Flashcards V1C5 - Sheet1
Question: V1C5-0001
Effective whistle-blower programs can help organizations meet the requirements of Section 301 of the Sarbanes-Oxley Act’s Audit Committees. Which of the following is not an element of the whistle-blower program?
Answers
A: Collecting employee concerns.
B: Improving internal communication.
C: Collecting information about emerging issues.
D: Improving external communication.
Answer Explanations
Answer (a) is incorrect. It does help the organization to meet the requirements of the act. It also helps to improve the implementation of whistle-blower program because it focuses on improving internal communication.
Answer (b) is incorrect. It does help the organization to meet the requirements of the act. It also helps to improve the implementation of whistle-blower program because it focuses on improving internal communication.
Answer (c) is incorrect. It does help the organization to meet the requirements of the act. It also helps to improve the implementation of whistle-blower program because it focuses on improving internal communication.
Answer (d) is the correct answer. The whistle-blower program can act as a means of collecting employee concerns, improving internal communication, collecting information regarding emerging issues before they become crises, and enhancing the organization’s overall system of internal controls. The program does not improve external communications because it focuses on internal communication.
Question: V1C5-0002 The most effective way of releasing the whistle-blower program throughout the organization is to have Answers A: Hard-copy memos. B: Electronic-mails. C: Face-to-face meetings. D: Computer-based training programs
Answer Explanations
Answer (a) is incorrect. It is not an effective way.
Answer (b) is incorrect. It is not an effective way.
Answer (c) is the correct answer. While a hard-copy memo, an e-mail, video conferencing, voice conferencing, or
even preparing a computer-based training program is a viable option to release the whistle-blower program throughout the organization, the most effective way is to have face-to-face meetings with employees. This shows management’s commitment to the program.
Answer (d) is incorrect. It is not an effective way.
Question: V1C5-0003 The “train-the-trainer” approach is implemented in which phase of the whistle-blower program? Answers A: Assessment. B: Building. C: Program release. D: Performance monitoring.
Answer Explanations
Answer (a) is incorrect. The assessment phase evaluates the needs.
Answer (b) is incorrect. The building phase trains operators.
Answer (c) is the correct answer. Program release phase introduces the whistle-blower program throughout the organization. An approach that is widely used in other settings and practical in the whistle-blower program is the “train-the-trainer” approach.
Answer (d) is incorrect. The performance-monitoring phase surveys employees.
Question: V1C5-0004 The selection of the facilitator is made in which phase of the whistle-blower program? Answers A: Assessment. B: Building. C: Program release. D: Performance monitoring.
Answer Explanations
Answer (a) is incorrect. The assessment phase identifies staff.
Answer (b) is incorrect. The building phase updates polices and procedures.
Answer (c) is the correct answer. The selection of the facilitator for the whistle-blower program release sessions is made in the program release phase. Choosing a sympathetic and knowledgeable facilitator will increase employee acceptance of the program and put employees at ease.
Answer (d) is incorrect. The performance-monitoring phase meets with oversight board.
Question: V1C5-0005 Employee surveys are conducted in which phase of the whistle-blower program? Answers A: Assessment. B: Building. C: Program release. D: Performance monitoring.
Answer Explanations
Answer (a) is incorrect. The assessment phase selects oversight board.
Answer (b) is incorrect. The building phase trains the oversight board.
Answer (c) is incorrect. The program release phase distributes notices.
Answer (d) is the correct answer. Performance monitoring requires verifying compliance with the program’s protocol
to ensure quality control. Surveys should be conducted to obtain feedback and to make sure that employees remain aware that the program is in place and working effectively
Question: V1C5-0006 A key element of the implementation of Section 302 of the Sarbanes-Oxley Act’s Quarterly CEO and CFO Certifications is Answers A: Disclosure controls. B: Disclosure procedures. C: Disclosure committee. D: Disclosure policies.
Answer Explanations
Answer (a) is incorrect. “Disclosure controls” is a part of the term introduced by the SEC and is not a key element.
Answer (b) is incorrect. “Disclosure procedures” is a part of the term introduced by the SEC, and is not a key element.
Answer (c) is the correct answer. Section 302 of the Sarbanes-Oxley Act requires CEOs and CFOs to personally certify in quarterly financial reports. To implement this section, the SEC introduced the term “disclosure controls and procedures,” which limits the evaluation to internal controls over financial reporting and over material nonfinancial disclosures. A key element of the disclosure process is a disclosure committee, in which knowledgeable, high-level people come together to rigorously examine financial information and other disclosures as they are being prepared.
Answer (d) is incorrect. The disclosure policies are neither a part of the term introduced by the SEC nor a key element.
Question: V1C5-0007 According to Section 404 of the Sarbanes-Oxley Act’s Management Assessment of Internal Controls, assessment and assertion of an organization’s control environment should focus on which of the following? Answers A: Integrated controls. B: Discrete controls. C: Soft controls. D: Hard controls.
Answer Explanations
Answer (a) is the correct answer. The control environment of an organization does not exist as series of discrete controls, like the steps in a transaction processing system. It is an integrated whole. The individual pieces contribute to the whole, but it is the interaction among the pieces that make up the control environment. Thus, the organization’s assessment and assertion of the control environment should be treated as a whole and in an integrated manner.
Answer (b) is incorrect. Discrete controls are used in transaction processing systems.
Answer (c) is incorrect. Soft controls are subjective aspects of control, like tone at the top.
Answer (d) is incorrect. Hard controls like testing are performed in traditional auditing work.
Question: V1C5-0008 According to the Committee of Sponsoring Organizations (COSO) report, which of the following is the most important component of internal control? Answers A: Risk assessment. B: Control environment. C: Control activities. D: Monitoring.
Answer Explanations
Answer (a) is incorrect because risk assessment identifies risks and suggests controls.
Answer (b) is the correct answer. According to the COSO’s report, five components of internal control include control environment, risk assessment, control activities, information and communication, and monitoring. Control environment is the foundation on which everything rests and is the basis for assessing integrity and ethical values, management’s philosophy, and operating style (soft controls).
Answer (c) is incorrect because control activities need control procedures.
Answer (d) is incorrect because monitoring includes management reviews and comparisons.
Question: V1C5-0009 When evaluating control self-assessment, most of the time should be spent on reviewing hard controls in which of the following areas? Answers A: Organizational level. B: Activity level. C: Process level. D: Department level.
Answer Explanations
Answer (a) is incorrect because soft controls should be evaluated at the organizational level.
Answer (b) is the correct answer. Most of the time, hard controls should be evaluated at the activity level; this is in addition to the soft controls. The focus of the hard controls should be on detailed documentation and testing of control activities. Activity level includes process level, functional level, and department level.
Answer (c) is incorrect because process level is a part of the activity level.
Answer (d) is incorrect because department level is a part of the activity level.
Question: V1C5-0010 Which of the COSO components include many soft controls? I. Control environment. II. Risk assessment. III. Control activities. IV. Information and communication. V. Monitoring. Answers A: I and II. B: I and III. C: II and V. D: I, III, and IV.
Answer Explanations
Answer (a) is the correct answer. The two of the five components of the COSO “control environment and risk assessment” includes many soft controls that are intangibles, such as evaluating tone at the top, management’s philosophy, operating style, integrity, and the organization’s ethical climate.
Answer (b) is incorrect because control activities focus on hard controls.
Answer (c) is incorrect because monitoring includes both soft and hard controls.
Answer (d) is incorrect because control activities, information, and communication include both soft and hard controls.
Question: V1C5-0011 COSO users adopt which of the following control evaluation processes? Answers A: Single-tiered. B: Two-tiered. C: Three-tiered. D: Four-tiered.
Answer Explanations
Answer (a) is incorrect because a single-tiered evaluation process is not as strong as the two-tiered one.
Answer (b) is the correct answer. COSO users often adopt a two-tiered control evaluation process. This includes entity-wide assessment (organizational level) followed by process or activity level (second-tier).
Answer (c) is incorrect because there is no such thing as the three-tiered evaluation.
Answer (d) is incorrect because there is no such thing as the four-tiered evaluation.
Question: V1C5-0012 The COSO-based audit approach should not override which of the following? Answers A: Risk-based approach. B: Transaction-based approach. C: Management-based approach. D: Audit committee-based approach.
Answer Explanations
Answer (a) is the correct answer. The COSO-based audit approach should not override the risk-based audit approach where the latter should receive high priority. Where there are gaps, the two approaches should be reconciled.
Answer (b) is incorrect because a transaction-based approach can be overridden.
Answer (c) is incorrect because a management-based approach can be overridden.
Answer (d) is incorrect because the audit committee would not be involved in the detailed audit approaches.
Question: V1C5-0013 According to the COSO report, audit plan changes as I. Risks change. II. Audit resources change. III. Board changes. IV. Policies change. Answers A: I only. B: I and II. C: III and IV. D: I, II, III, and IV.
Answer Explanations
Answer (a) is incorrect because audit resources do change frequently.
Answer (b) is the correct answer. The audit plan changes throughout the year as risks and audit resources change.
Answer (c) is incorrect because the changes occurring in the board’s composition and polices should not directly impact the audit plan.
Answer (d) is incorrect this choice mixes the correct and incorrect answers.
Question: V1C5-0014 According to the COSO report, the annual audit plan should be based on which of the following? I. Control model. II. Risk model. III. Resource model. IV. Management model. Answers A: I only. B: II only. C: I and II. D: III and IV.
Answer Explanations
Answer (a) is incorrect because risk should be considered.
Answer (b) is incorrect because control should be considered.
Answer (c) is the correct answer. The annual audit plan should be based on the control model. This should not replace a risk-based model.
Answer (d) is incorrect because resources and management model could be part of the control and risk model.
Question: V1C5-0015
According to the COSO report, the internal control framework consists of which of the following?
Answers
A: Processes, people, objectives.
B: Profits, products, processes.
C: Costs, revenues, margins.
D: Return on investment, earnings per share, market share.
Answer Explanations
Answer (a) is the correct answer. The core of any business is its people—their individual attributes, including integrity, ethical values, and competence and the environment in which they operate. They are the engine that drives the entity and the foundation on which everything else rests. The entity will have its objectives and the processes to achieve those objectives.
Answer (b) is incorrect because profits and products are not part of the internal control.
Answer (c) is incorrect because costs, revenues, and margins are not part of the internal control. Instead, they are part of financial control.
Answer (d) is incorrect because ROI, EPS, and market share are not part of the internal control. Instead, they are part of financial and marketing control.
Question: V1C5-0016 According to the COSO report, an entity’s internal control system is built into all of the following basic management processes except: Answers A: Planning. B: Execution. C: Monitoring. D: Risk.
Answer Explanations
Answer (a) is incorrect because planning is a part of the internal control system.
Answer (b) is incorrect because execution is a part of the internal control system.
Answer (c) is incorrect because monitoring is a part of the internal control system.
Answer (d) is the correct answer. According to the COSO report, there is a synergy and linkage among planning, execution, and monitoring, forming an integrated system that reacts dynamically to changing conditions. However, risk to an entity comes from internal and external sources, which must be identified, analyzed, measured, and managed. Risk varies with time, competition, and other factors.
Question: V1C5-0017 According to the COSO report, the correct sequence is Answers A: Risks, objectives, actions. B: Actions, objectives, risks. C: Objectives, risks, actions. D: Objectives, actions, risks.
Answer Explanations
Answer (a) is incorrect because objectives should be first since they drive everything else.
Answer (b) is incorrect because actions should come last.
Answer (c) is the correct answer. According to the COSO report, objectives provide the organization’s targets. To be in control, risks potentially affecting the achievement of an entity’s objectives must be identified and analyzed. Then actions must be put in place to mitigate the identified risks.
Answer (d) is incorrect because risks come before actions.
Question: V1C5-0018 According to the COSO report, the core of an organization is which of the following? Answers A: Products. B: Processes. C: People. D: Profits.
Answer Explanations
Answer (a) is incorrect because people make products.
Answer (b) is incorrect because people are involved in processes.
Answer (c) is the correct answer. According to the COSO report, the core of an organization is people. Profits result from products and processes, and it is the people who make things happen.
Answer (d) is incorrect because profits come from products.
Question: V1C5-0019 According to the COSO report, the effectiveness of an internal control system depends on which of the following? Answers A: Authorization of the process. B: Approval of the process. C: Condition of the process. D: Description of the process.
Answer Explanations
Answer (a) is incorrect because authorization of the process is a part of the internal control system.
Answer (b) is incorrect because approval of the process is a part of the internal control system.
Answer (c) is the correct answer. Deficiencies in an entity’s internal control system can surface from any of a number of sources. A “deficiency” may represent a perceived, potential, or real shortcoming, or an opportunity to strengthen the internal control system to provide a greater likelihood that the entity’s objectives will be achieved. The condition of the process is either deficient or not. Authorization, approval, and description of the process are steps in the internal control system, whereas the condition is the result of the process.
Answer (d) is incorrect because description of the process is a part of the internal control system.
Question: V1C5-0020 According to the COSO report, an entity’s objectives are based on all of the following except: Answers A: Preferences. B: Profits. C: Value judgments. D: Management style.
Answer Explanations
Answer (a) is incorrect because preferences should be considered in setting an entity’s objectives.
Answer (b) is the correct answer. Objective setting begins at the entity level, encompassing mission and value statements, preferences, and management style, which leads to overall strategy. Profits are the result of specific goals, where goals are derived from objectives.
Answer (c) is incorrect because value judgments should be considered in setting an entity’s objectives.
Answer (d) is incorrect because management style should be considered in setting an entity’s objectives.
Question: V1C5-0021 An effective relationship between risk level and internal control level is which of the following? Answers A: Low risk and strong controls. B: High risk and weak controls. C: Medium risk and weak controls. D: High risk and strong controls.
Answer Explanations
Answer (a) is incorrect because low risk requires weak controls.
Answer (b) is incorrect because high risk requires strong controls.
Answer (c) is incorrect because medium risk requires medium controls.
Answer (d) is the correct answer. According to the COSO report, there is a direct relationship between the risk level and the control level. That is, high-risk situations require stronger controls, low-risk situations require weaker controls, and medium-risk situations require medium controls.
Question: V1C5-0022 The concept of control should be viewed as Answers A: Accomplishing an objective. B: Limiting an operation. C: Blocking a process. D: Inhibiting a person.
Answer Explanations
Answer (a) is the correct answer. Controls should facilitate the achievement of an organization’s goals, and they should not limit operational practices, processes, and people’s actions. According to the COSO report, a control is defined as the policies, practices, and organizational structure designed to provide reasonable assurance that business objectives will be achieved and that undesired events could be prevented or detected and corrected.
Answer (b) is incorrect because controls should not limit an operation.
Answer (c) is incorrect because controls should not block a process.
Answer (d) is incorrect because controls should not inhibit a person.
Question: V1C5-0023
The purpose of control is to
Answers
A: Control employee behavior.
B: Determine who is in charge of a department.
C: Ensure that the goals of a firm are being achieved.
D: Determine whether an operation is a cost or profit center.
Answer Explanations
Answer (a) is incorrect because rewards and punishments control employee behavior.
Answer (b) is incorrect because management determines who is in charge of a department.
Answer (c) is the correct answer. The purpose of a control mechanism is to ensure that goals of a firm are being achieved.
Answer (d) is incorrect because responsibility accounting determines cost or profit center.
Question: V1C5-0024 Which of the following levers of control create positive and inspirational forces in an organization? I. Belief systems. II. Interactive control systems. III. Boundary systems. IV. Diagnostic control systems. Answers A: I and II. B: II and III. C: III and IV. D: II and IV.
Answer Explanations
Answer (a) is the correct answer. Belief systems and interactive control systems create positive and inspirational forces. Boundary systems and diagnostic control systems create negative forces such as rules and constraints.
Answer (b) is incorrect because boundary systems are part of negative forces.
Answer (c) is incorrect because boundary system and diagnostic control systems are part of negative forces.
Answer (d) is incorrect because diagnostic control systems are part of negative forces.