ACCT550 - Becker 3

Which of the following factors would most likely be considered an inherent limitation to an entity’s internal control ?

Human Judgement in the decision making process.

Which of the following statements correctly describes the “top-down approach” used during the audit of internal control over financial reporting ?

Begin by understanding the overall risks to internal control over financial reporting at the financial statement level.

When obtaining an understanding of an entity’s controls, an auditor should concentrate on the substance of the controls rather than their form because:

Management may establish appropriate procedures but not enforce compliance with them.

A client that recently installed a new accounts payable system assigned employees a user ID code (UIC) and a separate password. Each UIC is a person’s name, and their individual password is the same as the UIC. Users are not required to change their passwords at initial log-in nor do passwords ever expire. Which of the following statements does not reflect a limitation of the client’s computer-access control ?

Employees are not required to take regular vacations.

Which of the following is not a component of internal control ?

Inherent Risk

Which of the following constitutes a potential risk associated with the use of information technology in an entity’s system of internal control ?

Unauthorized changes to systems.

An auditor is required to document the auditor’s understanding of the:

I. Entity’s control activities that help ensure management directives are carried out.

II. Entity’s control environment factors that help the auditor plan the engagement.

Both I and II.

The COSO cube is used to illustrate the relationship between:

Categories of objectives, internal control components and entity' organizational levels.

In which of the following circumstances would an auditor expect to fin that an entity implemented automated controls to reduce risks of misstatement ?

When transactions are high-volume and recurring.

If a budgetary reporting system provides adequate reports, but the reports are not analyzed and acted upon:

The control has been implemented but is not operating effectively.

When engaged to audit a nonissuer’s internal control, an auditor should:

Obtain management’s written assessment regarding whether the company has maintained effective internal control.

An advantage of using system’s flowcharts to document information about internal control instead of using internal control questionnaires is that systems flowcharts

Provide a visual depiction of client’s activities.

Objectives of an entity include:

Reliable financial reporting and effective and efficient operations.

Which of the following statements best categorize the function of a physical access control?

Separates unauthorized individuals from computer resources.

Which of the following is not a possible reason why a properly designed system of internal control may fail to prevent or detect fraud?

Inadequate segregation of duties may allow one person to both perpetrate and conceal fraudulent activity.

Which of the following statements is most accurate regarding the existing control activities component of the integrated framework?

Segregation of duties is a critical preventive control activity.

The Committee on Sponsoring Organizations prepared the Internal Control Integrated Framework:

To help businesses assess internal control.

In an integrated audit of a nonissuer, which of the following is not required of management:

Providing a written assessment about the effectiveness of the entity’s control that is dated as part of the date of issuance of the assessment.

The overall attitude and awareness of those charged with governance (i.e., an entity’s board of directors) concerning the importance of internal control usually is reflected in its:

Control environment

In an audit of an issuer, the auditor must provide an opinion on which of the following?

I. The financial statements

II. The audit committee’s oversight of financial reporting and internal control.

III. the effectiveness of internal control.

I and III only.

As part of the information and communication component of the integrated framework, a company must:

Ensure that external auditors are aware of significant internal control issues.

The monitoring component of internal controls excludes:

Eliminating controls that are not operating effectively.

The audit team of issuer Kape Krafts Inc. Evaluated both qualitative and quantitative risk factors as part of the audit planning. The audit team should evaluate risk factors for:

Both an audit of financial statements and an audit of internal control.

Controls related to the control environment and the period-end financial reporting process are examples of:

Entity-level controls

Which of the following is necessary in a financial statement audit?

An understanding of internal control relevant to an entity’s financial reporting objective.

Which of the following is an important part of minimizing security threats working in conjunction with vulnerability management solutions?

Patch management

An organization requires both password and a numerical key generated on a smartphone for its users to log in to all of its applications. This is referred to as:

Multifactor authentication

South Co. Outsources their HR department to a 3rd-part service organization, Son Inc. Son Inc. processes highly sensitive employee information and Souths Co. is interested in obtaining a System and Organization Controls (SOC) report to ensure adequate controls around security, confidentiality and privacy during the processing of Souths Co. employee information, including controls around the transfer of information between two entities. Which type of SOC report would be most appropriate in this instance.

SOC 2

How should monitoring activities be conducted according to COSO’s framework ?

On an ongoing basis due to evolving threats.

Which of the following best describes the primary difference between least privilege and need-to-know principles when considering authorization and authentication in security operations ?

Least privilege focuses on system resources, while need-to-know focuses on data access.

The trust services categories include:

Availability, confidentiality, privacy, processing integrity and security.