Deck 7: Understanding and Testing the Clients System of Internal Controls

Question 1

Attribute sampling is a sampling technique used to reach a conclusion about the total dollar
amount of misstatement in an account balance.

Answer 1

False

Question 2

Tests of account balances can often provide evidence about the continued functioning of
controls.

Answer 2

True

Question 3

Narratives involve the auditor describing in words each step of the flow of transactions from
start to finish.

Answer 3

True

Question 4

IT general controls are driven by the particular software application being used.

Question 5

Control risk refers to the risk that the auditor's testing procedures will not be effective in
detecting a material misstatement.

Question 6

Transaction-level controls are implemented by businesses to reduce the risk of
misstatements due to error or fraud and to ensure that processes are operating effectively.

Question 7

In larger entities, there are often limitations surrounding the entity's ability to put effective
internal controls in place.

Question 8

The concept that no one employee should be in a position both to perpetrate and hide errors
or fraud in the normal course of their duties is known as segregation of incompatible duties.

Question 9

The internal control objective of 'real' refers to controls in place to ensure that fictitious or
duplicate transactions are not included in the books and records of the organization.

Question 10

The internal control objective of 'valued' refers to controls in place to ensure that transactions
are recorded in the correct accounting period.

Question 11

An example of a purely manual control is a locked inventory stock cage for high dollar-value items.

Question 12

The purpose of preventive controls is to discover fraud or errors that may have occurred
during transaction processing and to rectify those errors.

Question 13

One of the elements of an entity's control environment is management's philosophy and
operating style.

Question 14

The greater the degree of reliance on an internal control, the less they test the control to
provide the required assurance.

Question 15

Benchmarking is an audit strategy that can be used to carry forward the benefit of certain
application controls testing into future audit periods.

Question 16

To improve efficiency, auditors test only those controls that they believe are critical to their opinion.

Question 17

Checklists and preformatted questionnaires are particularly helpful in industries that the
auditor may not personally be familiar with auditing.

Question 18

Audit risk is the risk that an entity's internal control system will not prevent or detect material
misstatements.

Question 19

Internal control is intended to provide reasonable assurance about the achievement of an
entity's objectives.

Question 20

The inherent limitations of internal control include the possibility of collusion by two or more
individuals to circumvent a control.

Question 21

A partner and his team performed an audit and issued an unqualified audit report. A year later his firm was sued when a shareholder found out the financial statements were misstated.
This situation best describes

A) poor internal controls.
B) human error.
C) unethical behaviour.
D) audit risk.

Question 22

Which assertion is not specifically addressed by internal control objectives?

A) cut-off
B) presentation
C) completeness
D) existence

Question 23

An internal control exception is an observed condition that provides evidence that the control
being tested did not operate as intended.

Question 24

The generally accepted objectives of internal control do not include

A) efficiency.
B) classified.
C) recorded.
D) timely.

Question 25

If inherent risk is low and a reasonable level of assurance has been gained from controls
testing, extensive substantive procedures need to be performed to estimate the dollar value of
any error in an account balance.

Question 26

Internal control encompasses which of the following elements of an organization?

A) processes
B) culture
C) systems
D) all of the above

Question 27

Which audit assertion is not addressed by the internal control objectives?

A) valuation
B) allocation
C) classification
D) presentation

Question 28

Significant professional judgment is never required to decide whether an identified internal
control weakness is significant enough to warrant communicating to management.

Question 29

If the tests of controls confirm the auditor's preliminary evaluation of controls, the planned
substantive audit procedures are not modified.

Question 30

Internal control weaknesses decrease the risk of material misstatements being undetected
by management's processes and controls.

Question 31

The more complex the client's operations and its internal controls, the less experienced the
auditor who performs the work needs to be.

Question 32

Which of the following is an inherent limitation of internal control?

A) a control within a software program being overridden or disabled
B) human error that results in a breakdown in internal control
C) collusion by two or more individuals to circumvent a control
D) all of the above

Question 33

Which of the following statements about internal control is incorrect?

A) Internal control is a very broad concept.
B) Internal control eliminates the possibility of fraud and error.
C) Internal control encompasses all of the elements of an organization.
D) Internal control provides reasonable assurance about the achievement of the entity's objectives.

Question 34

Which statement about internal controls is incorrect?

A) Internal controls encompass all of the elements of an organization.
B) Internal controls support the achievement of an organization's objectives.
C) Internal controls don't have to be understood if a totally substantive approach is adopted.
D) Internal controls comprise a key component of audit risk assessment.

Question 35

Internal controls in large and medium sized entities can only provide an entity with reasonable assurance in achieving its financial reporting objectives. Which of the following is not an inherent limitation of internal control?

A) human error that results in a breakdown in internal control
B) collusion by two or more individuals to circumvent a control
C) a control within a software program being overridden or disabled
D) changing audit risk parameters

Question 36

The purpose of an auditor's management letter is to inform the client of the auditor's
recommendations for improving its internal controls.

Question 37

As part of her annual review Roma Lazor reviews her client's draft financial statements to assess that transactions appear to be charged and recorded in the correct account. This best describes which control objective(s)?

A) posting
B) classification
C) valuation
D) timeliness

Question 38

If controls are in place to ensure that transactions are recorded in the correct accounting period, this satisfies which internal control objective?

A) timely
B) real
C) valued
D) posted

Question 39

When internal controls are effective,

A) there will be an increased reliance on substantive tests of transactions and account balances.
B) control risk will also be high.
C) the organization is more likely to achieve its strategic and operating objectives.
D) the organization is less likely to achieve its strategic and operating objectives.

Question 40

The internal control objective of 'classified' means there are controls in place to ensure that

A) fictitious or duplicate transactions are not included in the books of an organization.
B) correct amounts are assigned to transactions.
C) transactions are recorded in the correct accounting period.
D) transactions are charged and allocated to the correct general ledger account.

Question 41

Which of the following is not an inherent limitation of internal controls?

A) human error
B) collusion between two or more employees
C) lack of knowledge of internal controls
D) overriding of a control within a software program

Question 42

Detection risk refers to

A) the susceptibility of an assertion to a material misstatement, assuming there are no related controls.
B) the risk that the auditor's testing procedures will not be effective in detecting a material misstatement.
C) the risk that a client's system of internal controls will not prevent or detect a material misstatement.
D) none of the above

Question 43

As part of her yearly audit plan activities, Krystyne Sliz reviews audit working papers of previous years to determine the risk that a client's system of internal controls will not prevent or
Detect a material misstatement. This review refers to

A) audit risk.
B) inherent risk.
C) control risk.
D) detection risk.

Question 44

Performance reviews are control activities that include

A) authorization for access to computer programs.
B) segregating incompatible duties.
C) reviews of actual performance versus budgets.
D) periodic counting and comparison with amounts shown on control records.

Question 45

Teja Gaudette decided to list several questions for herself about factors that influence management's attitudes towards internal control so as to assure herself that she could have
More confidence in management's abilities and integrity. When she was finished, which control
Environment element did she tick off on her working papers?

A) management's philosophy and operating style
B) communication and enforcement of integrity and ethical values
C) commitment to competence
D) participation by those charged with governance

Question 46

When gaining an understanding of the client's monitoring processes at the entity level, factors ordinarily considered include

A) evaluations or observations made by the external auditors.
B) management's approach to correcting known significant deficiencies on a timely basis.
C) both a and b
D) none of the above

Question 47

Which of the following statements relating to control activities is incorrect?

A) They include management's philosophy and operating style.
B) They are policies and procedures that help make sure management's directives are carried out.
C) They help guarantee that necessary actions are taken to address risks impacting the achievement of the organization's objectives.
D) They have various objectives and are applied at various organizational and functional levels.

Question 48

Susan Struthers will be reviewing those controls that stop fraud or errors from occurring. This is an example of a review of

A) detective controls.
B) preventive controls.
C) entity-level controls.
D) transaction-level controls.

Question 49

Rina Glickstein is unsure about the best way to evaluate her audit staff. She decides to look at their professional characteristics such as their expertise, experience, knowledge and training. What best describes what she is looking for?

A) their independence
B) their professional judgment
C) their due care
D) none of the above

Question 50

Emile Mayer was concerned when she reviewed the operations of her client and noticed that many of the employees had incompatible duties over the recording of transactions and
Custody of assets. This best refers to which desired control?

A) information processing controls
B) physical controls
C) authorization controls
D) segregation of incompatible duties

Question 51

Which of the following is an element of the control environment?

A) participation by those charged with governance
B) commitment to competence
C) segregation of duties
D) both a and b

Question 52

All of the following are components of internal control, except for

A) monitoring of controls.
B) the control environment.
C) audit committees.
D) the information system.

Question 53

Stanley Morgan has learned that it is important to be aware of the attitude and actions of management and those charged with governance concerning the entity's internal control and its
Importance in the entity. This best describes dealing with

A) a key control objective.
B) the control environment.
C) mitigation of audit risk.
D) financial statement assertions.

Question 54

Harry Karas was involved in getting a big picture of his client's entity controls. He went about finding out whether periodic evaluations of internal control are made and determining
The extent to which personnel, in carrying out their regular duties, obtain evidence as to
Whether the system of internal controls continues to function. These activities are part of

A) internal control activities.
B) documentation controls.
C) monitoring of controls.
D) none of the above

Question 55

For identified risks, management

A) assesses the likelihood of their occurrence.
B) decides upon actions to manage them.
C) estimates their significance.
D) all of the above

Question 56

When Melissa Lee, a senior auditor, performed an audit of an electronics firm, she reviewed the control environment, performed a risk assessment, and reviewed the key business
Processes and control activities. These activities are part of

A) a review of entity-level controls.
B) a review of the internal control system.
C) establishing audit risk.
D) none of the above

Question 57

Benny Pecarve is planning to visit an airline company to review the collective assessment of the client's control environment, risk assessment process, information system, control activities
And monitoring of controls. What does this mandate describe?

A) entity level controls
B) transaction-level controls
C) both a and b
D) none of the above

Question 58

When Vanessa Lanthier reviewed the different key activities in the marketing department of a wholesaler of jewellery, she was performing an entity level review of

A) monitoring controls.
B) the control environment.
C) internal controls.
D) the risk assessment process.

Question 59

In understanding the client's control activities at the entity level, consideration is given to factors such as

A) the extent to which performance of control activities relies on IT.
B) the extent to which controls included in the organization's policies are being applied.
C) whether adequate safeguards are in place to prevent unauthorized access to or destruction of documents, records and assets.
D) all of the above

Question 60

The control environment does not

A) set the tone of an entity.
B) set the foundation for all other components of internal control.
C) refer to the policies and procedures that help make sure management's directives are carried out.
D) influence the control consciousness of employees.

Question 61

Manual controls

A) generally rely on the client's IT applications in some way.
B) support the ongoing functioning of the programmed aspects of preventive and detective controls.
C) can be classified as program change controls or logical access controls.
D) do not rely on the client's IT environment for their operation.

Question 62

When the auditor decides to include controls testing in their audit strategy, they select those controls that

A) are the easiest to test.
B) provide the most efficient and effective audit evidence.
C) provide no assurance that the controls operated effectively throughout the period of reliance.
D) provide the least efficient and effective audit evidence.

Question 63

Sam Fenton wants to ensure that sales in a retail outlet are not recorded at the wrong amount. Which preventive control will help him ensure his objective?

A) the signature of the goods by the warehouse receiver on a receiving report or a bill of lading
B) a credit check by the credit manager
C) automatic pricing of sales invoices using a master price file
D) none of the above

Question 64

The two main objectives of internal controls are

A) to support the automated parts of the business in the functioning of the controls in place.
B) to prevent or detect misstatements in the financial statements.
C) both a and b
D) none of the above

Question 65

A sampling technique used to reach a conclusion about a population in terms of a rate of occurrence is known as

A) dollar unit sampling.
B) random sampling.
C) attribute sampling.
D) haphazard sampling.

Question 66

Boca Chino, a public accountant, is testing whether his client's account coding on each purchase order is checked by the computer to a table of valid account numbers, and that
Various logic tests are performed by the computer. He is trying to mitigate the following from
Going wrong:

A) detective controls not being in place.
B) amounts being posted to the wrong accounting period.
C) transactions being classified and coded to incorrect accounts.
D) all of the above

Question 67

Theo Lillis performs the following application control procedures: (i) Control totals: Input totals are balanced and reconciled
(ii) Reasonable checks: Actual data is compared to expected data for reasonableness
(iii) Sequence tests: Sequential data is reviewed and exception reports are produced for missing numbers.
Which of the above application controls do these procedures apply to?

A) processing controls
B) output controls
C) input controls
D) general controls

Question 68

Tamara Lansdown, an audit senior, performed a review of certain application controls at a clothing manufacturing client. Which one of these controls is an input control?

A) Reconciliation of totals where input totals are compared to the output totals.
B) Output is printed to a secure printer where access is limited.
C) Reasonable checks: actual data is compared to expected data for reasonableness.
D) none of the above

Question 69

Which of the following statements is incorrect?

A) The less frequently a control is performed, the more testing the auditor needs to perform to be satisfied the control is operating effectively.
B) When other controls related to a particular objective are also in place and are tested, the level of assurance that might be needed from any one control is not as high as if the auditor were relying solely on a single control.
C) The less frequently a control is performed, the less testing the auditor needs to perform to be satisfied the control is operating effectively.
D) The results of the tests in prior audits and the current audit to date affect the perception of risk.

Question 70

The auditor had the following procedures in his audit program for a client: (i) Review performance versus forecasts
(ii) Review performance indicators
(iii) Review exception reports
What are these instructions related to?

A) detective controls
B) physical controls
C) internal controls
D) entity-wide controls

Question 71

A computer program that will not allow a sale to be processed if a customer has exceeded its credit limit is an example of a

A) preventive control.
B) test of controls.
C) detect control.
D) substantive procedure.

Question 72

Millicent Vonareva was reviewing her IT General Controls program for her client visit. She noticed an item that she thought did not belong in her "Controls to prevent unauthorized access
To data" section of the program. Which item did not belong there?

A) Data files and critical applications are regularly backed up in offsite locations.
B) Program changes are subject to formal change management procedures.
C) Policies exist to ensure departing employees are denied access to software programs and databases.
D) All the above items belonged in the "controls to prevent unauthorized access to data" section of the program.

Question 73

Which of the following statements is correct?

A) Preventing errors during processing should not be an important objective of every accounting system.
B) Preventive controls can be applied to each transaction during normal processing to avoid errors occurring.
C) To be effective, controls over transactions should only include detective controls.
D) The purpose of preventive controls is to discover fraud or errors that may have occurred during transaction processing.

Question 74

The factors to consider when deciding the extent of testing of controls include which of the following?

A) the persuasiveness of the evidence produced by the control
B) the degree to which the auditors intend to rely on the control as a basis for limiting their substantive tests
C) how often the control is performed
D) all of the above

Question 75

Controls can be classified as

A) information technology general controls.
B) automated controls.
C) manual controls.
D) all of the above

Question 76

An example of a program change control is

A) the accounts receivable clerk does not have access to the cash payments application.
B) regular and timely back-ups of data.
C) program change forms must be authorized by the IT manager.
D) all of the above

Question 77

Which of the following is an example of a detective control?

A) account coding on purchase orders being checked by the computer to a table of valid account numbers
B) quarterly reviews of credit balances in accounts receivable to determine their causes
C) amounts are not able to be paid to employees without first matching a valid tax file number to the employee master file
D) none of the above

Question 78

It is important that detective controls

A) identify all potentially significant errors.
B) completely and accurately capture all data.
C) are performed on a consistent and regular basis.
D) all of the above

Question 79

Which of the following is an example of a preventive control?

A) management level reviews of actual performance versus budgets
B) credit manager following up on an exception report showing sales made to a customer who has exceeded their credit limit
C) sales invoices are automatically priced using the information in the price master file
D) a bank reconciliation

Question 80

The senior auditor has no physical evidence that a control was performed, who performed it, or how effectively it was performed. What is the nature of this control?

A) internal control
B) entity-level control
C) detective control
D) preventive control