Question 1

For an auditor's report to conclude that ICFR is effective, the auditor must have confidence in the conclusion that the ICFR are effective in both design and operation. The applicable period of time pertaining to this conclusion is:
A) the last day of the fiscal year.
B) the end of the fiscal year and for a reasonable period of time prior to the fiscal year-end.
C) throughout the majority of the fiscal year.
D) throughout the entire fiscal year.

Accepted Answer

The auditor must have confidence in the conclusion that the ICFR are effective in both design and operation at the end of the fiscal year and for a reasonable period of time prior to the fiscal year-end.

Question 2

Which of the following is not true regarding the performance of a walkthrough?
A) It is a type of ICFR consisting of a set of related procedures that are performed together for the purpose of identifying important control points or deficiencies in controls.
B) The auditor follows a transaction from origination through the processes and information systems until it is recorded in the accounting books.
C) It combines the audit procedures of tracing, inquiry, and observation.
D) It is an efficient way for an auditor to test the operating effectiveness of controls.

Accepted Answer

The statement "It is an efficient way for an auditor to test the operating effectiveness of controls" is not true regarding the performance of a walkthrough. While a walkthrough can help identify control points and deficiencies, it is not designed to test control effectiveness. It is primarily used for understanding the design and implementation of controls.

Question 3

Characteristics that drive a need for extensive audit documentation include:
A) the audit task is very straightforward and objective.
B) the management assertion related to the audit task involves a lot of risk.
C) the management assertion related to the audit task has been extensively tested by the company's internal auditors.
D) the audit task involves a conclusion that is self-evident.

Accepted Answer

Extensive audit documentation is needed when there is a high level of risk involved in the management assertion related to the audit task. This is because the riskier the assertion, the more evidence the auditor will need to gather to support their opinion. A straightforward and objective audit task or a self-evident conclusion would likely not require extensive audit documentation. The fact that the management assertion has been extensively tested by the company's internal auditors may provide some assurance, but it does not necessarily eliminate the need for the auditor to conduct their own independent testing and documentation.

Question 4

Which of the following is a compensating control for a lack of segregation of duties in a small business environment?
A) Collusion between an accountant and cashier.
B) Active involvement and oversight by the owner.
C) Cumulative access and authority of a super-user.
D) Requirement for an annual physical inventory count.

Accepted Answer

In a small business environment, it may not be possible to completely segregate duties due to limited resources. However, active involvement and oversight by the owner can act as a compensating control to ensure that no single individual has complete control over a process or transaction. This helps mitigate the risk of fraud or errors. Choices A and C are not compensating controls but create additional risks. Choice D is a good control but is not specifically compensating for a lack of segregation of duties.

Question 5

Each of the following is a monitoring procedure from the COSO monitoring guidance except:
A) periodic evaluation and testing of controls by the internal auditors.
B) supervisory reconciliations and other reviews of controls.
C) analysis of and follow up on metrics that might identify control failures.
D) cumulative access and authority of a super-user.

Accepted Answer

The COSO monitoring guidance includes periodic evaluation and testing of controls by internal auditors (A), supervisory reconciliations and other reviews of controls (B), and analysis of and follow-up on metrics that might identify control failures (C). However, cumulative access and authority of a super-user is not a monitoring procedure; rather, it relates to segregation of duties and access controls.

Question 6

Section 302 of the Sarbanes-Oxley Act requires the CEO and CFO of each public company to personally certify each annual and quarterly report issued to the SEC. These certifications indicate, among other things, that:
A) the signing officer has reviewed the report.
B) the financial statements do not contain any untrue statements or omissions of material facts.
C) the signing officer acknowledges responsibility for establishing and maintaining internal controls.
D) All of the above.

Accepted Answer

All of the above statements are required in the certifications under Section 302 of the Sarbanes-Oxley Act. The signing officer must review the report, certify that the financial statements do not contain any untrue statements or omissions of material facts, and acknowledge responsibility for establishing and maintaining internal controls.

Question 7

Which of the following describes management's responsibility for providing documentation for its assessment of the effectiveness of ICFR?
A) The documentation must follow strict SEC guidelines regarding its format and length.
B) The documentation must show the connection between significant financial statement accounts, management assertions, and controls.
C) The documentation must be updated monthly and updated via narrative reports.
D) All of the above are true.

Accepted Answer

Management's responsibility for providing documentation for its assessment of the effectiveness of ICFR is to show the connection between significant financial statement accounts, management assertions, and controls. The documentation does not need to follow strict SEC guidelines regarding its format and length, and it does not need to be updated monthly or via narrative reports. Therefore, options A and C are incorrect, and option D is incorrect because it includes options A and C as true.

Question 8

Which of the following circumstances would not warrant special risk assessment attention?
A) New client personnel.
B) New product lines.
C) New information systems.
D) New audit firm.

Accepted Answer

Out of the given circumstances, a new audit firm would not warrant special risk assessment attention as the audit firm itself is responsible for conducting its own risk assessment procedures to ensure the integrity of their client's financial statements. However, new client personnel, new product lines, and new information systems are all factors that can increase the risk of material misstatements in the financial statements and therefore require special risk assessment attention.

Question 9

Which of the following is not an audit procedure used to gain an understanding of specific controls in ICFR?
A) Making inquiries of appropriate personnel.
B) Inspecting company records.
C) Confirming transactions with external parties.
D) Observing specific actions, behaviors, and procedures.

Accepted Answer

Confirming transactions with external parties is not a procedure used to gain an understanding of specific controls in ICFR. This procedure is usually used to test the completeness and accuracy of transactions, but it does not provide information on internal control procedures. The other three procedures (making inquiries, inspecting records, observing actions) are commonly used in auditing to gain an understanding of internal controls.

Question 10

An auditor's work papers document all of the following except:
A) the procedures performed and evidence collected by the auditor.
B) the auditor's planning and performance of work.
C) the time required for company personnel to compile the records requested by the auditor.
D) conclusions reached by the auditor.

Accepted Answer

The auditor's work papers document the procedures performed, evidence collected, planning and performance of work, and conclusions reached by the auditor. However, they do not typically document the time required for company personnel to compile the records requested by the auditor.

Question 11

In the U.S., the first legislation requiring management of public companies to maintain a system of internal controls was the:
A) Committee of Sponsoring Organizations (COSO) of the Treadway Commission Act.
B) Sarbanes-Oxley Act.
C) Foreign Corrupt Practices Act.
D) Public Company Accounting Oversight Board (PCAOB) Act.

Accepted Answer

The Foreign Corrupt Practices Act (FCPA) of 1977 was the first U.S. legislation that required corporations to maintain systems of internal accounting controls. It was enacted in response to corporate scandals involving bribery of foreign officials.

Question 12

Which of the following statements is true regarding the SEC's 2007 interpretive release to management for assessing and reporting on the effectiveness of ICFR?
A) Examples of specific management documentation are provided in the release.
B) If controls appropriately address risks, indicating design effectiveness, management tests the controls to assess operating effectiveness.
C) The overall system of ICFR may be deemed effective if one or only a few material misstatements are identified.
D) Management only needs to test those controls that are ineffective in the prevention of material misstatements in the financial statements.

Accepted Answer

The SEC's 2007 interpretive release states that if controls appropriately address risks, indicating design effectiveness, management tests the controls to assess operating effectiveness. The release does not provide specific examples of management documentation, and management must test all controls, not just those deemed ineffective, to assess the overall effectiveness of ICFR. A few material misstatements cannot justify an overall ineffective system of ICFR.

Question 13

The management assertion that is concerned with the separation between fiscal years is the:
A) classification assertion.
B) valuation or allocation assertion.
C) completeness assertion.
D) cutoff assertion.

Accepted Answer

The cutoff assertion is concerned with ensuring that transactions are recorded in the correct accounting period. In this case, the management assertion regarding the separation between fiscal years is related to the cutoff assertion.

Question 14

The management assertion that is concerned with whether recorded transactions are real and actually happened is the:
A) occurrence assertion.
B) accuracy assertion.
C) completeness assertion.
D) cutoff assertion.

Accepted Answer

The occurrence assertion is concerned with whether recorded transactions actually happened and are real. This assertion ensures that all recorded transactions are valid and have actually occurred.

Question 15

Tracing is a specific type of document inspection whereby the auditor verifies whether the document:
A) has been posted to the relevant accounting records.
B) is supported by appropriate source documents.
C) is mathematically accurate.
D) proves ownership of the underlying asset or liability.

Accepted Answer

Tracing involves verifying whether a document has been correctly posted to the relevant accounting records. It does not involve checking for mathematical accuracy or ownership of assets or liabilities, and supporting source documents may be verified through other procedures such as vouching.

Question 16

Risks related to a company's business units or functions are:
A) activity-level risks.
B) external risks.
C) entity-level risks.
D) critical risks.

Accepted Answer

Risks related to a company's business units or functions are usually called activity-level risks. These risks are specific to the operations of the business and the activities it performs. They can include risks related to production, distribution, marketing, and human resources, among others. Therefore, choice A is the best answer. Entity-level risks (choice C) refer to risks that affect the entire organization, while critical risks (choice D) are risks that can have a significant impact on the achievement of the organization's objectives. External risks (choice B) are risks that originate outside the organization, such as economic, political, or environmental risks.

Question 17

Which of the following is not an entity-level control that monitors other controls?
A) The internal audit function.
B) The audit committee.
C) The code of conduct.
D) The self-assessment program.

Accepted Answer

The code of conduct is a set of rules and principles that guide an organization's actions and decisions, but it is not a control that monitors other controls. The internal audit function, audit committee, and self-assessment program are all examples of entity-level controls that monitor other controls.

Question 18

Which technique of ICFR documentation describes the activities performed and flow of documents using diagrams and symbols?
A) Narratives.
B) Job descriptions.
C) Questionnaires.
D) Flowcharts.

Accepted Answer

Flowcharts are a visual representation of processes and activities involved in ICFR documentation. They use symbols and diagrams to show how information flows within an organization and help to identify any potential weaknesses or risks in the internal control system. Narratives provide a description of the activities and procedures involved, while job descriptions and questionnaires focus more on the roles and responsibilities of individuals and departments.

Question 19

A material weakness will always exist when a company has:
A) a decentralized structure and authority is shared in a system of matrix management.
B) an audit committee that provides ineffective oversight of financial reporting and ICFR.
C) a corporate culture with a strong emphasis on achieving profitability.
D) inexperienced workers serving in demanding positions.

Accepted Answer

An ineffective audit committee oversight of financial reporting and ICFR can lead to material weaknesses in a company's internal controls over financial reporting. Material weaknesses are significant deficiencies in the design or operation of a company's internal controls that could result in a material misstatement of the financial statements. Therefore, company's audit committee should be effective in overseeing financial reporting and ICFR to prevent such deficiencies. None of the other options provided necessarily lead to material weaknesses.

Question 20

The objective of an integrated audit is to report on ICFR and the financial statements of a public company. How does an auditor express these two opinions?
A) Issue a single report to include both opinions.
B) Issue two separate reports: one on ICFR and one on the financial statements.
C) Issue three separate reports: one on ICFR design effectiveness; one of ICFR operating effectiveness; and one on the financial statements.
D) Either a or b

Accepted Answer

The auditor can choose to issue a single report that includes both opinions, or two separate reports: one on ICFR and one on the financial statements. Both options are acceptable under PCAOB standards, and the auditor can choose the approach that they believe will provide the most useful information to users of the audit report. Option C is incorrect because it suggests that the auditor would issue three separate reports, which is not a common approach for an integrated audit.

Quiz 7: Internal Control, Understanding the Clients Internal Control Over Financial Reporting and Auditing Design Effectiveness

For an auditor's report to conclude that ICFR is effective, the auditor must have confidence in the conclusion that the ICFR are effective in both design and operation. The applicable period of time pertaining to this conclusion is:

Which of the following is not true regarding the performance of a walkthrough?

Characteristics that drive a need for extensive audit documentation include:

Which of the following is a compensating control for a lack of segregation of duties in a small business environment?

Each of the following is a monitoring procedure from the COSO monitoring guidance except:

Section 302 of the Sarbanes-Oxley Act requires the CEO and CFO of each public company to personally certify each annual and quarterly report issued to the SEC. These certifications indicate, among other things, that:

Which of the following describes management's responsibility for providing documentation for its assessment of the effectiveness of ICFR?

Which of the following circumstances would not warrant special risk assessment attention?

Which of the following is not an audit procedure used to gain an understanding of specific controls in ICFR?

An auditor's work papers document all of the following except:

In the U.S., the first legislation requiring management of public companies to maintain a system of internal controls was the:

Which of the following statements is true regarding the SEC's 2007 interpretive release to management for assessing and reporting on the effectiveness of ICFR?

The management assertion that is concerned with the separation between fiscal years is the:

The management assertion that is concerned with whether recorded transactions are real and actually happened is the:

Tracing is a specific type of document inspection whereby the auditor verifies whether the document:

Risks related to a company's business units or functions are:

Which of the following is not an entity-level control that monitors other controls?

Which technique of ICFR documentation describes the activities performed and flow of documents using diagrams and symbols?

A material weakness will always exist when a company has:

The objective of an integrated audit is to report on ICFR and the financial statements of a public company. How does an auditor express these two opinions?