In reporting on an entity's internal control structure over financial reporting, a practitioner should include a paragraph that describes the
A) Inherent limitations of any internal control structure.
An auditor uses the knowledge provided by the understanding of internal control and the assessed level of control risk primarily to
B) Determine the nature, timing, and extent of substantive tests for financial statement assertions.
The auditor should use the risk assessment to determine
A) The nature, timing, and extent of further audit procedures to be performed.
After obtaining an understanding of an entity's internal control and assessing control risk, an auditor may next:
B) Consider whether evidential matter is available to support a further reduction in the assessed level of control risk.
Which of the following is not a component of an entity's internal control?
C) Control risk.
Which of the following is responsible for establishing internal controls for a public company?
C) Management.
The auditor's study of a public company's internal control is:
A) Recommended by the AICPA.
B) Required by GAAS.
C) Required by the AICPA.
D) Required by the Sarbanes-Oxley Act.
D) Required by the Sarbanes-Oxley Act.
The auditor's study of a private company's internal control is:
D) Required by GAAS.
Which of management's concerns with respect to implementing internal controls is the auditor primarily concerned?
C) Reliability of financial reporting.
When an auditor attempts to understand the operation of the accounting system by tracing a few transactions through the accounting system, the auditor is said to be:
D) Performing a walkthrough.
The primary emphasis by auditors by auditor when assessing internal control is on controls over:
B) Classes of transactions.
Which section of the Sarbanes-Oxley Act requires management to issue an internal control report?
A) 404
Narrative, flowcharts, and internal control questionnaires are three common methods of:
B) Documenting the auditor's understanding of internal controls.
The purpose of segregating the duties of hiring personnel and distributing payroll checks is to separate the:
D) Authorization of transactions from the custody of related assets.
The primary purpose of an auditor's consideration of internal control is to provide a basis for:
B) Determining the nature, extent, and timing of audit tests to be applied.
In obtaining an understanding of a manufacturing entity's internal control concerning inventory balances, an auditor most likely would:
C) Review the entity's descriptions of inventory policies and procedures.
The auditor who becomes aware of a reportable condition in internal control is required to communicate this to the:
D) Audit committee or its equivalent.
After obtaining an understanding of internal control and assessing control risk, an auditor decides to perform tests of controls. The auditor most likely decided that:
A) It would be efficient to perform tests of controls that would result in a reduction in planned substantive tests.
B) There were many internal control structure weaknesses that could allow errors in the accounting systems.
C) Additional evidence to support a further reduction in control risk is not available.
D) An increase in the assessed level of control risk is justified for certain financial statement assertions.
A) It would be efficient to perform tests of controls that would result in a reduction in planned substantive tests.
Equipment acquisitions that are misclassified as maintenance expense would most likely be detected by an internal control procedure that provides for
A) Investigation of variances within a formal budgeting system.
In planning an audit, the auditor's knowledge about the design of relevant internal control policies and procedures should be used to:
D) Identify the types of potential misstatements that could occur.
When considering internal control, an auditor must be aware of the concept of reasonable assurance, which recognizes that:
D) The cost of internal control should not exceed the benefits expected to be derived from internal control.
A flowchart is most frequently used by an auditor in connection with the
A) Documentation of the client's internal control procedures.
Which of the following is not a component of an entity's internal control?
B) Control risk.
In the early stages of an audit engagement, the independent CPA must obtain a general understanding of internal control. Which of the following is not studied as part of that step in the audit process?
A) Internal independence
The seven factors of the control environment are
B) I - Integrity and ethical values C - Commitment to competence H - Human resource policies and practices A - Assignment of authority and responsibility M - Management's philosophy and operating style B - Board of directors or audit committee participation O - Organization
Regarding internal control system failures. Even the best designed control systems are subject to failure due to:
A) Human error, faulty judgment, collusion and management override
An auditor must make an assessment of control risk as part of the process to determine how much substantive testing must be done to reduce overall audit risk to an acceptably low level. Which of the following is not one of the five components that make up internal control?
B) Checks and balances
Significant deficiencies are matters that come to an auditor's attention and should be communicated to an entity's audit committee because they represent:
A) Internal control deficiencies that could adversely affect a company's ability to initiate, record, process, or report external financial statements reliably.
How must significant deficiencies and material weaknesses be communicated to those charged with governance?
B) Written communication is required.
Significant deficiencies and material weaknesses in internal control of a public company must be reported to which of the following?
B) Audit Committee of the company's board of directors.
Which of the following is true regarding significant deficiencies and material weaknesses?
C) Auditors must communicate them to the audit committee.
Which of the following statements is correct concerning control deficiencies in an audit?
B) An auditor may communicate deficiencies during an audit or after the audit's completion.
Which of the following matters would an auditor most likely consider to be a significant deficiency to be communicated to management and those in charged with governance?
B) Evidence of a lack of objectivity by those responsible for accounting decisions.
In identifying matters to be communicated to those individuals charged with governance of an audit client, an auditor most likely would ask management about which of the following?
A) It consulted with another CPA about accounting matters.
The Sarbanes-Oxley Act requires:
C) All public companies to issue an internal control report.
Management must disclose material weaknesses in internal control:
A) If the weakness exists at the end of the year.
Internal control reports issued by public companies must identify the framework used to evaluate the effectiveness of internal control. Which of the following is the most common framework in the US?
A) Internal Control--Integrated Framework - COSO.
An independent auditor is performing an audit of a company's internal control in connection with its financial reporting under the standards of the Public Company Accounting Oversight Board (PCAOB). A control deficiency has been uncovered. What are the two possible types of control deficiencies?
D) Design and operations.
An example of an internal control weakness is to assign to a department supervisor the responsibility for:
C) Distributing payroll checks to subordinate employees.
Which of the following procedures most likely would be considered a weakness in an entity's internal controls over payroll?
D) The employee who distributes payroll checks returns unclaimed payroll checks to the payroll department.
A weakness in internal control over recording retirements of equipment may cause an auditor to:
C) Select certain items of equipment from the accounting records and locate them in the plant.
In an audit of financial statements in accordance with generally accepted auditing standards, an auditor is required to:
A) Document the auditor's understanding of the entity's internal control structure.
Reportable conditions are matters that come to an auditor's attention, which should be communicated to an entity's audit committee because they represent:
D) Significant deficiencies in the design or operation of the internal control structure
Which of the following statements is correct concerning reportable conditions in an audit?
D) An auditor may communicate reportable conditions during an audit or after the audit's completion.
Which of the following conditions is necessary for a practitioner to accept an attest engagement to examine and report on an entity's internal control structure over financial reporting?
C) Management presents its written assertion about the effectiveness of the internal control structure.
Which of the following is an inherent limitation in internal control?
A) Faulty human judgment.
The Venthura Corporation is a privately held company that is being auditing by the independent firm of Smith and Rapunzel CPAs. In assessing control risk, the auditors become aware of a significant deficiency in the company’s internal control. What should the auditors do as a result?
A) Issue a written report describing the problem to the board of directors and the management of the company.
When management is evaluating the design of internal control, management evaluates whether the control can do all but which of the following?
A) Correct material misstatements.
Which of the following may increase risk to an organization?
D) All of the above.
Risk assessment for financial reporting is management's process for identifying, analyzing, and responding to risks relevant to the preparation of financial statements in conformity with
B) Generally Accepted Accounting Principles
An auditor is currently assessing control risk and finds that it is lower than had been anticipated. How does this discovery impact the work of the auditor?
D) The acceptable level of detection risk can be raised.
A(n) ___________ deficiency exists if a necessary control is missing or not properly formulated.
A) Design.
Risk assessment involves considering threats to the organization's objectives in the areas of
C) Operations, financial reporting and compliance with laws and regulations.
To obtain an understanding of the entity and its environment, including its internal control, the auditor should perform each of the following risk assessment procedures except:
D) Attribute sampling.
An auditor uses the assessed level of control risk to
C) Determine the acceptable level of detection risk for financial statement assertions.
When an auditor increases the assessed level of control risk because certain control procedures were determined to be ineffective, the auditor would most likely increase the
D) Extent of tests of details.
In assessing control risk for purchases, an auditor compares a sample of entries in the voucher register to the supporting documents. Which assertion would this test of controls most likely support?
A) Existence or occurrence.
When there are numerous property and equipment transactions during the year, an auditor who plans to assess control risk at a low level usually performs.
A) Tests of controls and limited tests of current year property and equipment transactions.
The ultimate purpose of assessing control risk is to contribute to the auditor's evaluation of the risk that
A) Material misstatements may exist in the financial statements.
When control risk is assessed as being low for assertions related to payroll, substantive tests of payroll balances most likely would be limited to applying analytical procedures and
D) Recalculating payroll accruals.
An auditor most likely would assess control risk at the maximum if the payroll department supervisor is responsible for
D) Authorizing payroll rate changes for all employees.
Which of the following is a control procedure that most likely could help prevent employee payroll fraud?
D) The personnel department promptly sends employee termination notices to the payroll supervisor.
Which of the following internal control activities most likely would justify a reduced assessed level of control risk concerning plant and equipment acquisitions?
A) Periodic physical inspection of plant and equipment by the internal audit staff.
In assessing control risk, the auditor starts by learning the design of the control system and then considers whether to perform tests of individual controls. If the design of the control system is viewed as weak, which of the following is most likely to be true?
C) The auditor is likely to do additional substantive testing.
An independent CPA is assessing the level of control risk present at a company that is currently being audited. This company has an internal audit department and the independent CPA is evaluating the objectivity of that department. Which of the following is a sign that the department has proper objectivity?
C) The head of the department meets privately with the chair of the board of directors each quarter.
One of the components of internal control that an independent auditor must come to understand about each audit client is “information and communication.” What is meant by this term?
B) The ability of the accounting system to generate reliable information and convey it in a timely manner to those parties within the organization that need it.
A CPA firm is performing an audit engagement and it currently beginning to assess the amount of control risk. Which of the following is not viewed as one of the components of a company’s internal control?
D) Design and formulation
A CPA firm is beginning the audit of Panasian Corporation. One of the staff auditors has been assigned to gain and then document her understanding of the internal controls designed to be in place in the company’s payroll system. At the end of the day, the staff auditor has created a series of flowcharts, questionnaires, and narrative descriptions based on the understanding she has obtained. Which of the following is correct?
A) She only needed to use one of these techniques.
The firm of Martin & Lawrence, CPAs is undertaking the financial statement audit of GigantoCorp, which outsources its payroll processing to HR Specialist Company. Martin & Lawrence are considering the internal controls of HR Specialist Company in the assessment of control risk in the audit of GigantoCorp. Tommy, Lee, & Jones, CPAs is the auditor of HR Specialist Company and has recently issued a report detailing HR Specialist Company's procedures and policies for payroll processing services, which it has provided to Martin & Lawrence. Martin & Lawrence should:
D) Make appropriate inquiries to assess the professional reputation of Tommy, Lee, & Jones
Which of the following audit procedures would an auditor most likely perform to test controls relating to management's assertion concerning the completeness of sales transactions?
D) Inspect the entity's reports of prenumbered shipping documents that have not been recorded in the sales journal.
Cutoff tests designed to detect purchases made before the end of the year that have been recorded in the subsequent year most likely would provide assurance about management's assertion of
C) Completeness.
Internal control procedures are strengthened when the quantity of merchandise ordered is omitted from the copy of the purchase order sent to the
C) Receiving department.
While observing a client's annual physical inventory, an auditor recorded test counts for several items and noticed that certain test counts were higher than the recorded quantities in the client's perpetual records. This situation could be the result of the client's failure to record
A) Sales returns.
To best ascertain that a company has properly included merchandise that it owns in its ending inventory, the auditor should review and test the
C) Purchase cut-off procedures.
Which of the following computer-assisted auditing techniques allows fictitious and real transactions to be processed together without client operating personnel being aware of the testing process?
D) Integrated test facility.
An auditor most likely would introduce test data into a computerized payroll system to test internal controls related to the
D) Discovery of invalid employee I.D. numbers.
An auditor who is testing EDP controls in a payroll system would most likely use test data that contain conditions such as
D) Time tickets with invalid job numbers.
Processing data through the use of simulated files provides an auditor with information about the operating effectiveness of control policies and procedures. One of the techniques involved in this approach makes use of
C) An integrated test facility.
An effective system of control procedures over the payroll function would include:
B) Verification of agreement of job time tickets with employee clock card hours by a payroll department employee.
For an appropriate segregation of duties, journalizing and posting summary payroll transactions should be assigned to
B) General accounting.
In a well-designed internal control system, the same employee may be permitted to
D) Mail signed checks and also cancel supporting documents.
Epptons, CPA, is auditing the financial statements of a small rural municipality. The receivable balances represent residents' delinquent real estate taxes. The internal control structure at the municipality is weak. To determine the existence of the accounts receivable balances at the balance sheet date, Epptons would most likely
C) Send positive confirmation requests
Effective internal control over purchases generally can be achieved in a well-planned organizational structure with a separate purchasing department that has
D) The authority to make purchases of requisitioned materials and services.
Which of the following internal controls most likely would reduce the risk of diversion of customers receipts by an entity's employees?
A) A bank lockbox system.
Which of the following would most likely be an internal control procedure designed to detect errors and irregularities concerning the custody of inventory?
B) Independent comparisons of finished goods records with counts of goods on hand.
An internal control narrative indicates that an approved voucher is required to support every check request for payment of merchandise. Which of the following procedures provides the greatest assurance that this control is operating effectively?
D) Select and examine canceled checks and ascertain that the related vouchers are dated no later than the checks.
Tests of controls may include which of the following types of evidence?
A) Inquiry.
)B Observation.
C) Inspection.
D) All of the above.
D) All of the above.
An increased extent of the tests of controls is most likely to occur when
B) Controls are effective and the preliminary control risk assessment is low.
Which of the following best describes proper internal control over payroll?
A) The duties of hiring, payroll computation, and payment to employees should be segregated.
Transaction authorization within an organization may be either specific or general. An example of a specific transaction authorization is the
B) Approval of a detailed construction budget for a warehouse.
Which of the following internal control activities most likely would prevent direct labor hours from being charged to manufacturing overhead?
A) Use of time tickets to record actual labor worked on production orders.
Which of the following is ordinarily considered a test of controls?
C) Examine signatures on checks.
An auditor compares data for a sample of employees in a payroll register to approved clock card data to provide assurance that
B) Employees work the number of hours for which they are paid.
An auditor would consider internal control over a client's payroll procedures to be ineffective if the payroll department supervisor is responsible for
C) Having custody over unclaimed paychecks.
Which of the following procedures in the cash disbursements cycle should not be performed by the accounts payable department?
B) Canceling supporting documentation after payment.
Which of the following tests of controls most likely would help assure an auditor that goods shipped are properly billed?
D) Examine shipping documents for matching sales invoices.
Which of the following internal control procedures is not usually performed in the vouchers payable department?
D) Accounting for unused prenumbered purchase orders and receiving reports.
Internal control over cash receipts is weakened when an employee who receives customer mail receipts also
B) Records credits to individual accounts receivable.
Xavier, CPA is currently auditing the financial statements of the Polk Corporation. At the moment, Xavier is assessing the control risk surrounding the recognition of sales revenue. The CPA has become concerned that revenues are understated. The CPA thinks the company may be shipping merchandise to false customers with no sales invoice (or other record) being prepared. If true, company employees are using this scheme to steal goods from the company. In assessing the possibility of this problem, which of the following is the auditor most likely to do?
B) Take a sample of bills of lading (or other shipping document) and match those documents to the appropriate sales invoice.
A CPA is performing an audit examination of Malfoy, Inc. The CPA has already done the work necessary to gain a general understanding of the company’s internal control. The CPA is now looking at the internal control policies and procedures within the accounting system specifically for accounts receivable. The CPA has decided to perform test of controls in this area. Which of the following is least likely to be true?
D) The system contains an excess number of possible problems so that testing is required.
A customer buys some furniture from a company and must be billed for the $879 sales price. The company’s billings department prepares a sales invoice which is properly approved. Which of the following statements is not true?
A) The inventory management department gets a copy to update the perpetual records.
The Waynesboro Corporation has recently installed a new computer payroll processing program. Before the program is used to compute actual payroll checks for the employees, test data is going to be run through the computer to see how it would be processed. Which of the following is least likely to be tested in this manner?
B) A check requested for an employee paid an hourly rate of $12 per hour.
Jane Simpson works for Shadowline Corporation and is paid $30 per hour. She typically works 28 hours per week but always reports that she works 32 hours per week so that she can receive additional wages from the company. Which of the following internal control activities is most likely to prevent this type of theft?
A) The supervisor for Jane Simpson must review her time sheet each period and indicate approval.
