Question 1

The cutoff assertion refers to the distinction between the company and its subsidiaries and related entities.

Accepted Answer

The cutoff assertion primarily concerns the timing of transactions and events, ensuring they are recorded in the correct accounting period, not the distinction between a company and its subsidiaries or related entities.

Question 2

An ICFR audit is a stand-alone activity with its own objectives and requirements, and can therefore be conducted separately from the financial statement audit.

Accepted Answer

An ICFR (Internal Control over Financial Reporting) audit is often integrated with a financial statement audit because the effectiveness of internal controls is directly related to the reliability of financial reporting.

Question 3

Risk assessment is important only for companies who report to the SEC.

Accepted Answer

Risk assessment is important for all companies regardless of whether they report to the SEC or not. It helps identify potential threats and opportunities that may affect the company's objectives, operations, and reputation.

Question 4

"Tone at the top" refers to the:

Accepted Answer

"Tone at the top" refers to the environment in which the management supports the internal control system by behaving ethically and making business decisions that emphasize its importance. This includes the attitude and actions of senior management and their commitment to ethical behavior and compliance with laws and regulations. The tone at the top sets the standard for the organization's ethical culture and ultimately affects the effectiveness of the internal control system. A and B are important components of the internal control system, but they do not specifically address the tone at the top. D is not directly related to the tone at the top but is an important component of internal control monitoring.

Question 5

Auditors perform walkthroughs as an efficient way to gain an understanding of ICFR and assess design effectiveness.

Accepted Answer

This statement is true. Walkthroughs involve tracing a transaction through the accounting system to assess the design effectiveness of the organization's ICFR. It is an efficient way to gain an understanding of ICFR and identify any potential weaknesses.

Question 6

The Foreign Corrupt Practices Act prompted a definition of internal control that is broader than COSO's definition because COSO does not consider operating efficiency and effectiveness.

Accepted Answer

COSO's definition of internal control is broader and includes considerations of operating efficiency and effectiveness, whereas the Foreign Corrupt Practices Act primarily focuses on accounting transparency and the prevention of bribery and corruption.

Question 7

Segregation of duties calls for separation of the development and operations responsibilities.

Accepted Answer

Segregation of duties is a principle that emphasizes the separation of responsibilities for different stages in a process to reduce the risk of widespread errors, fraud, or security breaches. In the case of development and operations, it is recommended to separate these roles to ensure that the code created by developers is adequately tested, reviewed, and deployed by different professionals who can provide different perspectives and catch potential issues or conflicts. This way, developers can focus on writing code and improving the product, while operations personnel can focus on deploying, maintaining, and updating the code in different environments.

Question 8

When a client company's operations have expanded rapidly, auditors should be aware that existing systems may become strained and break down.

Accepted Answer

Rapid expansion can create a strain on existing systems which may result in breakdown. As auditors, it is important to be aware of this and take it into consideration during the audit process.

Question 9

Auditors' working papers must be in electronic format in order to protect their confidentiality.

Accepted Answer

The statement is false. Auditors' working papers may be kept in electronic or paper format, and confidentiality can be protected in either form. It depends on the auditor's preference and company policies.

Question 10

Which of the following is not one of the operating benefits provided by a strong system of internal controls?

Accepted Answer

Isolating transactions that generate significant profits or losses is not an operating benefit provided by a strong system of internal controls. The other options, such as streamlining accounting and financial information systems, improving financial activities, and identifying non-cost-effective procedures, are all benefits of a strong internal control system.

Question 11

Which of the following statements is true regarding the evolution of definitions of internal control?

Accepted Answer

All of the statements are true. The evolution of internal control definitions started with a narrow view focused only on financial reporting, but has since expanded to include effectiveness and efficiency of operations, compliance with laws and regulations, and safeguarding of assets, due to the efforts of organizations like COSO.

Question 12

Tracing deals with selecting a document and looking for the posting of the document in the accounting books and records.

Accepted Answer

Tracing involves following a transaction from its source documents through the accounting system to the financial statements. It is the process of determining where a particular account balance or amount came from, by examining the underlying documents and records.

Question 13

Within the ERM framework, the sequence of tasks is objective setting, event identification, risk assessment, and risk response.

Accepted Answer

The sequence of tasks in the ERM framework is objective setting, event identification, risk assessment, risk response, and monitoring and review.

Question 14

If an auditor determines that a client company's internal controls are producing reliable and complete financial information, the auditor will rely upon the internal control system and:

Accepted Answer

If the auditor determines that the client company's internal controls are producing reliable and complete financial information, then the auditor can reduce the extent of controls testing and instead rely on the internal control system. This means that the auditor can also reduce the planned substantive testing during the financial statement audit, as the internal control system is dependable. However, it is important to note that the auditor should still perform some level of substantive testing to ensure that the financial statements are free of material misstatements.

Question 15

that come from social engineering are the result of a lack of internal controls.

Accepted Answer

Social engineering attacks exploit human psychology rather than weaknesses in software or systems, and while a lack of internal controls can exacerbate the issue, the root cause is the manipulation of human behavior.

Question 16

Segregation of duties is easy to accomplish in a small-business setting because their operating structure and IT controls are less complex than larger organizations.

Accepted Answer

Segregation of duties may be more challenging to accomplish in a small-business setting because they may have limited staff resources and may not have a formalized system of checks and balances in place. Additionally, the lack of IT controls in a small-business setting may make it harder to monitor and restrict access to sensitive information or systems.

Question 17

Section 404 of the Sarbanes-Oxley Act of 2002 requires that ICFR effectiveness be audited by the PCAOB.

Accepted Answer

Section 404 of the Sarbanes-Oxley Act of 2002 requires that management and an independent auditor assess the effectiveness of the internal controls over financial reporting (ICFR), but it is the company's external auditor, not the Public Company Accounting Oversight Board (PCAOB), that performs the audit of ICFR. The PCAOB, however, establishes the standards for how these audits are conducted.

Question 18

If a company's system of ICFR is effective, auditors can rely upon the evidence that is produced by the system to reduce the extent of substantive testing on the audit.

Accepted Answer

If the system of ICFR is effective, auditors can rely upon the evidence produced by the system, which will reduce the extent of substantive testing required to be performed during the audit. This is because an effective ICFR system provides reasonable assurance that the financial statements are free from material misstatements. However, auditors will still need to perform some level of substantive testing as a part of the audit.

Question 19

Auditors must understand the flow of transactions in order to identify likely sources of financial statement misstatements.

Accepted Answer

Understanding the flow of transactions is an essential part of an auditor's job to identify potential sources of financial misstatement. This understanding helps them to evaluate the design and effectiveness of internal controls and identify areas of high risk for further testing.

Question 20

Physical vaulting refers to the control procedure involving the capture of transactions that by-passed the firewall.

Accepted Answer

Physical vaulting refers to the secure physical storage of backup media (like tapes, disks, or hard drives) in a secure location, not the capture of transactions bypassing a firewall.

Quiz 7: Internal Control, Understanding the Clients Internal Control Over Financial Reporting and Auditing Design Effectiveness