Deck 7: Understanding and Assessing Internal Control

Question 1

When obtaining an understanding of the entity and its environment, the auditor should obtain an understanding of internal controls primarily to:

A)assess the risk of material misstatement and plan the audit.
B)provide suggestions for improvement to the client.
C)serve as a basis for setting audit risk and materiality.
D)comply with the Corporations Act 2001.

Answer 1

A

Question 2

An auditor assesses the level of control risk to:

A)determine whether the entity is a going concern.
B)determine the extent of substantive tests to be performed.
C)ascertain whether irregularities are probable.
D)ascertain whether any employees have incompatible duties.

Answer 2

B

Question 3

Which of the following statements about internal control is correct?

A)The establishment and maintenance of internal control is an important responsibility of the internal auditor.
B)Properly maintained internal control reasonably ensures that collusion among employees cannot occur.
C)The cost-benefit relationship is a primary criterion that should be considered in designing internal control.
D)Exceptionally strong internal control is enough for the auditor to eliminate substantive tests on a significant account balance.

Answer 3

C

Question 4

An effective internal control for the payroll function would generally include which of the following?

A)Total time recorded on time-clock cards should be reconciled to job reports by employees responsible for those specific jobs.
B)Payroll department employees should be supervised by the management of the personnel department.
C)Payroll department employees should be responsible for maintaining employee personnel records.
D)Total time spent on jobs should be compared with total time indicated on time-clock cards.

Question 5

Assessing control risk at less than high involves all of the following except:

A)identifying specific controls to rely on.
B)concluding that controls are ineffective.
C)performing tests of controls.
D)analysing the achieved level of control risk after performing tests of controls.

Question 6

In assessing control risk, the auditor is basically concerned that the system provides reasonable assurance that:

A)controls have not been circumvented by collusion.
B)misstatements have been prevented or detected.
C)operational efficiency has been achieved in accordance with management plans.
D)management cannot override the system.

Question 7

A company policy should clearly indicate that defective merchandise returned by customers is to be delivered to the:

A)sales clerk.
B)receiving clerk.
C)inventory control clerk.
D)accounts receivable clerk.

Question 8

The conclusion reached as a result of assessing control risk is referred to as the:

A)assurance provided by internal control.
B)determined level of acceptable detection risk.
C)product of the understanding of internal control.
D)assessed level of control risk.

Question 9

Which of the following statements is one of the overriding principles of internal control?

A)Responsibility for accounting and financial duties should be assigned to one responsible officer.
B)Responsibility for the performance of each duty must be fixed.
C)Responsibility for the accounting duties must be borne by the audit committee of the company.
D)All of the options listed here are correct

Question 10

Virginia Samuels, the purchasing officer of Handyman Wholesalers Pty Ltd (Handyman), has a relative who owns a retail hardware store.Virginia arranged for hardware to be delivered by manufacturers to the retail store on a COD basis, thereby enabling her relative to buy at 'wholesale prices in Handyman's name.Virginia was probably able to accomplish this because of Handyman's poor internal control for:

A)sales returns.
B)cash receipts.
C)perpetual inventory records.
D)purchase orders.

Question 11

Management's attitude toward aggressive financial reporting and its emphasis on meeting projected profit goals most likely would significantly influence an entity's control environment when:

A)external policies established by parties outside the entity affect its accounting practices.
B)management is dominated by one individual.
C)internal auditors have direct access to the board of directors and the entity's management.
D)the audit committee is active in overseeing the entity's financial reporting policies.

Question 12

Obtaining an understanding of the internal control and assessing control risk:

A)may be performed concurrently in an audit.
B)needs to be documented only if the assessed level of control risk is less than high.
C)is possible but not necessary in performing an audit.
D)are necessarily sequential audit steps.

Question 13

The control environment component of internal controls includes all of the following except:

A)management's operating style.
B)access to computer programs.
C)organisational structure.
D)human resource policies and practices.

Question 14

Which of the following would be least likely to suggest to an auditor that the client's management may have overridden the internal control?

A)Differences are always disclosed on a computer exception report.
B)Management does not correct internal control deficiencies that it knows about.
C)There have been two new financial controllers this year.
D)There are numerous delays in preparing timely internal financial reports.

Question 15

An auditor reviews a client's payroll procedures.The auditor would consider the internal control to be less than effective if a payroll department supervisor was assigned the responsibility for:

A)reviewing and approving time reports for subordinate employees.
B)distributing payroll cheques to employees.
C)hiring subordinate employees.
D)initiating requests for salary adjustments for subordinate employees.

Question 16

How does the extent of substantive tests required to constitute sufficient appropriate audit evidence vary with the auditor's assessment of control risk?

A)Randomly.
B)Disproportionately.
C)Directly.
D)Inversely.

Question 17

A primary purpose of internal controls is to:

A)form a basis for evaluating employees.
B)monitor production quality.
C)avoid clerical errors.
D)meet objectives of maintaining sound documents and records and accurate financial reporting.

Question 18

Of the following statements about an internal control, which one is not valid?

A)No one person should be responsible for the custodial responsibility and the recording responsibility for an asset.
B)Transactions must be properly authorised before such transactions are processed.
C)Because of the cost-benefit relationship, a client may apply control procedures on a test basis.
D)Control procedures reasonably ensure that collusion among employees cannot occur.

Question 19

The ultimate purpose of assessing control risk is to contribute to the auditor's evaluation of the:

A)factors that raise doubts about the auditability of the financial report.
B)operating effectiveness of internal control policies and procedures.
C)risk that material misstatements exist in the financial report.
D)possibility that the nature and extent of substantive tests may be reduced.

Question 20

Assessing control risk at less than high would most likely involve:

A)changing the timing of substantive tests by omitting interim testing and performing the tests at year-end.
B)identifying specific internal controls relevant to specific assertions.
C)performing more extensive substantive tests with larger sample sizes than originally planned.
D)reducing inherent risk for most of the assertions relevant to significant account balances.

Question 21

An advantage of using systems flowcharts to document information about internal control instead of using internal control questionnaires is that systems flowcharts:

A)identify internal control weaknesses more prominently.
B)provide a visual depiction of clients' activities.
C)indicate whether controls are operating effectively.
D)reduce the need to observe clients' employees performing routine tasks.

Question 22

For a complex system, auditors are least likely to use which of the following when documenting their understanding of internal controls?

A)Narratives.
B)Internal control questionnaires.
C)Flowcharts.
D)Organisation charts.

Question 23

Which of the following situations is not a reason to assess control risk as high?

A)Internal control policies or procedures are unlikely to be effective.
B)Evaluating the effectiveness of the internal control policies or procedures would be more time consuming than another audit approach.
C)The auditor has assessed detection risk as high.
D)Internal control policies or procedures are unlikely to pertain to an assertion.

Question 24

A flowchart is most frequently used by an auditor in connection with the:

A)preparation of generalised computer audit programs.
B)review of the client's internal accounting controls.
C)use of statistical sampling in performing an audit.
D)performance of analytical procedures on account balances.

Question 25

The internal control environment includes all of the following except:

A)organisational structure.
B)management philosophy and operating style.
C)human resource policies and procedures.
D)tests of control.

Question 26

Which of the following internal control features would an auditor be least likely to review?

A)Segregation of the asset-handling and record-keeping functions.
B)Company policy regarding credit and collection efforts.
C)Classification of sales and cost records by products.
D)Authorisation of additions to plant and equipment.

Question 27

In the weekly computer run to prepare payroll cheques, a cheque was printed for an employee whose employment was terminated the previous week.Which of the following controls, if properly used, would have been most effective in preventing this error or ensuring its prompt detection?

A)A control total for hours worked, prepared from time-cards collected by the timekeeping department and compared to the payroll sheets.
B)Requiring the accounting department to account for all pre-numbered cheques issued to the IT department for the processing of the payroll.
C)The use of check digits on employee numbers.
D)The use of a header label on the payroll input sheet.

Question 28

The risk assessment component of internal controls refers to:

A)the auditor's assessment of control risk.
B)the auditor's assessment of engagement risk.
C)the entity's identification and analysis of risks relevant to achievement of its objectives.
D)the entity's monitoring of the potential for material misstatements.

Question 29

The auditor's understanding of the client's internal control is documented to substantiate:

A)conformity of the accounting records with the accounting standards.
B)representation as to adherence to requirements of management.
C)compliance with the auditing standards.
D)the fairness of the financial report presentation.

Question 30

In obtaining an understanding of the internal control policies and procedures that are relevant to audit planning, the auditor should perform procedures to provide sufficient knowledge of:

A)design of the relevant policies, procedures and records and their operating effectiveness.
B)design of the relevant policies, procedures and records and their relationships to assertions.
C)the complexity of the entity and the sophistication of its systems and operations.
D)design of the relevant policies, procedures and records and whether they have been placed in operation.

Question 31

The following are steps in the audit process: I.prepare flowchart.
II)gather exhibits of all documents.
III)interview personnel.
The most logical sequence of steps is:

A)I, II, III.
B)I, III, II.
C)III, II, I.
D)II, I, III.

Question 32

A well-prepared flowchart should make it easier for the auditor to:

A)prepare audit procedure manuals.
B)prepare detailed job descriptions.
C)perform walk-throughs.
D)assess the degree of accuracy of financial data.

Question 33

When considering the internal control for inventory with respect to segregation of duties, an auditor would be least likely to:

A)inspect documents.
B)make enquiries.
C)observe procedures.
D)consider policies and procedures manuals.

Question 34

Walk-throughs usually involve all of the following audit procedures except:

A)re-performance.
B)ienquiry.
C)observation.
D)inspection.

Question 35

Which of the following is not one of the five elements of internal control?

A)Corporate governance.
B)Control procedures.
C)Control environment.
D)Information system.

Question 36

Which of the following is not a medium that can normally be used by an auditor to record information concerning a client's internal control?

A)Narrative memorandum.
B)Procedures manual.
C)Flowchart.
D)None of the given answers is correct.

Question 37

When the auditor has assessed the level of control risk at less than high, the auditor should document:

A)the understanding of the entity's internal control elements obtained to plan the audit.
B)the conclusion and the basis for that conclusion.
C)the implications for the overall audit strategy.
D)All of the given answers are correct.

Question 38

The auditor observes client employees in obtaining an understanding of the internal control in order to:

A)prepare a flowchart.
B)update information contained in the organisation and procedure manuals.
C)corroborate the information obtained during the initial phases of obtaining an understanding of the internal control.
D)determine the extent of compliance with quality control standards.

Question 39

Procedures directed towards obtaining evidence concerning the effectiveness of the design or operation of an internal control policy or procedure are referred to as:

A)analytical procedures.
B)substantive tests.
C)tests of controls.
D)confirmations.

Question 40

After the auditor has prepared a flowchart of the accounting system and control procedures surrounding sales, and assessed the design of the system, the auditor would perform tests of controls for all control procedures:

A)documented in the flowchart.
B)considered to be deficiencies that might allow errors to enter the accounting system.
C)considered to be strengths that the auditor plans to use as a basis for an assessed level of control risk less than high.
D)that would aid in preventing irregularities.

Question 41

Which of the following would lessen the effectiveness of the internal control in a computer system?

A)The computer librarian maintains custody of computer program instructions and detailed program listings.
B)Computer operators have access to detailed program documentation.
C)The control group maintains sole custody of all computer output before distribution.
D)Computer programmers write and debug programs.

Question 42

In updating a computerised accounts receivable file, which one of the following would be used as a batch control to verify the accuracy of the postings of cash receipts remittances?

A)The sum of the cash deposits, plus the discounts, less the sales returns.
B)The sum of the cash deposits.
C)The sum of the cash deposits, less the discounts taken by customers.
D)The sum of the cash deposits, plus the discounts taken by customers.

Question 43

For good internal control, which of the following functions should not be the responsibility of the cashier?

A)Data processing.
B)Receiving of cash.
C)Custody of securities.
D)Banking of cash.

Question 44

Which of the following information is likely to be least important to an auditor who is reviewing the internal control of the data processing function?

A)Ancillary program functions.
B)Disposition of source documents.
C)Operator competence.
D)Bit storage capacity.

Question 45

The auditor obtains evidence supporting the notion that proper segregation of duties exists by:

A)personally observing the employees who apply the control procedures.
B)reviewing job descriptions in the personnel department.
C)preparing a flowchart of duties performed by personnel.
D)performing tests to determine whether control procedures operated consistently throughout the period.

Question 46

Which of the following computer documentation would an auditor most likely utilise in obtaining an understanding of internal control?

A)Systems flowcharts.
B)Record layouts.
C)Program listings.
D)Record counts.

Question 47

Which of the following input controls is a numeric value computed to provide assurance that the original input value does not contain a transcription error?

A)Hash total.
B)Financial total.
C)Encryption.
D)Check digit.

Question 48

An IT input control is designed to ensure that:

A)machine processing is accurate.
B)only authorised personnel have access to the computer area.
C)data received for processing are properly authorised and converted to machine readable form.
D)electronic data processing has been performed as intended for the particular application.

Question 49

When erroneous data are detected by computer program controls, such data may be excluded from processing and printed on an error report.The error report should most probably be reviewed and followed up by the:

A)IT control group.
B)system analyst.
C)supervisor of computer operations.
D)computer programmer.

Question 50

Totals of amounts in computer-record data fields that are not usually added, but are used only for data-processing control purposes, are called:

A)record totals.
B)hash totals.
C)processing data totals.
D)field totals.

Question 51

Which of the following is an example of a check digit?

A)An agreement of the total number of employees to the total number of cheques printed by the computer.
B)An algebraically determined number produced by the other digits of the employee number.
C)A logic test that ensures all employee numbers have nine digits.
D)A limit check that an employee's hours do not exceed 50 hours per work week.

Question 52

Which of the following information is likely to be of least importance to an auditor in obtaining an understanding of the internal control?

A)The segregation of duties within the IT department.
B)The control over source documents.
C)The documentation maintained for accounting applications.
D)The cost-benefit ratio of data processing operations.

Question 53

A limit test is a:

A)test to ensure that a numerical value does not exceed some predetermined value.
B)check to ensure that the value in a field falls within an allowable range of values.
C)check to ensure that the data in a field have the proper arithmetic sign.
D)check on a field to ensure that it contains either all numeric or alphabetic characters.

Question 54

Internal control procedures within the IT activity may leave no visible evidence indicating that the procedures were performed.In such instances, the auditor should test these controls by:

A)making corroborative inquiries.
B)observing the separation of duties of personnel.
C)reviewing transactions submitted for processing and comparing them to related output.
D)reviewing the run manual.

Question 55

The use of a header label is most likely to prevent errors by the:

A)computer operator.
B)key entry operator.
C)computer programmer.
D)maintenance technician.

Question 56

Which of the following activities would most likely be performed in the IT department?

A)Initiation of changes to master records.
B)Conversion of information to machine-readable form.
C)Correction of transactional errors.
D)Initiation of changes to existing applications.

Question 57

Which of the following situations most likely represents a weakness in IT internal control?

A)The accounts payable clerk prepares data for computer processing and enters the data into the computer.
B)The systems analyst reviews output and controls the distribution of output from the IT department.
C)The control clerk establishes control over data received by the IT department and reconciles control totals after processing.
D)The systems programmer designs the operating and control functions of programs and participates in testing operating systems.

Question 58

Which of the following procedures is essential to determine whether effective internal control policies and procedures have been prescribed and are being followed?

A)Developing questionnaires and checklists.
B)Understanding control policies directed towards operating efficiency.
C)Understanding the internal control and performing tests of controls.
D)Observing employee functions and making enquiries.

Question 59

After obtaining an initial understanding of a client's IT controls, an auditor may decide not to perform tests of controls related to the control procedures within the IT section of the client's internal control.Which of the following justifications would not be a valid reason for choosing to omit tests of controls?

A)The controls appear adequate.
B)The controls duplicate operative controls existing elsewhere in the system.
C)There appear to be major deficiencies that would preclude using the stated procedure as a basis to reduce the assessed level.
D)The time and dollar costs of testing exceed the time and dollar savings in substantive testing if the tests of controls show the controls to be operative.

Question 60

A procedural control used in the management of a computer centre to minimise the possibility of data or program file destruction through operator error includes:

A)control figures.
B)cross-adding tests.
C)limit checks.
D)external labels.

Question 61

If a control total were to be calculated on each of the following data items, which would best be identified as a hash total for a payroll IT application?

A)Net pay.
B)Department numbers.
C)Hours worked.
D)Total debits and total credits.

Question 62

Gift Stores Ltd has a fully integrated IT accounting system and is planning to issue credit cards to creditworthy customers.To strengthen the internal control by making it difficult for one to fraudulently create a customer account number, a check digit should be placed:

A)at the beginning of a valid account number, only.
B)in the middle of a valid account number, only.
C)at the end of a valid account number, only.
D)consistently in any position.

Question 63

Emerald Ltd maintains a large, full-time internal audit staff that reports directly to the chief accountant.Audit reports prepared by the internal auditors indicate that the structure is functioning as it should be and that the accounting records are reliable.The external auditor will probably:

A)eliminate tests of controls.
B)increase the depth of the procedures to obtain an understanding of controls directed towards operating efficiency.
C)avoid duplicating the work performed by the internal audit staff.
D)place limited reliance on the work performed by the internal audit staff.

Question 64

In which of the following situations would an auditor most likely use a strategy of reliance on internal control?

A)The systems analyst reviews output and controls the distribution of output from the IT department.
B)The entity has been slow to update its IT system to reflect changes in billing practices.
C)No paper trail is generated, as the entity receives sales orders, bills customers and receives payment based only on information generated from IT.
D)The auditor has been unable to determine whether all changes to a client's IT were properly authorised.

Question 65

One of the major problems with IT systems is that incompatible functions may be performed by the same individual.One compensating control for this is the use of:

A)a tape library.
B)a check-digit system.
C)computer-generated hash totals.
D)a computer log.

Question 66

An input control is designed to ensure that:

A)machine processing is accurate.
B)only authorised personnel have access to the computer area.
C)data received for processing are properly authorised and converted to machine-readable form.
D)electronic data processing has been performed as intended for the particular application.

Question 67

When an independent auditor decides that the work performed by internal auditors may have a bearing on the nature, timing and extent of contemplated audit procedures, the independent auditor should plan to evaluate the objectivity of the internal auditors.Relative to objectivity, the independent auditor should:

A)consider the organisation level to which internal auditors report the results of their work.
B)review the quality control program in effect for the internal audit staff.
C)examine the quality of the internal audit reports.
D)consider the qualifications of the internal audit staff.

Question 68

If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll IT application?

A)Hours worked.
B)Employee's identification number.
C)Number of employees.
D)Gross pay.

Question 69

The completeness of IT-generated sales figures can be tested by comparing the number of items listed on the daily sales report with the number of items billed on the actual invoices.This process uses:

A)control totals.
B)validity tests.
C)process tracing data.
D)check digits.

Question 70

To provide for the greatest degree of independence in performing internal auditing functions, an internal auditor most likely should report to the:

A)chief financial officer.
B)chief executive officer.
C)audit committee.
D)shareholders.