Deck 6: Internal Control and Risk Assessment

Question 1

Which factor has the most influence on the effectiveness of an organization's internal control?

A) Competent, dedicated, trustworthy employees
B) Board of directors
C) Written policies and procedures
D) Employee training

Answer 1

A

Question 2

Which of the following documents has become the widely accepted authority on internal control and is the basis for the others?

A) The AICPA's Statement of Auditing Standard No. 78
B) COSO's Internal Control - Integrated Framework
C) Information Systems Audit and Control Foundation's COBIT
D) Institute of Internal Auditors Research Foundation's Systems Auditability and Control Report

Answer 2

B

Question 3

Which of the following best describes the requirement for a company to report on the effectiveness of its internal control?

A) A company is required to report on the effectiveness of its internal control only if the company is a bank or a thrift with assets of $150 million or more.
B) Each publicly traded company is required to report on the effectiveness of its internal control.
C) Each publicly traded and privately held company is required to report the effectiveness of its internal control.
D) A company is not required to report on its internal control, but almost every publicly traded company voluntarily reports on the effectiveness of its internal control.

Answer 3

B

Question 4

Which of the internal control components provides the foundation for all the other components of internal control?

A) Risk assessment
B) Information and communication
C) Monitoring
D) Internal environment

Question 5

Which of the following is not a reason that an external auditor would have an interest in an organization's internal control?

A) Internal control provides a measure of protection against erroneous or fraudulent financial reporting.
B) The external auditor is required to evaluate internal control in planning an external audit, according to generally accepted auditing standards.
C) Strong internal control can eliminate the test of controls required to be performed by the external auditor.
D) The Sarbanes-Oxley Act of 2002 requires the external auditor attest to and report on management's assessment of internal control.

Question 6

Which of the following first required that an organization have internal control?

A) Securities and Exchange Act
B) AICPA Professional Standards
C) Foreign Corrupt Practices Act
D) Treadway Commission

Question 7

Why do organizational objectives stress the importance of quality information?

A) Quality information is required for accounting systems to operate effectively.
B) Investors, creditors, managers, and other users rely on this information.
C) The organization's reputation depends on the output of quality information.
D) External auditors insist that the information provided them be of high quality.

Question 8

Which of the following best defines internal control?

A) Internal rules and/or regulations with which organizations are expected to comply regarding accounting standards and preparation of financial data.
B) A process by which management gains reasonable assurance that its objectives will be achieved.
C) Procedures for input of and access to information systems used for internal analysis of an organization's short-term and long-term objectives.
D) A system of checks and balances that allows an organization to maintain control over its resources (data, systems, and all other assets).

Question 9

The five interrelated components of internal control (according to the COSO framework) include the following:

A) Control environment, risk assessment, control activities, organizational structure, and monitoring
B) Control environment, risk assessment, integrity and ethical values, information and communication, and monitoring.
C) Control environment, risk assessment, control activities, information and communication, and monitoring
D) Control environment, risk assessment, control activities, information and communication, and human resource policies and practices

Question 10

Which of the following factors are included in the internal environment?

A) Human resource policies and practices, integrity and ethical values, commitment to competence, and board of directors or audit committee
B) Human resource policies and practices, integrity and ethical values, risk assessment, and organizational structure
C) Board of directors, management's philosophy and operating style, commitment to competence, and quality of information
D) Assignment of authority and responsibility, organizational structure, effective and efficient operations, and management's philosophy and operating style

Question 11

Which of the following is not a responsibility of an audit committee?

A) Recommending an external auditor
B) Attesting to the fairness of the financial statements
C) Reviewing significant financial information
D) Seeing that an effective internal control is maintained

Question 12

Which of the following best describes the Sarbanes-Oxley Act of 2002?

A) It recommended that every publicly traded company include a report in its annual report assessing the effectiveness of the company's internal control structure and procedures.
B) This act made it a felony to intercept electronic communications and a misdemeanor to break into electronic mail storage facilities.
C) In accordance with section 1029, "Fraud and Related Activity in Connection with Access Devices," this act made it a crime to produce or use a counterfeit access device.
D) It established provisions for record keeping and internal control for companies registered with the Securities and Exchange Commission.

Question 13

Which of the following is not one of the three categories of entity objectives?

A) Compliance with applicable laws and regulations
B) Effectiveness and efficiency of operations
C) Human resource policies and practices
D) Quality of information
E) Organizational strategy C

Question 14

The effectiveness of the board of directors in contributing to internal control is best enhanced by which of the following?

A) Its independence
B) Its superiority to management
C) Its stockholder representation
D) Its legal power to govern the corporation

Question 15

Why is internal control so important?

A) Internal control is encouraged by several regulatory organizations, and it is required by law for publicly traded companies in an enactment in 1978 by the Cohen Commission.
B) Internal control is essential in lowering costs due to errors and irregularities in an organization by using risk assessment and risk management techniques.
C) Internal control enables management to maintain control over all its activities and it provides a measure of protection against erroneous or fraudulent financial reporting.
D) The U.S. Congress has enacted legislation requiring management of publicly-traded companies to report on the effectiveness of their internal control.

Question 16

Which of the following are entity objective categories?

A) Effectiveness and efficiency of operations, safeguarding of assets, strategy-setting, and quality of information
B) Organizational strategies, quality of information, effectiveness and efficiency of operations, and compliance with applicable laws and regulations
C) Compliance with applicable laws and regulations, risk assessment objectives, risk response, and quality of information
D) Effectiveness and efficiency of operations, quality of information, safeguarding of assets, and organizational control

Question 17

Which of the following best describes the Foreign Corrupt Practices Act of 1977 (amended 1988)?

A) It recommended that every publicly traded company include a report in its annual report assessing the effectiveness of the company's internal control structure and procedures.
B) This act made it a felony to intercept electronic communications and a misdemeanor to break into electronic mail storage facilities.
C) In accordance with section 1029, "Fraud and Related Activity in Connection with Access Devices," this act made it a crime to produce or use a counterfeit access device.
D) It established provisions for record keeping and internal control for companies registered with the Securities and Exchange Commission.

Question 18

Which of the following is not an essential component of the audit function of an organization?

A) Senior management
B) Audit committee
C) Internal auditors
D) External auditors

Question 19

An audit committee is a subcommittee under the direction of whom?

A) The controller
B) The treasurer
C) The CEO
D) The board of directors

Question 20

Which of the following are some of the characteristics of high quality information?

A) Accurate, relative, current, and confidential (when necessary)
B) Accurate, complete, operational, and accessible
C) Accurate, confidential (when necessary), complete, and relevant
D) Accurate, explicit, internal, and confidential (when necessary)

Question 21

Which of the following is not a consequence of uncontrolled risks?

A) Credit ratings are eroded.
B) Favorable audit opinions are received.
C) Important decisions are based on faulty data.
D) Resources are lost, wasted, or abused.

Question 22

Which of the following generally expresses the organizational structure?

A) Organizational chart
B) Managerial decision-making framework
C) Responsibility accounting chart
D) Functional model

Question 23

Which of the following is not a consequence of uncontrolled risk?

A) Data are produced that nobody uses or believe.
B) Management spends time dealing with unavoidable problems.
C) Public image is tarnished.
D) Critical information is unavailable when needed.

Question 24

Which of the following statements is FALSE with regard to the Enterprise Risk Management (ERM) framework?

A) The ERM is primarily focused on the risk aversion of management.
B) The ERM discusses the relationship between risk and strategy-setting.
C) The ERM is an ongoing process that permeates the entire company.
D) The ERM affects strategy-setting through risk identification.

Question 25

Which of the following is true concerning the cost/benefit model for risk analysis?

A) As costs of controls increase, costs associated with risks decrease.
B) As costs of controls increase, costs associated with risks increase.
C) As total costs increase, costs associated with risks increase.
D) As total costs decrease, costs of controls decrease.

Question 26

Which of the following is not defined by the formal organizational structure?

A) Areas of responsibility
B) Limits of managerial authority
C) Lines of reporting

Question 27

Which of the following best describes the Sarbanes-Oxley Act of 2002?

A) This act requires publicly-traded companies to include a report in its annual report assessing the effectiveness of the company's internal control structures/procedures.
B) This act made it a felony to intercept electronic communications and a misdemeanor to break into electronic mail storage facilities.
C) This act makes it a crime to produce or use a counterfeit access device.
D) This act established provisions for record-keeping and internal control for companies registered with the Securities and Exchange Commission.

Question 28

Which of the following characteristics usually does not describe a management philosophy or operating style that affects the internal environment?

A) Management's behavior toward other managers or personnel
B) Management's approach to external political factors
C) Management's attitude toward accounting functions
D) Management's approach to business risk

Question 29

What are the component factors in the assessment of risk?

A) Estimated probable loss and the estimated frequency of occurrence
B) Effectiveness of security measures and the value of the item involved
C) Estimated frequency of occurrence and the nature of the asset
D) Seriousness of the risk and the security measures employed

Question 30

Which of the following statements regarding the audit committee is true?

A) It is a standing subcommittee of the board of directors.
B) Its main objectives are to protect against management wrongdoing and to increase public confidence in the independent auditor's opinion.
C) The committee should be composed of independent board members.
D) A, B, and C
E) B and C only D

Question 31

What is the optimal point of reasonable assurance for internal control?

A) When all possible controls are implemented
B) When the cost of controls equals the savings on losses from risks
C) When standard costing is used in inventory accounts
D) When no discrepancies exist between the inventory physical count and the inventory account balance

Question 32

IT governance

A) Should be part of enterprise governance.
B) Has historically been ignored in corporate governance matters.
C) Refers to issues surrounding technology solutions.
D) All of the above describe IT governance.

Question 33

The audit committee is responsible for all of the following except:

A) Appointing and overseeing the external auditors
B) Directing investigations of possible fraud
C) Establishing internal control
D) Reviewing financial information

Question 34

Which of the following includes risks that are all related to accounting information system activities?

A) Computer system failure, information security breaches, errors and irregularities in transaction authorization
B) Computer fraud, errors and irregularities in transaction authorization, and internal audit fraud
C) Fraudulent financial reporting, external audit fraud, and concealment of illegal acts
D) Inadequate training, system failure, risk disclosure, and irregularities in transaction authorization

Question 35

Which of the following best describes the importance of risk assessment?

A) Risk assessment allows management to determine the extent of the internal controls required to eliminate inherent risk and to minimize control risk.
B) Risk assessment is necessary to set priorities for risks in order of frequency so the most frequently occurring risks can be eliminated in a cost effective manner.
C) As go the risks, so go the insurance premiums and costs. Risk assessment is management's primary tool to lower insurance premiums and casualty losses.
D) Risk assessment helps management set priorities and determine the organization's risk response.

Question 36

From the following factors, which one is least likely to impact the internal environment?

A) Management philosophy and operating style
B) Human resource policies and practices
C) Job descriptions
D) Integrity and ethical values

Question 37

The main goal in risk assessment is which of the following?

A) To achieve the lowest possible losses associated with risks identified in the assessment process
B) To reduce risks to the minimum level possible consistent with factors of assessment involved
C) To provide "reasonable assurance" and an acceptable level of risk while achieving the lowest total cost (cost of controls added to loss from risk)
D) To establish the most comprehensive control activities possible at a reasonable cost to the organization

Question 38

What is the definition of internal control?

A) A process designed to guarantee that objectives related to organizational strategy, quality of reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations will be achieved.
B) A process designed to provide reasonable assurance that objectives related to organizational strategy, quality of reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations will be achieved.
C) A process designed to provide reasonable assurance that objectives related to ethical values and integrity, quality of reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations will be achieved.
D) A process designed to guarantee that objectives related to ethical values and integrity, quality of reporting, SOX compliance, and efficiency of operations will be achieved.

Question 39

Which of the following is TRUE regarding the Enterprise Risk Management (ERM) framework?

A) The ERM framework replaces the COSO internal control framework.
B) Proper identification of risk can help management properly allocate resources.
C) The COSO requested the assistance of Ernst and Young for development of the ERM.
D) All of the above are true statements regarding ERM.

Question 40

The audit committee is responsible for all the following EXCEPT:

A) Appointing and overseeing the external auditors.
B) Directing investigations of possible fraud.
C) Establishing internal control.
D) Reviewing financial information.

Question 41

The primary objective of an external auditor's obtaining an understanding of a client's internal control is to provide the auditor with which of the following?

A) Evidential matter to use in reducing detection risk.
B) Knowledge necessary to plan the audit and related testing.
C) A basis from which to modify tests of controls.
D) Information necessary to prepare flowcharts.

Question 42

Which of the following describe categories of entity objectives that must exist before management can identify potential events?

A) High-level strategic goals aligned with and supporting the organization's vision or mission.
B) Effectiveness and efficiency of internal reporting.
C) Relevance of non-financial information and reporting.
D) Compliance with all laws and regulations.
E) All of these are categories of entity objectives. A

Question 43

Who is ultimately responsible for the implementation of cost-effective internal controls?

A) The director of internal auditing.
B) The chief executive officer.
C) The information systems audit manager.
D) All of these individuals are ultimately responsible for the implementation of cost-effective internal controls.

Question 44

Event identification includes:

A) Only negative events that impact risk.
B) Only positive events that indicate opportunities.
C) Both positive and negative events.
D) Neither positive nor negative events.

Question 45

Which of the following concepts are fundamental to the Enterprise Risk Management (ERM) framework?

A) The ERM framework is a process applied across the enterprise
B) The ERM framework is effected by people to allow the organization to achieve its objectives.
C) The ERM framework is applied in strategy setting to identify events and manage risk within the organization's risk appetite.
D) All of the above are concepts fundamental to the ERM framework.

Question 46

The Sarbanes-Oxley Act of 2002 recommended that every publicly traded company include a report in its annual report assessing the effectiveness of the company's internal control structure and procedures.

Question 47

One factor of the internal environment is the board of directors.

Question 48

One factor of the internal environment is management's philosophy and operating style.

Question 49

Use the following graph of the cost/benefit model for risk analysis to answer the next five questions.

What does (4) represent?

A) Total cost
B) Loss area
C) Cost of controls
D) Level of assurance
E) Optimal point of reasonable assurance E

Question 50

One factor of the internal environment is integrity and ethical values.

Question 51

Which of the following is true regarding Type II SAS 70 reports?

A) They include the company's opinion of the internal control system of a third-party service provider.
B) They include the results of testing of the third-party service provider's internal control system.
C) The report must cover the third-party service provider's audit period.
D) All of the above are true statements regarding the Type II SAS 70 report.

Question 52

Which of the following are required by the Sarbanes-Oxley Act of 2002?

A) Rotation of a company's external auditing firms every five years.
B) Limited loans under special circumstances to executive management.
C) Attestation as to the contents of the financial statements by the CEO and CFO.
D) All of the above.

Question 53

Which of the following is NOT a key area for focus in IT governance?

A) Responsible handling of transactions, events and decisions, to include management of mobile IT components such as laptops and PDAs.
B) Choice of public accounting firm to perform the annual audits and provide tax consulting services.
C) Management of contracts and relationships with service providers (i.e., outsourcing partners).
D) Timely and transparent disclosure of financial information and performance measures.

Question 54

Use the following graph of the cost/benefit model for risk analysis to answer the next five questions.

What does (1) represent?

A) Total cost
B) Loss area
C) Cost of controls
D) Level of assurance
E) Optimal point of reasonable assurance A

Question 55

Use the following graph of the cost/benefit model for risk analysis to answer the next five questions.

What does (2) represent?

A) Total cost
B) Loss area
C) Cost of controls
D) Level of assurance
E) Optimal point of reasonable assurance B

Question 56

Use the following graph of the cost/benefit model for risk analysis to answer the next five questions.

What does (5) represent?

A) Total cost
B) Loss area
C) Cost of controls
D) Level of assurance
E) Optimal point of reasonable assurance D

Question 57

One factor of the internal environment is the audit committee.

Question 58

The Foreign Corrupt Practices Act requires which of the following?

A) The auditor engaged to examine the financial statements must report to the SEC all illegal payments.
B) A publicly-held company must establish an independent audit committee to monitor the effectiveness of a company's internal controls.
C) U.S. firms doing business abroad must report sizable payments to non-U.S. citizens to the U.S. Justice Department.
D) A company registered with the SEC must devise and maintain an adequate internal control.
E) All of these are required by the Foreign Corrupt Practices Act. E

Question 59

Use the following graph of the cost/benefit model for risk analysis to answer the next five questions.

What does (3) represent?

A) Total cost
B) Loss area
C) Cost of controls
D) Level of assurance
E) Optimal point of reasonable assurance C

Question 60

Which of the following statements about internal control is CORRECT?

A) Exceptional strong internal control is enough for the auditor to eliminate substantive tests on a significant account balance.
B) Properly maintained internal control reasonably ensures that collusion among employees cannot occur.
C) The cost-benefit relationship is a primary criterion that should be considered in designing internal control.
D) The establishment and maintenance of internal control is an important responsibility of the internal auditor.
E) All of these are correct statements about internal control. C

Question 61

The four objectives in the internal control framework are related to organizational strategy, effectiveness of reporting (internal and external), effectiveness and efficiency of operations, and compliance with applicable laws and regulations.

Question 62

The Foreign Corrupt Practices Act was passed to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws.

Question 63

Two factors of the internal environment are the board of directors and control activities.

Question 64

Parties who are interested in an organization's internal control include management, stakeholders, legislators, auditors, and professional organizations.

Question 65

One of the basic factors of the internal environment is an historical perspective of the organization.

Question 66

Controls must be justified by the benefits to be derived.

Question 67

One of the basic factors of the internal environment is the board of directors or audit committee.

Question 68

The Sarbanes-Oxley Act (SOX) allows the director of internal audit to attest to the internal control system of the company.

Question 69

The Sarbanes-Oxley Act of 2002 requires each member of the audit committee of a publicly traded company to be an independent member of the board of directors.

Question 70

Management is not required to report on its internal control.

Question 71

One factor of the internal environment is organizational structure.

Question 72

The organizational structure defines limits of managerial authority, areas of responsibility, and lines of reporting.

Question 73

IT governance refers to the board of directors' policies and procedures related to the choice of IT audit firms.

Question 74

Internal control is a state, or condition, of an organization's internal control at a point in time.

Question 75

The Sarbanes-Oxley Act of 2002 requires that a publicly traded company's independent auditor report directly to the audit committee.

Question 76

The audit committee is composed of top managers of a company.

Question 77

The Enterprise Risk Management (ERM) framework discusses the relationship between risk and strategy-setting.

Question 78

The internal environment is the organizational infrastructure that supports internal control.

Question 79

Three characteristics of high-quality information are that it is accurate, complete, and required by more than 70% of the users of the accounting system.

Question 80

Public interest in internal control is not as high now as it was twenty years ago.