk assessment process.E)What is the relationship between management's risk assessment process and audit evidence?

Question 51

A major control available in a small company,which might not be feasible in a large company,is

A)a wider segregation of duties.
B)use of sequentially numbered documents.
C)fewer transactions to process.
D)the owner-manager's personal interest in and close relationship with personnel.

Question 52

An employee who communicates improprieties is called a

A)spy.
B)tipster.
C)informer.
D)whistleblower.

Question 53

A)The COSO internal control framework consists of five components.Describe each of these components. B)Custody of assets and reconciliation should be separated to contribute to strong internal control.List the general categories of activities that should be separated.