Internal Control

Question 1

What is internal control?

Answer 1

Provides reasonable assurance that

1. ) Material misstatements will be prevented
2. ) reliability and integrity of F/S will be preserved
3. ) Assets are protected against misuse.

Question 2

Examination of I/C is required by mgmt under?

Answer 2

Sarbanes-Oxley

Question 3

Under Sarbanes-Oxley what must management do?

Answer 3

1. ) CEO/CFO must disclose deficiencies
2. ) Mgmt must assess I/C
3. ) Mgmt must certify F/S

Question 4

What type of relationship does I/C have with Substantive Testing?

Answer 4

An inverse relationship

Question 5

Stronger I/C =

Answer 5

Less testing needed

Question 6

Weaker I/C =

Answer 6

More testing needed

Question 7

What are the 3 objectives of I/C?

Answer 7

1. ) Reliability of Financial Reporting
2. ) Operational efficiency/effectiveness
3. ) Compliance with Law and Regulations

Question 8

What are the 5 components of I/C?

Answer 8

1. ) Control environment
2. ) Risk assessment
3. ) Control activities
4. ) Information and communication
5. ) Monitoring

Question 9

What does the control environment assessment do?

Answer 9

Sets tone for the entire company

Question 10

What are the 8 questions that the control environment assessment should address?

Answer 10

1. ) How are mgmt’s integrity/ethics
2. ) Is mgmt competent
3. ) Healthy organizational structure
4. ) Appropriate HR policies
5. ) Authority/responsibility assignments
6. ) What is mgmt’s style
7. ) Is mgmt agressive
8. ) Are the Board/Audit Committee actively involved

Question 11

What is the risk of material misstatement? (RMM)

Answer 11

determines acceptable level of detection risk

Question 12

What is detection risk? (DR)

Answer 12

Detection risk determines the nature, timing, and extent of audit procedures

Question 13

What type of growth is considered risky?

Answer 13

Rapid

Question 14

What are 3 risk assessment questions to ask about mgmt?

Answer 14

How does mgmt:

1. ) Identify risks
2. ) Estimate significance
3. ) Assess occurrence likelihood

Question 15

When performing a risk assessment what are the major changes that need to be addressed?

Answer 15

1. ) operations
2. ) personnel
3. ) systems
4. ) IT
5. ) products
6. ) corporate organization
7. ) foreign ops

Question 16

What type of I/C testing is performed when control risk is assessed at maximum?

Answer 16

None

Question 17

What types of procedures are performed when control risk is assessed below maximum?

Answer 17

1. ) tests I/C
2. ) evaluates control risk based on tests
3. ) adjusts substantive tests accordingly

Question 18

What are 4 types of control activities?

Answer 18

1. ) performance reviews
2. ) information processing
3. ) physical controls
4. ) segregation of duties

Question 19

When it comes to information and communication what are 6 things an auditor needs to understand?

Answer 19

1. ) major transaction classes
2. ) transaction initiation
3. ) support records/documents
4. ) transaction processing
5. ) financial statement internal reporting process
6. ) financial statement external reporting process

Question 20

How can an auditor document I/C?

Answer 20

1. ) memo
2. ) flowchart
3. ) questionnaires

Question 21

Understanding I/C allows the auditor to determine what?

Answer 21

The nature, timing and extent of planned audit procedures.

Question 22

What are 6 risks associated with material misstatements?

Answer 22

1. ) were all transactions recorded
2. ) were they recorded timely
3. ) were they measured appropriately
4. ) were they recorded in the correct period
5. ) were they presented and disclosed properly
6. ) did mgmt communicate their responsibilities

Question 23

I/C should be IRON strong. What does IRON stand for?

Answer 23

I - inquiry: interview co personnel
R - re-performance: can it be replicated
O - observation: watch the control being applied
N - inspection: dig into the details/documents

Question 24

Substantive procedures should not need to be adjusted if the results of I/C testing are?

Answer 24

as expected

Question 25

If internal controls are deficient:

Answer 25

1. ) Control risk increases 2. ) Substantive tests increase 3. ) Detection risk decreases 4. ) a more than remote chance that a material misstatement in F/S would not be found

Question 26

What does tracing test?

Answer 26

Tests completeness. | Starts with the source document and traces forward to journal entry

Question 27

What does vouching test?

Answer 27

Tests existence. | Starts with journal entry and searches for a voucher or source document to support the entry

Question 28

What does T before V and C before E mean?

Answer 28

``` Tracing = Completeness Vouching = Existence ```

Question 29

What are 3 limitations of I/C?

Answer 29

1. ) controls can't stop collusion or bad judgement 2. ) Mgmt can override controls 3. ) cost vs benefit

Question 30

How are material weaknesses reported?

Answer 30

1. ) reasonable possibility that controls will not prevent a material misstatement 2. ) written report required; can issue a report with no material weaknesses 3. ) previous weaknesses that still exist should be reported again 4. ) should be reported no later than 60 days after audit report release date 5. ) If one or more material weaknesses is uncorrected at year-end and adverse opinion on I/C must be given

Question 31

How are significant deficiencies reported?

Answer 31

1. ) adversely affects company's ability to report F/S in accordance with GAAP 2. ) important enough to merit attention by those responsible for oversight of the company's financial reporting 3. ) written report to mgmt required: cannot issue a report with no significant deficiencies 4. ) previous deficiencies reported that still exist should be reported again 5. ) should be reported not later than 60 days after audit repot release date

Question 32

What is a control deficiency?

Answer 32

1. ) a control is not operating as intended | 2. ) written report to mgmt is not required

Question 33

When using the work of a third party (internal auditor) you should determine if they are:

Answer 33

1. ) competent | 2. ) objective

Question 34

An internal auditor reporting to the audit committee is:

Answer 34

More objective and reliable

Question 35

An internal auditor reporting to a manager is:

Answer 35

Less objective and reliable