Question 1

Ideally, tests of controls should be applied to controls
A) at the balance sheet date.
B) at each quarterly interim period.
C) for the entire period under audit.
D) at the beginning of the fiscal period.

Accepted Answer

Tests of controls should be applied for the entire period under audit to ensure the effectiveness of controls throughout the financial period. Testing at the balance sheet date or at quarterly interim periods may not provide a comprehensive assessment of the operating effectiveness of controls. Testing at the beginning of the fiscal period may be helpful but would need to be supplemented by ongoing testing throughout the period.

Question 2

The auditor may identify some risks that cannot be effectively tested by substantive tests alone. For example, when there are paperless transactions (perhaps using EDI - electronic data interchange). To address these risks, the auditor is required to
A) assess the design effectiveness of relevant controls and test them.
B) obtain an understanding of the controls and test them if reliance is intended.
C) obtain an understanding of the controls and assess their design effectiveness.
D) test the controls that address the paperless aspects of the transactions.

Accepted Answer

When substantive tests alone are not sufficient, the auditor is required to obtain an understanding of the controls that address the risks and test them if reliance is intended. This is known as testing control effectiveness. The auditor may not need to test every control if they have identified a control environment that is effective and provides adequate protection against the identified risks. However, they must have a sufficient understanding of the controls to determine whether reliance can be placed on them. Choice A may be considered if the auditor intends to rely on relevant controls. Choice C focuses on assessing the design of controls, and choice D is not a comprehensive enough approach.

Question 3

Which one of the following is an example of a specific authorization?
A) The computer systems automatically reorder inventory when quantities fall below the economic order quantity.
B) The highest credit limit allowed for accounts receivable customers is $100 000.
C) Each sales transaction that exceeds the credit limit of a customer must be approved by the controller.
D) Grocery sales clerks may approve returns of goods less than ten dollars in value.

Accepted Answer

Specific authorization refers to the approval required for a particular action or transaction. Option C states that each sales transaction that exceeds the credit limit of a customer must be approved by the controller, which is a specific authorization requirement. Options A, B, and D describe general authorization policies or guidelines.

Question 4

A) The first step in the auditor's study and evaluation of internal control is obtain understanding of internal control for audit planning purposes. List the remaining steps.
B) Once the auditor has an understanding of internal control, what two assessments must be made prior to testing controls?
C) Describe five common procedures an auditor can use to obtain an understanding of internal control design.

Accepted Answer

The answer of A) The first step in the auditor's...

Question 5

A major control available in a small company, which might not be feasible in a large company, is
A) a wider segregation of duties.
B) use of sequentially numbered documents.
C) fewer transactions to process.
D) the owner-manager's personal interest in and close relationship with personnel.

Accepted Answer

In a small company, the owner-manager is likely to have a more personal interest in and close relationship with personnel which makes it easier to implement control measures. In a large company, there would be too many employees for the owner-manager to develop such relationships to be able to exercise the same level of control.

Question 6

Paul is in the process of performing procedures to obtain the necessary understanding of the client's internal controls. As part of this process, Paul received from the client completed narratives, flowcharts, and internal control questionnaires. Paul can use this information from the client
A) if the entity-level controls and tone at the top were found to be effective.
B) if there has not been any significant change in the internal controls since the prior year.
C) as long as any subsequent reliance on controls is adequately substantiated with testing.
D) since it was prepared by management, which is unbiased.

Accepted Answer

While the information provided by the client can be a useful starting point, it cannot be relied upon without testing to confirm its effectiveness. Therefore, subsequent reliance on controls must be substantiated with testing to ensure that they are functioning properly. Additionally, even if entity-level controls and tone at the top were found to be effective in the past, conditions may have changed since then that affect their effectiveness. Finally, the fact that the information was prepared by management does not necessarily make it unbiased.

Question 7

When planning the audit, the auditor's decision on the appropriate assessed level of control risk to use is
A) an economic issue, trading off the costs of testing controls against the cost of testing balances.
B) calculated by using the audit risk model.
C) calculated by using a standard formula.
D) determined by using actuarial tables.

Accepted Answer

The appropriate assessed level of control risk is influenced by economic issues, as the auditor needs to weigh the costs of testing controls against the cost of testing balances. The audit risk model is used to determine the overall audit risk and set the planned level of detection risk, but it does not directly determine the level of control risk. There is no standard formula or actuarial tables for determining the appropriate assessed level of control risk, as it is a judgment-based decision.

Question 8

When the auditor identifies opportunities for the client to make operational improvements in the internal control system, it will be communicated to the client's audit committee in the
A) management letter.
B) reportable conditions letter.
C) engagement letter.
D) audit report.

Accepted Answer

Operational improvements in the internal control system are commonly communicated in the management letter, which is used to provide recommendations for improvements to the client's management team and audit committee. Reportable conditions letters are used to communicate significant deficiencies and material weaknesses in internal control identified during the audit, while engagement letters outline the expectations and scope of the audit. The audit report provides an opinion on the fairness of the financial statements.

Question 9

Once an understanding of internal controls is obtained that is sufficient for audit planning, then the auditor must first assess
A) whether a lower level of control risk could be supported.
B) whether the financial statements are auditable.
C) the level of control risk supported by the understanding obtained.
D) the level of control risk to use.

Accepted Answer

The answer of Once an understanding of internal controls is...

Question 10

Each key control that the auditor intends to rely on must be supported by sufficient
A) tests of details of balances.
B) tests of controls.
C) analytical review procedures.
D) reperformance procedures.

Accepted Answer

The question is asking about the support for key controls the auditor intends to rely on, which means the focus should be on tests of controls. Testing of details of balances and analytical review procedures may provide other types of support but are not directly relevant to supporting key controls. Reperformance procedures may be used to confirm the effectiveness of controls, but they are not the primary means of supporting controls.

Question 11

If an external auditor's client has used a service organization during the year for some of its payroll processing and accounting, which of the following steps should the external auditor take if he or she decides to use the service organization auditor's report as audit evidence that the entity's controls are operating effectively for certain assertions?
A) Consider the sufficiency and appropriateness of the evidence provided by the service organization auditor's report about the effectiveness of controls intended to prevent or detect material misstatements in the particular assertions.
B) Double-date the audit report to show the date of the service organization's audit and the date of the client's audit.
C) The auditor should make reference to the report of the service auditor as a basis, in part, for his or her own opinion on the entity's financial statements.
D) Re-perform each of the audit tests used by the service organization auditor.

Accepted Answer

The external auditor should consider the sufficiency and appropriateness of the evidence provided by the service organization auditor's report about the effectiveness of controls intended to prevent or detect material misstatements in the particular assertions. This is necessary to ensure that the external auditor can rely on the service organization auditor's report as audit evidence. The other options are not necessary or appropriate actions to take.

Question 12

When a compensating control exists, a weakness in the system
A) is no longer a concern because the potential for misstatement has been sufficiently reduced.
B) is reduced but not removed; therefore, it is still of concern to the auditor.
C) could cause a material loss, so it must be tested using substantive procedures.
D) is magnified and must be removed from the sampling process and examined in its entirety.

Accepted Answer

A compensating control is implemented to reduce or eliminate the risk associated with a weakness in a system. Therefore, if a compensating control exists, the potential for misstatement has been sufficiently reduced, and the weakness is no longer a concern to the auditor.

Question 13

You have just finished documenting your understanding of cycle controls at an audit engagement.
Required:
A) Explain how you will identify the controls that will be tested.
B) What process will you follow for weakness in internal controls?

Accepted Answer

The answer of You have just finished documenting your understanding...

Question 14

When the auditor attempts to determine the operation of the accounting system by tracing one or a few transactions through the accounting system, this is referred to as
A) tracing.
B) vouching.
C) tests of controls.
D) a walk-through.

Accepted Answer

This is referred to as a walk-through, where the auditor follows a transaction from start to finish through the accounting system to understand the system's effectiveness and identify any weaknesses or areas of potential risk. Tracing and vouching are specific procedures used during the walk-through, while tests of controls are broader procedures that assess the effectiveness of internal controls in preventing or detecting errors or fraud.

Question 15

Control risk is a measure of the auditor's expectation that internal controls will
A) prevent material misstatements from occurring.
B) detect and correct material misstatements.
C) either prevent material misstatements or detect and correct them.
D) neither prevent material misstatements nor detect and correct them.

Accepted Answer

The answer of Control risk is a measure of the...

Question 16

The procedures to test effectiveness of control policies and procedures in support of a reduced assessed control risk are called
A) tests of details of balances.
B) tests of controls.
C) analytical procedures.
D) a walk-through.

Accepted Answer

Tests of controls are specifically designed to test effectiveness of control policies and procedures in support of a reduced assessed control risk. Tests of details of balances and analytical procedures are used to gather evidence about account balances and relationships among financial data, respectively. A walk-through is a procedure to trace the flow of transactions through a system to identify potential control weaknesses.

Question 17

Which of the following duties would indicate a weakness in internal controls?
A) The accounting function is under the controller.
B) The custodianship of cash is the responsibility of the treasurer's function.
C) The internal auditor reports to the board of directors.
D) The custodianship of buildings and equipment is the responsibility of the controller's function.

Accepted Answer

The custodianship of buildings and equipment should not be the responsibility of the controller's function as it creates a potential conflict of interest. The controller is responsible for recording and reporting on the assets, while the custodian is responsible for safeguarding them. This separation of duties helps to prevent fraud or misuse of assets. Therefore, having the controller responsible for custodianship would indicate a weakness in internal controls. The other options mentioned above are all common and appropriate examples of effective internal controls.

Question 18

Jenny is the information technology support manager at CMH. Jenny is considered to be a super-user at CMH since she can circumvent normal controls. In order to address the risk of super-users, management should
A) remove the super-user.
B) establish effective compensating controls.
C) update the background check on the super-user on a yearly basis.
D) ensure that the super-user is familiar with the code of conduct of the company.

Accepted Answer

Removing a super-user may hinder the efficiency of IT support and is not a practical solution. Updating the background check annually and ensuring familiarity with the code of conduct are good practices but may still not address the risk adequately. Therefore, the best option is to establish effective compensating controls that limit the amount of access and actions super-users can perform, while still allowing them to perform their duties efficiently.

Question 19

A procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is
A) inspection.
B) observation.
C) reperformance.
D) reconciliation.

Accepted Answer

When testing control procedures that involve segregation of functions and leave no transaction trail, observation is likely the most suitable procedure for the auditor. This allows the auditor to visually observe the segregation of duties being performed and evaluate whether the functions are being carried out as they should be. Inspection may not be useful in this scenario since there is no transaction trail to inspect. Reperformance and reconciliation may not provide relevant information about segregation of functions.

Question 20

A secondary objective of the auditor's study and evaluation of internal control is that the study and evaluation provide
A) a basis for constructive suggestions concerning improvements in internal control.
B) a basis for reliance on the accounting system.
C) an assurance that the records and documents have been maintained in accordance with existing company policies and procedures.
D) an indication that management and employees are trustworthy.

Accepted Answer

The primary objective of an auditor's study and evaluation of internal controls is to assess the effectiveness of internal controls in preventing and detecting material misstatements. However, a secondary objective is to identify weaknesses in internal control and provide constructive suggestions for improvement. Option B is incorrect because reliance on the accounting system is not a secondary objective of an auditor's study of internal control - rather, it is a primary objective. Option C is incorrect because while an auditor's evaluation of internal control may provide some assurance that records and documents have been maintained in accordance with policies and procedures, this is not its primary or secondary objective. Option D is incorrect because an auditor's evaluation of internal control does not provide an indication of management and employee trustworthiness.

Quiz 8: Internal Controls and Control Risk

Ideally, tests of controls should be applied to controls

The auditor may identify some risks that cannot be effectively tested by substantive tests alone. For example, when there are paperless transactions (perhaps using EDI - electronic data interchange) . To address these risks, the auditor is required to

Which one of the following is an example of a specific authorization?

A major control available in a small company, which might not be feasible in a large company, is

Paul is in the process of performing procedures to obtain the necessary understanding of the client's internal controls. As part of this process, Paul received from the client completed narratives, flowcharts, and internal control questionnaires. Paul can use this information from the client

When planning the audit, the auditor's decision on the appropriate assessed level of control risk to use is

When the auditor identifies opportunities for the client to make operational improvements in the internal control system, it will be communicated to the client's audit committee in the

Once an understanding of internal controls is obtained that is sufficient for audit planning, then the auditor must first assess

Each key control that the auditor intends to rely on must be supported by sufficient

When a compensating control exists, a weakness in the system

You have just finished documenting your understanding of cycle controls at an audit engagement. Required: A) Explain how you will identify the controls that will be tested. B) What process will you follow for weakness in internal controls?

When the auditor attempts to determine the operation of the accounting system by tracing one or a few transactions through the accounting system, this is referred to as

Control risk is a measure of the auditor's expectation that internal controls will

The procedures to test effectiveness of control policies and procedures in support of a reduced assessed control risk are called

Which of the following duties would indicate a weakness in internal controls?

Jenny is the information technology support manager at CMH. Jenny is considered to be a super-user at CMH since she can circumvent normal controls. In order to address the risk of super-users, management should

A procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is

A secondary objective of the auditor's study and evaluation of internal control is that the study and evaluation provide