Audit Exam #3

Which of the following is not considered a general control?

• Requiring change authorization forms on all program software.

• Back up and disaster recovery controls.

• Password protection on the central server.

• Reconciliation of payroll record count with the number of active employees.

Reconciliation of payroll record count with the number of active employees.

Which of the following statements regarding auditor documentation of the entity's internal control is correct?

• Documentation must include narrative memorandums.

• No documentation is necessary to satisfy GAAS, however, oral inquiry is required at minimum.

• No one particular form of documentation is necessary, and the extent of documentation may vary.

• Internal control questionnaires are generally used for entities with a relatively simple internal control structure.

No one particular form of documentation is necessary, and the extent of documentation may vary.

For nonpublic companies with preliminary control risk assessments set at high or maximum, auditors are likely to:

• Test controls extensively.

• Complete little or no tests of controls.

• Complete interim testing of account balances.

• Use a reliance strategy.

Complete little or no tests of controls

Which of the following represents the correct sequence of audit steps that come after first obtaining an understanding and documenting the entity's internal control?

• Assess Control Risk, Test of Controls, Determine Extent of Substantive Testing, Reassess Control Risk.

• Test of Controls, Assess Control Risk, Determine Extent of Substantive Tests, Reassess Control Risk.

• Assess Control Risk, Test of Controls, Reassess Control Risk, Determine Extent of Substantive Testing.

• Assess Control Risk, Determine Extent of Substantive Testing, Test of Controls, Reassess Control Risk.

Assess Control Risk, Test of Controls, Reassess Control Risk, Determine Extent of Substantive Testing.

Auditors obtain an understanding of a nonpublic entity’s system of internal control for the primary purpose of:

• Providing documentary evidence to present to the audit committee.

• Gathering sufficient evidence to provide a reasonable basis for an opinion on the financial statements.

• Determining whether interim audit testing is appropriate.

• Determining the nature, extent, and timing of subsequent audit procedures to be performed.

Determining the nature, extent, and timing of subsequent audit procedures to be performed.

Which of the following is not one of the five major components of internal control?

• Risk assessment.

• Human resource background checks.

• Information and communication system.

• Control activities.

Human resource background checks.

An auditor may need to obtain a service auditor’s report when an entity receives accounting services such as payroll from a service organization. Which of the following statements is true regarding this service audit report?

• It provides the client auditor with a guarantee regarding whether the entity’s control procedures have been placed in operation.

• The client auditor should perform the procedures at the service organization to verify the information in the report.

• The client auditor cannot rely on a SOC 1 report.

• It should include an opinion on the service organization’s system of internal control.

It should include an opinion on the service organization’s system of internal control.

A reliance strategy is chosen when the auditor:

• Plans on conducting tests of controls.

• Has set the control risk at a high level.

• Has set the control risk at a lower level.

• Both a and c.

Both a and c.

The auditor must report the following to both the audit committee and others charged with governance:

• Only significant deficiencies.

• Significant deficiencies and material weaknesses.

• Only material weaknesses.

• All control deficiencies identified during the audit.

Significant deficiencies and material weaknesses.

In order to be able to set control risk at a lower level, the auditor must do all of the following except:

• Perform tests of controls.

• Conclude on the achieved level of control risk.

• Identify all general IT controls.

• Identify specific controls that will be relied upon.

Identify all general IT controls.

Understanding each of the components of internal control provides knowledge about:

• The design of tests of controls.

• The assessment of inherent risks.

• Factors that affect the risk of material misstatement.

• Both a and c.

Both a and c.

Internal controls are designed to achieve company objectives in all of the following areas except:

• Reliability of financial reporting.

• Compliance with laws and regulations.

• Reduction of debt financing costs.

• Safeguarding of assets.

Reduction of debt financing costs.

Which of the following is a proper reason for not conducting tests of controls for nonpublic companies?

• The auditor prefers the control risk to be assessed at the minimum.

• The internal control structure appears very strong.

• The procedures require more audit effort than the projected benefits to be obtained from lowering the control risk.

• The company does not have any flowcharts of its system available for review.

The procedures require more audit effort than the projected benefits to be obtained from lowering the control risk.

The auditor may document the achieved level of control risk using all of the following except:

• Internal control questionnaire.

• Flowcharts.

• A memorandum.

• Structured working papers.

Flowcharts.

The effectiveness of internal control is reduced by:

• Computerized accounting records.

• Flowcharts.

• Human errors or mistakes.

• Both a and c.

Human errors or mistakes.

An auditor’s primary consideration regarding an entity’s internal controls is whether they:

• prevent management override.

• reflect management’s philosophy and operating style.

• affect the financial statement assertions.

• relate to the control environment.

affect the financial statement assertions.

Which of the following statements about internal control is correct?

• The cost-benefit relationship is a primary criterion that should be considered in designing an internal control system.

• An exceptionally strong internal control system is enough for the auditor to eliminate substantive procedures on a significant account balance.

• The establishment and maintenance of internal control is an important responsibility of the internal auditor.

• A properly maintained internal control system reasonably ensures that collusion among employees cannot occur.

The cost-benefit relationship is a primary criterion that should be considered in designing an internal control system.

Internal control is a process designed to provide reasonable assurance regarding the achievement of which objective?

• all of these are correct.

• reliability of financial reporting

• effectiveness and efficiency of operations

• compliance with applicable laws and regulations

all of these are correct.

Monitoring is a major component of the COSO Internal Control—Integrated Framework. Which of the following is not correct in how the company can implement the monitoring component?

• Monitoring and other audit work conducted by internal audit staff can reduce external audit costs.

• Monitoring can be an ongoing process.

• The independent auditor can serve as part of the entity’s control environment and continuous monitoring.

• Monitoring can be conducted as a separate evaluation.

The independent auditor can serve as part of the entity’s control environment and continuous monitoring.

After obtaining an understanding of an entity’s internal control system, an auditor may set control risk at high for some assertions (i.e., plan to follow a substantive strategy) because the auditor:

• performs tests of controls to restrict detection risk to an acceptable level.

• determines that the pertinent internal control components are well documented.

• identifies internal controls that are likely to prevent material misstatements.

• believes the internal controls are unlikely to be effective.

believes the internal controls are unlikely to be effective.

Regardless of the assessed level of control risk, an auditor would perform some:

• tests of controls to determine the effectiveness of internal controls.

• dual-purpose tests to evaluate both the risk of monetary misstatement and preliminary control risk.

• substantive procedures to restrict detection risk for significant transaction classes.

• analytical procedures to verify the design of internal controls.

substantive procedures to restrict detection risk for significant transaction classes.

Assessing control risk below high (i.e., planning to follow a reliance strategy) involves all of the following except:

• analyzing the achieved level of control risk after performing tests of controls.

• identifying specific controls to rely on.

• concluding that controls are ineffective.

• performing tests of controls.

concluding that controls are ineffective.

Which of the following audit techniques would most likely provide an auditor with the least assurance about the effectiveness of the operation of a control?

• inquiry of entity personnel

• reperformance of the control by the auditor

• walkthrough

• observation of entity personnel

inquiry of entity personnel

The highest-quality and most reliable audit evidence that segregation of duties is properly implemented is obtained by:

• inspection of documents prepared by a third party but which contain the initials of those applying entity controls.

• inspection of a flowchart of duties performed and available personnel.

• inquiries of employees who apply control activities.

• observation by the auditor of the employees performing control activities.

observation by the auditor of the employees performing control activities.

SOC 1, Type 2 reports issued by the service organization’s auditor typically:

• ensure that the entity is billed correctly.

• provide reasonable assurance that their financial statements are free of material misstatements.

• assess whether the service organization’s controls are suitably designed and operating effectively.

• ensure that the entity will not have any misstatements in areas related to the service organization’s activities.

assess whether the service organization’s controls are suitably designed and operating effectively.

Significant deficiencies are matters that come to an auditor’s attention that should be communicated to an entity’s audit committee because they represent:

• significant deficiencies in the design or operation of the internal control.

• manipulation or falsification of accounting records or documents from which financial statements are prepared.

• disclosures of information that significantly contradict the auditor’s going concern assumption.

• material fraud or illegal acts perpetrated by high-level management.

significant deficiencies in the design or operation of the internal control.

An auditor anticipates assessing control risk at a low level in an IT environment. Under these circumstances, on which of the following controls would the auditor initially focus?

• general controls

• output controls

• application controls

• data capture controls

general controls

An auditor’s flowchart of an entity’s accounting system is a diagrammatic representation that depicts the auditor’s:

• understanding of the types of fraud that are probable, given the present system.

• documentation of the study and evaluation of the system.

• understanding of the system.

• program for tests of controls.

understanding of the system.

With regard to entities that have locations or business units that are judged to have financial reporting risks, the auditor

• Must first determine whether the internal audit staff has performed testing at such locations.

• Must first evaluate the risk of financial reporting fraud.

• Need not perform any audit procedures.

• Must first determine whether those risks are adequately addressed by entity-level controls.

Must first determine whether those risks are adequately addressed by entity-level controls.

Which of the following statements concerning control deficiencies is true?

• Auditors are required to report all control deficiencies to the audit committee.

• A control deficiency is a type of significant deficiency.

• Significant deficiencies are a subset of material weaknesses that must be reported to the public.

• The two dimensions on which control deficiencies are evaluated are likelihood of occurrence and magnitude.

The two dimensions on which control deficiencies are evaluated are likelihood of occurrence and magnitude.

Which of the following is not a requirement for management under Section 404 of the Sarbanes-Oxley Act of 2002?

• Present a written assessment regarding the effectiveness of the entity’s ICFR as of the end of the most recent fiscal year.

• Accept responsibility for the effectiveness of the entity’s ICFR.

• Support the evaluation of the entity’s ICFR with sufficient evidence, including documentation.

• Guarantee the effectiveness of the entity’s ICFR.

Guarantee the effectiveness of the entity’s ICFR.

Which of the following types of audit reports would not be appropriate for an auditor to issue on the effectiveness of an entity's internal controls?

• Disclaimer [unable to perform key audit procedures].

• Adverse [a material weakness exists].

• Qualified [a significant deficiency exists].

• Unqualified [no material weaknesses identified].

Qualified [a significant deficiency exists].

All of the following factors should be considered by the auditor when deciding on the extent of controls testing except:

• The importance of the control.

• The nature of the control to be tested.

• The frequency with which the control is applied.

• The time the auditor has to test controls before a report must be issued.

The time the auditor has to test controls before a report must be issued.

Which of the following steps or procedures is least likely to be performed as part of management's assessment of the effectiveness of internal controls?

• Evaluating the design effectiveness and operating effectiveness of selected controls.

• Engaging the external auditors to conduct cutoff tests.

• Communication of management’s assessment to the external auditors.

• Determining the locations or business units to be evaluated.

Engaging the external auditors to conduct cutoff tests.

"Remediation" refers to

• Management’s testing of a new control designed to eliminate a previous material weakness.

• Corrective actions taken by management to eliminate a material weakness.

• Management’s required annual communication to the Audit Committee regarding changes in the ICFR.

• The auditor’s required annual communication to the Audit Committee regarding weaknesses found in the ICFR.

Corrective actions taken by management to eliminate a material weakness.

Place the following steps in the top-down, risk-based approach to the audit of ICFR in their proper order:

1. Identify significant accounts and disclosures and their relevant assertions.

2. Select controls to test.

3. Understand likely sources of misstatement.

4. Identify entity level controls.

• 3, 4, 1, 2.

• 1, 2, 3, 4.

• 4, 2, 1, 3.

• 4, 1, 3, 2.

  
  

4, 1, 3, 2.

Which of the following statements is false concerning the requirements of the Sarbanes-Oxley Act of 2002 and the PCAOB’s auditing standard  related to internal controls?

• Management's report should state its responsibility for establishing and maintaining effective internal control.

• The auditor should evaluate whether the internal controls are effective in accurately and fairly reflecting the entity's transactions.

• Management should identify material weaknesses in its report.

• The auditor should provide recommendations to the audit committee for improving internal control as part of the auditor’s assessment.

The auditor should provide recommendations to the audit committee for improving internal control as part of the auditor’s assessment.

The role of the registered independent auditing firm relative to its clients’ internal controls under the Sarbanes-Oxley Act of 2002 is to

• Report to both the PCAOB and SEC those entities with unsatisfactory internal control over financial reporting.

• Express an opinion on the effectiveness of the entity's internal control over financial reporting.

• Express an opinion on whether the entity is subject to all provisions of the Securities Exchange Act of 1934.

• Provide report feedback but disclaim an opinion on management's assessment.

Express an opinion on the effectiveness of the entity's internal control over financial reporting.

Which of the following statements best describes how the requirements under Sarbanes-Oxley changed the auditor's responsibility for issuing an opinion in connection with the audits of most public companies?

• CPA firms are now required to add a second opinion related to the timeliness of the financial information provided to the public in addition to an opinion on the overall fairness of the financial statements.

• CPA firms are required to rely less on their own direct evidence to support their opinion regarding the effectiveness of controls.

• While the CPA firm is required to issue an additional opinion, that opinion is for internal use only and does not need to be made available in the entity’s annual report.

• CPA firms are now required to issue a second opinion related to their evaluation of the effectiveness of internal controls in addition to an opinion on the overall fairness of the financial statements.

CPA firms are now required to issue a second opinion related to their evaluation of the effectiveness of internal controls in addition to an opinion on the overall fairness of the financial statements.

All of the following controls may mitigate the risk of fraud and management override except:

• Controls related to significant management estimates.

• Controls over period-end adjusting entries.

• Controls related to executive compensation.

• Controls over related-party transactions.

Controls related to executive compensation.

The requirements of Section 404 of the Sarbanes-Oxley Act of 2002 apply to

• All companies that are subject to an independent audit.

• Most publicly-held companies.

• All companies with sales in excess of $500 million.

• All privately-held companies.

Most publicly-held companies.

The Sarbanes-Oxley Act of 2002 requires management to include a report on the effectiveness of ICFR in the entity’s annual report. It also requires auditors to report on the effectiveness of ICFR for large public companies. Which of the following statements concerning these requirements is false?

Multiple Choice

• Management should identify material weaknesses in its report.

• The auditor should evaluate whether internal controls over financial reporting are designed and operating effectively.

• The auditor should provide recommendations for improving internal control in the audit report.

• Management’s report should state its responsibility for establishing and maintaining an adequate internal control system.

The auditor should provide recommendations for improving internal control in the audit report.

A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a:

• deficiency in design.

• significant deficiency.

• deficiency in operation.

• material weakness.

deficiency in operation.

Which of the following is not a factor that might affect the likelihood that a control deficiency could result in a misstatement in an account balance?

• the nature of the financial statement accounts, disclosures, and assertions involved

• the interaction or relationship of the control with other controls

• the financial statement amounts exposed to the deficiency

• the susceptibility of the related assets or liability to loss or fraud

the financial statement amounts exposed to the deficiency

Entity-level controls can have a pervasive effect on the entity’s ability to meet the control criteria. Which one of the following is not an entity-level control?

• controls to monitor results of operations

• the period-end financial reporting process

• controls to require authorization of inventory purchases.

• management’s risk assessment process

controls to require authorization of inventory purchases.

Which of the following controls would most likely be tested during an interim period?

• controls over transactions that involve a high degree of subjectivity

• controls over the period-end financial reporting process

• controls over nonroutine transactions

• controls that operate on a continuous basis

controls that operate on a continuous basis

If the financial reporting risks for a location are low and the entity has good entity-level controls, management may rely on which of the following for its assessment?

• document and test controls over specific risks

• document and test entity-level controls over the entire entity

• self-assessment processes in conjunction with entity-level controls

• selective control test at that location

self-assessment processes in conjunction with entity-level controls

A walkthrough is one procedure used by an auditor as part of the internal control audit. A walkthrough requires an auditor to:

Multiple Choice

• trace a transaction from every class of transactions from origination through the entity's information system.

• trace a transaction from each major class of transactions from origination through the entity’s information system until it is reflected in the entity’s financial reports.

• tour the organization’s facilities and locations before beginning any audit work.

• trace a transaction from each major class of transactions from origination through the entity’s information system.

trace a transaction from each major class of transactions from origination through the entity’s information system until it is reflected in the entity’s financial reports.

When auditors report on the effectiveness of internal control “as of” a specific date and obtain evidence about the operating effectiveness of controls at an interim date, which of the following items would be the least helpful in evaluating the additional evidence to gather for the remaining period?

• any significant changes that occurred in internal control subsequent to the interim date

• the walkthrough of the control system conducted at interim

• the specific controls tested prior to the “as of” date and the results of those tests

• the length of the remaining period

the walkthrough of the control system conducted at interim

AnnaLisa, an auditor for N. M. Neal & Associates, is prevented by the management of Lileah Company from auditing controls over inventory. Lileah is a public company. Management explains that controls over inventory were recently implemented by a highly regarded public accounting firm that the entity hired as a consultant and insists that it is a waste of time for AnnaLisa to evaluate these controls. Inventory is a material account, but procedures performed as part of the financial statement audit indicate the account is fairly stated. AnnaLisa found no material weaknesses in any other area of the entity’s internal control relating to financial reporting. What kind of report should AnnaLisa issue on the effectiveness of Lileah’s internal control?

• a disclaimer of opinion

• an unqualified report

• an adverse report

• an exculpatory opinion

a disclaimer of opinion

In auditing a public company, Natalie, an auditor for N. M. Neal & Associates, identifies four deficiencies in ICFR. Three of the deficiencies are unlikely to result in financial misstatements that are material. One of the deficiencies is reasonably likely to result in misstatements that are not material but significant. What type of audit report should Natalie issue?

• an unqualified report

• an adverse report

• a disclaimer of opinion

• an exculpatory opinion

an unqualified report

In auditing ICFR for a public company, Emily finds that the entity has a significant subsidiary located in a foreign country. Emily’s accounting firm has no offices in that country, and the entity has thus engaged another reputable firm to conduct the audit of internal control for that subsidiary. The other auditor’s report indicates that there are no material weaknesses in the foreign subsidiary’s ICFR. What should Emily do?

• Accept the other auditor’s opinion and express an unqualified opinion, making no reference to the other auditor’s report in her audit opinion.

• Qualify the opinion because she is unable to conduct the testing herself, and this constitutes a significant scope limitation.

• Disclaim an opinion because she cannot rely on the opinion of another auditor in dealing with a significant subsidiary.

• Accept the other auditor’s opinion after evaluating the auditor’s work and make reference to the other auditor’s report in her audit opinion.

Accept the other auditor’s opinion after evaluating the auditor’s work and make reference to the other auditor’s report in her audit opinion.

Which of the following statements concerning control deficiencies is true?

• All significant deficiencies are material weaknesses.

• The auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit.

• All control deficiencies are significant deficiencies.

• An auditor must immediately report material weaknesses and significant deficiencies discovered during an audit to the PCAOB.

The auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit.

Significant deficiencies and material weaknesses must be communicated to an entity’s audit committee because they represent:

• potential manipulation or falsification of accounting records.

• significant deficiencies in the design or operation of internal control.

• material fraud or illegal acts perpetrated by high-level management.

• disclosures of information that significantly contradict the auditor’s going concern assumption.

significant deficiencies in the design or operation of internal control.

Which of the following most likely represents a weakness in internal control of an IT system?

• The systems analyst reviews output and controls the distribution of output from the IT department.

• The control clerk establishes control over data received by the IT department and reconciles control totals after processing.

• The accounts payable clerk prepares data for computer processing and enters the data into the computer.

• The systems programmer designs the operating and control functions of programs and participates in testing operating systems.

The systems analyst reviews output and controls the distribution of output from the IT department.

A primary advantage of using generalized audit software packages to audit the financial statements of an entity that uses an IT system is that the auditor may:

• consider increasing the use of substantive tests of transactions in place of analytical procedures.

• access information stored on computer files while having a limited understanding of the entity’s hardware and software features.

• substantiate the accuracy of data through self-checking digits and hash totals.

• reduce the level of required tests of controls to a relatively small amount.

access information stored on computer files while having a limited understanding of the entity’s hardware and software features.