Question 1

The external environment is a system of integrated elements-people, structures, processes, and procedures-acting together to provide reasonable assurance that an organization achieves both its operations system and its information system goals.

Accepted Answer

The description provided actually defines an internal control system, not the external environment. The external environment refers to external factors (economic, legal, technological, competitive, etc.) that affect an organization's operations and performance, not the internal elements like people, structures, processes, and procedures designed to achieve organizational goals.

Question 2

SAS No. 99 emphasizes auditors should brainstorm fraud risks, increase professional skepticism, use unpredictable audit test patterns, and detect management override of internal controls.

Accepted Answer

This statement accurately reflects the main points emphasized in SAS No. 99, which is titled "Consideration of Fraud in a Financial Statement Audit." SAS No. 99 requires auditors to specifically assess the risk of material misstatement due to fraud and to design procedures to address this risk. This includes brainstorming potential fraud scenarios, incorporating professional skepticism throughout the audit, using unpredictable audit procedures, and specifically addressing the risk of management override of internal controls.

Question 3

Organizational governance is a process by which organizations select objectives, establish processes to achieve objectives, and monitor performance.

Accepted Answer

Organizational governance refers to the overall process of directing and controlling an organization in order to achieve its objectives. This typically involves selecting objectives, developing strategies and processes to achieve those objectives, and monitoring performance to ensure that goals are being met. Therefore, the statement is true.

Question 4

Fraud is the possibility that an event or action will cause an organization to fail to meet its objectives (or goals).

Accepted Answer

Fraud is defined as intentional deception for the sake of personal gain. While fraud can certainly have an impact on an organization's ability to meet its objectives, it is not the possibility of an event or action causing failure, but rather a deliberate act of wrongdoing.

Question 5

Management is responsible for establishing and maintaining an adequate system of internal control.

Accepted Answer

According to the COSO Internal Control-Integrated Framework, management is responsible for establishing and maintaining an adequate system of internal control.

Question 6

Establishing and maintaining a viable internal control system is the responsibility of management.

Accepted Answer

The establishment and maintenance of a viable internal control system is a fundamental responsibility of management. It is their responsibility to ensure that the system is effective in managing risk, safeguarding assets, reducing errors and irregularities, and ensuring compliance with laws and regulations.

Question 7

A fraud is a deliberate act or untruth intended to obtain unfair or unlawful gain.

Accepted Answer

This is the definition of fraud as it involves intentional deception for personal gain.

Question 8

Under the Sarbanes Oxley Act of 2002, the section on Corporate Tax Returns conveys a sense of the Senate that the corporate federal income tax returns be signed by the treasurer.

Accepted Answer

The Sarbanes Oxley Act of 2002 does not include a section on corporate tax returns or require the treasurer to sign them.

Question 9

A major reason management must exercise control over an organization's business processes is to provide reasonable assurance that the company is in compliance with applicable laws and regulations.

Accepted Answer

Management is responsible for ensuring compliance with laws and regulations as part of their overall governance responsibilities. Control over business processes can provide reasonable assurance that the company is meeting its legal and regulatory obligations. Failure to comply with applicable laws and regulations can result in serious consequences, such as fines, legal actions, and damage to the company's reputation.

Question 10

Under the Sarbanes Oxley Act of 2002, the section on Corporate Responsibility requires a company's CEO and CFO to certify quarterly and annual reports.

Accepted Answer

The section on Corporate Responsibility under the Sarbanes-Oxley Act of 2002 requires a company's CEO and CFO to certify quarterly and annual reports.

Question 11

Monitoring is a process that assesses the quality of internal control performance over time.

Accepted Answer

Monitoring is a key element of internal control and involves ongoing assessments of the effectiveness of the internal control system over time. It is important to monitor internal control regularly to ensure that it is operating effectively and efficiently, and to identify any weaknesses or deficiencies that may need to be addressed.

Question 12

Risks are those events that could have a negative impact on organization objectives.

Accepted Answer

Risks are defined as events or circumstances that could have a negative impact on an organization's objectives, goals, or ability to achieve them. It is important for organizations to identify, assess and manage risks to minimize their impact and ensure business continuity.

Question 13

The control environment reflects the organization's general awareness of and commitment to the importance of control throughout the organization.

Accepted Answer

The control environment is one of the five components of internal control defined by COSO, and it represents the overall tone and culture of an organization as it relates to control activities. It includes the organization's commitment to ethics and integrity, the effectiveness of its board of directors and management in establishing and communicating control objectives and responsibilities, and the company's approach to managing and mitigating risk. Overall, the control environment is a critical factor in determining the effectiveness of an organization's internal control system.

Question 14

Under the Sarbanes Oxley Act of 2002, the section on Auditor Independence establishes an independent board to oversee public company audits.

Accepted Answer

The Sarbanes-Oxley Act of 2002 established the Public Company Accounting Oversight Board (PCAOB) to oversee public company audits, but the section on Auditor Independence specifically addresses rules to ensure auditors remain independent from their clients.

Question 15

Expected gross risk is a function of the initial expected gross risk, reduced risk exposure due to controls, and cost of controls.

Accepted Answer

Expected gross risk is typically considered as the risk before any controls are applied, so it does not factor in reduced risk exposure due to controls or the cost of controls.

Question 16

Opportunities are events that could have a positive impact on organization objectives.

Accepted Answer

Opportunities are often considered as external factors that could benefit an organization if they are properly identified and exploited. These events could include things such as new market openings, advancements in technology, or changes in the regulatory environment. By taking advantage of opportunities, organizations may achieve their objectives more effectively and efficiently.

Question 17

External directives are the policies and procedures that help ensure that management directives are carried out.

Accepted Answer

External directives are not policies and procedures; they are typically regulations or guidelines imposed by external entities. Internal controls are the mechanisms that ensure management directives are carried out.

Question 18

Management's legal responsibility to prevent fraud and other irregularities is implied by laws such as the Foreign Corrupt Practices Act.

Accepted Answer

The Foreign Corrupt Practices Act (FCPA) requires management to establish and maintain effective internal controls to prevent and detect fraud and other irregularities. Failure to do so can result in legal and financial consequences for the organization and its management. Therefore, management's legal responsibility to prevent fraud and other irregularities is implied by laws such as the FCPA.

Question 19

Risk assessment is the entity's identification and analysis of relevant risks to the achievement of its objectives, forming a basis for determining how the risks should be managed.

Accepted Answer

Risk assessment involves identifying and analyzing risks that could impact an entity's ability to achieve its objectives, and using this information to determine how these risks should be managed.

Question 20

Under the Sarbanes Oxley Act of 2002, the section on Enhanced Financial Disclosures requires each annual report filed with the SEC to include an internal control report.

Accepted Answer

The Enhanced Financial Disclosures section of the Sarbanes Oxley Act of 2002 does require each annual report filed with the SEC to include an internal control report.

Quiz 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control