Deck 4: Internal Control, Control Risk, Section 404 Audits, Fraud Auditing, and the Impact of Information Technology on the Audit Process

Question 1

Internal controls can never be considered as absolutely effective because:

A) controls are designed to prevent and detect only material misstatements.
B) internal controls prevent separation of duties.
C) not all organizations have internal audit departments.
D) their effectiveness is limited by the competency and dependability of employees.

Answer 1

their effectiveness is limited by the competency and dependability of employees.

Question 2

Which of the following parties provides an assessment of the effectiveness of internal control over financial reporting for U.S. public companies?

Answer 2

B

Question 3

An act of two or more employees to steal assets or misstate records is frequently referred to as:

A) a control deficiency.
B) collusion.
C) a material weakness.
D) a significant deficiency.

Answer 3

collusion.

Question 4

Which section of the Sarbanes- Oxley Act requires management to issue an internal control report?

A) 408.
B) 202.
C) 404.
D) 203.

Question 5

When management is evaluating the design of internal control, management evaluates whether the control can do which of the following?

Question 6

Internal control reports issued by public companies must identify the framework used to evaluate the effectiveness of internal control. Which of the following is the most common framework in the U.S.?

A) Enterprise Internal Control - COSO.
B) Effective Internal Control Framework - AICPA.
C) Enterprise Internal Control - AICPA.
D) Internal Control - Integrated Framework - COSO.

Question 7

The auditor's tests to understand the client's internal controls might include which of the following types of procedures?

Question 8

The initial presumption in the audit of a public company is that control risk is:

A) moderate.
B) low.
C) high.
D) low or moderate, but not high.

Question 9

In the audit of a private company, an auditor will test controls when control risk is initially assessed at:

Question 10

The auditor's consideration of a private company's internal control is:

A) recommended by most capital market authorities.
B) required by ISA 315.
C) required by IFAC's Code of Ethics.
D) required by IFRS.

Question 11

Which of the following factors may increase risks to an organization?

Question 12

Which of the following is correct?

A) Approval should be given by the employee responsible for recording the transaction.
B) Authorization is a policy decision for either a general class of transactions or specific transactions.
C) Approval is a policy decision implemented by employees.
D) Approval occurs as a matter of general policy and includes significant transactions only.

Question 13

Which of the following principles is not necessary for the proper design and use of documents and records?

A) Designed for multiple uses to increase efficiency of operations.
B) Prepared at the time a transaction takes place.
C) Designed for a single use to increase efficiency of operations.
D) Constructed in a manner that encourages correct preparation.

Question 14

Which of the following is not one of the levels of an absence of internal controls?

A) Material weakness.
B) Control deficiency.
C) Significant deficiency.
D) Major deficiency.

Question 15

To determine if significant internal control deficiencies are material weaknesses, they must be evaluated on their:

Question 16

The purpose of an entity's accounting information and communication system is to:

Question 17

Which of the following is correct?

A) A control deficiency is always a material weakness.
B) A material weakness is always a significant deficiency.
C) A material weakness is less significant that a control deficiency.
D) A significant deficiency is always a material weakness.

Question 18

Which of the following is not a likely procedure to support the operating effectiveness of internal controls?

A) Inquiry of client personnel.
B) Completing an internal control questionnaire.
C) Reperformance of client procedures.
D) Observation of control- related activities.

Question 19

Before making the final assessment of internal control at the end of an integrated audit, the auditor must:

Question 20

Compared to a public company, the most important difference in a nonpublic company in assessing control risk is the ability to assess control risk at ________ for any or all control- related objectives.

A) moderately low
B) high
C) low
D) medium

Question 21

To be effective, an internal audit department must be independent of:

A) operating departments.
B) the accounting department.
C) both A and B.
D) either A or B, but not both.

Question 22

Briefly describe the responsibilities of management and external auditors for internal controls.

Question 23

During a financial statement audit of a private company, three steps must be completed by the auditor before concluding that control risk is low. What are these steps?

Question 24

What are the two primary factors that auditors consider in determining if an entity is auditable?

Question 25

Match each of the definition with the following terms

-Management's ongoing and periodic assessment of the quality of internal control performance to determine that controls are operating as intended and modified when needed.

A) Control environment
B) Control activities
C) Independent checks on performance
D) Internal control
E) Monitoring
F) Separation of duties
G) General authorization
H) Specific authorization
I) Risk assessment

Question 26

Which of the following is a category of fraud?

Question 27

With respect to fraudulent financial reporting, most frauds involve:

Question 28

________ involves deliberate actions taken by management to meet earnings objectives.

A) Expenditure management
B) Earnings management
C) Top- line management
D) Management- by- objective

Question 29

Which of the following is one of the conditions for fraud described in the fraud triangle?

Question 30

Fraudulent financial reporting may be accomplished through the manipulation of:

A) liabilities.
B) revenues.
C) assets.
D) all of the above

Question 31

The most common technique used by management to misstate financial information is:

A) improper revenue recognition.
B) understatement of liabilities.
C) understatement of assets.
D) overstatement of expenses.

Question 32

Which of the following statements describes circumstances that underlie employee incentives to misappropriate assets?

A) Weak internal controls encourage employees to take chances.
B) Dissatisfied employees may steal from a sense of entitlement.
C) Employees have a vested interest in making the company's financial statements erroneous.
D) If management cheats customers and gets away with it, then employees believe they can do the same to the company.

Question 33

Which of the following issues is normally part of the 'brainstorming' session required by ISA 240 and 315?

Question 34

Sources of information gathered to assess fraud risks usually do not include:

A) review of memorandum and articles of association.
B) communication among audit team members.
C) analytical procedures.
D) inquiries of management.

Question 35

ISA 230 requires auditors to document which of the following matters related to the auditor's consideration of material misstatements due to fraud?

A) Reasons supporting a conclusion that there is not a significant risk of material improper expense recognition.
B) Procedures performed to obtain information necessary to identify and assess the risks of material fraud.
C) Results of the internal auditor's procedures performed to address the risk of management override of controls.
D) Discussions with management regarding separation of duties.

Question 36

After fraud risks are identified and documented, the auditor should evaluate factors that ________ fraud risk before developing an appropriate response to the risk of fraud.

A) increase or decrease
B) increase
C) enhance
D) reduce

Question 37

As part of the brainstorming sessions, auditors are directed to emphasize:

Question 38

Auditor responses to fraud risks include which of the following?

Question 39

As part of designing and performing procedures to address management override of controls, auditors must perform which of the following procedures?

Question 40

For inquiry to be effective, auditors need to be skilled at listening and ________ an interviewee's response to questions.

A) remembering
B) evaluating
C) recording
D) transcribing

Question 41

This type of inquiry often elicits 'yes' or 'no' responses to the auditor's questions.

A) Assessment
B) Declarative
C) Interrogative
D) Informational

Question 42

Which of the following non- verbal cues is a sign of stress?

A) Avoiding eye contact.
B) Leaning away from the auditor, usually toward the door or window.
C) Crossing one's arms or legs.
D) Each of the above is a sign of stress.

Question 43

Management is responsible for:

Question 44

List and briefly describe the three conditions for fraud arising from fraudulent financial reporting and misappropriation of assets as described in ISAs 240, 315 and 450.

Question 45

Briefly discuss the discussions required by ISAs 240 and 315 within the audit team to consider fraud. Be sure to include a list of issues that should be addressed in these discussions.

Question 46

List and briefly describe examples of risk factors for each condition of fraud for misappropriation of assets.

Question 47

What matters related to their consideration of fraud must auditors document according to ISA 230?

Question 48

Information and idea exchange sessions are required by ISAs 240 and 315.

Question 49

ISAs 240 and 315 does not specifically indicate which members of an audit engagement team must attend a brainstorming session.

Question 50

One significant risk related to an automated environment is that auditors may ________ information provided by an information system.

A) not place enough reliance on
B) not understand
C) reveal
D) place too much reliance on

Question 51

Which of the following is not a category of an application control?

A) Processing controls.
B) Input controls.
C) Hardware controls.
D) Output controls.

Question 52

Which of the following is a category of general controls?

A) Output controls.
B) Input controls.
C) Physical and online security.
D) Processing controls.

Question 53

________ involves implementing a new system in one part of the organization, while other locations continue to use the current system.

A) Parallel testing
B) Pilot testing
C) Online testing
D) Control testing

Question 54

Which of the following statements about general controls is not correct?

A) Programmers should have access to computer operations to aid users in resolving problems.
B) Disaster recovery plans should identify alternative hardware to process company data.
C) Successful IT development efforts require the involvement of IT and non- IT personnel.
D) The chief information officer should report to senior management and the board.

Question 55

Which of the following is not an example of an applications control?

A) An equipment failure causes system downtime.
B) There is a preprocessing authorization of the sales transactions.
C) There are reasonableness tests for the unit selling price of a sale.
D) After processing, all sales transactions are reviewed by the sales department.

Question 56

Which of the following is not a general control?

A) Adequate program run instructions for operating the computer.
B) Reasonableness test for unit selling price of a sale.
C) Separation of duties between programmer and operators.
D) Equipment failure causes error messages on monitor.

Question 57

Which of the following is not one of the three categories of testing strategies when auditing through the computer?

A) Embedded audit module.
B) Test data approach.
C) Pilot simulation.
D) Parallel simulation.

Question 58

Companies with non- complex IT environments often rely on microcomputers to perform accounting system functions. Which of the following is not an audit consideration in such an environment?

A) Vulnerability to viruses and other risks.
B) Excess reliance on automated controls.
C) Unauthorized access to master files.
D) Limited reliance on automated controls.

Question 59

Because general controls have a ________ effect on the operating effectiveness of application controls, auditors must consider general controls.

A) mitigating
B) worsening
C) nominal
D) pervasive

Question 60

________ link equipment in large geographic regions.

A) Local area networks (LANs)
B) Wide area networks (WANs)
C) Cosmopolitan area networks (CANs)
D) Virtual area networks (VANs)

Question 61

What tools do companies use to limit access to sensitive company data?

Question 62

Which of the following is not a general control?

A) Hardware controls.
B) The plan of organization and operation of IT activity.
C) Processing controls.
D) Procedures for documenting, reviewing, and approving systems and programs.

Question 63

Service center auditors do not issue which of the following types of reports?

A) Report on implemented controls.
B) Report on controls that have been implemented and tested for design effectiveness.
C) Report on controls that have been implemented and tested for operating effectiveness.
D) Each of the above is issued.

Question 64

Discuss the circumstances that must exist for the auditor to 'audit around the computer.

Question 65

Why do businesses use networks? Describe a local area network and a wide area network.

Question 66

What types of reports may be issued by a service organization auditor? Which of these is likely to be used by an auditor performing an audit of a public company?

Question 67

Inherent risk is often reduced in complex IT systems relative to less complex IT systems.

Question 68

Programmers should not have access to transaction data.

Question 69

Knowledge of both general and application controls is not particularly crucial for auditors of public companies.

Question 70

When the auditor decides to 'audit around the computer,' there is no need to test the client's IT controls or obtain an understanding of the client's internal controls related to the IT system.