Question 1

Jenny is the information technology support manager at CMH. Jenny is considered to be a super-user at CMH since she can circumvent normal controls. In order to address the risk of super-users, management should
A) remove the super-user.
B) establish effective compensating controls.
C) update the background check on the super-user on a yearly basis.
D) ensure that the super-user is familiar with the code of conduct of the company.

Accepted Answer

Removing the super-user is not necessarily the best solution as they may have important responsibilities and skills. Instead, effective compensating controls such as additional monitoring, review and approval processes, or limiting access to specific areas should be established. Updating the background check and ensuring familiarity with the code of conduct are also important measures, but alone they may not fully address the risk of super-users.

Question 2

A procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is
A) inspection.
B) observation.
C) reperformance.
D) reconciliation.

Accepted Answer

The procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is observation. This involves the auditor physically observing employees carrying out their assigned duties to determine if segregation of functions is being properly implemented.

Question 3

When a compensating control exists, a weakness in the system
A) is no longer a concern because the potential for misstatement has been sufficiently reduced.
B) is reduced but not removed; therefore, it is still of concern to the auditor.
C) could cause a material loss, so it must be tested using substantive procedures.
D) is magnified and must be removed from the sampling process and examined in its entirety.

Accepted Answer

A compensating control is implemented to sufficiently reduce the potential for misstatement, which means that the weakness in the system is no longer a concern to the auditor. Therefore, choice A is correct. Choices B, C, and D are incorrect because they do not accurately reflect the purpose and effect of a compensating control.

Question 4

The auditor may identify some risks that cannot be effectively tested by substantive tests alone. For example, when there are paperless transactions (perhaps using EDI - electronic data interchange). To address these risks, the auditor is required to
A) assess the design effectiveness of relevant controls and test them.
B) obtain an understanding of the controls and test them if reliance is intended.
C) obtain an understanding of the controls and assess their design effectiveness.
D) test the controls that address the paperless aspects of the transactions.

Accepted Answer

When substantive tests alone are not sufficient, the auditor is required to obtain an understanding of the controls that address the risks and test them if reliance is intended. This is known as testing control effectiveness. The auditor may not need to test every control if they have identified a control environment that is effective and provides adequate protection against the identified risks. However, they must have a sufficient understanding of the controls to determine whether reliance can be placed on them. Choice A may be considered if the auditor intends to rely on relevant controls. Choice C focuses on assessing the design of controls, and choice D is not a comprehensive enough approach.

Question 5

You have just finished documenting your understanding of cycle controls at an audit engagement.
Required:
A) Explain how you will identify the controls that will be tested.
B) What process will you follow for weakness in internal controls?

Accepted Answer

The answer of You have just finished documenting your understanding...

Question 6

A) The first step in the auditor's study and evaluation of internal control is obtain understanding of internal control for audit planning purposes. List the remaining steps.
B) Once the auditor has an understanding of internal control, what two assessments must be made prior to testing controls?
C) Describe five common procedures an auditor can use to obtain an understanding of internal control design.

Accepted Answer

The answer of A) The first step in the auditor's...

Question 7

A secondary objective of the auditor's study and evaluation of internal control is that the study and evaluation provide
A) a basis for constructive suggestions concerning improvements in internal control.
B) a basis for reliance on the accounting system.
C) an assurance that the records and documents have been maintained in accordance with existing company policies and procedures.
D) an indication that management and employees are trustworthy.

Accepted Answer

The study and evaluation of internal control provide a basis for constructive suggestions concerning improvements in internal control. While the other options may be benefits of evaluating internal control, they are not the secondary objective of the auditor's evaluation. The primary objective is to determine the effectiveness of internal control over financial reporting.

Question 8

Each key control that the auditor intends to rely on must be supported by sufficient
A) tests of details of balances.
B) tests of controls.
C) analytical review procedures.
D) reperformance procedures.

Accepted Answer

Each key control that the auditor intends to rely on must be tested to determine whether it is operating effectively. Such tests are called tests of controls. Tests of details of balances, analytical review procedures, and reperformance procedures are types of substantive procedures, which are used to obtain evidence about the completeness, accuracy, and validity of the information contained in the financial statements. While substantive procedures may also provide some evidence about the effectiveness of controls, they are not sufficient to support an assertion of control effectiveness on their own.

Question 9

Ideally, tests of controls should be applied to controls
A) at the balance sheet date.
B) at each quarterly interim period.
C) for the entire period under audit.
D) at the beginning of the fiscal period.

Accepted Answer

Tests of controls should be applied for the entire period under audit to provide reasonable assurance that controls were operating effectively throughout the period. Applying tests of controls only at the balance sheet date, each interim period or at the beginning of the fiscal period would not provide comprehensive coverage of the period under audit.

Question 10

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by
A) employment of temporary personnel to aid in the segregation of duties.
B) direct participation by the owner of the business in the record-keeping activities of the business.
C) engaging a public accountant to perform monthly "write-up" work.
D) delegation of full, clear-cut responsibility to each employee for the functions assigned to each.

Accepted Answer

Direct participation by the owner in the record-keeping activities can compensate for the lack of sufficient staff to ensure proper segregation of duties, enhancing internal control by closely monitoring business activities.

Question 11

When the auditor attempts to determine the operation of the accounting system by tracing one or a few transactions through the accounting system, this is referred to as
A) tracing.
B) vouching.
C) tests of controls.
D) a walk-through.

Accepted Answer

This process is called a walk-through. Tracing and vouching are specific types of substantive testing, and tests of controls are used to determine the effectiveness of the client's internal controls.

Question 12

If an external auditor's client has used a service organization during the year for some of its payroll processing and accounting, which of the following steps should the external auditor take if he or she decides to use the service organization auditor's report as audit evidence that the entity's controls are operating effectively for certain assertions?
A) Consider the sufficiency and appropriateness of the evidence provided by the service organization auditor's report about the effectiveness of controls intended to prevent or detect material misstatements in the particular assertions.
B) Double-date the audit report to show the date of the service organization's audit and the date of the client's audit.
C) The auditor should make reference to the report of the service auditor as a basis, in part, for his or her own opinion on the entity's financial statements.
D) Re-perform each of the audit tests used by the service organization auditor.

Accepted Answer

The external auditor should consider the sufficiency and appropriateness of the evidence provided by the service organization auditor's report about the effectiveness of controls intended to prevent or detect material misstatements in the particular assertions. This is because the service organization auditor's report may not cover all the assertions or risks identified by the external auditor. Therefore, the external auditor needs to assess the relevance of the report to the audit objectives and the nature, timing, and extent of the procedures performed by the service organization auditor. The external auditor may also need to test the suitability of the controls for the entity's specific circumstances and adjust the audit scope accordingly. The other choices are incorrect because double-dating the audit report is not necessary, making reference to the report of the service auditor may not be sufficient alone, and re-performing each of the audit tests may not be efficient or cost-effective.

Question 13

When the auditor identifies opportunities for the client to make operational improvements in the internal control system, it will be communicated to the client's audit committee in the
A) management letter.
B) reportable conditions letter.
C) engagement letter.
D) audit report.

Accepted Answer

The management letter is a communication from the auditor to the client's management, which includes recommendations and suggestions for improvements in the internal control system. It is also usually shared with the audit committee. The reportable conditions letter is a letter that communicates to the audit committee any significant deficiencies in the internal control system identified during the audit. The engagement letter is a document that outlines the terms of the audit engagement. The audit report is a public document that provides an opinion on the financial statements of the company. Therefore, the most appropriate choice for communicating opportunities for operational improvements in the internal control system to the client's audit committee is the management letter.

Question 14

Control risk is a measure of the auditor's expectation that internal controls will
A) prevent material misstatements from occurring.
B) detect and correct material misstatements.
C) either prevent material misstatements or detect and correct them.
D) neither prevent material misstatements nor detect and correct them.

Accepted Answer

The answer of Control risk is a measure of the...

Question 15

The procedures to test effectiveness of control policies and procedures in support of a reduced assessed control risk are called
A) tests of details of balances.
B) tests of controls.
C) analytical procedures.
D) a walk-through.

Accepted Answer

Tests of controls are specifically designed to test the effectiveness of control policies and procedures in support of a reduced assessed control risk. These tests are used to evaluate whether controls are functioning as intended and to identify any weaknesses that may require remediation. Tests of details of balances and analytical procedures are used for other purposes related to the audit, while a walk-through is a more general term for the process of evaluating a business process from start to finish.

Question 16

Which one of the following is an example of a specific authorization?
A) The computer systems automatically reorder inventory when quantities fall below the economic order quantity.
B) The highest credit limit allowed for accounts receivable customers is $100 000.
C) Each sales transaction that exceeds the credit limit of a customer must be approved by the controller.
D) Grocery sales clerks may approve returns of goods less than ten dollars in value.

Accepted Answer

Option C specifies a specific authorization that requires the approval of the controller for sales transactions that exceed the credit limit of a customer. The other options are either automatic processes or general authorization thresholds, not a specific authorization.

Question 17

Once an understanding of internal controls is obtained that is sufficient for audit planning, then the auditor must first assess
A) whether a lower level of control risk could be supported.
B) whether the financial statements are auditable.
C) the level of control risk supported by the understanding obtained.
D) the level of control risk to use.

Accepted Answer

The answer of Once an understanding of internal controls is...

Question 18

Which of the following duties would indicate a weakness in internal controls?
A) The accounting function is under the controller.
B) The custodianship of cash is the responsibility of the treasurer's function.
C) The internal auditor reports to the board of directors.
D) The custodianship of buildings and equipment is the responsibility of the controller's function.

Accepted Answer

Custodianship of buildings and equipment falls under the physical control of assets. When the responsibility for physical control of assets lies with personnel who also have access to accounting records or inventory records, it creates a potential conflict of interest and weakens internal controls. Therefore, the custodianship of buildings and equipment should be separate from the accounting function, and assigning it to the controller's function indicates a weakness in internal controls. A, B, and C are all acceptable roles and responsibilities within a company's internal control framework.

Question 19

A major control available in a small company, which might not be feasible in a large company, is
A) a wider segregation of duties.
B) use of sequentially numbered documents.
C) fewer transactions to process.
D) the owner-manager's personal interest in and close relationship with personnel.

Accepted Answer

In a small company, the owner-manager has a more personal interest in and close relationship with personnel, allowing for more effective communication and supervision of employees. This level of oversight may not be feasible in a large company with a more extended chain of command and more employees.

Question 20

When planning the audit, the auditor's decision on the appropriate assessed level of control risk to use is
A) an economic issue, trading off the costs of testing controls against the cost of testing balances.
B) calculated by using the audit risk model.
C) calculated by using a standard formula.
D) determined by using actuarial tables.

Accepted Answer

The appropriate assessed level of control risk is influenced by economic issues, as the auditor needs to weigh the costs of testing controls against the cost of testing balances. The audit risk model is used to determine the overall audit risk and set the planned level of detection risk, but it does not directly determine the level of control risk. There is no standard formula or actuarial tables for determining the appropriate assessed level of control risk, as it is a judgment-based decision.

Quiz 8: Internal Controls and Control Risk

Jenny is the information technology support manager at CMH. Jenny is considered to be a super-user at CMH since she can circumvent normal controls. In order to address the risk of super-users, management should

A procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is

When a compensating control exists, a weakness in the system

The auditor may identify some risks that cannot be effectively tested by substantive tests alone. For example, when there are paperless transactions (perhaps using EDI - electronic data interchange) . To address these risks, the auditor is required to

You have just finished documenting your understanding of cycle controls at an audit engagement. Required: A) Explain how you will identify the controls that will be tested. B) What process will you follow for weakness in internal controls?

A secondary objective of the auditor's study and evaluation of internal control is that the study and evaluation provide

Each key control that the auditor intends to rely on must be supported by sufficient

Ideally, tests of controls should be applied to controls

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by

When the auditor attempts to determine the operation of the accounting system by tracing one or a few transactions through the accounting system, this is referred to as

When the auditor identifies opportunities for the client to make operational improvements in the internal control system, it will be communicated to the client's audit committee in the

Control risk is a measure of the auditor's expectation that internal controls will

The procedures to test effectiveness of control policies and procedures in support of a reduced assessed control risk are called

Which one of the following is an example of a specific authorization?

Once an understanding of internal controls is obtained that is sufficient for audit planning, then the auditor must first assess

Which of the following duties would indicate a weakness in internal controls?

A major control available in a small company, which might not be feasible in a large company, is

When planning the audit, the auditor's decision on the appropriate assessed level of control risk to use is