Question 1

In an audit of financial statements of a nonpublic company in accordance with generally accepted auditing standards,an auditor is required to
A) Document his or her understanding of the entity's internal control.
B) Search for significant deficiencies in the operation of internal controls.
C) Perform tests of controls to evaluate the effectiveness of the entity's accounting system.
D) Determine whether control activities are operating effectively to prevent or detect material misstatements.

Accepted Answer

An auditor is required to document their understanding of the entity's internal control as part of the audit process to assess the risk of material misstatement and plan the audit accordingly.

Question 2

After obtaining an understanding of internal controls and assessing control risk on the audit of a nonpublic company,an auditor decided to perform tests of controls.The auditor most likely decided that
A) It would be efficient to perform tests of controls that would result in a reduction in planned substantive tests.
B) Additional evidence to support a further reduction in control risk is not available.
C) An increase in the assessed level of control risk is justified for certain financial statement assertions.
D) There were many internal control weaknesses that could allow errors to enter the accounting system.

Accepted Answer

Performing tests of controls can provide evidence that the internal controls are operating effectively and can reduce the amount of substantive testing needed. This saves time and resources on the audit. Therefore, the auditor may have decided to perform tests of controls to increase the efficiency of the audit process.

Question 3

If a control total were to be computed on each of the following data items,which would best be identified as a hash total for a payroll IT application?
A) Hours worked.
B) Total debits and total credits.
C) Net pay.
D) Department numbers.

Accepted Answer

A hash total is a control total that does not have a direct financial meaning but is used to ensure data integrity. Department numbers work well for this purpose as they can be added together to create a non-financial total that can be used to check that all data has been processed correctly, unlike hours worked, total debits and credits, or net pay, which are financial figures.

Question 4

The primary objective of procedures performed to obtain an understanding of the entity's internal control is to provide an auditor
A) The knowledge necessary for audit planning.
B) The evidential matter to use in assessing inherent risk.
C) A basis for modifying tests of controls.
D) An evaluation of the consistency of application of management's policies.

Accepted Answer

The primary objective of procedures performed to obtain an understanding of the entity's internal control is to provide an auditor the knowledge necessary for audit planning. This knowledge will enable an auditor to assess risk, design audit procedures, and evaluate the control environment.

Question 5

As part of understanding the internal control,an auditor is not required to
A) Consider factors that affect the risk of material misstatement.
B) Ascertain whether internal control policies and activities have been placed in operation.
C) Identify the types of potential misstatements that can occur.
D) Obtain knowledge about the operating effectiveness of the client's internal control activities.

Accepted Answer

An auditor is not required to obtain knowledge about the operating effectiveness of the client's internal control activities during the understanding phase; this is typically done during the testing phase.

Question 6

After obtaining an understanding of a client's financial reporting control activities,the auditor would next
A) Test the client's control activities.
B) Assess the final control risk.
C) Document the understanding obtained.
D) Plan the remainder of the audit work.

Accepted Answer

After obtaining an understanding of a client's financial reporting control activities, the auditor would next document the understanding obtained. This step is necessary to ensure that the auditor has a complete understanding of the client's control activities and that this understanding is properly documented for future reference. Once the understanding is documented, the auditor can move on to testing the client's control activities, assessing the final control risk, and planning the remainder of the audit work.

Question 7

When the audit team increases the planned assessed level of control risk because certain control activities were determined to be ineffective,the audit team would most likely increase the
A) Extent of substantive tests of details.
B) Level of inherent risk.
C) Extent of tests of controls.
D) Level of detection risk.

Accepted Answer

When the audit team increases the planned assessed level of control risk, it means that they believe the controls in place are not effective in preventing or detecting material misstatements. Therefore, the audit team would need to perform more extensive substantive tests of details to obtain sufficient evidence about the accuracy and completeness of the account balances or transactions. This is because the substantive tests of details are designed to directly test the materiality of the account balance or transaction and are used when the control risk is assessed as high. The other options are not appropriate because increasing the level of inherent risk would assume that there is a greater likelihood of material misstatements occurring in the account balance or transaction due to factors outside the entity's control, and increasing the extent of tests of controls would not be useful if the control activities are already determined to be ineffective. Finally, increasing the level of detection risk would increase the risk of the auditor failing to detect material misstatements and would not be an appropriate response.

Question 8

In computer systems,the information technology general controls (ITGC)would not include
A) Processing of control activities.
B) Separation of various computer system functions.
C) Appropriate documentation of the data processing system.
D) Control over physical access to computer hardware.

Accepted Answer

ITGCs are the overall policies and procedures that relate to the organization's overall IT environment. Processing of control activities is a specific control activity, and therefore, it is not considered an ITGC. ITGCs typically include controls over access to data, system development and maintenance, security management, and operations management, among others. Separation of various computer system functions, appropriate documentation of the data processing system, and control over physical access to computer hardware are all examples of ITGCs.

Question 9

Which of the following is a step in an auditor's decision to assess control risk at below the maximum?
A) Apply analytical procedures to both financial data and nonfinancial information to detect conditions that may indicate weak controls.
B) Perform tests of details of transactions and account balances to identify potential errors and fraud.
C) Identify specific internal control policies and activities that are likely to detect or prevent material misstatements.
D) Document the fact that the additional audit effort to perform tests of controls exceeds the potential reduction in substantive testing.

Accepted Answer

To assess control risk at below the maximum, the auditor must identify specific internal control policies and activities that are likely to detect or prevent material misstatements. Option A is a step to detect weak controls, but it does not help the auditor to assess control risk at below the maximum. Option B is a step in the substantive testing phase, which may be performed if the auditor assesses control risk at the maximum. Option D is a consideration for determining the extent of testing and does not help the auditor to assess control risk at below the maximum.

Question 10

Which of the following would most likely be classified as a material weakness?
A) Absence of appropriate separation of duties.
B) Absence of appropriate reviews and approvals of transactions.
C) Evidence of failure of control activities.
D) Ineffective oversight of the financial reporting process by the company's audit committee.

Accepted Answer

The answer of Which of the following would most likely...

Question 11

Proper separation of duties reduces the opportunity for persons to be in positions to both
A) Journalize entries and prepare financial statements.
B) Record cash receipts and cash disbursements.
C) Establish internal controls and authorize transactions.
D) Perpetrate a fraud and then conceal it in the books.

Accepted Answer

Proper separation of duties ensures that no single individual has control over all aspects of any critical transaction, which reduces the risk of fraud and its concealment.

Question 12

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?
A) Incompatible duties.
B) Management override.
C) Mistakes in judgment.
D) Collusion among employees.

Accepted Answer

Incompatible duties are not an inherent limitation of internal controls; rather, they represent a flaw in the design of the control environment. Inherent limitations, such as management override, mistakes in judgment, and collusion among employees, acknowledge that even well-designed internal controls can fail or be circumvented.

Question 13

Generally accepted auditing standards (GAAS)give auditors considerable discretion to decide the amount of work required to satisfy auditing standards guiding internal control evaluation and related audit planning.Which of the following descriptions best expresses the minimum amount of work permitted by GAAS for nonpublic companies?
A) Do not obtain an understanding of client environment, accounting, or control activities. Do not document the decision to assess control risk at maximum. Perform 100% substantive audit on all financial statement transactions and balances.
B) Obtain an understanding of client environment, accounting, and control activities. Document the decision to assess control risk at maximum. Perform an extensive but not 100% substantive audit on financial statement transactions and balances.
C) Obtain an understanding of client environment, accounting, and control activities, and perform detail tests of controls. Document the decision to assess control risk below the maximum. Perform restricted substantive audit on financial statement transactions and balances, considering the control risk assessment.
D) Obtain an understanding of client environment, accounting, and control activities, and perform detail tests of controls. Document the decision to assess control risk at zero. Perform no substantive audit on financial statement transactions and balances because zero control risk means that no errors or fraud can affect the accounts.

Accepted Answer

GAAS requires auditors to obtain an understanding of the client's environment, accounting, and control activities, and to document their decision regarding control risk. For nonpublic companies, auditors can assess control risk at maximum and perform substantive testing, but not necessarily 100% testing.

Question 14

In an audit of financial statements,an auditor's primary consideration regarding an internal control policy or activity is whether the policy or activity
A) Reflects management's philosophy and operating style.
B) Affects management's financial statement assertions.
C) Provides adequate safeguards over access to assets.
D) Enhances management's decision making processes.

Accepted Answer

In an audit, the auditor's primary consideration regarding an internal control policy or activity is whether it affects management's financial statement assertions. This is because management's assertions provide a basis for the auditor to plan and perform audit procedures to obtain sufficient appropriate audit evidence. Therefore, an effective internal control policy or activity that supports management's assertions would reduce the level of detection risk and increase the reliability of financial information.

Question 15

If auditors assess control risk at the maximum level,they will tend to
A) Perform a great deal of additional tests of controls.
B) Perform a great deal of substantive testing during the audit.
C) Perform substantive tests at an interim date.
D) Perform more audit procedures using internal evidence.

Accepted Answer

If auditors assess control risk at the maximum level, it means that they believe that the company's internal controls are not effective at preventing or detecting material misstatements. As a result, auditors will need to rely more on substantive testing to obtain assurance that the financial statements are free from material misstatements. Therefore, they will perform a great deal of substantive testing during the audit to obtain sufficient appropriate audit evidence.

Question 16

The overall attitude and awareness of an entity's board of directors concerning the importance of the client's internal control usually is reflected in its
A) Computer-based control activities.
B) System of separation of duties.
C) Control environment.
D) Safeguards over access to assets.

Accepted Answer

The control environment reflects the overall attitude, awareness, and actions of an entity's board of directors regarding the importance of internal control. It sets the tone for the organization and influences the awareness and actions of others. Therefore, the control environment is the best choice for reflecting the board of directors' attitude and awareness regarding the importance of internal control.

Question 17

The ultimate purpose of assessing control risk is to contribute to the auditor's evaluation of the
A) Factors that raise doubts about the auditability of the financial statements.
B) Operating effectiveness of internal control policies and procedures.
C) Risk that material misstatements exist in the financial statements.
D) Possibility that the nature and extent of substantive tests may be reduced.

Accepted Answer

The ultimate purpose of assessing control risk is to evaluate the risk that material misstatements exist in the financial statements. This evaluation helps the auditor to plan and perform further audit procedures to reduce the risk of misstatement to an acceptably low level. Therefore, choice C is the correct answer.

Question 18

During the audit of a private company's financial statements,which of the following statements best describes the minimum work an auditor must perform in connection with a company's internal control?
A) Perform exhaustive tests of accounting controls and evaluate the company's control system effectiveness.
B) Determine whether the company's control policies are designed well enough to prevent material misstatements.
C) Prepare auditing working papers that document the auditor's understanding of the company's internal control.
D) Design procedures to search for significant deficiencies in the actual operation of the company's internal control.

Accepted Answer

The minimum work an auditor must perform in connection with a company's internal control is to prepare auditing working papers that document the auditor's understanding of the company's internal control. This includes documenting the company's control environment, control activities, and monitoring activities. It is not required to perform exhaustive tests or design procedures to search for deficiencies at this minimum level, although the auditor may choose to do so if they believe it is necessary. The auditor is also not required to determine whether the company's control policies are well-designed at this minimum level, although they may identify potential weaknesses in the control environment during their documentation process.

Question 19

Which of the following is not an objective of internal controls over financial reporting as defined by the Sarbanes-Oxley Act?
A) Policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant.
B) Policies and procedures that provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles and that receipts and expenditures of the registrant are being made only in accordance with authorizations of management and directors of the registrant.
C) Policies and procedures that provide reasonable assurance regarding the compliance with applicable laws and regulations.
D) Policies and procedures that provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the registrant's assets that could have a material effect on the financial statements.

Accepted Answer

The Sarbanes-Oxley Act focuses on financial reporting and internal controls related to financial statements, not directly on compliance with laws and regulations.

Question 20

When obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company,an auditor is not obligated to
A) Determine whether control activities have been placed in operation.
B) Perform procedures to understand the design of the internal control system.
C) Document the understanding of the company's internal control system.
D) Search for significant deficiencies in the operation of the internal control system.

Accepted Answer

While an auditor is required to obtain an understanding of a nonpublic company's internal control system, they are not required to search for significant deficiencies in the operation of the system. However, if they do become aware of any significant deficiencies, they are required to communicate them to management.

Quiz 5: Risk Assessment: Internal Control Evaluation

In an audit of financial statements of a nonpublic company in accordance with generally accepted auditing standards,an auditor is required to

After obtaining an understanding of internal controls and assessing control risk on the audit of a nonpublic company,an auditor decided to perform tests of controls.The auditor most likely decided that

If a control total were to be computed on each of the following data items,which would best be identified as a hash total for a payroll IT application?

The primary objective of procedures performed to obtain an understanding of the entity's internal control is to provide an auditor

As part of understanding the internal control,an auditor is not required to

After obtaining an understanding of a client's financial reporting control activities,the auditor would next

When the audit team increases the planned assessed level of control risk because certain control activities were determined to be ineffective,the audit team would most likely increase the

In computer systems,the information technology general controls (ITGC) would not include

Which of the following is a step in an auditor's decision to assess control risk at below the maximum?

Which of the following would most likely be classified as a material weakness?

Proper separation of duties reduces the opportunity for persons to be in positions to both

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

In an audit of financial statements,an auditor's primary consideration regarding an internal control policy or activity is whether the policy or activity

If auditors assess control risk at the maximum level,they will tend to

The overall attitude and awareness of an entity's board of directors concerning the importance of the client's internal control usually is reflected in its

The ultimate purpose of assessing control risk is to contribute to the auditor's evaluation of the

During the audit of a private company's financial statements,which of the following statements best describes the minimum work an auditor must perform in connection with a company's internal control?

Which of the following is not an objective of internal controls over financial reporting as defined by the Sarbanes-Oxley Act?

When obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company,an auditor is not obligated to