Question 1

As part of gaining an initial understanding of internal control,an auditor is required to do all of the following except:
A) Consider factors that affect the risk of material misstatement.
B) Ascertain whether internal control policies and procedures have been placed in operation.
C) Identify the types of potential misstatements that can occur.
D) Obtain knowledge about the operating effectiveness of the internal control.

Accepted Answer

Auditors are not required to obtain knowledge about the operating effectiveness of internal controls during the initial understanding phase; this is done during the testing phase.

Question 2

Which of the following statements concerning control risk is correct?
A) Assessing control risk and obtaining an understanding of an entity's internal controls may be performed concurrently.
B) When control risk is high, an auditor is required to document the basis for that assessment.
C) Control risk may be assessed sufficiently low to eliminate substantive procedures for significant accounts.
D) When assessing control risk, an auditor should not consider evidence obtained in prior audits about the operation of control activities.

Accepted Answer

Assessing control risk and obtaining an understanding of an entity's internal controls can be performed concurrently as they are part of the process of evaluating the effectiveness of internal controls.

Question 3

The control environment component of internal control includes all of the following except:
A) Management's operating style.
B) Access to computer programs.
C) Organizational structure.
D) Human resource policies and practices.

Accepted Answer

Access to computer programs is not a component of the control environment. The control environment consists of management's operating style, organizational structure, and human resource policies and practices, among other things.

Question 4

After completing the preliminary phase of the review of internal control,the auditor decides not to rely on the system to restrict substantive procedures.Documentation may be limited to the auditor's
A) Understanding of the internal control.
B) Reasons for deciding not to extend the review.
C) Basis for concluding that errors and fraud will be prevented.
D) Completed internal control questionnaire.

Accepted Answer

If the auditor decides not to rely on the system to restrict substantive procedures, then the documentation should be limited to the auditor's understanding of the internal control. This documentation should include information on the control environment, control activities, and monitoring activities, which will help the auditor identify any potential weaknesses or deficiencies in the internal control system. The documentation should also include a description of any control deficiencies that were identified during the review process, and the reasons why the auditor decided not to extend the review. However, the documentation does not need to include the completed internal control questionnaire or the basis for concluding that errors and fraud will be prevented, as these are not relevant to the decision not to rely on the system.

Question 5

Information and communication includes all of the following except:
A) Identifying and recording all valid transactions.
B) Determining the time period in which transactions occurred.
C) Communicating price changes to customers.
D) Properly presenting transactions and related disclosures in the financial statements.

Accepted Answer

Communicating price changes to customers is not typically considered part of the information and communication component of internal control systems, which focuses on the accurate recording and reporting of financial transactions.

Question 6

An effective control environment
A) Allows management to identify all relevant risks.
B) Creates a commitment to competence.
C) Guarantees that all controls are followed as prescribed.
D) Requires an internal audit function.

Accepted Answer

An effective control environment creates a commitment to competence among employees and management, but it does not guarantee that all controls are followed as prescribed, nor does it necessarily require an internal audit function. While it is important for management to identify relevant risks, this is not the defining characteristic of an effective control environment.

Question 7

A substantive strategy differs from a reliance strategy in that a substantive strategy includes
A) Increased implementation of detailed tests of transactions and balances.
B) Extra tests of controls.
C) Increased emphasis on verbal representations from management.
D) Setting control risk at a minimum level.

Accepted Answer

A substantive strategy involves an increased focus on detailed testing of transactions and balances, as opposed to a reliance strategy which places more emphasis on testing controls. Extra tests of controls and verbal representations from management may still be present in a substantive strategy, but the key difference is the increased focus on substantive testing. Setting control risk at a minimum level is not necessarily specific to either strategy.

Question 8

An IT specialist is least likely to be necessary when
A) Data are shared extensively among systems.
B) The entity participates heavily in electronic commerce.
C) The system has not changed from the prior year.
D) Significant audit evidence is in electronic form.

Accepted Answer

When the system has not changed from the prior year, an IT specialist may not be necessary as there are no new updates or changes that require their expertise. However, options A, B, and D all involve the use of technology and data in some way, making it more likely that an IT specialist would be necessary.

Question 9

The independent auditor should acquire an understanding of the internal audit function as it relates to the assessment of control risk because
A) Internal audit programs, audit documents, and reports can eliminate the need for the independent auditor's staff.
B) The procedures performed by the internal audit staff may eliminate the independent auditor's need for an extensive study and evaluation of internal control.
C) The work performed by internal audit personnel may be a factor in determining the nature, timing, and extent of the independent auditor's procedures.
D) The understanding of the internal audit function is an important substantive procedure to be performed by the independent auditor.

Accepted Answer

The work performed by the internal audit function can provide valuable information to the independent auditor in assessing the risk of material misstatement and determining the nature, timing, and extent of audit procedures. However, the independent auditor cannot rely solely on the work performed by the internal audit function and must still perform their own independent procedures. A and B are incorrect because the independent auditor's role cannot be eliminated by the work of the internal audit function. D is incorrect because understanding the internal audit function is a preliminary analytical procedure and not a substantive procedure.

Question 10

In obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company,an auditor is not obligated to
A) Determine whether the control activities have been placed in operation.
B) Perform procedures to understand the design of the internal control policies.
C) Document the understanding of the entity's internal control components.
D) Search for significant deficiencies in the operation of the internal control.

Accepted Answer

The auditor is not obligated to search for significant deficiencies in the operation of the internal control. However, if the auditor becomes aware of any significant deficiencies during the audit, they are required to report them to management and include them in the audit report. A, B, and C are obligations of the auditor in obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company.

Question 11

The risk assessment component of internal control refers to
A) The auditor's assessment of control risk.
B) The auditor's assessment of client risk.
C) The entity's identification and analysis of risks relevant to achievement of its objectives.
D) The entity's monitoring of the potential for material misstatements.

Accepted Answer

The risk assessment component of internal control refers to the identification and analysis of risks relevant to the entity's objectives. This involves evaluating the potential impact of those risks on achieving those objectives and developing appropriate responses to mitigate those risks. The auditor's assessment of control and client risk are separate components of the audit process. The entity's monitoring of the potential for material misstatements is part of the monitoring component of internal control.

Question 12

In the audit of financial statements,an auditor's primary consideration regarding an internal control policy or procedure is whether the policy or procedure
A) Reflects management's philosophy and operating style.
B) Affects management's financial statement assertions.
C) Provides adequate safeguards over access to assets.
D) Enhances management's decision-making processes.

Accepted Answer

The primary consideration of an internal control policy or procedure in the audit of financial statements is whether it affects management's financial statement assertions, meaning the policies and procedures in place are designed to provide reasonable assurance that financial statements are fairly stated. While management philosophy and safeguards over access to assets are also important aspects of internal control, they are not the primary consideration in an audit. Enhancing management's decision-making processes is not directly relevant to the audit of financial statements.

Question 13

As opposed to a manual control,an automated control
A) Can never be circumvented.
B) Should function consistently in the absence of program changes.
C) Need not be tested by the auditor.
D) Must be tested using the same techniques as a manual control.

Accepted Answer

An automated control should function consistently in the absence of program changes. This is the main advantage of automated controls over manual controls, which are subject to human error and inconsistency. The other options are not true. Automated controls can be circumvented if there are programming errors or flaws, they should be tested by the auditor to ensure their effectiveness, and they require specialized testing techniques beyond those used for manual controls.

Question 14

It is important for the CPA to consider the competence of the entity's employees because their competence bears directly and importantly upon the
A) Cost/benefit relationship of the system of internal control.
B) Achievement of the objectives of the system of internal control.
C) Comparison of recorded accountability with assets.
D) Timing of the tests to be performed.

Accepted Answer

The competence of the entity's employees directly affects the achievement of the objectives of the system of internal control. Employees who are not competent may not be able to perform their assigned tasks effectively or efficiently, which could result in weaknesses or breakdowns in the internal control system. On the other hand, competent employees are more likely to understand and follow internal controls, reducing the risk of errors or fraud. A and C are incorrect because the competence of the employees does not directly affect the cost/benefit relationship of the system of internal control or the comparison of recorded accountability with assets. D is incorrect because the timing of the tests to be performed is not directly related to the competence of the employees.

Question 15

The concept of reasonable assurance in the context of an entity's internal controls recognizes that
A) Auditors may fail to detect material misstatements.
B) Proper internal controls guarantee that material misstatements will not occur.
C) Proper internal controls preclude fraud.
D) The costs of some controls may be too high to implement in relation to potential benefits.

Accepted Answer

Reasonable assurance acknowledges that internal controls cannot provide absolute assurance against material misstatements or fraud, as auditors may still fail to detect them. Cost-benefit considerations must be taken into account when designing and implementing internal controls. Therefore, the costs of some controls may be too high to implement in relation to the potential benefits, and management must make informed judgments about which risks to mitigate and which are acceptable at an acceptable level of risk.

Question 16

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?
A) Incompatible duties.
B) Management override.
C) Mistakes in judgment.
D) Collusion among employees.

Accepted Answer

Incompatible duties are not an inherent limitation of internal controls; rather, they represent a flaw in the design of the control environment. Inherent limitations, such as management override, mistakes in judgment, and collusion among employees, acknowledge that even well-designed internal controls can fail or be circumvented.

Question 17

An organizational structure is important for all of the following reasons except:
A) Ensuring proper accountability.
B) Defining areas of authority.
C) Creating clear lines of reporting.
D) Ensuring a proper commitment to controls.

Accepted Answer

Ensuring a proper commitment to controls is not a primary reason for having an organizational structure. While it can be a benefit of having a structure in place, it is not the primary reason for establishing one.

Question 18

In planning an audit of a new client,an auditor most likely would consider the methods used to process accounting information because such methods
A) Influence the design of internal controls.
B) Affect the auditor's overall materiality levels.
C) Assist in evaluating the planned audit assertions.
D) Determine the auditor's acceptable level of audit risk.

Accepted Answer

The methods used to process accounting information have a direct impact on the design of internal controls within the organization. Therefore, it is important for the auditor to consider these methods when planning the audit. Moreover, this consideration helps the auditor to assess the risk of material misstatement in financial statements, design and execute audit procedures, and gather sufficient and appropriate audit evidence.

Question 19

Assessing control risk at a lower level most likely would involve
A) Changing the timing of substantive procedures by omitting interim testing and performing the tests at year-end.
B) Identifying specific internal controls relevant to specific assertions.
C) Performing more extensive substantive procedures with larger sample sizes than originally planned.
D) Reducing inherent risk for most of the assertions relevant to significant account balances.

Accepted Answer

Assessing control risk at a lower level involves identifying specific internal controls relevant to specific assertions. This is done to gain assurance that the internal controls existing in an organization are operating effectively and efficiently to facilitate the company's compliance with the applicable accounting standards and financial reporting requirements. This would enable auditors to perform substantive procedures on a broader range of transactions rather than a smaller subset of tests, thus lowering control risk. Changing the timing of substantive procedures, reducing inherent risk, or performing more extensive substantive procedures may not necessarily be linked to assessing control risk at a lower level.

Question 20

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by
A) Employment of temporary personnel to aid in the separation of duties.
B) Direct participation by the owner of the business in the recordkeeping activities of the business.
C) Engaging a CPA to perform monthly bookkeeping.
D) Delegation of full, clear-cut responsibility to each employee for the functions assigned to each.

Accepted Answer

Direct participation by the owner can help compensate for the lack of segregation of duties by providing oversight and ensuring that controls are in place.

Quiz 6: Internal Control in a Financial Statement Audit

As part of gaining an initial understanding of internal control,an auditor is required to do all of the following except:

Which of the following statements concerning control risk is correct?

The control environment component of internal control includes all of the following except:

After completing the preliminary phase of the review of internal control,the auditor decides not to rely on the system to restrict substantive procedures.Documentation may be limited to the auditor's

Information and communication includes all of the following except:

An effective control environment

A substantive strategy differs from a reliance strategy in that a substantive strategy includes

An IT specialist is least likely to be necessary when

The independent auditor should acquire an understanding of the internal audit function as it relates to the assessment of control risk because

In obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company,an auditor is not obligated to

The risk assessment component of internal control refers to

In the audit of financial statements,an auditor's primary consideration regarding an internal control policy or procedure is whether the policy or procedure

As opposed to a manual control,an automated control

It is important for the CPA to consider the competence of the entity's employees because their competence bears directly and importantly upon the

The concept of reasonable assurance in the context of an entity's internal controls recognizes that

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

An organizational structure is important for all of the following reasons except:

In planning an audit of a new client,an auditor most likely would consider the methods used to process accounting information because such methods

Assessing control risk at a lower level most likely would involve

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by