Question 1

The procedures used to gain an understanding of internal control do not vary from client to client.

Accepted Answer

The procedures used to gain an understanding of internal control may vary from client to client depending on the nature of the client's operations, the size of the company, and the complexity of its internal control system. The auditor must determine the procedures that are appropriate for each individual client based on these factors.

Question 2

Which of the following may represent the biggest challenge smaller public companies and nonpublic companies face in implementing effective internal control?
A) a lack of competent, trustworthy personnel
B) no clear lines of authority
C) no adequate separation of duties
D) a lack of adequate documents and records

Accepted Answer

Smaller companies often struggle with separating duties due to limited staff, which can compromise the effectiveness of internal controls.

Question 3

Which of the following computer-assisted auditing techniques inserts an audit module in the client's application system to identify specific types of transactions?
A) parallel simulation testing
B) test data approach
C) embedded audit module
D) generalized audit software testing

Accepted Answer

The technique described is the embedded audit module, which involves inserting an audit module into the client's application system to identify specific types of transactions. A is incorrect because parallel simulation testing involves running a parallel system to test the accuracy of the client's system. B is incorrect because the test data approach involves creating fictitious data to test the accuracy and completeness of the client's system. D is incorrect because generalized audit software testing involves using software to test the client's system overall, rather than focusing on specific types of transactions.

Question 4

Which of the following best describes the test data approach?
A) Auditors process their own test data using the client's computer system and application program.
B) Auditors process their own test data using their own computers that simulate the client's computer system.
C) Auditors use auditor-controlled software to do the same operations that the client's software does, using the same data files.
D) Auditors use client-controlled software to do the same operations that the client's software does, using auditor created data files.

Accepted Answer

Auditors process their own test data using the client's computer system and application program to verify the accuracy and reliability of the client's processing system.

Question 5

In the audit of a private company, the auditor will test internal controls when control risk is initially assessed at
A) 
B) 
C) 
D)

Accepted Answer

The answer of In the audit of a private company,...

Question 6

The assessment of control risk does not impact the testing of controls.

Accepted Answer

The assessment of control risk does impact the testing of controls. If the assessment of control risk is high, the auditor will perform more extensive testing of controls to obtain sufficient evidence that the controls are operating effectively. On the other hand, if the assessment of control risk is low, the auditor may choose to perform less extensive testing of controls.

Question 7

When using the test data approach,
A) auditors process test data supplied by the client.
B) auditors often obtain assistance from a computer audit specialist.
C) the tests must be performed at the end of the year.
D) the test data must remain in the client's records.

Accepted Answer

In the test data approach, auditors often obtain assistance from a computer audit specialist to select and process test data. The other options are incorrect as (A) auditors should not rely on the client to process the test data, (C) the testing can be performed at any time during the audit, not necessarily at the end of the year, and (D) the test data is the property of the auditor, not the client.

Question 8

If, when obtaining an understanding of control activities of a relatively small client, the auditor identified no control activities, the auditor would probably set a high assessment of control risk.

Accepted Answer

If the auditor identifies no control activities, it means that there are no procedures or policies in place to ensure that transactions are properly recorded and processed. Therefore, the auditor would have no basis for relying on any internal controls and would likely set a high assessment of control risk.

Question 9

In an audit of a nonpublic company, the less control risk there is, the smaller the amount of planned substantive evidence that is required.

Accepted Answer

This is true because when control risk is lower, there is a greater likelihood that the company's internal controls are effective and can be relied upon. Therefore, auditors can reduce the amount of planned substantive evidence they need to gather in order to provide assurance on the financial statements.

Question 10

The auditor obtains a sufficient understanding of internal control to assess the risk of material misstatement at the overall financial statement level and at the relevant assertion level.

Accepted Answer

This statement is true. To properly assess the risk of material misstatement, the auditor must obtain a sufficient understanding of the client's internal control system, both at the overall financial statement level and at the relevant assertion level. This allows the auditor to identify any weaknesses or deficiencies in the internal control system that may increase the risk of material misstatement in the financial statements.

Question 11

The auditor's objective in determining whether the client's computer program correctly processes valid and invalid transactions is accomplished through the
A) test data approach.
B) generalized audit software approach.
C) microcomputer-aided auditing approach.
D) generally accepted auditing standards.

Accepted Answer

The auditor's objective of determining whether the client's computer program correctly processes valid and invalid transactions can be achieved through the test data approach, which involves the creation of fictitious input data and comparing the program's output with the auditor's expected results. The generalized audit software approach and the microcomputer-aided auditing approach are more focused on analyzing entire populations of data, rather than testing individual transactions. The generally accepted auditing standards provide guidance for the auditor's overall approach to an audit but do not specifically address testing computer programs.

Question 12

Control risk is generally set at minimum for most private companies.

Accepted Answer

Control risk is not necessarily set at minimum for most private companies. Control risk is dependent on the nature of the business, the industry, and the risk tolerance of the company's management team. Some private companies may prioritize control risk and invest resources to minimize risk, while others may not see it as a priority.

Question 13

Which of the following is not seen as an advantage to using generalized audit software (GAS)?
A) Auditors can learn the software in a short period of time.
B) It can be applied to a variety of clients after detailed customization.
C) It can be applied to a variety of clients with minimal adjustments to the software.
D) It greatly accelerates audit testing over manual procedures.

Accepted Answer

Generalized Audit Software (GAS) is designed to be flexible and adaptable to a wide range of clients and situations with minimal adjustments, making detailed customization (as mentioned in option B) not typically seen as an advantage. Instead, the ease of application across different clients with minimal changes (option C) is one of its key benefits.

Question 14

The embedded audit module approach requires the auditor to insert an audit module in the client's application system to identify specific types of transactions.

Accepted Answer

The statement accurately describes the embedded audit module approach, where the auditor inserts an audit module in the client's application system to identify specific types of transactions.

Question 15

Auditing by testing automated internal controls and account balances electronically, generally because effective general controls exist, is known as
A) auditing through the computer.
B) auditing around the computer.
C) embedded audit module approach.
D) parallel simulation testing.

Accepted Answer

Auditing by testing automated internal controls and account balances electronically is commonly known as auditing through the computer. It is used when general controls are effective and reliable, requiring less manual auditing work.

Question 16

Which of the following is most correct for audits of non-public companies?
A) An audit of internal control is required.
B) An audit of internal control is not required.
C) An audit of the design of internal controls is required.
D) An audit of the operational effectiveness of internal controls is required.

Accepted Answer

An audit of internal control is not required for audits of non-public companies, according to the PCAOB standards. However, auditors are still required to assess the risks of material misstatement and design their audit procedures accordingly. They may also choose to test internal controls as a substantive procedure to obtain audit evidence, but it is not a requirement.

Question 17

When using the test data approach,
A) test data should include data that the client's system should accept or reject.
B) application programs tested by the auditor's test data must be different from those used by the client throughout the year.
C) select data may remain in the client system after testing.
D) None of the above statements is correct.

Accepted Answer

The test data approach involves selecting specific data that is input into the system to test its processing and output. These data should include both valid and invalid data to test if the system accepts or rejects them correctly. Therefore, choice A is correct. Choice B is incorrect because the application programs used should be the same as those used by the client throughout the year to ensure accuracy. Choice C is also incorrect because all test data, including any select data, should be removed from the client's system after testing to avoid affecting regular operations.

Question 18

Parallel simulation is used primarily to test internal controls over the client's IT systems, whereas the test data approach is used primarily for substantive testing.

Accepted Answer

The statement is incorrect. Parallel simulation can be used for both testing internal controls and substantive testing, while the test data approach is primarily used for testing internal controls over the client's IT systems.

Question 19

A company's size should have no impact on the nature of internal control and the controls that are implemented.

Accepted Answer

The size of a company can impact the nature of internal control and the controls that are implemented. Smaller companies may have more informal controls while larger companies may need more formal and structured controls. Additionally, larger companies may have more complex operations and risks that require more robust controls.

Question 20

The objective of the test data approach is to determine whether the client's computer programs can correctly process valid and invalid transactions.

Accepted Answer

The test data approach is specifically designed to test the client's computer programs using both valid and invalid transactions to determine their correctness.

Quiz 12: Assessing Control Risk and Reporting on Internal Controls

The procedures used to gain an understanding of internal control do not vary from client to client.

Which of the following may represent the biggest challenge smaller public companies and nonpublic companies face in implementing effective internal control?

Which of the following computer-assisted auditing techniques inserts an audit module in the client's application system to identify specific types of transactions?

Which of the following best describes the test data approach?

In the audit of a private company, the auditor will test internal controls when control risk is initially assessed at

The assessment of control risk does not impact the testing of controls.

When using the test data approach,

If, when obtaining an understanding of control activities of a relatively small client, the auditor identified no control activities, the auditor would probably set a high assessment of control risk.

In an audit of a nonpublic company, the less control risk there is, the smaller the amount of planned substantive evidence that is required.

The auditor obtains a sufficient understanding of internal control to assess the risk of material misstatement at the overall financial statement level and at the relevant assertion level.

The auditor's objective in determining whether the client's computer program correctly processes valid and invalid transactions is accomplished through the

Control risk is generally set at minimum for most private companies.

Which of the following is not seen as an advantage to using generalized audit software (GAS) ?

The embedded audit module approach requires the auditor to insert an audit module in the client's application system to identify specific types of transactions.

Auditing by testing automated internal controls and account balances electronically, generally because effective general controls exist, is known as

Which of the following is most correct for audits of non-public companies?

When using the test data approach,

Parallel simulation is used primarily to test internal controls over the client's IT systems, whereas the test data approach is used primarily for substantive testing.

A company's size should have no impact on the nature of internal control and the controls that are implemented.

The objective of the test data approach is to determine whether the client's computer programs can correctly process valid and invalid transactions.