Deck 10: Fraud and Internal Control

Question 1

What three things must a perpetrator have to commit fraud? Include a brief description of each.

Answer 1

The perpetrator must have motive - reason for committing the fraud, such as financial difficulties.
The perpetrator must have opportunity - access to the asset or financial statements in order to carry out the fraud.
The perpetrator must have the means to carry out the fraud - knowledge or skills that permit the perpetrator to commit the crime.

Question 2

List the three fraud and abuse categories. Provide examples.

Answer 2

1. Corruption, such as bribery
2. Misappropriation of assets, including theft of cash, fraudulent disbursements, or stealing merchandise
3. Fraudulent financial reporting, such as misstating financial statements in order to meet earnings targets (acfe.com, 2009)

Question 3

Earnings management focuses on managing when revenues and expenses are recorded in order to favorably reflect a company's financial performance in a(n)________.

A)Illegal manner
B)Legal manner
C)Questionable manner
D)Vague manner

Answer 3

B

Question 4

What percentage of occupational fraud is committed by upper management?

A)19%
B)15%
C)25%
D)30%

Question 5

What percentage of occupational fraud is committed by the accounting department?

A)16%
B)29%
C)35%
D)38%

Question 6

Tips are the most likely means of detecting fraud.

Question 7

What are the elements required to prove fraud?

Question 8

The typical fraud lasts three years before it is detected.

Question 9

The Sarbanes-Oxley Act of 2002, which would become known as SOX, created the ________ to oversee and regulate public companies and their auditors.

Question 10

List and describe the principles for establishing an environment to effectively manage fraud risk.

Question 11

The SOX legislation basically requires management of privately held companies must assess and report on the effectiveness of internal controls for financial reporting using a recognized framework.

Question 12

Accounting professionals often refer to the fraud triangle as incentive/opportunity/rationalization.

Question 13

Most occupational frauds are committed by the accounting department or upper management.

Question 14

If the internal audit revealed any significant deficiencies, it is not required to be disclosed by the signing officers of the company.

Question 15

Substantive procedures collect evidence regarding the accuracy, completeness, and validity of data produced by the accounting system.

Question 16

What percentage for frauds are detected by tips?

A)33%
B)36%
C)46%
D)56%

Question 17

How long does the typical fraud last before being detected?

A)Six months
B)One year
C)Two years
D)Three years

Question 18

________ techniques to avoid potential key fraud risk events should be established, where feasible, to mitigate possible impacts on the organization.

Question 19

________ focuses on managing when revenues and expenses are recorded in order to favorably reflect a company's financial performance in a legal manner.

Question 20

________ techniques should be established to uncover fraud events when preventive measures fail or unmitigated risks are realized.

Question 21

In a(n)________, the auditor performs tests of controls and substantive procedures.

Question 22

Which SOX section requires the public accounting firm that audits the financial statements of the company to issue an attestation report regarding the effectiveness of the company's internal controls?

A)

Question 23

It is not possible for a material weakness in internal control over financial reporting to exist even though the financial statements are not materially misstated.

Question 24

Which COSO Internal Control-Integrated Framework essential component of an effective internal control system involves identifying, analyzing, and managing risks that affect a company's ability to record, process, summarize, and report financial data properly?

A)Risk Assessment
B)Control Environment
C)Control Activities
D)Monitoring

Question 25

To comply with SOX, companies must use a framework for evaluating internal control.

Question 26

A(n)________ over financial reporting requires the auditor to conduct tests of controls to obtain evidence that internal control over financial reporting has operated effectively.

Question 27

Which organization was created by the Sarbanes-Oxley Act of 2002?

A)Public Company Accounting Oversight Board (PCAOB)
B)Institute of Management Accountants (IMA)
C)American Accounting Association (AAA)
D)Committee of Sponsoring Organizations of the Treadway Commission (COSO)

Question 28

In control activities, ________ ensure appropriate information processing, authorization, and data integrity.

Question 29

Which SOX section requires the chief executive officer and the chief financial officer to disclose to the auditors and the audit committee of the board of directors all significant deficiencies in internal controls, which could adversely affect the ability to record, process, summarize, and report financial data and any material weaknesses in internal controls?

A)

Question 30

Which of the following is not the purpose of internal controls?

A)Compliance with laws and regulations
B)Effectiveness and efficiency of operations
C)Public examine of private data
D)Reliability of financial reporting

Question 31

In the COSO Internal Control-Integrated Framework, control activities do not include

A)Independent reconciliations of assets and accounting records
B)Physical controls
C)Segregation of duties
D)Management controls

Question 32

When investigating fraud, ________ enables auditors to extract, analyze, and interpret evidence to detect unusual patterns and irregularities.

Question 33

What does Auditing Standard No. 5, an Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, require the auditor to understand about IT?

Question 34

The COSO ________ provides a blueprint for implementing an internal control system to assist in ensuring the reliability of financial statements and compliance with Sarbanes-Oxley legislation.

Question 35

In control activities, ________ divide authorization, recording, and asset custody among different individuals.

Question 36

What are the objectives of internal control?

Question 37

Increasingly, the PCAOB is expecting auditors to understand how IT affects the audit and integrating IT into the audit.

Question 38

Physical controls ensure appropriate information processing, authorization, and data integrity.

Question 39

Which COSO Internal Control-Integrated Framework essential component of an effective internal control system includes the accounting system for identifying, recording, processing, and reporting transactions and financial data?

A)Monitoring
B)Information and Communication
C)Control Activities
D)Control Environment

Question 40

A(n)________, as required by Auditing Standard No. 5, integrates an audit of internal control with an audit of financial statements.

Question 41

What factors are part of the control environment?

Question 42

Increasingly the expectation is that the auditor and the IT professional learn more about the other's field.

Question 43

Which IT process domain, as defined by COBIT, encompasses IT operations, security, and training?

A)Plan and Organize (PO)Domain
B)Deliver and Support (DS)Domain
C)Acquire and Implement (AI)Domain
D)Monitor and Evaluate (ME)Domain

Question 44

Internal controls for the accounting system are incomplete without IT controls.

Question 45

Application controls ensure completeness and accuracy of transaction processing, authorization, and validity.

Question 46

IT general controls have a pervasive effect on all internal controls.

Question 47

In the COBIT framework, which IT resource category consists of manual and programmed procedures to process information?

A)Infrastructure
B)Applications
C)People
D)Information

Question 48

While COSO is a broad framework for internal control in general, COBIT provides the detailed IT processes necessary to provide IT controls for monitoring and evaluating the IT environment.

Question 49

The COSO internal control component Information and Communication usually maps to which COBIT domain for IT processes?

A)PO2 Define the information architecture
B)PO1 Define a strategic IT plan
C)PO4 Define the IT processes, organization, and relationships
D)PO9 Assess and manage IT risks

Question 50

List and describe the IT resources categories as defined by COBIT.

Question 51

________ controls include IT governance at top management levels where strategic business objectives are set and policies are established.

Question 52

Which of the following is not part of the information criteria as defined by COBIT?

A)Integrity
B)Scalability
C)Availability
D)Confidentiality

Question 53

COBIT provides high-level strategic guidance for meeting overall internal control objectives.

Question 54

Which IT process domain, as defined by COBIT, relates to IT strategy and tactics to contribute to attaining business goals?

A)Plan and Organize (PO)Domain
B)Deliver and Support (DS)Domain
C)Acquire and Implement (AI)Domain
D)Monitor and Evaluate (ME)Domain

Question 55

The COSO internal control component Control Activities usually maps to which COBIT domain for IT processes?

A)PO9 Assess and manage IT risks
B)ME4 Provide IT governance
C)AI5 Procure IT resources
D)PO1 Define a strategic IT plan

Question 56

What are the five essential components of an effective internal control system listed in COSO Internal Control-Integrated Framework?

Question 57

List and describe the control activities for mitigating financial, operational, and compliance controls risks.

Question 58

________ controls support application controls to provide a reliable operating environment.

Question 59

Input controls ensure data is processed properly.

Question 60

List and describe the 10 generally accepted privacy principles.

Question 61

Match the DFD symbol to the name.

A)Agent
B)Dataflow
C)Datastore
D)Process

Question 62

In a HotSpot DFD, which color indicates the least risk?

A)Yellow
B)Orange
C)Red
D)Green

Question 63

Which of the following is not part of the audit committee's responsibilities?

A)The organization's compliance with legal and regulatory requirements
B)The integrity of the organization's financial statements and reports
C)The organization's policies regarding ethical conduct
D)The organization's ability to process data efficiently and effectively

Question 64

Match the DFD symbol to the name.

A)Agent
B)Dataflow
C)Datastore
D)Process

Question 65

Control ________ are control weaknesses.

Question 66

What are the three major objectives of an IT audit?

Question 67

When documenting HotSpots on DFDs, what types of controls are documented?

A)Detective controls
B)Preventative controls
C)Corrective controls
D)A and B

Question 68

Internal controls are an integral part of business processes and the accompanying accounting transaction cycles.

Question 69

What are the three phases for documenting control HotSpots?

Question 70

Match the DFD symbol to the name.

A)Agent
B)Dataflow
C)Datastore
D)Process

Question 71

What are the steps for building a HotSpot DFD?

Question 72

Application controls for business processes cannot be documented using DFDs.

Question 73

What do the audit committee's responsibilities include?

Question 74

Which level in the company corresponds to the Entity-Level IT Controls?

A)Top management
B)Information management
C)Business processes
D)IT services

Question 75

Match the DFD symbol to the name.

A)Agent
B)Dataflow
C)Datastore
D)Process

Question 76

Which general IT control includes control over SDLC phases for software upgrades and modifications?

A)Program development controls
B)Access security controls
C)Computer operations controls
D)Program change controls

Question 77

Document the preventive and detective controls on the Books Ga'Lore! shipping DFD.

Question 78

Which general IT control covers acquisition, implementation, and maintenance of system software including the operating system, DBMS, network software, and security software?

A)Access security controls
B)Computer operations controls
C)Program change controls
D)Program development controls

Question 79

Books Ga'Lore! Shipping DFD
Using the Books Ga'Lore! shipping DFD, create an event-agent-datastore-control table.

Question 80

In a HotSpot DFD, which color indicates the most risk?

A)Yellow
B)Orange
C)Red
D)Green