Question 1

In an audit of financial statements of a nonpublic company in accordance with generally accepted auditing standards,an auditor is required to

Accepted Answer

An auditor is required to document their understanding of the entity's internal control as part of the audit process to assess the risk of material misstatement and plan the audit accordingly.

Question 2

After obtaining an understanding of internal controls and assessing control risk on the audit of a nonpublic company,an auditor decided to perform tests of controls.The auditor most likely decided that

Accepted Answer

Performing tests of controls can provide evidence that the internal controls are operating effectively and can reduce the amount of substantive testing needed. This saves time and resources on the audit. Therefore, the auditor may have decided to perform tests of controls to increase the efficiency of the audit process.

Question 3

If a control total were to be computed on each of the following data items,which would best be identified as a hash total for a payroll IT application?

Accepted Answer

A hash total is a control total that does not have a direct financial meaning but is used to ensure data integrity. Department numbers work well for this purpose as they can be added together to create a non-financial total that can be used to check that all data has been processed correctly, unlike hours worked, total debits and credits, or net pay, which are financial figures.

Question 4

The primary objective of procedures performed to obtain an understanding of the entity's internal control is to provide an auditor

Accepted Answer

The primary objective of procedures performed to obtain an understanding of the entity's internal control is to provide an auditor the knowledge necessary for audit planning. This knowledge will enable an auditor to assess risk, design audit procedures, and evaluate the control environment.

Question 5

As part of understanding the internal control,an auditor is not required to

Accepted Answer

An auditor is not required to obtain knowledge about the operating effectiveness of the client's internal control activities during the understanding phase; this is typically done during the testing phase.

Question 6

After obtaining an understanding of a client's financial reporting control activities,the auditor would next

Accepted Answer

After obtaining an understanding of a client's financial reporting control activities, the auditor would next document the understanding obtained. This step is necessary to ensure that the auditor has a complete understanding of the client's control activities and that this understanding is properly documented for future reference. Once the understanding is documented, the auditor can move on to testing the client's control activities, assessing the final control risk, and planning the remainder of the audit work.

Question 7

When the audit team increases the planned assessed level of control risk because certain control activities were determined to be ineffective,the audit team would most likely increase the

Accepted Answer

When the audit team increases the planned assessed level of control risk, it means that they believe the controls in place are not effective in preventing or detecting material misstatements. Therefore, the audit team would need to perform more extensive substantive tests of details to obtain sufficient evidence about the accuracy and completeness of the account balances or transactions. This is because the substantive tests of details are designed to directly test the materiality of the account balance or transaction and are used when the control risk is assessed as high. The other options are not appropriate because increasing the level of inherent risk would assume that there is a greater likelihood of material misstatements occurring in the account balance or transaction due to factors outside the entity's control, and increasing the extent of tests of controls would not be useful if the control activities are already determined to be ineffective. Finally, increasing the level of detection risk would increase the risk of the auditor failing to detect material misstatements and would not be an appropriate response.

Question 8

In computer systems,the information technology general controls (ITGC)would not include

Accepted Answer

ITGCs are the overall policies and procedures that relate to the organization's overall IT environment. Processing of control activities is a specific control activity, and therefore, it is not considered an ITGC. ITGCs typically include controls over access to data, system development and maintenance, security management, and operations management, among others. Separation of various computer system functions, appropriate documentation of the data processing system, and control over physical access to computer hardware are all examples of ITGCs.

Question 9

Which of the following is a step in an auditor's decision to assess control risk at below the maximum?

Accepted Answer

To assess control risk at below the maximum, the auditor must identify specific internal control policies and activities that are likely to detect or prevent material misstatements. Option A is a step to detect weak controls, but it does not help the auditor to assess control risk at below the maximum. Option B is a step in the substantive testing phase, which may be performed if the auditor assesses control risk at the maximum. Option D is a consideration for determining the extent of testing and does not help the auditor to assess control risk at below the maximum.

Question 10

Which of the following would most likely be classified as a material weakness?

Accepted Answer

The answer of Which of the following would most likely...

Question 11

Proper separation of duties reduces the opportunity for persons to be in positions to both

Accepted Answer

Proper separation of duties ensures that no single individual has control over all aspects of any critical transaction, which reduces the risk of fraud and its concealment.

Question 12

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

Accepted Answer

Incompatible duties are not an inherent limitation of internal controls; rather, they represent a flaw in the design of the control environment. Inherent limitations, such as management override, mistakes in judgment, and collusion among employees, acknowledge that even well-designed internal controls can fail or be circumvented.

Question 13

Generally accepted auditing standards (GAAS)give auditors considerable discretion to decide the amount of work required to satisfy auditing standards guiding internal control evaluation and related audit planning.Which of the following descriptions best expresses the minimum amount of work permitted by GAAS for nonpublic companies?

Accepted Answer

GAAS requires auditors to obtain an understanding of the client's environment, accounting, and control activities, and to document their decision regarding control risk. For nonpublic companies, auditors can assess control risk at maximum and perform substantive testing, but not necessarily 100% testing.

Question 14

In an audit of financial statements,an auditor's primary consideration regarding an internal control policy or activity is whether the policy or activity

Accepted Answer

In an audit, the auditor's primary consideration regarding an internal control policy or activity is whether it affects management's financial statement assertions. This is because management's assertions provide a basis for the auditor to plan and perform audit procedures to obtain sufficient appropriate audit evidence. Therefore, an effective internal control policy or activity that supports management's assertions would reduce the level of detection risk and increase the reliability of financial information.

Question 15

If auditors assess control risk at the maximum level,they will tend to

Accepted Answer

If auditors assess control risk at the maximum level, it means that they believe that the company's internal controls are not effective at preventing or detecting material misstatements. As a result, auditors will need to rely more on substantive testing to obtain assurance that the financial statements are free from material misstatements. Therefore, they will perform a great deal of substantive testing during the audit to obtain sufficient appropriate audit evidence.

Question 16

The overall attitude and awareness of an entity's board of directors concerning the importance of the client's internal control usually is reflected in its

Accepted Answer

The control environment reflects the overall attitude, awareness, and actions of an entity's board of directors regarding the importance of internal control. It sets the tone for the organization and influences the awareness and actions of others. Therefore, the control environment is the best choice for reflecting the board of directors' attitude and awareness regarding the importance of internal control.

Question 17

The ultimate purpose of assessing control risk is to contribute to the auditor's evaluation of the

Accepted Answer

The ultimate purpose of assessing control risk is to evaluate the risk that material misstatements exist in the financial statements. This evaluation helps the auditor to plan and perform further audit procedures to reduce the risk of misstatement to an acceptably low level. Therefore, choice C is the correct answer.

Question 18

During the audit of a private company's financial statements,which of the following statements best describes the minimum work an auditor must perform in connection with a company's internal control?

Accepted Answer

The minimum work an auditor must perform in connection with a company's internal control is to prepare auditing working papers that document the auditor's understanding of the company's internal control. This includes documenting the company's control environment, control activities, and monitoring activities. It is not required to perform exhaustive tests or design procedures to search for deficiencies at this minimum level, although the auditor may choose to do so if they believe it is necessary. The auditor is also not required to determine whether the company's control policies are well-designed at this minimum level, although they may identify potential weaknesses in the control environment during their documentation process.

Question 19

Which of the following is not an objective of internal controls over financial reporting as defined by the Sarbanes-Oxley Act?

Accepted Answer

The Sarbanes-Oxley Act focuses on financial reporting and internal controls related to financial statements, not directly on compliance with laws and regulations.

Question 20

When obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company,an auditor is not obligated to

Accepted Answer

While an auditor is required to obtain an understanding of a nonpublic company's internal control system, they are not required to search for significant deficiencies in the operation of the system. However, if they do become aware of any significant deficiencies, they are required to communicate them to management.

Quiz 5: Risk Assessment: Internal Control Evaluation