Deck 5: Risk Assessment: Internal Control Evaluation

Question 1

Dual-purpose audit tests are procedures that produce both control and substantive evidence.

Answer 1

True

Question 2

The key person in the internal control system of a small business is the independent auditor.

Answer 2

False

Question 3

The primary reason to evaluate internal control is to formulate constructive suggestions for improvement.

Answer 3

False

Question 4

The most efficient means of gathering evidence about a client's internal control is to prepare a flowchart of the system.

Question 5

The primary reason for evaluating a company's internal control is to provide a basis for communicating significant deficiencies.

Question 6

Tests of controls consist of procedures designed to produce evidence regarding how effectively the client's controls work in practice.

Question 7

Control systems generally provide absolute assurance that the objectives of internal control are satisfied.

Question 8

Auditors of public companies do not need to determine the quality of a client's internal control; they need to know only enough to plan the audit work.

Question 9

The strengths and weaknesses of a control system should be documented in bridge workpapers connecting the control evaluation to subsequent audit procedures.

Question 10

The COSO report indicates that internal control should be considered a process,not an end in itself.

Question 11

The most important feature of an internal control system is the people who make the system work.

Question 12

Evaluation of internal control systems on a nonpublic entity should not be subject to cost-benefit considerations.

Question 13

To reduce the final control risk assessment to a low level,auditors need to determine only the required degree of compliance with the control policies and procedures.

Question 14

Auditors do not need to perform tests of controls on internal control activities that are evaluated as weak just to prove the weaknesses actually exist.

Question 15

The audit task of control risk assessment involves learning what the company does to prevent,detect,and correct errors and fraud.

Question 16

Auditors can stop the assessment of control risk for nonpublic entities for either effectiveness or efficiency reasons.

Question 17

Auditors perform tests of control activities to determine how the company's controls actually functioned during the period under audit.

Question 18

The audit team is responsible for the client's internal control.

Question 19

A control activity is an action taken to prevent,detect,and correct errors and frauds in transactions.

Question 20

The attitudes of managers and directors are probably the most pervasive influences on the control environment.

Question 21

Which of the following is not an input control activity?

A) Reasonableness tests.
B) Record counts.
C) Financial totals.
D) Hash totals.

Question 22

Auditors should begin their evaluation of internal controls over financial reporting on a bottom-up basis,starting with the account level assertion and working up to entity-level controls.

Question 23

Control activities intended to ensure that transactions are recorded in the right period are designed to achieve the ASB assertion of

A) Occurrence.
B) Accuracy.
C) Valuation or allocation.
D) Cutoff.

Question 24

PCAOB Auditing Standard No.5 only applies to public companies.

Question 25

Which of the following is the least important audit reason for the auditor's obtaining an understanding of a company's internal control?

A) To serve as a basis for constructive suggestions.
B) To plan subsequent substantive tests.
C) To identify types of possible misstatements that may occur.
D) To consider factors that may affect the risk of material misstatement.

Question 26

Tracing bills of lading to sales invoices provides evidence that

A) Shipments to customers were invoiced.
B) Shipments to customers were recorded as sales.
C) Recorded sales were shipped.
D) Invoiced sales were recorded as sales.

Question 27

Control strengths and weaknesses should be documented in audit documentation,sometimes called

A) Questionnaires, narratives, and flowcharts.
B) Bridge working papers.
C) Communications of significant deficiencies.
D) Internal control letters.

Question 28

Which of the following client internal control activities is not usually performed in the treasurer's department?

A) Verifying the accuracy of checks and vouchers.
B) Controlling the mailing of checks to vendors.
C) Approving vendors' invoices for payment.
D) Canceling payment vouchers when paid.

Question 29

The internal control in small business is highly dependent on the

A) Separation of functional responsibilities.
B) Complexity of the client's internal controls.
C) Owner-manager's competence as well as ethics and integrity.
D) Bonding of employees.

Question 30

A set of characteristics that helps to define a seriousness about employees' attitudes about the control activities in a company is referred to as

A) Management assertions.
B) Control environment.
C) Control risk assessment.
D) Functional responsibilities.

Question 31

An audit team's responsibility would not include

A) Designing client's internal controls.
B) Documenting an understanding of a client's internal controls.
C) Communicating internal control deficiencies.
D) Assessing the effectiveness a client's internal controls.

Question 32

Which of the following is an information technology general control?

A) Check digit.
B) Run-to-run totals.
C) Distribution of computerized output.
D) Separation of duties in the IT department.

Question 33

The "obtaining an understanding" work phase (phase 1)of internal control evaluation would not give auditors an overall acquaintance with the client's

A) Control environment.
B) Information and communication system.
C) Control activity effectiveness.
D) Monitoring activities.

Question 34

After obtaining an understanding of the entity's internal control and assessing control risk,an auditor of a nonpublic company decided not to perform additional tests of controls.The auditor most likely concluded that the

A) Additional evidence to support an additional reduction in control risk was not cost beneficial.
B) Assessed level of inherent risk exceeded the assessed level of control risk.
C) Internal control structure was properly designed and justifiably may be relied on.
D) Evidence obtainable through tests of controls would not support an increased level of control risk.

Question 35

The appropriate separation of duties does not include

A) Having authorization to execute transactions.
B) Recording transactions.
C) Having custody of assets involved in the transactions.
D) Preparing data.

Question 36

Which of the following audit procedures most likely would provide an auditor the most assurance about the effectiveness of the operation of an entity's internal control?

A) Confirmation with outside parties.
B) Inquiry of client personnel.
C) Successful reperformance of the control activity.
D) Observation of client personnel.

Question 37

Regardless of the assessed level of control risk,an auditor of a nonpublic company would perform some

A) Tests of controls to determine the effectiveness of internal control policies.
B) Analytical procedures to verify the design of internal control activities.
C) Substantive tests to restrict detection risk for significant transaction classes.
D) Dual-purpose tests to evaluate both the risk of monetary misstatement and preliminary control risk.

Question 38

A salesclerk enters a customer's six-number customer account.The computer program uses the first five numbers to calculate a sixth number.This resulting number is then compared to the sixth number entered by the sales clerk.This is an example of a

A) Valid character test.
B) Missing data test.
C) Reasonableness test.
D) Check digit.

Question 39

Sound internal control can be described as separating all of the following duties and responsibilities except for

A) Transaction authorization.
B) Recordkeeping.
C) Custody of, or direct access to, assets.
D) Hiring of employees.

Question 40

The auditor's opinion on internal control under AS 5 relates only to controls existing at the end of the year.

Question 41

In an audit of financial statements of a nonpublic company in accordance with generally accepted auditing standards,an auditor is required to

A) Document his or her understanding of the entity's internal control.
B) Search for significant deficiencies in the operation of internal controls.
C) Perform tests of controls to evaluate the effectiveness of the entity's accounting system.
D) Determine whether control activities are operating effectively to prevent or detect material misstatements.

Question 42

After obtaining an understanding of internal controls and assessing control risk on the audit of a nonpublic company,an auditor decided to perform tests of controls.The auditor most likely decided that

A) It would be efficient to perform tests of controls that would result in a reduction in planned substantive tests.
B) Additional evidence to support a further reduction in control risk is not available.
C) An increase in the assessed level of control risk is justified for certain financial statement assertions.
D) There were many internal control weaknesses that could allow errors to enter the accounting system.

Question 43

If a control total were to be computed on each of the following data items,which would best be identified as a hash total for a payroll IT application?

A) Hours worked.
B) Total debits and total credits.
C) Net pay.
D) Department numbers.

Question 44

The primary objective of procedures performed to obtain an understanding of the entity's internal control is to provide an auditor

A) The knowledge necessary for audit planning.
B) The evidential matter to use in assessing inherent risk.
C) A basis for modifying tests of controls.
D) An evaluation of the consistency of application of management's policies.

Question 45

As part of understanding the internal control,an auditor is not required to

A) Consider factors that affect the risk of material misstatement.
B) Ascertain whether internal control policies and activities have been placed in operation.
C) Identify the types of potential misstatements that can occur.
D) Obtain knowledge about the operating effectiveness of the client's internal control activities.

Question 46

After obtaining an understanding of a client's financial reporting control activities,the auditor would next

A) Test the client's control activities.
B) Assess the final control risk.
C) Document the understanding obtained.
D) Plan the remainder of the audit work.

Question 47

When the audit team increases the planned assessed level of control risk because certain control activities were determined to be ineffective,the audit team would most likely increase the

A) Extent of substantive tests of details.
B)

Question 48

In computer systems,the information technology general controls (ITGC)would not include

A) Processing of control activities.
B) Separation of various computer system functions.
C) Appropriate documentation of the data processing system.
D) Control over physical access to computer hardware.

Question 49

Which of the following is a step in an auditor's decision to assess control risk at below the maximum?

A) Apply analytical procedures to both financial data and nonfinancial information to detect conditions that may indicate weak controls.
B) Perform tests of details of transactions and account balances to identify potential errors and fraud.
C) Identify specific internal control policies and activities that are likely to detect or prevent material misstatements.
D) Document the fact that the additional audit effort to perform tests of controls exceeds the potential reduction in substantive testing.

Question 50

Which of the following would most likely be classified as a material weakness?

A) Absence of appropriate separation of duties.
B) Absence of appropriate reviews and approvals of transactions.
C) Evidence of failure of control activities.
D) Ineffective oversight of the financial reporting process by the company's audit committee.

Question 51

Proper separation of duties reduces the opportunity for persons to be in positions to both

A) Journalize entries and prepare financial statements.
B) Record cash receipts and cash disbursements.
C) Establish internal controls and authorize transactions.
D) Perpetrate a fraud and then conceal it in the books.

Question 52

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

A) Incompatible duties.
B) Management override.
C) Mistakes in judgment.
D) Collusion among employees.

Question 53

Generally accepted auditing standards (GAAS)give auditors considerable discretion to decide the amount of work required to satisfy auditing standards guiding internal control evaluation and related audit planning.Which of the following descriptions best expresses the minimum amount of work permitted by GAAS for nonpublic companies?

A) Do not obtain an understanding of client environment, accounting, or control activities. Do not document the decision to assess control risk at maximum. Perform 100% substantive audit on all financial statement transactions and balances.
B) Obtain an understanding of client environment, accounting, and control activities. Document the decision to assess control risk at maximum. Perform an extensive but not 100% substantive audit on financial statement transactions and balances.
C) Obtain an understanding of client environment, accounting, and control activities, and perform detail tests of controls. Document the decision to assess control risk below the maximum. Perform restricted substantive audit on financial statement transactions and balances, considering the control risk assessment.
D) Obtain an understanding of client environment, accounting, and control activities, and perform detail tests of controls. Document the decision to assess control risk at zero. Perform no substantive audit on financial statement transactions and balances because zero control risk means that no errors or fraud can affect the accounts.

Question 54

In an audit of financial statements,an auditor's primary consideration regarding an internal control policy or activity is whether the policy or activity

A) Reflects management's philosophy and operating style.
B) Affects management's financial statement assertions.
C) Provides adequate safeguards over access to assets.
D) Enhances management's decision making processes.

Question 55

If auditors assess control risk at the maximum level,they will tend to

A) Perform a great deal of additional tests of controls.
B) Perform a great deal of substantive testing during the audit.
C) Perform substantive tests at an interim date.
D) Perform more audit procedures using internal evidence.

Question 56

The overall attitude and awareness of an entity's board of directors concerning the importance of the client's internal control usually is reflected in its

A) Computer-based control activities.
B) System of separation of duties.
C) Control environment.
D) Safeguards over access to assets.

Question 57

The ultimate purpose of assessing control risk is to contribute to the auditor's evaluation of the

A) Factors that raise doubts about the auditability of the financial statements.
B) Operating effectiveness of internal control policies and procedures.
C) Risk that material misstatements exist in the financial statements.
D) Possibility that the nature and extent of substantive tests may be reduced.

Question 58

During the audit of a private company's financial statements,which of the following statements best describes the minimum work an auditor must perform in connection with a company's internal control?

A) Perform exhaustive tests of accounting controls and evaluate the company's control system effectiveness.
B) Determine whether the company's control policies are designed well enough to prevent material misstatements.
C) Prepare auditing working papers that document the auditor's understanding of the company's internal control.
D) Design procedures to search for significant deficiencies in the actual operation of the company's internal control.

Question 59

Which of the following is not an objective of internal controls over financial reporting as defined by the Sarbanes-Oxley Act?

A) Policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant.
B) Policies and procedures that provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles and that receipts and expenditures of the registrant are being made only in accordance with authorizations of management and directors of the registrant.
C) Policies and procedures that provide reasonable assurance regarding the compliance with applicable laws and regulations.
D) Policies and procedures that provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the registrant's assets that could have a material effect on the financial statements.

Question 60

When obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company,an auditor is not obligated to

A) Determine whether control activities have been placed in operation.
B) Perform procedures to understand the design of the internal control system.
C) Document the understanding of the company's internal control system.
D) Search for significant deficiencies in the operation of the internal control system.

Question 61

A transaction-level internal control activity is best described as

A) An action taken by auditors to obtain evidence.
B) An action taken by client personnel for the purpose of preventing, detecting, and correcting errors and frauds in transactions to eliminate or mitigate risks identified by the company.
C) A method for recording, summarizing, and reporting financial information.
D) The functioning of the board of directors in support of its audit committee.

Question 62

A report on internal control effectiveness by the management team of public companies is required by

A) The Sarbanes-Oxley Act of 2002.
B) The PCAOB.
C) The AICPA.
D) The ASB.

Question 63

Which of the following is a device designed to help the audit team obtain evidence about the accounting and control activities of an audit client?

A) A narrative memorandum describing the control system.
B) An internal control questionnaire.
C) A flowchart of the documents and procedures used by the company.
D) All of the above.

Question 64

A material weakness is a situation in which

A) It is probable that an immaterial financial statement misstatement would not be detected on a timely basis.
B) There is a remote likelihood that a material misstatement would be detected on a timely basis.
C) It is reasonably possible that a material misstatement would not be detected on a timely basis.
D) It is reasonably possible that an immaterial misstatement would not be detected on a timely basis.

Question 65

Assessing control risk at below the maximum level most likely would involve

A) Performing more extensive substantive tests with larger sample sizes than originally planned.
B) Reducing inherent risk for most of the assertions relevant to significant account balances.
C) Changing the timing of substantive tests by omitting interim-date testing and performing the tests at year-end.
D) Identifying specific internal control activities that are relevant to specific financial statement assertions.

Question 66

To test the operating effectiveness of a control,an audit team might use a combination of each of the following tests except for:

A) Inquiry of client personnel.
B) Observation of company operations.
C) Confirmation of balances.
D) Inspection of documentation.

Question 67

The most important fundamental component of an entity's internal control is

A) Effectiveness and efficiency of operations.
B) People who operate the control system.
C) Reliability of financial reporting.
D) Compliance with applicable laws and regulations.

Question 68

A bridge workpaper shows the connection between

A) Control evaluation findings and subsequent audit procedures.
B) Management objectives and accounting system procedures.
C) Management objectives and entity control activities.
D) Financial statement assertions and tests of controls.

Question 69

The primary purpose for obtaining an understanding of a nonpublic audit client's internal control is to

A) Provide a basis for making constructive suggestions in a management letter.
B) Determine the nature, timing, and extent of tests to be performed in the audit.
C) Provide the rationale for the inherent risk assessment at the financial statement assertion level.
D) Provide information for a communication of internal control-related matters to management.

Question 70

Which of the following is a preventive control?

A) Reconciliation of a bank account.
B) Recalculation of a sample of payroll entries by internal auditors.
C) Separation of duties between the payroll and personnel departments.
D) Detailed fluctuation analysis completed by the CFO for revenue.

Question 71

Tests of controls in a GAAS audit are required for

A) Obtaining evidence about the financial statement assertions.
B) Accomplishing control over the occurrence of recorded transactions.
C) Applying analytical procedures to financial statement balances.
D) Obtaining evidence about the operating effectiveness of client control activities.

Question 72

In most audits of large entities,control risk assessment contributes to audit efficiency,which means that

A) The cost of substantive procedures will exceed the cost of control evaluation work.
B) Auditors will be able to reduce the cost of substantive procedures by an amount more than the control evaluation costs.
C) The cost of control evaluation work will exceed the cost of substantive procedures.
D) Auditors will be able to reduce the cost of substantive procedures by an amount less than the cost of tests of controls.

Question 73

Effectiveness of audit procedures would be reduced by

A) Selecting larger sample sizes for audit.
B) Performing audit procedures at the fiscal year-end date as opposed to the interim period.
C) Deciding to obtain external evidence instead of internal evidence.
D) Performing procedures during the interim period as opposed to at the fiscal year-end date.

Question 74

In testing control activities,an auditor ordinarily selects from a variety of techniques,including

A) Inquiry and analytical procedures.
B) Reperformance and observation.
C) Comparison and confirmation.
D) Inspection and verification.

Question 75

Management's report on internal controls must include each of the following except

A) A statement that management is responsible for establishing and maintaining adequate internal control over financial reporting.
B) A statement identifying the framework management uses to evaluate the effectiveness of the company's internal control.
C) A statement providing management's assessment of the effectiveness of the company's internal control.
D) A statement providing management's evaluation of the company's control environment.

Question 76

Which of the following areas can external auditors rely on internal auditors' work in auditing internal controls?

A) Evaluation of the auditing environment.
B) Testing of low-risk internal control activities.
C) All testing of the operating effectiveness of internal control activities.
D) Providing the principal evidence for the external auditors' opinion.

Question 77

According to the PCAOB,during the audit of internal controls for an issuer,the ultimate objective of testing the design effectiveness of internal controls is to

A) Determine whether the company's controls are processing company data effectively.
B) Determine that the company's controls will satisfy the company's control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements, if they operate as prescribed.
C) Determine that the company's employees are processing the controls according to the policy and procedure manuals at the company.
D) None of the above.

Question 78

When completing the audit of internal controls for an issuer,the severity of an internal control deficiency depends on:

A) Whether there is a reasonable possibility that the company's controls will fail to prevent or detect a misstatement of an account balance or disclosure.
B) Whether the account has a history of errors.
C) The magnitude of the potential misstatement resulting from the deficiency or the deficiencies.
D) Both A and C are correct.
E) All of the above are correct.

Question 79

When planning an audit of internal controls for an issuer,the audit team should

A) Identify significant accounts, locations, and assertions.
B) Conduct a walkthrough of the internal control process.
C) Make inquiries of employees regarding the existence of control activities.
D) Reperform control activities performed by client employees to determine their effectiveness.

Question 80

Which of the following does not accurately summarize auditors' requirements regarding internal control?

A) Option A
B) Option B
C) Option C
D) Option D