Question 1

As part of gaining an initial understanding of internal control, an auditor is required to do all of the following except:

Accepted Answer

Obtaining knowledge about the operating effectiveness of internal control is a more detailed procedure that typically occurs after the initial understanding of internal control has been gained. The initial phase focuses on understanding the design of internal controls and whether they have been implemented, rather than assessing how effectively they operate.

Question 2

An IT specialist is least likely to be necessary when:

Accepted Answer

If the system has not changed from the prior year, it is less likely that an IT specialist will be necessary as there would be no new technology or software updates to implement or troubleshoot. However, data being shared extensively among systems, participation in electronic commerce, and significant audit evidence in electronic form all require an IT specialist to ensure information security, data accuracy, and system functionality.

Question 3

It is important for the CPA to consider the competence of the entity's employees because their competence bears directly and importantly upon the:

Accepted Answer

The competence of the entity's employees is important because it directly affects the achievement of the objectives of the system of internal control. The system of internal control is designed to ensure that the entity's objectives are achieved, and competent employees are necessary to effectively implement and maintain the system. If employees lack competence, they may not properly carry out their responsibilities, which may result in the system not achieving its objectives. Therefore, the CPA must consider the competence of the entity's employees when assessing the effectiveness of the system of internal control.

Question 4

An organizational structure is important for all of the following reasons except:

Accepted Answer

The statement "ensuring a proper commitment to controls" is a benefit of having an organizational structure. Therefore, all of the given options are valid reasons for having an organizational structure, making option D the exception.

Question 5

In obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company, an auditor is not obligated to:

Accepted Answer

While an auditor is required to obtain an understanding of the entity's internal control, they are not obligated to search for significant deficiencies in the operation of internal control. However, if the auditor becomes aware of any control deficiencies during the audit, they have a responsibility to report them to the appropriate levels of management. A, B, and C are all obligations of the auditor when obtaining an understanding of the entity's internal control.

Question 6

After completing the preliminary phase of the review of internal control, the auditor decides not to rely on the system to restrict substantive procedures. Documentation may be limited to the auditor's:

Accepted Answer

The auditor should document their understanding of the internal control system even if they decide not to rely on it. This documentation should include the nature, timing, and extent of their preliminary review of internal control.

Question 7

When an auditor increases the planned assessed level of control risk because certain control activities were determined to be ineffective, the auditor would most likely increase the:

Accepted Answer

When an auditor increases the planned assessed level of control risk due to ineffective control activities, they would likely increase the extent of tests of details to gain more assurance from substantive procedures, as they cannot rely as much on the effectiveness of the entity's internal controls.

Question 8

Assessing control risk at a lower level involves all of the following except:

Accepted Answer

Assessing control risk at a lower level involves identifying specific controls to rely on, performing tests of controls, and analyzing the achieved level of control risk after performing tests of controls. Concluding that controls are ineffective would result in an assessment of maximum control risk, not a lower level of control risk. Therefore, option B is not a part of assessing control risk at a lower level.

Question 9

An auditor is least likely to test the internal controls that provide for:

Accepted Answer

The auditor is least likely to test the internal controls related to vouching a sample of sales transactions to ensure each one has an accompanying shipping document. This is because it primarily deals with the sales function rather than internal controls related to financial reporting. The other options listed are all related to internal controls that are important for financial reporting and are typically tested by auditors.

Question 10

The control environment component of internal control includes all of the following except:

Accepted Answer

Access to computer programs is not a component of the control environment. The correct components of the control environment are management's philosophy and operating style, organizational structure, and human resource policies and practices.

Question 11

A substantive strategy differs from a reliance strategy in that a substantive strategy includes:

Accepted Answer

A substantive strategy involves performing detailed tests of transactions and balances to gather evidence about the financial statements' accuracy, as opposed to relying primarily on the effectiveness of internal controls.

Question 12

In the audit of financial statements, an auditor's primary consideration regarding an internal control policy or procedure is whether the policy or procedure:

Accepted Answer

When considering internal control policies or procedures, an auditor's primary consideration is whether they affect management's financial statement assertions. The policies or procedures must ensure the completeness, accuracy, and validity of financial statement information. While considerations of management philosophy and style, safeguarding assets, and enhancing decision-making processes are also important, they are not the primary focus in the audit of financial statements.

Question 13

Which of the following procedures most likely would be included as part of an auditor's tests of controls?

Accepted Answer

Inspection is a common test of controls performed by auditors. It involves examining documents, records, and other tangible evidence to determine whether controls are operating effectively. Reconciliation and confirmation are generally substantive auditing procedures rather than tests of controls, while analytical procedures can be either a test of controls or a substantive procedure depending on their purpose.

Question 14

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

Accepted Answer

Incompatible duties are not an inherent limitation of internal controls; rather, they represent a flaw in the design of the control environment. Inherent limitations, such as management override, mistakes in judgment, and collusion among employees, acknowledge that even well-designed internal controls can fail or be circumvented.

Question 15

The risk assessment component of internal control refers to:

Accepted Answer

The risk assessment component of internal control refers to the entity's identification and analysis of risks relevant to achievement of its objectives. It involves the entity assessing the risk of potential events or circumstances that could adversely affect its ability to achieve its objectives, in order to develop and implement effective internal controls.

Question 16

Information and communication includes all of the following except:

Accepted Answer

Information and communication in the context of accounting and financial reporting primarily involve identifying, recording, and presenting transactions and their disclosures in financial statements. Communicating price changes to customers, while important for business operations, does not fall under the typical scope of accounting information and communication processes.

Question 17

Assessing control risk at a lower level most likely would involve:

Accepted Answer

Assessing control risk at a lower level involves identifying specific internal controls relevant to specific assertions. This allows the auditor to rely on those controls and perform less substantive procedures. Changing the timing of substantive procedures (A) and performing more extensive substantive procedures (C) would increase the level of detection risk rather than reducing control risk. Reducing inherent risk (D) would not be related to assessing control risk at a lower level.

Question 18

For a complex IT system, auditors are least likely to use which of the following when documenting their understanding of internal controls?

Accepted Answer

Narratives are least likely to be used by auditors when documenting their understanding of internal controls because they are not as structured as other methods, such as internal control questionnaires, flowcharts, and organization charts.

Question 19

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by:

Accepted Answer

Direct participation by the owner in the recordkeeping activities can compensate for the lack of sufficient staff to ensure proper separation of duties, enhancing internal control by closely monitoring business activities.

Question 20

As opposed to a manual control, an automated control:

Accepted Answer

An automated control should function consistently in the absence of program changes. However, this does not mean that it can never be circumvented or that it need not be tested by the auditor. Testing techniques for automated controls may differ from those used for manual controls.

Quiz 6: Internal Control in a Financial Statement Audit