Deck 7: Understanding and Testing the Clients System of Internal Controls

Question 1

Control risk refers to the risk that the auditor's testing procedurwill not be effective in detecting a material misstatement.

Answer 1

False

Question 2

Benchmarking is an audit strategy that can be used to carry forward the benefit of certain application controls testing into future audit periods.

Answer 2

True

Question 3

Tests of account balanccan often provide evidence about the continued functioning of controls.

Answer 3

True

Question 4

Internal control is intended to provide reasonable assurance about the achievement of an entity's objectives.

Question 5

IT general controls are driven by the particular software application being used.

Question 6

Attribute sampling is a sampling technique used to reach a conclusion about the total dollar amount of misstatement in an account balance.

Question 7

The inherent limitations of internal control include the possibility of collusion by two or more individuals to circumvent a control.

Question 8

The internal control objective of 'real' refers to controls in place to ensure that fictitious or duplicate transactions are not included in the books and records of the organization.

Question 9

An example of a purely manual control is a locked inventory stock cage for high dollar-value items.

Question 10

The internal control objective of 'valued' refers to controls in place to ensure thattransactions are recorded in the correct accounting period.

Question 11

One of the elements of an entity's control environment is management's philosophy and operating style.

Question 12

Narrativinvolve the auditor describing in words each step of the flow of transactions from start to finish.

Question 13

In larger entities, there are often limitations surrounding the entity's ability to put effective internal controls in place.

Question 14

To improve efficiency, auditors test only those controls that they believe are critical to their opinion.

Question 15

The greater the degree of reliance on an internal control, the less they test the control to provide the required assurance.

Question 16

Audit risk is the risk that an entity's internal control system will not prevent or detect material misstatements.

Question 17

Checklists and preformatted questionnairare particularly helpful in industrithat the auditor may not personally be familiar with auditing.

Question 18

Transaction-level controls are implemented by businessto reduce the risk of misstatements due to error or fraud and to ensure that processare operating effectively.

Question 19

The purpose of preventive controls is to discover fraud or errors that may have occurred during transaction processing and to rectify those errors.

Question 20

The concept that no one employee should be in a position both to perpetrate and hide errors or fraud in the normal course of their dutiis known as segregation of incompatible duties.

Question 21

Stanley Morgan has learned that it is important to be aware of the attitude and actions of management and those charged with governance concerning the entity's internal control and its importance in the entity. This best describdealing with

A) a key control objective.
B) the control environment.
C) mitigation of audit risk.
D) financial statement assertions.

Question 22

The internal control objective of 'classified' means there are controls in place to ensure that:

A) fictitious or duplicate transactions are not included in the books of an organization.
B) correct amounts are assigned to transactions.
C) transactions are recorded in the correct accounting period.
D) transactions are charged and allocated to the correct general ledger account.

Question 23

Internal controls in large and medium sized entitican only provide an entity with reasonable assurance in achieving its financial reporting objectives. Which of the following is not an inherent limitation of internal control?

A) human error that results in a breakdown in internal control
B) collusion by two or more individuals to circumvent a control
C) a control within a software program being overridden or disabled
D) changing audit risk parameters

Question 24

Thea Lisowski decided to list several questions for herself about factors that influence management's attitudtowards internal control so as to assure herself that she could have more confidence in management's abilitiand integrity. When she was finished, which control environment element did she tick off on her working papers?

A) management's philosophy and operating style
B) communication and enforcement of integrity and ethical values
C) commitment to competence
D) participation by those charged with governance

Question 25

A partner and his team performed an audit and issued an unqualified audit report. A year later his firm was sued when a shareholder found out the financial statements were misstated. This situation best describes:

A) poor internal controls.
B) human error.
C) unethical behaviour.
D) audit risk.

Question 26

Which of the following is an inherent limitation of internal control?

A) a control within a software program being overridden or disabled
B) human error that results in a breakdown in internal control
C) collusion by two or more individuals to circumvent a control
D) all of the above

Question 27

If the tests of controls confirm the auditor's preliminary evaluation of controls, the planned substantive audit procedurare not modified.

Question 28

Which assertion is not specifically addressed by internal control objectives?

A) cut-off
B) presentation and disclosure
C) completeness
D) existence

Question 29

The more complex the client's operations and its internal controls, the less experienced the auditor who performs the work needs to be.

Question 30

Significant professional judgment is never required to decide whether an identified internal control weakness is significant enough to warrant communicating to management.

Question 31

Internal control weaknessdecrease the risk of material misstatements being undetected by management's processand controls.

Question 32

When internal controls are effective:

A) there will be an increased reliance on substantive tests of transactions and account balances.
B) control risk will also be high.
C) the organization is more likely to achieve its strategic and operating objectives.
D) the organization is less likely to achieve its strategic and operating objectives.

Question 33

Internal control encompasswhich of the following elements of an organization?

A) processes
B) culture
C) systems
D) all of the above

Question 34

As part of her annual review Roma Lazor reviews her client's draft financial statements for proper disclosurand compliance to accounting standards. This best describwhich control objective(s)?

A) posting
B) classification and understandability
C) valuation
D) timeliness

Question 35

If inherent risk is low and a reasonable level of assurance has been gained from controls testing, extensive substantive procedurneed to be performed to estimate the dollar value of any error in an account balance.

Question 36

An internal control exception is an observed condition that providevidence that the control being tested did not operate as intended.

Question 37

Which of the following statements about internal control is incorrect?

A) Internal control is a very broad concept.
B) Internal control eliminates the possibility of fraud and error.
C) Internal control encompasses all of the elements of an organization.
D) Internal control provides reasonable assurance about the achievement of the entity's objectives.

Question 38

If controls are in place to ensure that transactions are recorded in the correct accounting period, this satisfiwhich internal control objective?

A) timely
B) real
C) valued
D) posted

Question 39

The purpose of an auditor's management letter is to inform the client of the auditor's recommendations for improving its internal controls.

Question 40

The generally accepted objectivof internal control do not include:

A) efficiency.
B) classified.
C) recorded.
D) timely.

Question 41

Which of the following is an element of the control environment?

A) participation by those charged with governance
B) commitment to competence
C) segregation of duties
D) both a and b

Question 42

Performance reviews are control activitithat include:

A) authorization for access to computer programs.
B) segregating incompatible duties.
C) reviews of actual performance versus budgets.
D) periodic counting and comparison with amounts shown on control records.

Question 43

Which of the following statements relating to control activitiis incorrect?

A) They include management's philosophy and operating style.
B) They are policies and procedures that help make sure management's directives are carried out.
C) They help guarantee that necessary actions are taken to address risks impacting the achievement of the organization's objectives.
D) They have various objectives and are applied at various organizational and functional levels.

Question 44

Ben Simon wants to ensure that salin a retail outlet are not recorded at the wrong amount. Which preventive control will help him ensure his objective?

A) the signature of the goods by the warehouse receiver on a receiving report or a bill of lading
B) a credit check by the credit manager
C) automatic pricing of sales invoices using a master price file
D) none of the above

Question 45

For identified risks, management:

A) assesses the likelihood of their occurrence.
B) decides upon actions to manage them.
C) estimates their significance.
D) all of the above.

Question 46

Rolland Meilleur, a public accountant, is testing whether his client's account coding on each purchase order is checked by the computer to a table of valid account numbers, and that various logic tests are performed by the computer. He is trying to mitigate the following from going wrong:

A) detective controls not being in place.
B) amounts being posted to the wrong accounting period.
C) transactions being classified and coded to incorrect accounts.
D) all of the above.

Question 47

Claudia Andreou was concerned when she reviewed the operations of her client and noticed that many of the employehad incompatible dutiover the recording of transactions and custody of assets. This best refers to which desired control?

A) information processing controls
B) physical controls
C) authorization controls
D) segregation of incompatible duties

Question 48

All of the following are components of internal control, except for:

A) monitoring of controls.
B) the control environment.
C) audit committees.
D) the information system.

Question 49

The control environment donot:

A) set the tone of an entity.
B) set the foundation for all other components of internal control.
C) refer to the policies and procedures that help make sure management's directives are carried out.
D) influence the control consciousness of employees.

Question 50

When MelisLee, a senior auditor, performed an audit of an electronics firm, she reviewed the control environment, performed a risk assessment, and reviewed the key business processand control activities. These activitiare part of:

A) a review of entity-level controls.
B) a review of the internal control system.
C) establishing audit risk.
D) none of the above.

Question 51

When VanesLanthier reviewed the different key activitiin the marketing department of a wholesaler of jewellery, she was performing an entity level review of:

A) monitoring controls.
B) the control environment.
C) internal controls.
D) the risk assessment process.

Question 52

Harry Karas was involved in getting a big picture of his client's entity controls. He went about finding out whether periodic evaluations of internal control are made and determining the extent to which personnel, in carrying out their regular duties, obtain evidence as to whether the system of internal controls continuto function. These activitiare part of:

A) internal control activities.
B) documentation controls.
C) monitoring of controls.
D) none of the above.

Question 53

Millicent Vonareva was reviewing her IT General Controls program for her client visit. She noticed an item that she thought did not belong in her "Controls to prevent unauthorized access to data" section of the program. Which item did not belong there?

A) Data files and critical applications are regularly backed up in offsite locations.
B) Program changes are subject to formal change management procedures.
C) Policies exist to ensure departing employees are denied access to software programs and databases.
D) All the above items belonged in the "controls to prevent unauthorized access to data" section of the program.

Question 54

As part of her yearly audit plan activities, Krystyne Sliz reviews audit working papers of previous years to determine the risk that a client's system of internal controls will not prevent or detect a material misstatement. This review refers to:

A) audit risk.
B) inherent risk.
C) control risk.
D) detection risk.

Question 55

Susan Struthers will be reviewing those controls that stop fraud or errors from occurring. This is an example of a review of

A) detective controls.
B) preventive controls.
C) entity-level controls.
D) transaction-level controls.

Question 56

Benny Pecarve is planning to visit an airline company to review the collective assessment of the client's control environment, risk assessment process, information system, control activitiand monitoring of controls. What dothis mandate describe?

A) entity level controls
B) transaction-level controls
C) both a and b
D) none of the above

Question 57

When gaining an understanding of the client's monitoring processat the entity level, factors ordinarily considered include:

A) evaluations or observations made by the external auditors.
B) management's approach to correcting known significant deficiencies on a timely basis.
C) both a and b.
D) none of the above.

Question 58

In understanding the client's control activitiat the entity level, consideration is given to factors such as:

A) the extent to which performance of control activities relies on IT.
B) the extent to which controls included in the organization's policies are being applied.
C) whether adequate safeguards are in place to prevent unauthorized access to or destruction of documents, records and assets.
D) all of the above.

Question 59

Detection risk refers to:

A) the susceptibility of an assertion to a material misstatement, assuming there are no related controls.
B) the risk that the auditor's testing procedures will not be effective in detecting a material misstatement.
C) the risk that a client's system of internal controls will not prevent or detect a material misstatement.
D) none of the above.

Question 60

Rina Glickstein is unsure about the best way to evaluate her audit staff. She decidto look at their professional characteristics such as their expertise, experience, knowledge and training. What best describwhat she is looking for?

A) their independence
B) their professional judgment
C) their due care
D) none of the above

Question 61

The senior auditor has no physical evidence that a control was performed, who performed it, or how effectively it was performed. What is the nature of this control?

A) internal control
B) entity-level control
C) detective control
D) preventive control

Question 62

Lucia Dottore, an audit senior, performed a review of certain application controls at a clothing manufacturing client. Which one of these controls is an input control?

A) Reconciliation of totals where input totals are compared to the output totals.
B) Output is printed to a secure printer where access is limited.
C) Reasonable checks: actual data is compared to expected data for reasonableness.
D) None of the above.

Question 63

The factors to consider when deciding the extent of testing of controls include which of the following?

A) the persuasiveness of the evidence produced by the control
B) the degree to which the auditors intend to rely on the control as a basis for limiting their substantive tests
C) how often the control is performed
D) all of the above

Question 64

A sampling technique used to reach a conclusion about a population in terms of a rate of occurrence is known as:

A) dollar unit sampling.
B) random sampling.
C) attribute sampling.
D) haphazard sampling.

Question 65

Benchmarking is appropriate when:

A) a reliable trail of program changes exists.
B) a programmed control can be matched to a defined program within an application.
C) the application is stable.
D) all of the above.

Question 66

Which of the following is an example of a preventive control?

A) management level reviews of actual performance versus budgets
B) credit manager following up on an exception report showing sales made to a customer who has exceeded their credit limit
C) sales invoices are automatically priced using the information in the price master file
D) a bank reconciliation

Question 67

Controls can be classified as:

A) information technology general controls.
B) automated controls.
C) manual controls.
D) all of the above.

Question 68

Rosie Garaga spent the past week designing audit procedurto evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements of a major bookstore operation at the assertion level. What typof audit procedurdid she employ?

A) entity-level controls
B) detective controls
C) tests of controls
D) preventive controls

Question 69

The two main objectivof internal controls are:

A) to support the automated parts of the business in the functioning of the controls in place.
B) to prevent or detect misstatements in the financial statements.
C) both a and b.
D) none of the above.

Question 70

Benchmarking is:

A) based on the premise that a computer will continue to perform any given procedures in exactly the same way until such time as the program is changed.
B) an audit testing strategy that can be used to carry forward the benefit of certain application controls testing into future audit periods.
C) both a and b.
D) none of the above.

Question 71

It is important that detective controls:

A) identify all potentially significant errors.
B) completely and accurately capture all data.
C) are performed on a consistent and regular basis.
D) all of the above.

Question 72

Manual controls:

A) generally rely on the client's IT applications in some way.
B) support the ongoing functioning of the programmed aspects of preventive and detective controls.
C) can be classified as program change controls or logical access controls.
D) do not rely on the client's IT environment for their operation.

Question 73

A computer program that will not allow a sale to be processed if a customer has exceeded its credit limit is an example of a:

A) preventive control.
B) test of controls.
C) detect control.
D) substantive procedure.

Question 74

When the auditor decidto include controls testing in their audit strategy, they select those controls that:

A) are the easiest to test.
B) provide the most efficient and effective audit evidence.
C) provide no assurance that the controls operated effectively throughout the period of reliance.
D) provide the least efficient and effective audit evidence.

Question 75

Which of the following statements is correct?

A) Preventing errors during processing should not be an important objective of every accounting system.
B) Preventive controls can be applied to each transaction during normal processing to avoid errors occurring.
C) To be effective, controls over transactions should only include detective controls.
D) The purpose of preventive controls is to discover fraud or errors that may have occurred during transaction processing.

Question 76

Which of the following statements is incorrect?

A) The less frequently a control is performed, the more testing the auditor needs to perform to be satisfied the control is operating effectively.
B) When other controls related to a particular objective are also in place and are tested, the level of assurance that might be needed from any one control is not as high as if the auditor were relying solely on a single control.
C) The less frequently a control is performed, the less testing the auditor needs to perform to be satisfied the control is operating effectively.
D) The results of the tests in prior audits and the current audit to date affect the perception of risk.

Question 77

An example of a program change control is:

A) the accounts receivable clerk does not have access to the cash payments application.
B) regular and timely back-ups of data.
C) program change forms must be authorized by the IT manager.
D) all of the above.

Question 78

The auditor had the following procedurin his audit program for a client:
(i) Review performance versus forecasts
(ii) Review performance indicators
(iii) Review exception reports What are these instructions related to?

A) detective controls
B) physical controls
C) internal controls
D) entity-wide controls

Question 79

Theo Lillis performs the following application control procedures:
(i)) Control totals: Input totals are balanced and reconciled
(ii). Reasonable checks: Actual data is compared to expected data for reasonableness
(iii). Sequence tests: Sequential data is reviewed and exception reports are produced for missing numbers. Which of the above application controls do these procedurapply to?

A) processing controls
B) output controls
C) input controls
D) general controls

Question 80

Which of the following is an example of a detective control?

A) account coding on purchase orders being checked by the computer to a table of valid account numbers
B) quarterly reviews of credit balances in accounts receivable to determine their causes
C) amounts are not able to be paid to employees without first matching a valid tax file number to the employee master file
D) none of the above