Question 1

An IT specialist is least likely to be necessary when
A) Data are shared extensively among systems.
B) The entity participates heavily in electronic commerce.
C) The system has not changed from the prior year.
D) Significant audit evidence is in electronic form.

Accepted Answer

If the system has not changed from the prior year, it is less likely that an IT specialist will be necessary as the system is already familiar to the auditors and there are no major updates or changes that would require additional expertise. However, in all other scenarios (data sharing, electronic commerce, significant audit evidence in electronic form), an IT specialist may be necessary to ensure the reliability and security of the system and data being audited.

Question 2

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by
A) Employment of temporary personnel to aid in the separation of duties.
B) Direct participation by the owner of the business in the recordkeeping activities of the business.
C) Engaging a CPA to perform monthly bookkeeping.
D) Delegation of full, clear-cut responsibility to each employee for the functions assigned to each.

Accepted Answer

The answer of Effective internal control in a small company...

Question 3

The risk assessment component of internal control refers to
A) The auditor's assessment of control risk.
B) The auditor's assessment of client risk.
C) The entity's identification and analysis of risks relevant to achievement of its objectives.
D) The entity's monitoring of the potential for material misstatements.

Accepted Answer

The risk assessment component of internal control refers to the entity's identification and analysis of risks relevant to achievement of its objectives. It is a critical step in developing effective internal controls as it helps identify potential risks and develop strategies to mitigate them. Options A and B are related to the auditor's assessment of control and client risk, respectively, and option D refers to monitoring potential material misstatements, which is a separate component of internal control.

Question 4

The control environment component of internal control includes all of the following except:
A) Management's operating style.
B) Access to computer programs.
C) Organizational structure.
D) Human resource policies and practices.

Accepted Answer

The control environment component of internal control includes management's operating style, organizational structure, human resource policies and practices, and the company's overall attitude towards control. Access to computer programs is not a component of the control environment; it is a component of the information and communication component of internal control.

Question 5

It is important for the CPA to consider the competence of the entity's employees because their competence bears directly and importantly upon the
A) Cost/benefit relationship of the system of internal control.
B) Achievement of the objectives of the system of internal control.
C) Comparison of recorded accountability with assets.
D) Timing of the tests to be performed.

Accepted Answer

The competence of the entity's employees is important for the achievement of the objectives of the system of internal control. The employees are responsible for implementing and operating the controls, so their competency ensures the controls are effective in achieving their objectives. This also has an impact on the cost/benefit relationship of the system, timing of tests, and comparison of recorded accountability with assets, but these factors are indirect consequences of employee competence.

Question 6

After completing the preliminary phase of the review of internal control, the auditor decides not to rely on the system to restrict substantive procedures. Documentation may be limited to the auditor's
A) Understanding of the internal control.
B) Reasons for deciding not to extend the review.
C) Basis for concluding that errors and fraud will be prevented.
D) Completed internal control questionnaire.

Accepted Answer

The best choice is A because documentation should include the auditor's understanding of the internal control system, which serves as a basis for assessing control risk and planning the nature, timing, and extent of substantive procedures. Reasons for not extending the review, the basis for concluding that errors and fraud will be prevented, and the completed internal control questionnaire may also be documented, but they are not as important as the auditor's understanding of the system.

Question 7

A substantive strategy differs from a reliance strategy in that a substantive strategy includes
A) Increased implementation of detailed tests of transactions and balances.
B) Extra tests of controls.
C) Increased emphasis on verbal representations from management.
D) Setting control risk at a minimum level.

Accepted Answer

A substantive strategy involves relying less on client controls and performing more detailed tests of transactions and balances. It focuses on detecting material misstatements through detailed testing and analysis of transaction data rather than relying on the effectiveness of internal controls. Option B is incorrect because extra tests of controls are part of a reliance strategy, not a substantive strategy. Option C is incorrect because verbal representations from management are not a key component of a substantive strategy. Option D is incorrect because setting control risk at a minimum level is a component of a reliance strategy, not a substantive strategy.

Question 8

In planning an audit of a new client, an auditor most likely would consider the methods used to process accounting information because such methods
A) Influence the design of internal controls.
B) Affect the auditor's overall materiality levels.
C) Assist in evaluating the planned audit assertions.
D) Determine the auditor's acceptable level of audit risk.

Accepted Answer

The methods used to process accounting information have a direct impact on the design of internal controls within the organization. Therefore, it is important for the auditor to consider these methods when planning the audit. Moreover, this consideration helps the auditor to assess the risk of material misstatement in financial statements, design and execute audit procedures, and gather sufficient and appropriate audit evidence.

Question 9

As opposed to a manual control, an automated control
A) Can never be circumvented.
B) Should function consistently in the absence of program changes.
C) Need not be tested by the auditor.
D) Must be tested using the same techniques as a manual control.

Accepted Answer

Automated controls are designed to function consistently without human intervention, which means they should work consistently in the absence of program changes. This does not mean that they can never be circumvented, and they should still be tested by the auditor to ensure they are effective. Testing methods for automated controls may differ from those used for manual controls.

Question 10

In obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company, an auditor is not obligated to
A) Determine whether the control activities have been placed in operation.
B) Perform procedures to understand the design of the internal control policies.
C) Document the understanding of the entity's internal control components.
D) Search for significant deficiencies in the operation of the internal control.

Accepted Answer

While an auditor is required to obtain an understanding of the entity's internal control, they are not obligated to search for significant deficiencies in the operation of the internal control. However, if during the course of the audit the auditor identifies significant deficiencies, they must communicate them to management in writing.

Question 11

The independent auditor should acquire an understanding of the internal audit function as it relates to the assessment of control risk because
A) Internal audit programs, audit documents, and reports can eliminate the need for the independent auditor's staff.
B) The procedures performed by the internal audit staff may eliminate the independent auditor's need for an extensive study and evaluation of internal control.
C) The work performed by internal audit personnel may be a factor in determining the nature, timing, and extent of the independent auditor's procedures.
D) The understanding of the internal audit function is an important substantive procedure to be performed by the independent auditor.

Accepted Answer

The work performed by the internal audit function may affect the independent auditor's assessment of control risk, and thus determine the nature, timing, and extent of the auditor's procedures. Therefore, the auditor needs to understand the internal audit function to effectively plan and execute their audit procedures. Choices A and B are incorrect because they imply that the internal audit function can replace or substitute for the independent auditor's work, which is not the case. Choice D is incorrect because the understanding of the internal audit function is not a substantive procedure, but rather a planning procedure.

Question 12

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?
A) Incompatible duties.
B) Management override.
C) Mistakes in judgment.
D) Collusion among employees.

Accepted Answer

Incompatible duties are not an inherent limitation of internal controls; rather, they represent a flaw in the design of the control environment. Inherent limitations, such as management override, mistakes in judgment, and collusion among employees, acknowledge that even well-designed internal controls can fail or be circumvented.

Question 13

Information and communication includes all of the following except:
A) Identifying and recording all valid transactions.
B) Determining the time period in which transactions occurred.
C) Communicating price changes to customers.
D) Properly presenting transactions and related disclosures in the financial statements.

Accepted Answer

The answer of Information and communication includes all of the...

Question 14

Which of the following statements concerning control risk is correct?
A) Assessing control risk and obtaining an understanding of an entity's internal controls may be performed concurrently.
B) When control risk is high, an auditor is required to document the basis for that assessment.
C) Control risk may be assessed sufficiently low to eliminate substantive procedures for significant accounts.
D) When assessing control risk, an auditor should not consider evidence obtained in prior audits about the operation of control activities.

Accepted Answer

The answer of Which of the following statements concerning control...

Question 15

As part of gaining an initial understanding of internal control, an auditor is required to do all of the following except:
A) Consider factors that affect the risk of material misstatement.
B) Ascertain whether internal control policies and procedures have been placed in operation.
C) Identify the types of potential misstatements that can occur.
D) Obtain knowledge about the operating effectiveness of the internal control.

Accepted Answer

The answer of As part of gaining an initial understanding...

Question 16

An organizational structure is important for all of the following reasons except:
A) Ensuring proper accountability.
B) Defining areas of authority.
C) Creating clear lines of reporting.
D) Ensuring a proper commitment to controls.

Accepted Answer

Ensuring a proper commitment to controls is not a primary reason for establishing an organizational structure. While an organizational structure can support effective controls, it is not the primary reason for its establishment. The other options listed (accountability, areas of authority, and lines of reporting) are important reasons to establish an organizational structure.

Question 17

An effective control environment
A) Allows management to identify all relevant risks.
B) Creates a commitment to competence.
C) Guarantees that all controls are followed as prescribed.
D) Requires an internal audit function.

Accepted Answer

An effective control environment creates a commitment to competence, meaning that management and employees are dedicated to performing their duties with skill and proficiency. While control procedures are put in place to manage risks, it is not guaranteed that all risks will be identified. It is also not necessary to have an internal audit function in order to create an effective control environment, although it may be helpful in assessing the effectiveness of existing controls. Therefore, choices A and C are incorrect.

Question 18

In the audit of financial statements, an auditor's primary consideration regarding an internal control policy or procedure is whether the policy or procedure
A) Reflects management's philosophy and operating style.
B) Affects management's financial statement assertions.
C) Provides adequate safeguards over access to assets.
D) Enhances management's decision-making processes.

Accepted Answer

In the audit of financial statements, the primary consideration of an auditor regarding an internal control policy or procedure is whether it affects management's financial statement assertions. That is, does the policy or procedure ensure the accuracy, completeness, and validity of the financial statements? The other options may also be considerations, but they are not the primary consideration.

Question 19

Assessing control risk at a lower level most likely would involve
A) Changing the timing of substantive procedures by omitting interim testing and performing the tests at year-end.
B) Identifying specific internal controls relevant to specific assertions.
C) Performing more extensive substantive procedures with larger sample sizes than originally planned.
D) Reducing inherent risk for most of the assertions relevant to significant account balances.

Accepted Answer

Assessing control risk at a lower level involves identifying specific internal controls relevant to specific assertions. This allows for more targeted testing of those controls and reduces the overall risk that a material misstatement could occur in the financial statements. Changing the timing of substantive procedures, performing more extensive procedures, or reducing inherent risk would not necessarily be effective ways to assess control risk at a lower level.

Question 20

The concept of reasonable assurance in the context of an entity's internal controls recognizes that
A) Auditors may fail to detect material misstatements.
B) Proper internal controls guarantee that material misstatements will not occur.
C) Proper internal controls preclude fraud.
D) The costs of some controls may be too high to implement in relation to potential benefits.

Accepted Answer

Reasonable assurance recognizes that internal controls cannot guarantee that material misstatements or fraud will never occur. Instead, internal controls are designed to provide a reasonable level of assurance that such occurrences will be detected or prevented in a cost-effective manner. This acknowledges that some controls may be too costly to implement relative to their potential benefits, and that auditors may not always detect material misstatements despite their best efforts.

Quiz 6: Internal Control in a Financial Statement Audit

An IT specialist is least likely to be necessary when

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by

The risk assessment component of internal control refers to

The control environment component of internal control includes all of the following except:

It is important for the CPA to consider the competence of the entity's employees because their competence bears directly and importantly upon the

After completing the preliminary phase of the review of internal control, the auditor decides not to rely on the system to restrict substantive procedures. Documentation may be limited to the auditor's

A substantive strategy differs from a reliance strategy in that a substantive strategy includes

In planning an audit of a new client, an auditor most likely would consider the methods used to process accounting information because such methods

As opposed to a manual control, an automated control

In obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company, an auditor is not obligated to

The independent auditor should acquire an understanding of the internal audit function as it relates to the assessment of control risk because

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

Information and communication includes all of the following except:

Which of the following statements concerning control risk is correct?

As part of gaining an initial understanding of internal control, an auditor is required to do all of the following except:

An organizational structure is important for all of the following reasons except:

An effective control environment

In the audit of financial statements, an auditor's primary consideration regarding an internal control policy or procedure is whether the policy or procedure

Assessing control risk at a lower level most likely would involve

The concept of reasonable assurance in the context of an entity's internal controls recognizes that