Question 1

Physical vaulting refers to the control procedure involving the capture of transactions that by-passed the firewall.

Accepted Answer

A) True 
 B)False

Question 2

Segregation of duties is easy to accomplish in a small-business setting because their operating structure and IT controls are less complex than larger organizations.

Accepted Answer

A) True 
 B)False

Question 3

Tracing deals with selecting a document and looking for the posting of the document in the accounting books and records.

Accepted Answer

A) True 
 B)False

Question 4

"Tone at the top" refers to the:

Accepted Answer

A)  thoroughness of policies for screening and electing the company's board of directors. 
B)  clarity of the company's written code of conduct which sets forth the expectations for personal ethical behavior to support the internal control structure. 
C)  environment in which management supports the internal control system by behaving ethically and making business decisions that emphasize its importance. 
D)  effectiveness of the company's internal audit function in monitoring the control environment.

Question 5

Which of the following statements is true regarding the evolution of definitions of internal control?

Accepted Answer

A)  The definition initiated by the Foreign Corrupt Practices Act in 1977 and included in the auditing standards took a narrow view that was specific to financial reporting. 
B)  COSO's 1992 framework expanded the definition to include categories for the effectiveness and efficiency of operations and compliance with laws and regulations. 
C)  COSO's 1994 framework expanded the definition to include the safeguarding of assets. 
D)  All of the above.

Question 6

Which of the following is not a step in the process of program development?

Accepted Answer

A)  Analysis and design. 
B)  Construction. 
C)  Testing and quality assurance. 
D)  Batch processing.

Question 7

Risks related to a company's business units or functions are:

Accepted Answer

A)  activity-level risks. 
B)  external risks. 
C)  entity-level risks. 
D)  critical risks.

Question 8

Auditors must understand the flow of transactions in order to identify likely sources of financial statement misstatements.

Accepted Answer

A) True 
 B)False

Question 9

Following are procedures used by auditors to understand likely sources of misstatements: 
I. Identify controls that management has implemented to address potential misstatements.
II. Identify points within the process at which misstatements could arise.
III. Understand the flow of transactions.
The proper sequence of these steps is:

Accepted Answer

A)  I, II, III. 
B)  III, II, I. 
C)  I, III, II. 
D)  III, I, II.

Question 10

that come from social engineering are the result of a lack of internal controls.

Accepted Answer

A) True 
 B)False

Question 11

Section 404 of the Sarbanes-Oxley Act of 2002 requires that ICFR effectiveness be audited by the PCAOB.

Accepted Answer

A) True 
 B)False

Question 12

Auditors should make inquiries about whether there is knowledge of fraud in the company. Such inquiries should be made of:

Accepted Answer

A)  management. 
B)  the audit committee. 
C)  internal auditors. 
D)  All of the above.

Question 13

Auditors perform walkthroughs as an efficient way to gain an understanding of ICFR and assess design effectiveness.

Accepted Answer

A) True 
 B)False

Question 14

Contingency controls are primarily concerned with:

Accepted Answer

A)  batch processing. 
B)  recovery. 
C)  capacity planning. 
D)  end user computing.

Question 15

Which of the following is not an audit procedure used to gain an understanding of specific controls in ICFR?

Accepted Answer

A)  Making inquiries of appropriate personnel. 
B)  Inspecting company records. 
C)  Confirming transactions with external parties. 
D)  Observing specific actions, behaviors, and procedures.

Question 16

The Foreign Corrupt Practices Act prompted a definition of internal control that is broader than COSO's definition because COSO does not consider operating efficiency and effectiveness.

Accepted Answer

A) True 
 B)False

Question 17

The cutoff assertion refers to the distinction between the company and its subsidiaries and related entities.

Accepted Answer

A) True 
 B)False

Question 18

Risk assessment is important only for companies who report to the SEC.

Accepted Answer

A) True 
 B)False

Question 19

Application controls are part of the effectiveness of ITGC in that they are the controls that:

Accepted Answer

A)  are specific to a single process or activity within the system but depend upon the validity of the ITGC environment. 
B)  occur at the entity-level to link the operation of automated and manual controls. 
C)  occur at the transaction-level to integrate the financial reporting aspects of a given activity. 
D)  are intended to enhance the access control limitations provided by passwords.

Question 20

In smaller companies where management's interaction with its controls provides the basis for its assessment of ICFR, management should provide documentation of how its interaction provided it with sufficient evidence. Appropriate documentation includes:

Accepted Answer

A)  memos and emails with instructions and directions to and from management to company employees. 
B)  evidence of formal, direct testing and ongoing monitoring evaluations. 
C)  daily checklists and questionnaires indicating the extent of interaction and monitoring. 
D)  All of the above are appropriate for small companies as well as larger companies.

Exam 7: Internal Control, Understanding the Clients Internal Control Over Financial Reporting and Auditing Design Effectiveness

Physical vaulting refers to the control procedure involving the capture of transactions that by-passed the firewall.

Segregation of duties is easy to accomplish in a small-business setting because their operating structure and IT controls are less complex than larger organizations.

Tracing deals with selecting a document and looking for the posting of the document in the accounting books and records.

"Tone at the top" refers to the:

Which of the following statements is true regarding the evolution of definitions of internal control?

Which of the following is not a step in the process of program development?

Risks related to a company's business units or functions are:

Auditors must understand the flow of transactions in order to identify likely sources of financial statement misstatements.

that come from social engineering are the result of a lack of internal controls.

Section 404 of the Sarbanes-Oxley Act of 2002 requires that ICFR effectiveness be audited by the PCAOB.

Auditors should make inquiries about whether there is knowledge of fraud in the company. Such inquiries should be made of:

Auditors perform walkthroughs as an efficient way to gain an understanding of ICFR and assess design effectiveness.

Contingency controls are primarily concerned with:

Which of the following is not an audit procedure used to gain an understanding of specific controls in ICFR?

The Foreign Corrupt Practices Act prompted a definition of internal control that is broader than COSO's definition because COSO does not consider operating efficiency and effectiveness.

The cutoff assertion refers to the distinction between the company and its subsidiaries and related entities.

Risk assessment is important only for companies who report to the SEC.

Application controls are part of the effectiveness of ITGC in that they are the controls that:

In smaller companies where management's interaction with its controls provides the basis for its assessment of ICFR, management should provide documentation of how its interaction provided it with sufficient evidence. Appropriate documentation includes: