Question 1

In an audit of a non-public company, the auditor's assessment of control risk and the extent of tests of controls are inversely related.

Accepted Answer

This is true because if the auditor assesses control risk as low, meaning that internal controls are effective in preventing or detecting material misstatements, then they will perform less extensive tests of controls. On the other hand, if the auditor assesses control risk as high, meaning that there is a higher risk of material misstatements due to weak internal controls, then the auditor will need to perform more extensive tests of controls to ensure the accuracy of financial statements.

Question 2

If, when obtaining an understanding of control activities of a relatively small client, the auditor identified no control activities, the auditor would probably set a high assessment of control risk.

Accepted Answer

If the auditor identified no control activities, there is a high risk of material misstatement and the auditor would set a high assessment of control risk.

Question 3

Which of the following may represent the biggest challenge smaller public companies face in implementing effective internal control?
A) a lack of expertise
B) reduced importance
C) limited resources
D) limited available guidance

Accepted Answer

Smaller public companies often have limited resources, including financial and personnel resources, which can make it difficult to implement effective internal controls. This may leave them vulnerable to errors, fraud, or other risks, which could impact their financial reporting and overall business success. While the other factors may also pose challenges, limited resources are often the most significant barrier for smaller organizations.

Question 4

Auditors of private companies may rely on prior periods' tests of controls.

Accepted Answer

Auditors of private companies may rely on prior periods' tests of controls, as long as there have been no changes in the controls or their operating effectiveness, and the auditor obtains sufficient evidence to support their continued reliance.

Question 5

The criterion that is most likely to be used as a framework in evaluating a company's internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act is the Enterprise Risk Management framework.

Accepted Answer

The COSO Internal Control - Integrated Framework is the most commonly used framework for evaluating internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act.

Question 6

For proper internal control, there should be adequate separation of duties. However, the extent of separation of duties considered "adequate" does not depend on the size of the organization.

Accepted Answer

The extent of separation of duties considered "adequate" does depend on the size of the organization, as smaller organizations may have fewer staff and resources, making it more challenging to separate duties as extensively as larger organizations.

Question 7

To issue an unqualified opinion on internal control over financial reporting, there must be no identified material weaknesses and no restrictions on the scope of the audit.

Accepted Answer

An unqualified opinion on internal control over financial reporting means that the auditor has determined that there are no material weaknesses present and that they had full scope to perform their audit.

Question 8

Match seven of the terms (a-i) with the definitions provided below (1-7):
a. Control environment
b. Control activities
c. Independent checks on performance
d. Internal control
e. Monitoring
f. Separation of duties
g. General authorization
h. Specific authorization
i. Risk assessment
________ 1. Management's ongoing and periodic assessment of the quality of internal control performance to determine that controls are operating as intended and are modified when needed.
________ 2. Company-wide policies for the approval of all transactions within stated limits.
________ 3. The actions, policies, and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity.
________ 4. Segregation of the following activities in an organization: custody of assets, accounting, authorization, and operational responsibility.
________ 5. Management's identification and analysis of risks relevant to the preparation of financial statements in accordance with an applicable accounting framework.
________ 6. Policies and procedures that help ensure that necessary actions are taken to address risks in the achievement of the entity's objectives.
________ 7. A process designed to provide reasonable assurance regarding the achievement of management's objectives in the following categories: (1) reliability of financial reporting, (2) effectiveness and efficiency of operations, and (3) compliance with applicable laws and regulations.

Accepted Answer

The answer of Match seven of the terms (a-i) with...

Question 9

If, when obtaining an understanding of control activities of a relatively small client, the auditor identified no control activities, the auditor would probably reassess whether the client is auditable.

Accepted Answer

If the auditor identified no control activities, it is unlikely that the client has adequate internal controls in place. This may indicate a higher risk of misstatement in the financial statements, and the auditor may need to reassess whether they can obtain sufficient and appropriate audit evidence. This could ultimately impact the auditor's decision to accept or continue the audit engagement.

Question 10

Which of the following is most correct for audits of non-public companies?
A) an audit of internal control is required
B) an audit of internal control is not required
C) an audit of the design of internal controls is required
D) an audit of the operational effectiveness of internal controls is required

Accepted Answer

Audits of non-public companies are not required to include an audit of internal control under generally accepted auditing standards (GAAS). However, the auditor may still choose to perform such an audit if it is deemed necessary or requested by the client.

Question 11

The auditor's consideration of a private company's internal control is:
A) required by GAAP.
B) required by GAAS.
C) required by the IRS.
D) recommended by the SEC.

Accepted Answer

The auditor's consideration of a private company's internal control is required by generally accepted auditing standards (GAAS). While GAAP requires private companies to have internal controls, the auditor is not explicitly required to consider them under GAAP. The IRS and SEC may also have their own requirements or recommendations, but they are not relevant to this specific question.

Question 12

When auditing a private company, the auditor should obtain an understanding of internal control sufficient to:
A) provide reasonable protection against client fraud and defalcations by client employees.
B) assess control risk.
C) provide a basis for suggestions to the client for improving the accounting system.
D) provide a method for safeguarding assets, checking the accuracy and reliability of accounting data, promoting operational efficiency, and encouraging adherence to prescribed managerial policies.

Accepted Answer

Obtaining an understanding of internal control is necessary for auditors to assess control risk, which determines the extent of substantive testing necessary for the audit. While internal control can also help prevent fraud and improve accounting systems and operational efficiency, those are not the primary objectives of obtaining an understanding of internal control in the audit process.

Question 13

In an audit of a non-public company, the less control risk there is, the smaller the amount of planned substantive evidence that is required.

Accepted Answer

If there is less control risk, it means that the company's internal controls are effective in preventing and detecting material misstatements. Therefore, the auditor can rely more on the company's controls and reduce the amount of substantive evidence needed to obtain assurance on the financial statements.

Question 14

In the audit of a private company, the auditor will test internal controls when control risk is initially assessed at:
A) 
B) 
C) 
D)

Accepted Answer

The answer of In the audit of a private company,...

Question 15

Smaller companies usually have less extensive internal controls than larger companies which result in more frauds being committed at small companies.

Accepted Answer

Smaller companies tend to have fewer resources to dedicate to internal controls and may not have the same level of expertise or technology available to detect and prevent fraud, making them more vulnerable to fraudulent activity.

Question 16

A control available in a small company, which may be necessitated because of lack of competent personnel, is:
A) a wider segregation of duties.
B) a voucher system.
C) fewer transactions to process.
D) the owner-manager's direct involvement in the control process.

Accepted Answer

In a small company with a lack of competent personnel, the owner-manager's direct involvement in the control process can be an effective control to ensure that operations and financial activities are being properly managed. The owner-manager can oversee all the financial activities and ensure that appropriate controls are in place. This also provides an opportunity for the owner-manager to gain a better understanding of the company's financial position and identify areas for improvement. A wider segregation of duties may not be possible in a small company, and a voucher system may not be necessary if there are fewer transactions to process.

Quiz 10: Section 404 Audits of Internal Control and Control Risk

In an audit of a non-public company, the auditor's assessment of control risk and the extent of tests of controls are inversely related.

If, when obtaining an understanding of control activities of a relatively small client, the auditor identified no control activities, the auditor would probably set a high assessment of control risk.

Which of the following may represent the biggest challenge smaller public companies face in implementing effective internal control?

Auditors of private companies may rely on prior periods' tests of controls.

The criterion that is most likely to be used as a framework in evaluating a company's internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act is the Enterprise Risk Management framework.

For proper internal control, there should be adequate separation of duties. However, the extent of separation of duties considered "adequate" does not depend on the size of the organization.

To issue an unqualified opinion on internal control over financial reporting, there must be no identified material weaknesses and no restrictions on the scope of the audit.

If, when obtaining an understanding of control activities of a relatively small client, the auditor identified no control activities, the auditor would probably reassess whether the client is auditable.

Which of the following is most correct for audits of non-public companies?

The auditor's consideration of a private company's internal control is:

When auditing a private company, the auditor should obtain an understanding of internal control sufficient to:

In an audit of a non-public company, the less control risk there is, the smaller the amount of planned substantive evidence that is required.

In the audit of a private company, the auditor will test internal controls when control risk is initially assessed at:

Smaller companies usually have less extensive internal controls than larger companies which result in more frauds being committed at small companies.

A control available in a small company, which may be necessitated because of lack of competent personnel, is: