Deck 10: Fraud and Internal Control

Question 1

Motive and opportunity without means still results in fraud.

Answer 1

False

Question 2

SOX emphasizes a strong system of internal control as a way of avoiding Enron-sized accounting frauds.

Answer 2

True

Question 3

________ should be assessed periodically by the organization to identify specific potential schemes and events that the organization needs to mitigate.

Answer 3

Fraud Risk Assessment

Question 4

What percentage of fraud cases were inadequate internal controls cited as a primary contributing factor?

A)48%
B)29%
C)35%
D)42%

Question 5

How long does the typical fraud last before being detected?

A)Six months
B)One year
C)Two years
D)Three years

Question 6

________ includes illegal acts such as bribery, kickbacks, money laundering, and rigging bids.

Question 7

SOX section 302 requires each annual report of a publicly traded company to contain an internal control report stating the management's responsibility to establish and maintain an adequate system of internal control for financial reporting.

Question 8

The SOX legislation basically requires management of privately held companies must assess and report on the effectiveness of internal controls for financial reporting using a recognized framework.

Question 9

Corruption involves theft of assets for personal gain.

Question 10

What percentage of occupational fraud is committed by the accounting department?

A)10%
B)29%
C)12%
D)21%

Question 11

What percentage of occupational fraud is committed by upper management?

A)19%
B)33%
C)29%
D)12%

Question 12

List the three fraud and abuse categories. Provide examples.

Question 13

Fraudulent financial reporting includes misstating financial statements to meet earnings targets.

Question 14

________ techniques should be established to uncover fraud events when preventive measures fail or unmitigated risks are realized.

Question 15

The accounting profession is self-regulated.

Question 16

List and describe the principles for establishing an environment to effectively manage fraud risk.

Question 17

What three things must a perpetrator have to commit fraud? Include a brief description of each.

Question 18

Earnings management focuses on managing when revenues and expenses are recorded in order to favorably reflect a company's financial performance in a(n)________.

A)illegal manner
B)legal manner
C)questionable manner
D)vague manner

Question 19

Not even the strongest system of controls can eliminate all risk of organizations being defrauded by employees who are sufficiently motivated to find loopholes.

Question 20

________ focuses on managing when revenues and expenses are recorded in order to favorably reflect a company's financial performance in a legal manner.

Question 21

A(n)________ over financial reporting requires the auditor to conduct tests of controls to obtain evidence that internal control over financial reporting has operated effectively.

Question 22

The internal control category control environment includes identifying, analyzing, and managing risks affecting the ability to report financial data properly.

Question 23

The Sarbanes-Oxley Act of 2002, which would become known as SOX, created the ________ to oversee and regulate public companies and their auditors.

Question 24

A(n)________ in internal control over financial reporting is defined as a deficiency as such that there is a reasonable possibility that a material misstatement of financial statements will not be prevented or detected in a timely basis.

Question 25

Internal control is designed to provide reasonable assurance regarding the achievement of objectives in effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations.

Question 26

Which organization was created by the Sarbanes-Oxley Act of 2002?

A)Public Company Accounting Oversight Board (PCAOB)
B)Institute of Management Accountants (IMA)
C)Security and Exchange Commission (SEC)
D)Committee of Sponsoring Organizations of the Treadway Commission (COSO)

Question 27

The COSO ________ provides a blueprint for implementing an internal control system to assist in ensuring the reliability of financial statements and compliance with Sarbanes-Oxley legislation.

Question 28

When investigating fraud, ________ enables auditors to extract, analyze, and interpret evidence to detect unusual patterns and irregularities.

Question 29

In a(n)________, the auditor performs tests of controls and substantive procedures.

Question 30

In control activities, ________ divide authorization, recording, and asset custody among different individuals.

Question 31

For internal control to be effective, an organization needs ________ with internal controls.

Question 32

SOX section 404 requires requires each annual report of a publicly traded company to contain an internal control report to contain a assessment of the effectiveness of the company's internal control structure and procedures.

Question 33

What does Auditing Standard No. 5, an Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements, require the auditor to understand about IT?

Question 34

SOX section 906 requires corporate management to certify reports filed with the SEC.

Question 35

Which SOX section requires the chief executive officer and the chief financial officer to disclose to the auditors and the audit committee of the board of directors all significant deficiencies in internal controls, which could adversely affect the ability to record, process, summarize, and report financial data and any material weaknesses in internal controls?

A)Section 806. Protection for Employees of Publicly Traded Companies Who Provide Evidence of Fraud
B)Section 404. Management Assessment of Internal Controls
C)Section 906. Corporate Responsibility for Financial Reports
D)Section 302. Corporate Responsibility for Financial Reports

Question 36

Which SOX section requires the public accounting firm that audits the financial statements of the company to issue an attestation report regarding the effectiveness of the company's internal controls?

A)Section 806. Protection for Employees of Publicly Traded Companies Who Provide Evidence of Fraud
B)Section 404. Management Assessment of Internal Controls
C)Section 906. Corporate Responsibility for Financial Reports
D)Section 302. Corporate Responsibility for Financial Reports

Question 37

A(n)________, as required by Auditing Standard No. 5, integrates an audit of internal control with an audit of financial statements.

Question 38

What is SOX?

Question 39

Which audit type requires the auditor to conduct tests of controls to obtain evidence that internal control over financial reporting has operated effectively?

A)Audit of financial reporting control
B)Audit of financial statements
C)Audit of internal control
D)IT audit

Question 40

For internal control to be effective, an organization needs stated ________ and ________ for internal controls.

Question 41

List and describe the control activities for mitigating financial, operational, and compliance controls risks.

Question 42

Application controls ensure completeness and accuracy of transaction processing, authorization, and validity.

Question 43

What is internal control and what is its purpose?

Question 44

In the COSO Internal Control-Integrated Framework, risk assessment objectives include all of the following EXCEPT

A)Identification and analysis of financial reporting risks
B)Importance of financial reporting objectives
C)Assessment of fraud risk
D)Risks of financial controls

Question 45

Input controls ensure data is processed properly.

Question 46

In control activities, ________ ensure appropriate information processing, authorization, and data integrity.

Question 47

IT general controls have a pervasive effect on all internal controls.

Question 48

Which of the following is NOT the purpose of internal controls?

A)Compliance with laws and regulations
B)Effectiveness and efficiency of operations
C)Public examine of private data
D)Reliability of financial reporting

Question 49

Which COSO Internal Control-Integrated Framework essential component of an effective internal control system involves assessing internal controls as well as the process for taking corrective action?

A)Control Environment
B)Risk Assessment
C)Monitoring
D)Control Activities

Question 50

Which COSO Internal Control-Integrated Framework essential component of an effective internal control system involves identifying, analyzing, and managing risks that affect a company's ability to record, process, summarize, and report financial data properly?

A)Risk Assessment
B)Control Environment
C)Control Activities
D)Monitoring

Question 51

Which COSO Internal Control-Integrated Framework essential component of an effective internal control system includes the accounting system for identifying, recording, processing, and reporting transactions and financial data?

A)Monitoring
B)Information and Communication
C)Control Activities
D)Control Environment

Question 52

What are the five major categories of internal control?

Question 53

What are the objectives of internal control?

Question 54

Internal control is a set of policies, procedures, and activities to achieve an enterprise's objectives that are related to what?

Question 55

For internal control to be effective what two things does an enterprise need?

Question 56

Increasingly the expectation is that the auditor and the IT professional learn more about the other's field.

Question 57

In the COSO Internal Control-Integrated Framework, control activities do NOT include

A)Independent reconciliations of assets and accounting records
B)Physical controls
C)Segregation of duties
D)Management controls

Question 58

Processing controls ensure reports and other output are distributed properly.

Question 59

Internal controls for the accounting system are incomplete without IT controls.

Question 60

What factors are part of the control environment?

Question 61

Which report provides an opinion regarding fairness of the service organization's description of controls other than those relevant to a company's internal control related to financial reporting, including the service auditor tests controls and expresses an opinion regarding the effectiveness of the controls?

A)SOC 1 Type 1 Report
B)SOC 1 Type 2 Report
C)SOC 2 Type 1 Report
D)SOC 2 Type 2 Report

Question 62

Match the privacy principle to the correct

-Management
definition.

A)The entity defines, documents, communicates, and assigns accountability for its privacy policies and procedures.
B)The entity provides information about its privacy policies and procedures and identifies the purposes for which personal information is collected, used, retained, and disclosed.
C)The entity limits the use of personal information to the purposes identified in the notice and for which the individual has provided implicit or explicit consent. The entity retains personal information only for as long as necessary to fulfill the stated purposes.
D)The entity maintains accurate, complete, and relevant personal information for the purposes identified in the notice.
E)The entity shares personal information to third parties only for the purposes identified in the notice and with the implicit or explicit consent of the individual.
F)The entity monitors compliance with its privacy policies and procedures and has procedures to address privacy-related complaints and disputes.
G)The entity provides individuals their personal information for review and update.
H)The entity collects personal information only for the purposes identified in the notice.
I)The entity describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use, and disclosure of personal information.
J)The entity protects personal information against unauthorized access (both physical and logical).

Question 63

Match the privacy principle to the correct

-Choice and Consent
definition.

A)The entity defines, documents, communicates, and assigns accountability for its privacy policies and procedures.
B)The entity provides information about its privacy policies and procedures and identifies the purposes for which personal information is collected, used, retained, and disclosed.
C)The entity limits the use of personal information to the purposes identified in the notice and for which the individual has provided implicit or explicit consent. The entity retains personal information only for as long as necessary to fulfill the stated purposes.
D)The entity maintains accurate, complete, and relevant personal information for the purposes identified in the notice.
E)The entity shares personal information to third parties only for the purposes identified in the notice and with the implicit or explicit consent of the individual.
F)The entity monitors compliance with its privacy policies and procedures and has procedures to address privacy-related complaints and disputes.
G)The entity provides individuals their personal information for review and update.
H)The entity collects personal information only for the purposes identified in the notice.
I)The entity describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use, and disclosure of personal information.
J)The entity protects personal information against unauthorized access (both physical and logical).

Question 64

To attest, the auditor is

A)Testifying in court
B)Expressing an opinion
C)Testing financial reporting controls
D)Testing the fairness of the description of controls

Question 65

Service organizations are external organizations that perform services to the company being audited.

Question 66

________ reports are issued by the service organization to report on controls other than those relevant to a company's internal control related to financial reporting.

Question 67

Which level in the company corresponds to the Entity-Level IT Controls?

A)Top management
B)Information management
C)Business processes
D)IT services

Question 68

Which SOC report is conducted by the service organization's auditors using Attestation Standards (AT)Section 101 and prepared using the AICPA Trust Services?

A)SOC 1
B)SOC 2
C)SOC 3
D)SOC 3 Type 2 report

Question 69

What are the three major objectives of an IT audit?

Question 70

What do the audit committee's responsibilities include?

Question 71

________ controls include IT governance at top management levels where strategic business objectives are set and policies are established.

Question 72

________ controls are embedded within business process applications.

Question 73

Match the privacy principle to the correct

-Notice
definition.

A)The entity defines, documents, communicates, and assigns accountability for its privacy policies and procedures.
B)The entity provides information about its privacy policies and procedures and identifies the purposes for which personal information is collected, used, retained, and disclosed.
C)The entity limits the use of personal information to the purposes identified in the notice and for which the individual has provided implicit or explicit consent. The entity retains personal information only for as long as necessary to fulfill the stated purposes.
D)The entity maintains accurate, complete, and relevant personal information for the purposes identified in the notice.
E)The entity shares personal information to third parties only for the purposes identified in the notice and with the implicit or explicit consent of the individual.
F)The entity monitors compliance with its privacy policies and procedures and has procedures to address privacy-related complaints and disputes.
G)The entity provides individuals their personal information for review and update.
H)The entity collects personal information only for the purposes identified in the notice.
I)The entity describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use, and disclosure of personal information.
J)The entity protects personal information against unauthorized access (both physical and logical).

Question 74

Which of the following is NOT part of the audit committee's responsibilities?

A)The organization's compliance with legal and regulatory requirements
B)The integrity of the organization's financial statements and reports
C)The organization's policies regarding ethical conduct
D)The organization's ability to process data efficiently and effectively

Question 75

________ reports are issued by the service organization to report on its controls relevant to a company's internal control over financial reporting.

Question 76

Which general IT control covers acquisition, implementation, and maintenance of system software including the operating system, DBMS, network software, and security software?

A)Access security controls
B)Computer operations controls
C)Program change controls
D)Program development controls

Question 77

________ controls support application controls to provide a reliable operating environment.

Question 78

The reporting framework for Service Organization Control (SOC)consists of five SOC reports.

Question 79

Which report provides an opinion regarding fairness of the service organization's description of controls relevant to a company's internal control over financial reporting, but does not test the controls or express an opinion regarding the effectiveness of the controls?

A)SOC 1 Type 1 Report
B)SOC 1 Type 2 Report
C)SOC 2 Type 1 Report
D)SOC 2 Type 2 Report

Question 80

Which general IT control includes control over SDLC phases for software upgrades and modifications?

A)Program development controls
B)Access security controls
C)Computer operations controls
D)Program change controls