Question 1

Of the three objectives management has when designing an effective system of internal control, the objective that auditors are primarily concerned with is the client's compliance with applicable laws and regulations.

Accepted Answer

Auditors are primarily concerned with ensuring the reliability of financial reporting, although they also consider compliance with laws and regulations and the effectiveness of operations.

Question 2

The auditor's assessment of control risk and the extent of tests of controls are inversely related; that is, if the auditor's assessment of control risk decreases, more extensive tests of controls are applied.

Accepted Answer

This statement is true. When the auditor assesses control risk as lower, they have more confidence in the effectiveness of the entity's internal controls. As a result, they may perform less extensive tests of controls. Alternatively, if the auditor's assessment of control risk is higher, they will apply more extensive tests of controls to obtain sufficient evidence.

Question 3

Discuss 'monitoring activities' and give an example.

Accepted Answer

The answer of Discuss 'monitoring activities' and give an example....

Question 4

When a company designs and implements an internal control system the control must be cost- effective.

Accepted Answer

A company needs to ensure that the benefits of implementing internal controls outweigh the costs associated with designing and maintaining the control system. A cost-effective internal control system can help a company to manage risks and ensure compliance with regulations while minimizing unnecessary expenses.

Question 5

Discuss what is meant by the term 'control environment' and identify four control environment subcomponents that the auditor should consider.

Accepted Answer

The answer of Discuss what is meant by the term...

Question 6

The less control risk there is, the smaller the amount of planned substantive evidence required.

Accepted Answer

This statement is true. When there is less control risk, it means that the internal controls in place are strong and effective. This reduces the risk of material misstatements in the financial statements, which in turn reduces the amount of planned substantive evidence required to be gathered by auditors. Conversely, if there is a higher level of control risk, auditors would need to gather more substantive evidence to ensure the accuracy of the financial statements.

Question 7

There is a distinction between authorisation and approval. Approval is a policy decision for a general class of transactions. Authorisation is the implementation of management's general authorisation decisions.

Accepted Answer

The answer of There is a distinction between authorisation and...

Question 8

Procedures used to obtain an understanding of internal control are normally performed on fewer transactions than procedures used to test controls.

Accepted Answer

The purpose of obtaining an understanding of internal control is to identify key controls that can be relied upon to prevent or detect material misstatements. This understanding is gained through inquiries of personnel, observation of activities, and review of documentation. These procedures are typically performed on a sample of transactions or activities, but they do not involve testing the operating effectiveness of controls. That comes later, after the auditor has identified the relevant controls and plans to test them. Testing controls involves selecting a larger sample of transactions and testing whether the controls were operating effectively. Therefore, the procedures used to obtain an understanding of internal control are generally performed on fewer transactions than those used to test controls.

Question 9

For IT equipment, there are three categories of controls related to safeguarding IT equipment, programs and data files. Discuss the categories of IT- related controls and for each category, give an example of a specific control.

Accepted Answer

The answer of For IT equipment, there are three categories...

Question 10

For proper internal control, there should be adequate separation of duties. However, the extent of separation of duties considered 'adequate' depends heavily on the size of the organisation.

Accepted Answer

The extent of separation of duties considered 'adequate' can vary based on the size and complexity of the organization. Smaller organizations may have fewer resources and may not be able to afford a high degree of separation of duties, while larger organizations may have the resources to implement a more robust system of separation of duties. However, regardless of the size of the organization, there should be some level of separation of duties in place to ensure proper internal control.

Question 11

Control activities are defined as 'the policies and procedures, in addition to those included in the other elements, that help ensure necessary actions are taken to address risks in the achievement of the entity's objectives.' There are five categories of control activities. Please describe the five categories of control activities.

Accepted Answer

The answer of Control activities are defined as 'the policies...

Question 12

For proper internal control, the custodianship of cash, including receipts and disbursements, should be the responsibility of the accounting department.

Accepted Answer

Proper internal control principles dictate the separation of duties; the custodianship of cash should be separate from the accounting functions to prevent fraud and errors.

Question 13

It is more common for the auditor's assessment of control risk to be low when auditing larger clients than smaller clients.

Accepted Answer

When auditing larger clients, there tends to be more extensive and formalized internal control systems in place due to the complexity and volume of transactions. This can often result in a lower assessment of control risk compared to smaller clients who may have less formal control systems and greater potential for errors or fraud.

Question 14

There is a significant overlap between tests of controls and procedures to obtain an understanding of controls. However, discuss the main differences in the types of audit evidence.

Accepted Answer

The answer of There is a significant overlap between tests...

Question 15

Adequate documents and records are important for effective internal control. There are five principles that dictate the proper design and use of documents and records. Discuss each of these principles of adequate documents and records.

Accepted Answer

The answer of Adequate documents and records are important for...

Question 16

A company should develop internal controls that provide reasonable, but not absolute, assurance that the financial statements are fairly stated.

Accepted Answer

The purpose of internal controls is to provide reasonable assurance, not absolute certainty, that the financial statements are fairly presented. Absolute assurance is not possible due to limitations such as human error and collusion. Therefore, a company should aim to establish internal controls that offer reasonable assurance for the accuracy and reliability of financial reporting.

Question 17

Describe three inherent limitations of internal control.

Accepted Answer

The answer of Describe three inherent limitations of internal control....

Question 18

Describe five common procedures an auditor can use to obtain an understanding of internal control design.

Accepted Answer

The answer of Describe five common procedures an auditor can...

Question 19

Management, with the help of the auditor, must establish and maintain the entity's controls.

Accepted Answer

Management is responsible for establishing and maintaining the entity's internal controls, while the auditor's role is to independently assess and report on the effectiveness of these controls.

Question 20

For internal controls that leave no documentary evidence, the auditor observes their application at year- end.

Accepted Answer

Auditors may observe the application of such controls at various times throughout the year, not just at year-end, to ensure they are consistently applied.

Quiz 8: Internal Control and Control Risk