Exam 11: Ais and Internal Controls

Topic: COSO Internal Control FrameworkWhich of the following is the best way to compensate for the lack of adequate segregation of duties in a small organization? A. Disclosing lack of segregation of duties to external auditors during the annual review. B. Replacing personnel every three or four years. C. Requiring accountants to pass a yearly background check. D. Providing greater management oversight of incompatible activities.

COBIT (Control Objectives for Information and related Technology) is a generally accepted framework for IT governance in the U.S.

Corporate governance is a set of processes and policies in managing an organization with sound ethics to safeguard the interests of its stakeholders.

Which of the following is considered an application input control? A. Run control total. B. Edit check. C. Reporting distribution log. D. Exception report.

An auditor assesses control risk because it A. is relevant to the auditor's understanding of the control environment. B. provides assurance that the auditor's materiality levels are appropriate. C. indicates to the auditor where inherent risk may be the greatest. D. affects the level of detection risk that the auditor may accept.

The Sarbanes-Oxley Act (SOX) was passed as a response to which of the following events? A. The savings & loan scandals of the 1980s. B. The bust of dot-com bubble companies such as pets.com and Webvan. C. Corporate reporting scandals by companies such as WorldCom, Enron, and Tyco. D. Securities manipulation and insider trading in the 1930s.

Which of the following most likely would not be considered as an inherent limitation of the effectiveness of a firm's internal control? A. Incompatible duties. B. Management override. C. Mistakes in judgment. D. Collusion among employees.

The chief executive officer is ultimately responsible for enterprise risk management.

Obtaining an understanding of an internal control involves evaluating the design of the control and determining whether the control has been: A. Authorized. B. Implemented. C. Tested. D. Monitored.

According to AS 5, control risk should be assessed in terms of A. Specific controls. B. Types of potential fraud. C. Financial statement assertions. D. Control environment factors.

The risk of a company's internal auditing processes failing to catch the misstated dollar amount of revenue on the company's income statement is classified as inherent risk.

COBIT 5 takes the view that all IT processes should provide clear links between all of the following except: A. IT processes. B. IT controls. C. IT components. D. IT governance requirements.

The COSO ERM framework encourages a review of risks as they apply to achieving firms' objectives. Which of the following is not one of the listed categories of objectives to be considered? A. Environment. B. Operations. C. Strategic. D. Compliance.

In addition to focusing on controls, COBIT 5 expands its scope by incorporating which of the following broad perpsectives? A. How IT brings value to the firm. B. How IT can automate specific business processess. C. IT networking requirements. D. IT cost reductions.

In a computerized environment, internal controls can be categorized as general controls and application controls.

Which of the following statement is correct regarding internal control? A. A well-designed internal control environment ensures the achievement of an entity's control objectives. B. An inherent limitation to internal control is the fact that controls can be circumvented by management override. C. A well-designed and operated internal control environment should detect collusion perpetrated by two people. D. Internal control in a necessary business function and should be designed and operated to detect errors and fraud.

Segregation of duties reduces the risk of errors and irregularities in accounting records.

Which of the following is not a component of internal control as defined by COSO? A. Control environment. B. Control activities. C. Inherent risk D. Monitoring.

Ethical principals are derived from all of the following except: A. Personal attitudes on issues of right and wrong. B. Cost benefit analysis. C. Cultural values. D. Societal traditions.

Internal control is a process consisting of ongoing tasks and activities. It is a means to an end, not an end in itself.