Deck 3: Risk Management and Internal Controls

Question 1

What type of process is implemented by management to mitigate risks?

A) External controls
B) Internal controls
C) External regulations
D) Internal regulations

Answer 1

Internal controls

Question 2

A company's process of implementing internal control provides reasonable assurance that

A) financial statements are fairly presented.
B) operations are efficient and effective.
C) laws and regulations are being followed.
D) All of these answer choices are correct.

Answer 2

All of these answer choices are correct.

Question 3

In what ways do companies address risk?

A) Mitigating it
B) Transferring it
C) Avoiding it
D) All of these answer choices are correct.

Answer 3

All of these answer choices are correct.

Question 4

Which of the following is the most commonly used response to risk by businesses?

A) Accepting it
B) Mitigating it
C) Transferring it
D) Avoiding it

Question 5

The first consideration for reliable accounting information includes ensuring the

A) security of the accounting information system.
B) privacy of the accounting information system.
C) integrity of the accounting information system.
D) All of these answer choices are correct.

Question 6

Proper internal controls can

A) safeguard assets from theft and waste.
B) increase operating efficiency.
C) provide investors with reassurance.
D) All of these answer choices are correct.

Question 7

Internal controls

A) are mandated for public companies.
B) may be adopted voluntarily.
C) provide reasonable assurance, not absolute mitigation.
D) All of these answer choices are correct.

Question 8

Internal controls

A) are defined based on industry specifications.
B) are customized to fit a company's unique risks and risk appetite.
C) are predefined for public companies.
D) All of these answer choices are correct.

Question 9

Internal controls for accounting information focus on

A) safeguarding equity from theft.
B) providing quality information to management and stakeholders.
C) lessening the risk of fraudulent investor activity.
D) All of these answer choices are correct.

Question 10

The functions of internal controls are to do which of the following?

A) Process, defend, correct
B) Prevent, detect, control
C) Prevent, detect, correct
D) All of these answer choices are correct.

Question 11

Which type of internal control seeks to stop problems from occurring?

A) Preventative controls
B) Detective controls
C) Corrective controls
D) All of these answer choices are correct.

Question 12

Charles audits the internal controls of Devinshire Corporation and finds that Devinshire lacks a robust firewall to prevent unauthorized access to their computer network. Charles recommends that Devinshire research and implement a more robust firewall as a

A) preventative control.
B) detective controls.
C) corrective control.
D) All of these answer choices are correct.

Question 13

The American Institute of Certificate Public Accountants describes this as a basic building block of internal control.

A) Preventative controls
B) Ensuring the security, privacy, and integrity of the AIS
C) Management override
D) Separation or segregation of duties

Question 14

Segregation of duties ensures that

A) one employee authorizes and records data for a transaction to ensure accuracy.
B) the work of one employee acts as a check on the work of another employee.
C) employees have access to input, approve, and receive goods into the AIS.
D) All of these answer choices are correct.

Question 15

Jon works as a purchasing manager. Jon must approve purchase orders input throughout the company before the order is placed. Which duty is Jon performing in his role?

A) Recording
B) Authorizing
C) Custody
D) Segregation

Question 16

Which type of control monitors business processes to identify problems like fraud risk, quality control, or legal compliance?

A) Preventative
B) Detective
C) Corrective
D) All of these answer choices are correct.

Question 17

Which of the following is NOT an example of a detective control?

A) A firm performs a physical inventory count monthly and compares the count to totals in the inventory system.
B) Store managers count the cash drawer nightly and reconcile the cash with sales for the day.
C) A manufacturing firm requires that purchases are recorded, approved, and received by different employees.
D) An accounting firm programs the digital dashboard to show abnormal account balances in bold red to draw attention to them.

Question 18

Jose requires that the night manager responsible for closing the restaurant count the cash drawer and reconcile the total with cash sales for the day. Which type of control did Jose implement?

A) Preventative
B) Detective
C) Corrective
D) All of the answer choices are correct.

Question 19

Which of the following statements concerning corrective controls is TRUE?

A) Corrective controls change undesirable outcomes.
B) Corrective controls occur after a risk has become a reality.
C) Corrective controls are used as a backup plan when preventative or detective controls fail.
D) All of these answer choices are correct.

Question 20

Which of the following reasons can lead to the failure of internal controls?

A) Management override
B) Human judgment
C) Collusion
D) All of these answer choices are correct.

Question 21

Which of the following is an example of a corrective control?

A) An employee is disciplined for not following procedures.
B) IT updates and patches software regularly.
C) Management oversees and updates company policies.
D) All of these answer choices are correct.

Question 22

Which of the following represents the time-based model of controls for technology attacks?

A) P > (D + C)
B) C < (P + D)
C) D > (P + D)
D) P < (D + C)

Question 23

Which of the following functions as a preventative, detective, and corrective control simultaneously?

A) Locked doors
B) Security cameras
C) Firewall
D) Security guard

Question 24

Internal controls are classified by

A) function and technology.
B) physical and computer.
C) function and where in a business process the control exists.
D) technology and where in a business process the control exists.

Question 25

Which of the following types of controls governs human activities?

A) Physical controls
B) IT general controls
C) IT application controls
D) All of these answer choices are correct.

Question 26

Which of the following controls is an example of an IT general control?

A) Business continuity plan
B) Password policy
C) Separation of duties
D) Motion sensors

Question 27

Systems roles that enforce separation of duties is an example of a(n)

A) physical control.
B) IT general control.
C) IT application control.
D) All of these answer choices are correct.

Question 28

Which of the following are subject to IT general controls?

A) Email
B) Benefits management system
C) Time-keeping software
D) All of these answer choices are correct.

Question 29

Alfonso is asked to make recommendations on what kinds of IT general controls the company should implement to prevent any disruption of services. How should Alfonso begin his analysis?

A) Alfonso should create a detailed list of risks to the system.
B) Alfonso should recommend a firewall.
C) Alfonso should review the business continuity plan.
D) Alfonso should create system roles to enforce separation of duties.

Question 30

Detective network activity monitoring is an example of a(n)

A) physical control.
B) IT general control.
C) IT application control.
D) All of these answer choices are correct.

Question 31

When a control applies specifically to a software tool and the business processes and accounts that are linked to it, this control is classified as a(n)

A) physical control.
B) IT general control.
C) IT application control.
D) All of these answer choices are correct.

Question 32

Cox Enterprises tested a trial of working from home in response to a pending threat. The successful trial became part of Cox's business continuity plan. How would you classify Cox's controls?

A) Preventative and physical
B) Corrective and physical
C) Preventative and IT general
D) Corrective and IT general

Question 33

Which of the following methods of control yields increased reliability and consistency?

A) Manual
B) Automated
C) IT general
D) IT application

Question 34

Which of the following methods of controls is implemented when human judgment or physical interaction is required?

A) Manual
B) Automated
C) Physical
D) IT general

Question 35

Which type of control has a higher risk of failure?

A) Manual
B) Automated
C) IT general
D) IT application

Question 36

Rural Enterprises raises sheep and cattle for meat production. As a technologically advanced ranching operation, Rural Enterprises has experimented with using drones to capture images of herds grazing to assist employees in obtaining physical inventory counts. Employees then count the animals in the images and record the data in the information system. What type of control classification best characterizes Rural's inventory system?

A) Manual control
B) Automated control
C) Combination of manual and automated controls
D) Continuous monitoring

Question 37

Which type of control is less susceptible to override and judgment errors?

A) Manual
B) Automated
C) Combination of manual and automated
D) Continuous

Question 38

Fully automated physical inventory controls may prevent errors associated with

A) human miscount.
B) fraud.
C) laziness.
D) All of these answer choices are correct.

Question 39

Which of the following statements is TRUE?

A) Artificial intelligence can replace human judgment.
B) Combining automated and manual controls is not feasible for most solutions.
C) Risk response is optimized by combining human expertise with insight from systems.
D) Fully automated controls may require human judgment.

Question 40

Automated controls use technology to implement a control activity. To be classified as automated, the control must

A) include an automated component.
B) be fully automated.
C) reside on the accounting information system.
D) utilize robots or drone technology for physical inventory.

Question 41

Continuous monitoring technology can be classified as what type of internal control?

A) Preventative
B) Detective
C) Corrective
D) Physical

Question 42

Continuous monitoring is often programmed to monitor

A) key performance indicators.
B) gross profit margin.
C) fraud risk indicators.
D) All of these answer choices are correct.

Question 43

Which of the following statements concerning continuous monitoring is FALSE?

A) Data analysts use continuous monitoring technology to create detective controls.
B) Continuous monitoring software uses rules-based programming to monitor the business's data for red flags of risks.
C) Continuous monitoring can notify management in real-time when risk events occur.
D) Continuous monitoring focuses on segregation of duties to prevent fraud.

Question 44

Africell operates several call centers for customer service. Charles implements a digital dashboard that will display the following: number of rings to answer, number of minutes on hold, and the number of dropped calls. What kind of internal control has Charles implemented for Africell?

A) Physical
B) IT general
C) Continuous monitoring
D) Manual

Question 45

A control is characterized by its

A) type, location, and implementation.
B) function, location, and implementation.
C) location, implementation, and technology.
D) type, technology, and location.

Question 46

Which of the following statements concerning continuous monitoring is FALSE?

A) Continuous monitoring uses data stored in the AIS for analysis.
B) The continuous monitoring program is often its own system with its own risks.
C) Continuous monitoring is an internal control that often uses additional internal controls for its source data and the monitoring program.
D) Continuous monitoring programs are kept separate from the AIS to avoid creating its own technology risks.

Question 47

Who in an organization is responsible for making sure that internal controls are functioning as designed?

A) Management
B) Internal audit department
C) External auditors
D) All of these answer choices are correct.

Question 48

Which of the following statements concerning internal controls is TRUE?

A) Internal controls are designed and implemented without the need for assessment.
B) Internal controls provide absolute confidence in risk mitigation.
C) Internal controls must be continuously assessed.
D) Manual internal controls must be assessed but not automated controls.

Question 49

Internal audit has responsibility for which line of defense?

A) First
B) Second
C) Third
D) Fourth

Question 50

What role in an organization is responsible for enforcing mitigating measures to prevent an identified risks from occurring?

A) Management
B) Internal Audit
C) External Audit
D) All of these answer choices are correct.

Question 51

Enterprise risk management (ERM) provides which line of defense in combating risk?

A) First
B) Second
C) Third
D) All of these answer choices are correct.

Question 52

Internal audit provides the third line of defense by testing internal controls and reporting to

A) executive management.
B) board of directors.
C) external audit.
D) both executive management and the board of directors.

Question 53

Which of the following statements concerning internal audit is TRUE?

A) Internal audit is an independent function of the company.
B) Internal audit reports both to executive management and the board of directors.
C) Internal audit tests internal controls to provide assurance of their effectiveness.
D) All of these answer choices are correct.

Question 54

Which of the following statements concerning external audit is TRUE?

A) External audit serves as the third line of defense of a company.
B) External audit reports directly to stockholders regarding risk mitigation.
C) External audit provides additional assurance to the company stakeholders.
D) All of these answer choices are correct.

Question 55

What role in a company is responsible for designing and implementing controls?

A) Management
B) Board of directors
C) Internal audit
D) External audit

Question 56

What type of tool is used to measure how far a company is on its journey to reach the ideal state?

A) Maturity ruler
B) Maturity model
C) Optimization ruler
D) Optimization model

Question 57

Which statement concerning maturity models is FALSE?

A) Companies use maturity models to measure their current performance.
B) Companies use maturity models to create a plan for continuous improvement.
C) Companies use custom-designed maturity models from the Institute of Internal Auditors.
D) Companies use guidelines from the Institute of Internal Auditors to custom design models.

Question 58

The Key Company provides staffing services for South Florida. Key has clearly defined processes and controls and employs a top-down, proactive approach to management with clear communication throughout the organization. Based on your review, at which phase of maturity would you classify Key?

A) Phase 1 - Limited
B) Phase 2 - Informal
C) Phase 3 - Defined
D) Phase 4 - Optimized

Question 59

Inspire Accounting Services operates a regional tax and accounting services for small businesses. Inspire has some processes and controls defined, but documentation is lacking, so Inspire relies on some key individuals to perform these processes and controls. Based on your review, at which phase of maturity would you classify Inspire?

A) Phase 1 - Limited
B) Phase 2 - Informal
C) Phase 3 - Defined
D) Phase 4 - Optimized

Question 60

Biloxi Bowling Products manufactures bowling lane equipment and accessories. Biloxi has relied on key individuals and has yet to document processes. During your audit, you determine that Biloxi's management seems to be reactive to issues that occur and not proactive with controls. At what phase of maturity would you classify Biloxi?

A) Phase 1 - Limited
B) Phase 2 - Informal
C) Phase 3 - Defined
D) Phase 4 - Optimized

Question 61

Internal audit adds value to a business by providing

A) assurance.
B) insight.
C) objectivity.
D) All of these answer choices are correct.

Question 62

Internal audit provides

A) assurance that the organization is operating in accordance with management's plan.
B) insight that may improve policies, procedures, controls, and risk management.
C) objective assessment of the company through an independent consulting point of view.
D) All of these answer choices are correct.

Question 63

Jenna works as an internal auditor for a local bank. Jenna determines that the procedure for counting change in a teller's cash drawer at the end of a shift creates a challenge for the manager checking in the drawers. Jenna designed and tested an alternative procedure. Which of the following roles of internal audit most accurately describes Jenna's added value for the bank?

A) Assurance
B) Insight
C) Objectivity
D) Independence

Question 64

Which characteristic of internal audit must be present to assess the company from an independent point of view?

A) Assurance
B) Insight
C) Objectivity
D) Assessment

Question 65

Which role of internal audit includes the discovery of improvements for risk management?

A) Assurance
B) Insight
C) Objectivity
D) Independence

Question 66

Which of the following statements concerning internal audit is FALSE?

A) Internal audit must remain independent of all business functions that they audit.
B) Internal auditors have a stake in the outcome of the business processes that they audit.
C) Internal audit departments may be in-house employees or contractors.
D) Internal audit provides insight to the company leadership, audit committee, and board.

Question 67

For what reasons do internal audit departments report to an audit committee?

A) The audit committee provides objective oversight of a company.
B) The audit committee oversees management who may be the subject of an audit report.
C) The audit committee includes board members and others with qualifications in accounting.
D) All of these answer choices are correct.

Question 68

Internal auditors who are employees of the organization must have no stake in or influence over the outcome of the business processes they are auditing. This principle is known as

A) assurance.
B) insight.
C) objectivity.
D) independence.

Question 69

Which of the following statements concerning internal audit departments is TRUE?

A) All companies are required to have an internal audit department.
B) Public companies listed on the New York Stock Exchanges are required to have an internal audit department.
C) Internal auditors report to the leader of the enterprise risk management team.
D) Internal auditors must be employed by the organization.

Question 70

A published set of specifications and criteria that assists companies in achieving objectives is a(n)

A) control.
B) framework.
C) assessment.
D) report.

Question 71

Frameworks

A) provide a set of instructions for a business to follow.
B) are often referred to as roadmaps for companies.
C) give an outline for companies to follow on how to approach a topic.
D) All of these answer choices are correct.

Question 72

What bill was passed by the U.S. government in 2002 to increase the liability of corporate leaders for companies' actions?

A) Sarbanes-Oxley Act
B) Enron Act
C) Risk Management Act
D) Financial Trust Act

Question 73

The goal of the Sarbanes-Oxley Act of 2002 is to

A) protect the U.S. government from fraudulent acts committed by U.S. companies.
B) protect investors from fraud and other risks by improving the reliability and accuracy of financial statements.
C) protect companies from the U.S. government interfering in how they present financial statements.
D) protect investors from the risk of increased taxes impacting the financial statements of companies in which they are invested.

Question 74

The rules enacted with Sarbanes-Oxley (SOX) include which of the following?

A) SOX places the responsibility for financial reporting failures on the U.S. government.
B) SOX places the responsibility for financial reporting failures on the internal audit team.
C) SOX places the responsibility for control failures with managers of the company.
D) SOX places the responsibility for control failures with accountants of the company.

Question 75

Which of the following is an example of a regulatory control?

A) Internal controls
B) Segregation of duties
C) Maturity models
D) Sarbanes-Oxley Act

Question 76

Compliance with the Sarbanes-Oxley Act is required for

A) U.S. publicly traded companies.
B) private companies planning their initial public offering.
C) foreign companies traded in or that do business in the United States.
D) All of these answer choices are correct.

Question 77

The Sarbanes-Oxley Act requires that chief executive and chief financial officers of firms are responsible for

A) the accuracy of financial statements.
B) overall internal control structure reports.
C) informing external auditors about issues or concerns.
D) All of these answer choices are correct.

Question 78

Which of the following is NOT a Sarbanes-Oxley (SOX) Act requirement?

A) An internal control report included in the annual financial statements
B) An external audit that includes a disclosure of internal control deficiencies
C) An internal audit report that confirms that management did not review financial statements before they were published
D) An external audit evaluates management's assessment of the effectiveness of the system of internal control.

Question 79

Which of the following is NOT a Sarbanes-Oxley (SOX) Act requirement?

A) Formal implementation of a maturity model
B) Ensuring that financial statements are reviewed by management
C) Formal data security policy that is communicated and enforced
D) Companies ensure the protection of all financial data in storage and use.

Question 80

Most publicly traded companies comply with Sarbanes-Oxley requirements by utilizing a framework from the

A) Securities and Exchange Commission.
B) Committee of Sponsoring Organizations.
C) Compliance and Sarbanes-Oxley Organization.
D) Company and Securities Organization.