Exam 7: Internal Control, Understanding the Clients Internal Control Over Financial Reporting and Auditing Design Effectiveness

Physical vaulting refers to the control procedure involving the capture of transactions that by-passed the firewall.

Segregation of duties is easy to accomplish in a small-business setting because their operating structure and IT controls are less complex than larger organizations.

Tracing deals with selecting a document and looking for the posting of the document in the accounting books and records.

"Tone at the top" refers to the:

Which of the following statements is true regarding the evolution of definitions of internal control?

Which of the following is not a step in the process of program development?

Risks related to a company's business units or functions are:

Auditors must understand the flow of transactions in order to identify likely sources of financial statement misstatements.

Following are procedures used by auditors to understand likely sources of misstatements: I. Identify controls that management has implemented to address potential misstatements. II. Identify points within the process at which misstatements could arise. III. Understand the flow of transactions. The proper sequence of these steps is:

that come from social engineering are the result of a lack of internal controls.

Section 404 of the Sarbanes-Oxley Act of 2002 requires that ICFR effectiveness be audited by the PCAOB.

Auditors should make inquiries about whether there is knowledge of fraud in the company. Such inquiries should be made of:

Auditors perform walkthroughs as an efficient way to gain an understanding of ICFR and assess design effectiveness.

Contingency controls are primarily concerned with:

Which of the following is not an audit procedure used to gain an understanding of specific controls in ICFR?

The Foreign Corrupt Practices Act prompted a definition of internal control that is broader than COSO's definition because COSO does not consider operating efficiency and effectiveness.

The cutoff assertion refers to the distinction between the company and its subsidiaries and related entities.

Risk assessment is important only for companies who report to the SEC.

Application controls are part of the effectiveness of ITGC in that they are the controls that:

In smaller companies where management's interaction with its controls provides the basis for its assessment of ICFR, management should provide documentation of how its interaction provided it with sufficient evidence. Appropriate documentation includes: