Deck 13: Accounting Information Systems and Internal Controls

Question 1

Segregation of duties reduces the risk of errors and irregularities in accounting records.

Answer 1

True

Question 2

In a computerized environment,internal controls can be categorized as general controls and application controls.

Answer 2

True

Question 3

The chief executive officer is ultimately responsible for enterprise risk management.

Answer 3

True

Question 4

Which of the following represents an inherent risk for a financial institution?

A)Bank reconciliations are not performed on a timely basis.
B)The economy goes into a recession.
C)Customer credit check not performed.
D)An error occurs in a loan loss calculation.

Question 5

Given the requirement of the Sarbanes-Oxley Act of 2002 (SOX),the Public Company Accounting Oversight Board (PCAOB)established the Securities and Exchange Commission (SEC)to provide independent oversight of public accounting firms.

Question 6

Internal controls guarantee the accuracy and reliability of accounting records.

Question 7

Which of the following is the best way to compensate for the lack of adequate segregation of duties in a small organization?

A)Disclosing lack of segregation of duties to external auditors during the annual review.
B)Replacing personnel every three or four years.
C)Requiring accountants to pass a yearly background check.
D)Providing greater management oversight of incompatible activities.

Question 8

The risk of a company's internal auditing processes failing to catch the misstated dollar amount of revenue on the company's income statement is classified as inherent risk.

Question 9

Corporate governance is a set of processes and policies in managing an organization with sound ethics to safeguard the interests of its stakeholders.

Question 10

Review of the audit log is an example of which of the following types of security control?

A)Governance.
B)Detective.
C)Preventive.
D)Corrective.

Question 11

The main objective of the ISO 27000 series is to provide a model for establishing,implementing,operating,monitoring,maintaining,and improving information security.

Question 12

Processing controls are IT general controls.

Question 13

According to the Sarbanes-Oxley Act of 2002,it is the responsibility of the Board of Directors to establish and maintain the effectiveness of internal control.

Question 14

Public Company Accounting Oversight Board (PCAOB)encourages auditors to start from the basic/bottom of financial transaction records to identify the key controls.

Question 15

Which of the following represents a residual risk for a services company?

A)Two employees are colluding to facilitate theft.
B)All checks require two signatures.
C)Bank accounts are reconciled weekly.
D)A manager reviews all account reconciliations.

Question 16

A firm must establish control policies,procedures,and practices that ensure the firm's business objectives are achieved and its risk mitigation strategies are carried out.

Question 17

Which of the following items is one of the eight components of COSO's enterprise risk management 2004 framework?

A)Operations.
B)Reporting.
C)Monitoring.
D)Compliance.

Question 18

COBIT (Control Objectives for Information and related Technology)is a generally accepted framework for IT governance in the U.S.

Question 19

Which of the following represents a control risk for a retail business?

A)Bank reconciliations are not performed on a timely basis.
B)Two employees are colluding to facilitate theft.
C)There are many competitors in the region.
D)A bank reconciliation is not performed correctly.

Question 20

Internal controls help safeguard an organization's assets.

Question 21

A customer intended to order 100 units of a product A,but incorrectly ordered nonexistent product B.Which of the following controls most likely would detect this error?

A)Validity check
B)Record count
C)Hash total
D)Parity check

Question 22

Sound internal control dictates that immediately upon receiving checks from customers by mail,a responsible employee should

A)Add the checks to the daily cash summary.
B)Verify that each check is supported by a pre-numbered sales invoice.
C)Prepare a summary listing of checks received.
D)Record the checks in the cash receipts journal.

Question 23

Reconciliation of cash accounts may be referred to as what type of control?

A)Detective.
B)Preventive.
C)Adjustive.
D)Non-routine.

Question 24

Which of the following represents an application control for a customer sale?

A)The customer name must be populated.
B)Accounts are reconciled.
C)A manager reviews all return transactions.
D)Procedures are documented.

Question 25

According to COSO which of the following is not a component of internal control?

A)Control risk.
B)Control activities.
C)Monitoring.
D)Control environment.

Question 26

Each of the following types of controls is considered to be an entity-level control,except those:

A)Relating to the control environment.
B)Pertaining to the company's risk assessment process.
C)Regarding the company's annual stockholder meeting.
D)Addressing policies over significant risk management practices.

Question 27

Controls in the information technology area are classified into preventive,detective,and corrective categories.Which of the following is preventive control?

A)Contingency planning.
B)Hash total.
C)Echo check.
D)Access control software.

Question 28

Which of the following statement is correct regarding internal control?

A)A well-designed internal control environment ensures the achievement of an entity's control objectives.
B)An inherent limitation to internal control is the fact that controls can be circumvented by management override.
C)A well-designed and operated internal control environment should detect collusion perpetrated by two people.
D)Internal control in a necessary business function and should be designed and operated to detect errors and fraud.

Question 29

Which of the following control activities should be taken to reduce the risk of incorrect processing in a newly installed computerized accounting system?

A)Segregation of duties.
B)Ensure proper authorization of transactions.
C)Adequately safeguard assets.
D)Independently verify the transactions.

Question 30

Which of the following is considered an application input control?

A)Run control total.
B)Edit check.
C)Reporting distribution log.
D)Exception report.

Question 31

Tracing shipping documents to pre-numbered sales invoices provides evidence that:

A)No duplicate shipments or billings occurred.
B)Shipments to customers were properly invoiced.
C)All goods ordered by customers were shipped.
D)All pre-numbered sales invoices were accounted for.

Question 32

The overall attitude and awareness of a firm's top management and board of directors concerning the importance of internal control is often reflected in its:

A)Computer-based controls.
B)System of segregation of duties.
C)Control environment.
D)Safeguards over access to assets.

Question 33

The framework to be used by management in its internal control assessment under requirements of SOX is the:

A)COSO internal control framework.
B)COSO enterprise risk management framework.
C)COBIT framework.
D)All of the choices are correct.

Question 34

All of the following are examples of internal control procedures except

A)Using pre-numbered documents
B)Reconciling the bank statement
C)Processing customer satisfaction surveys
D)Insistence that employees take vacations

Question 35

According to AS 5,control risk should be assessed in terms of

A)Specific controls.
B)Types of potential fraud.
C)Financial statement assertions.
D)Control environment factors.

Question 36

All of the following are the primary functions of internal controls except:

A)Prevention.
B)Reflection.
C)Detection.
D)Correction.

Question 37

A manufacturing firm identified that it would have difficulty sourcing raw materials locally,so it decided to relocate its production facilities.According to COSO,this decision represents which of the following response to the risk?

A)Risk reduction.
B)Prospect theory.
C)Risk sharing.
D)Risk acceptance.

Question 38

The Public Company Accounting Oversight Board (PCAOB)is not responsible for standards related to:

A)Accounting practice.
B)Attestation.
C)Auditing.
D)Quality control over attestation and/or assurance.

Question 39

Which of the following is not a component of internal control as defined by COSO?

A)Control environment.
B)Control activities.
C)Inherent risk.
D)Monitoring.

Question 40

The internal control provisions of SOX apply to which companies in the United States?

A)All companies.
B)SEC registrants.
C)All issuer (public)companies and nonissuer (nonpublic)companies with more than $100,000,000 of net worth.
D)All nonissuer companies.

Question 41

Which of the following is a component of COSO ERM 2017?

A)Governance and culture.
B)Strategy and objective setting.
C)Performance.
D)Review and revision.
E)All of the choices are correct.

Question 42

Which of the following is not one of the key COBIT 5 principles for governance and amangement of enterprise IT?

A)Enabling a holistic approach.
B)Meeting stakeholder needs.
C)Separating management from shareholders.
D)Applying an integrated framework.

Question 43

The COSO ERM framework encourages a review of risks as they apply to achieving firms' objectives.Which of the following is not one of the listed categories of objectives to be considered?

A)Environment.
B)Operations.
C)Strategic.
D)Compliance.

Question 44

The IT Infrastructure Libarary (ITIL)is considered a de facto standard in which of the following regions?

A)Asia and Australia.
B)North America.
C)The UK.
D)Europe.

Question 45

The ISO 27000 Series of standards are designed to address which of the following?

A)Corporate governance.
B)Internal controls.
C)Information security issues.
D)IT value.

Question 46

Which of the following provides the advantage of incorporating other widely accepted standards and frameworks?

A)ITIL.
B)COBIT 2019.
C)COSO 2013.
D)ISO 27000.

Question 47

In a computerized environment,internal controls can be categorized into which of the following?

A)General controls and application controls.
B)Detective controls and protective controls.
C)Network controls and transaction controls.
D)Preventive controls and mandatory controls.

Question 48

Which of the following is not one of the responses to risk presented in COSO ERM?

A)Share the risk.
B)Accept the risk.
C)Eliminate the risk.
D)Reduce the risk.

Question 49

If a Chief Technology Officer wanted to ensure a new system had appropriate processing controls which of the following would he/she require?

A)Disposal of excess documents.
B)URL Class diagram.
C)A record count.
D)Password management.

Question 50

If a Chief Technology Officer wanted to ensure a new system had appropriate input controls which of the following would he/she require?

A)Disposal of documents.
B)Access control.
C)Sequence checks.
D)URL Class diagram.

Question 51

COBIT framework takes the view that all IT processes should provide clear links between all of the following except:

A)IT processes.
B)IT controls.
C)IT components.
D)IT governance requirements.

Question 52

Which of the following is an example of a validity check?

A)The computer ensures that a numerical amount in a record does not exceed some predetermined amount.
B)As the computer corrects errors and data are successfully resubmitted to the system,the causes of the errors are printed out.
C)The computer flags any transmission for which the control field value did not match that of an existing file record.
D)After data for a transaction are entered,the computer sends certain data back to the terminal for comparison with data originally sent.

Question 53

In addition to focusing on controls,COBIT 5 expands its scope by incorporating which of the following broad perpsectives?

A)How IT brings value to the firm.
B)How IT can automate specific business processess.
C)IT networking requirements.
D)IT cost reductions.

Question 54

Which of the following is not a component of COSO ERM 2017?

A)Information communication and reporting.
B)Strategy and objective setting.
C)Control activities.
D)Review and revision.

Question 55

Which of the following best describes why firms choose to create codes of ethics?

A)Because most people will not behave ethically without a written set of guidelines.
B)Codes of ethics protect firms against lawsuits that may be filed due to corporate fraud.
C)They allow firms to create a formal set of expectations for employees who may have different sets of personal values.
D)Companies must have a written code of ethics in order to conduct interstate commerce in the U.S.

Question 56

The Sarbanes-Oxley Act (SOX)was passed as a response to which of the following events?

A)The savings & loan scandals of the 1980s.
B)The bust of dot-com bubble companies such as pets.com and Webvan.
C)Corporate reporting scandals by companies such as WorldCom,Enron,and Tyco.
D)Securities manipulation and insider trading in the 1930s.

Question 57

In the event identification component of the COSO ERM framework,management must classify events into which of the following?

A)Weaknesses and vulnerabilities.
B)Risks and opportunities.
C)Risks and rewards.
D)Controls and vulnerabilities.

Question 58

Ethical principals are derived from all of the following except:

A)Personal attitudes on issues of right and wrong.
B)Cost benefit analysis.
C)Cultural values.
D)Societal traditions.

Question 59

According to COSO ERM,which of the following is not one of the bases that should be used to analyze the risks of an identified event?

A)Inherent risk.
B)Organizational risk.
C)Residual risk.
D)Control risk.

Question 60

Which of the following best describes what is meant by corporate governance?

A)The organizational structure and responsibilities of the executive team and board of directors of a corporation.
B)Regulatory bodies,such as the SEC and PCAOB,that govern the behavior of corporations.
C)The ability of a corporation's management team to meet earnings forecasts over an extended period of time.
D)Management's processes,policies,and ethical approach to safeguarding stakeholder interests.