Question 1

Risk response represents a series of actions taken by management to implement a desired risk management strategy.

Accepted Answer

Risk response involves identifying, selecting, and implementing measures that can be taken to align risks with the organization's risk appetite and tolerance levels, as part of the broader risk management strategy.

Question 2

A good internal control system will contribute towards detecting accidental errors made by employees.

Accepted Answer

A good internal control system is designed to provide reasonable assurance regarding the achievement of objectives in effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations, which includes mechanisms to detect and correct accidental errors made by employees.

Question 3

For a specific internal control to be effective, both the preventive and the detective aspect of the control must exist and be interrelated.

Accepted Answer

Effective internal controls often include both preventive measures (to avoid errors or fraud) and detective measures (to identify errors or fraud after they have occurred), working together to mitigate risks.

Question 4

The separation of duties control would not be violated if a company's cashier was also responsible for recording cash transactions.

Accepted Answer

Separation of duties is a key control in financial systems to prevent fraud and errors, requiring that no single individual has control over all aspects of a financial transaction. Having the cashier also record cash transactions violates this principle by combining the roles of handling cash and recording transactions, which should be segregated to ensure checks and balances.

Question 5

Risk portfolio represents the amount and type of risk that an organization is willing to accept in pursuit of its goals and objectives.

Accepted Answer

The answer of Risk portfolio represents the amount and type...

Question 6

The five components of internal control articulated in the 2013 COSO Report include Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

Accepted Answer

These are indeed the five components of internal control as outlined in the 2013 update of the COSO (Committee of Sponsoring Organizations of the Treadway Commission) framework, which is a widely accepted standard for designing, implementing, and evaluating the effectiveness of an organization's internal control system.

Question 7

An effective approach for maintaining a good audit trail for cash disbursements is to utilize a voucher system with coins and currency issued for each disbursement.

Accepted Answer

A voucher system typically involves the use of checks and electronic payments rather than coins and currency, as it allows for better tracking and documentation of cash disbursements.

Question 8

A company's control environment is unimportant when developing an internal control system.

Accepted Answer

The control environment is a crucial component of an internal control system as it sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.

Question 9

Controls that specifically encourage operating efficiency are often called preventive controls.

Accepted Answer

Controls that specifically encourage operating efficiency are often referred to as detective controls, while preventive controls are designed to prevent errors or irregularities from occurring in the first place.

Question 10

Risk assessment is an important component of an internal control system.

Accepted Answer

Risk assessment helps in identifying and analyzing risks that might affect the achievement of an organization's objectives, allowing for the implementation of appropriate controls to mitigate those risks.

Question 11

COSO did not change its definition of enterprise risk management when it released the 2017 COSO ERM Report.

Accepted Answer

The 2017 COSO ERM Report, titled "Enterprise Risk Management—Integrating with Strategy and Performance," updated the definition and framework of enterprise risk management to focus more on integrating ERM with strategy and performance, reflecting changes in the business and risk management environments since the original framework was published in 2004.

Question 12

Within COSO's 2017 ERM Report, Risk Governance and Culture represents the organization's tone toward the design, implementation, execution and oversight of risk management activities.

Accepted Answer

Risk Governance and Culture is one of the five components of the COSO ERM framework, emphasizing the importance of organizational culture, governance, and the tone at the top in shaping risk management practices.

Question 13

The separation of duties control does not completely eliminate the possibility of embezzlement by employees.

Accepted Answer

Separation of duties is a key control that reduces the risk of fraud by dividing responsibilities among different employees, but it does not completely eliminate the possibility of collusion between employees or other ways to circumvent the controls.

Question 14

An audit trail problem associated with computerized data processing is that certain financial data processed by the computer may never be seen by the company's management.

Accepted Answer

In computerized data processing systems, some financial data can be processed and stored in a manner that does not require direct review or intervention by management, potentially leading to situations where important information is not seen by them.

Question 15

The personnel subsystem has the important function of matching job qualifications to people qualifications.

Accepted Answer

The personnel subsystem is responsible for ensuring that individuals' qualifications match the requirements of the job positions they are being considered for, which includes tasks such as recruitment, selection, and training.

Question 16

COBIT 5 deals exclusively with internal control within an IT context.

Accepted Answer

COBIT 5 provides a comprehensive framework that assists enterprises in achieving their objectives for the governance and management of enterprise IT, not limited to internal control but also encompassing areas such as risk management, information security, and IT governance.

Question 17

The 2004 COSO ERM Report differs from the 2017 COSO ERM Report, in that the former adopted a components- and principles-based approach to risk management.

Accepted Answer

The 2004 COSO ERM Report introduced a components-based approach to risk management, while the 2017 update expanded on this by integrating a principles-based approach and emphasizing the importance of integrating risk management with strategy and performance.

Question 18

Timely performance reports contribute towards achieving the monitoring component of an internal control system.

Accepted Answer

Timely performance reports are essential for the monitoring component of an internal control system as they allow for the ongoing assessment of the system's effectiveness in achieving its objectives, identifying areas for improvement, and taking corrective actions.

Question 19

A good audit trail is an important element within a company's internal control system.

Accepted Answer

A good audit trail enhances the transparency and traceability of financial transactions, helping to ensure accuracy, prevent fraud, and facilitate audits, thereby strengthening the company's internal control system.

Question 20

According to the 2017 COSO ERM Report, management is responsible for exercising oversight over strategy and risk management activities.

Accepted Answer

According to the 2017 COSO ERM (Enterprise Risk Management) Framework, it is the board of directors that is primarily responsible for exercising oversight over strategy and risk management activities, not management. Management is responsible for implementing the risk management practices under the oversight of the board.

Quiz 6: Introduction to Internal Control Systems and Risk Management