Question 1 - Fraud Risk Awareness

Which of the following gives the internal auditor the authority to investigate fraud?

A. Management.
B. Common law.
C. The Institute of Internal Auditors Code of Ethics.
D. The Standards.

Question 2 - Types of Controls

Which of the following statements best describes the relationship between planning and controlling?

A. Planning and controlling are completely independent of each other.

B. Planning prevent problems; controlling is initiated by problems, which have occurred.
C. Controlling cannot operate effectively without the tools provided by planning.
D. Planning looks to the future; controlling is concerned with the past.

Question 3 - Fraud Risk Awareness

An internal auditor’s field work uncovers a series of transactions that indicate a possible embezzlement. Which of the
following actions should the chief audit executive (CAE) take?

A. Discuss the case with the board.

B. Review the finding with the suspect's fellow workers to see whether they can furnish additional evidence.
C. Confront the suspected embezzler to determine that the facts are correct.
D. Consult with security personnel.

Question 4 - Types of Controls

The use of financial statement analysis, quality control procedures, and employee performance evaluations are all
examples of

A. Feedforward controls.
B. Concurrent controls.
C. Preliminary controls.
D. Feedback controls.

Question 5 - Internal Control Framework Characteristics and Use

An auditor noted that the accounts receivable department is separate from other accounting activities. Credit is
approved by a separate credit department. Control accounts and subsidiary ledgers are balanced monthly. Similarly,
accounts are aged monthly. The accounts receivable manager writes off delinquent accounts after 1 year, or sooner if
a bankruptcy or other unusual circumstances are involved. Credit memoranda are prenumbered and must correlate
with receiving reports. Which of the following areas could be viewed as an internal control weakness of the above
organization?
A. Credit approvals.
B. Write-offs of delinquent accounts.
C. Monthly aging of receivables.
D. Handling of credit memos.

Question 6 - Internal Control Framework Characteristics and Use

The internal auditor recognizes that certain limitations are inherent in any internal control system. Which one of the
following scenarios is the result of an inherent limitation of internal control?

A. The comptroller both makes and records cash deposits.

B. An employee, who is unable to read, is assigned custody of the firm's computer tape library and run manuals that
are used during the third shift.
C. The firm sells to customers on account, without credit approval.
D. A security guard allows one of the warehouse employees to remove company assets from the premises without
authorization.

Question 7 - Internal Control Framework Characteristics and Use

An employee should not be able to visit the organization's safety deposit box containing investment securities without
being accompanied by another employee. What would be a possible consequence of an employee's being able to visit
the safety deposit box unaccompanied?

A. The employee could pledge organizational investments as security for a short-term personal bank loan.
B. The employee could steal securities and the theft would never be discovered.
C. There would be no record of when organizational personnel visited the safety deposit box.
D. It would be impossible to obtain a fidelity bond on the employee.

Question 8 - Internal Control Framework Characteristics and Use

Which of the following credit approval procedures would be the basis for developing a deficiency finding for a
wholesaler?

A. Trade-credit standards are reviewed and approved by the finance committee of the board of directors.
B. An authorized signature from the credit department, denoting approval of the customer's credit, is to appear on all
credit-sales orders.
C. Salespeople are responsible for evaluating and monitoring the financial condition of prospective and continuing
customers.
D. Customers not meeting trade-credit standards are shipped merchandise on a cash-on-delivery (C.O.D.) basis only.

Question 9 - Types of Controls

Which of the following is an operating control relating to management's directing function?

A. Prescribing formal procedures for selecting potential suppliers.

B. Informing purchasing personnel of the future need for long lead time products in ample time.
C. Establishing measurable goals for the department.
D. Supplying buyers with timely, accurate, and useful reports on products received, accepted, or rejected.

Question 10 - Types of Controls

Controls that are designed to provide management with assurance of the realization of specified minimum gross
margins on sales are

A. Preventive controls.
B. Directive controls.
C. Output controls.
D. Detective controls.

Question 11 - Internal Control Framework Characteristics and Use

Which of the following activities performed by a payroll clerk is a control weakness rather than a control strength?

A. Forwards the payroll register to the chief accountant for approval.

B. Prepares the payroll register.
C. Has custody of the check signature stamp machine.
D. Draws the paychecks on a separate payroll checking account.

Question 12 - Fraud Risk Awareness

A key feature that distinguishes fraud from other types of crime or impropriety is that fraud always involves the

A. False representation or concealment of a material fact.

B. Unlawful conversion of property that is lawfully in the custody of the perpetrator
C. Deceitful wrongdoing of management-level personnel.
D. Violent or forceful taking of property.

Question 13 - Fraud Risk Awareness

Prior to issuing a final communication on a fraud investigation, the internal auditor should submit a proposed draft for
review by the

A. Board.
B. Organization's public relations department.
C. Engagement client's management.
D. Organization's legal counsel.

Question 14 - Internal Control Framework Characteristics and Use

One payroll audit objective is to determine if there is proper segregation of duties. Which of the following activities are
incompatible?

A. Signing and distributing payroll checks.

B. Preparing the payroll and filing payroll tax forms.
C. Preparing attendance data and preparing the payroll.
D. Hiring employees and authorizing changes to pay rates.

Question 15 - Types of Controls

In evaluating the effectiveness and efficiency with which resources are employed, an internal auditor is responsible for

A. Verifying the existence of assets.

B. Reviewing the reliability of operating information.
C. Verifying the accuracy of asset valuation.
D. Determining the extent to which adequate operating criteria have been established.

Question 16 - Management Control Techniques

Budgets are a necessary component of financial decision making because they help provide a(n)

A. means to check managerial discretion.

B. automatic corrective mechanism for errors.
C. means to use all the firm's resources.
D. efficient allocation of resources.

Question 17 - Types of Controls

Which of the following describes the most effective preventive control to ensure proper handling of cash receipt
transactions?

A. One employee issues a prenumbered receipt for all cash collections; another employee reconciles the daily total of
prenumbered receipts to the bank deposits.
B. Bank reconciliations are prepared by an employee not involved with cash collections and then are reviewed by a
supervisor.
C. The employee who receives customer mail receipts prepares the daily bank deposit, which is then deposited by
another employee.
D. Predetermined totals (hash totals) of cash receipts are used to control posting routines.

Question 18 - Fraud Risk Awareness

An internal auditor suspects that a mailroom clerk is embezzling funds. In exercising due professional care, the
internal auditor should

A. Inform the appropriate authorities in the organization.

B. Reassign the clerk to another department
C. Confront the clerk with his/her suspicions.
D. Institute stricter controls over mailroom operations.

Question 19 - Fraud Risk Awareness

An internal auditor's responsibility for reporting fraud includes

A. Notifying management if fraud has been established to a reasonable certainty.

B. Issuing a written report at the conclusion of the investigation and not sooner.
C. Providing a draft of the report only to senior management.
D. Notifying management of fraud when the internal auditor has exhaustively reviewed all the data related to the fraud.

Question 20 - Types of Controls

An internal auditor is examining inventory control in a merchandising division with annual sales of $3,000,000 and a
40% gross profit rate. Tests show that 2% of the monetary amount of purchases do not reach inventory because of
breakage and employee theft. Adding certain controls costing $35,000 annually could reduce these losses to 0.5% of
purchases. Should the controls be recommended?

A. Yes, regardless of cost-benefit considerations, because the situation involves employee theft.
B. Yes, because the ideal system of internal control is the most extensive one.
C. Yes, because the projected saving exceeds the cost of the added controls.
D. No, because the cost of the added controls exceeds the projected savings.

Question 21 - Types of Controls

The procedure requiring preparation of a prelisting of incoming cash receipts, with copies of the prelist going to the
cashier and to accounting, is an example of which type of control?

A. Preventive.
B. Corrective.
C. Detective.
D. Directive.

Question 22 - Internal Control Framework Characteristics and Use

A multinational corporation has an office in a foreign branch with a monetary transfer facility. Effective internal control
requires that

A. The hiring of individual branch employees be approved by the headquarters office.

B. Foreign currency translation rates be computed separately by two branch employees in the same department.
C. The person making wire transfers not reconcile the bank statement.
D. The branch manager not deliver payroll checks to employees.
Question 23 - Internal Control Framework Characteristics and Use

An organization's directors, management, external auditors, and internal auditors all play important roles in creating a
proper control environment. Senior management is primarily responsible for

A. Implementing and monitoring controls designed by the board of directors.

B. Designing and operating a control system that provides reasonable assurance that established objectives and
goals will be achieved.
C. Ensuring that external and internal auditors adequately monitor the control environment.
D. Establishing a proper organizational culture and specifying a system of internal control.

Question 24 - Internal Control Framework Characteristics and Use

An internal auditor found that employee time cards in one department are not properly approved by the supervisor.
Which of the following could result?

A. Payroll checks might not be distributed to the appropriate payees.

B. The wrong hourly rate could be used to calculate gross pay.
C. Duplicate paychecks might be issued.
D. Employees might be paid for hours they did not work.

Question 25 - Types of Controls

Which of the following controls would most likely minimize defects in finished goods because of poor quality raw
materials?

A. Determination of spoilage at the end of the manufacturing process.

B. Proper handling of work-in-process inventory to prevent damage.
C. Timely follow-up on unfavorable usage variances.
D. Implementation of specifications for purchases.

Question 26 - Internal Control Framework Characteristics and Use

The treasurer makes disbursements by check and reconciles the monthly bank statements to accounting records.
Which of the following best describes the control impact of this arrangement?

A. Controls will be enhanced because the treasurer will have two opportunities to discover inappropriate
disbursements.
B. Internal control will be enhanced because these are duties that the treasurer should perform.
C. The treasurer will be in a position to make and conceal unauthorized payments.
D. The treasurer will be able to make unauthorized adjustments to the cash account.

Question 27 - Types of Controls

An operational engagement relating to the production function includes a procedure to compare actual costs with
standard costs. The purpose of this engagement procedure is to

A. Assist management in its evaluation of effectiveness and efficiency.

B. Determine the accuracy of the system used to record actual costs.
C. Assess the reasonableness of standard costs.
D. Measure the effectiveness of the standard cost system.

Question 28 - Types of Controls

Control may be described as a closed system consisting of six elements. One of the six elements is

A. Establishment of an independent internal audit activity.

B. Approval of the internal audit activity's charter.
C. Setting performance standards.
D. Adequately securing data files.

Question 29 - Types of Controls

To be successful, large companies must develop the means to keep the organization focused in the proper direction.
Organizational control systems help keep companies focused. These control systems consist of which three basic
components?

A. Setting goals, empowering employees, and job enrichment.

B. Role analysis, team building, and survey feedback.
C. Objectives, standards, and an evaluation-reward system.
D. Budgeting, financial ratio analysis, and cash management.

Question 30 - Types of Controls

The operations manager of a company notified the treasurer 60 days in advance that a new, expensive piece of
machinery was going to be purchased. This notification allowed the treasurer to make an orderly liquidation of some of
the company's investment portfolio on favorable terms. What type of control was involved?

A. Feedback.
B. Strategic.
C. Feedforward.
D. Concurrent.

Question 31 - Management Control Techniques

In a critical path analysis, if slack time in an activity exists, the activity

A. Could be delayed without delaying the overall project.

B. Is a backup activity to replace a main activity should it fail.
C. Is not essential to the overall project.
D. Involves essentially no time to complete.

Question 32 - Types of Controls

Which of the following aspects of the administration of a compensation program is the most important control in the
long run?

A. A plan of job classifications based on predefined evaluation criteria.

B. An informal wage and salary policy to be competitive with the industry average.
C. A wage and salary review plan for individual employee compensation.
D. A level of general compensation that is reasonably competitive.

Question 33 - Types of Controls

Controls can be classified according to the function they are intended to perform; for example, to discover the
occurrence of an unwanted event (detective), to avoid the occurrence of an unwanted event (preventive), or to ensure
the occurrence of a desirable event (directive). Which of the following is a directive control?

A. Requiring all members of the internal auditing department to be CIAs.

B. Dual signatures on all disbursements over a specific dollar amount.
C. Recording every transaction on the day it occurs.
D. Monthly bank statement reconciliations.

Question 34 - Fraud Risk Awareness

The internal auditors' responsibility for the prevention of fraud includes all of the following except

A. Ensuring that fraud will not occur.

B. Determining whether the organizational environment fosters control consciousness.
C. Being aware of activities in which fraud is likely to occur.
D. Evaluating the effectiveness of actions taken by management to deter fraud.

Question 35 - Types of Controls

Which of the following best defines control?

A. Control is provided when cost-effective measures are taken to restrict deviations to a tolerable level.
B. Control accomplishes objectives and goals in an accurate, timely, and economical fashion.
C. Control is the result of proper planning, organizing, and directing by management.
D. Controls are statements of what the organization chooses to accomplish.

Question 36 - Fraud Risk Awareness

To minimize the risk that agents in the purchasing department will use their positions for personal gain, the
organization should

A. Request internal auditors to confirm selected purchases and accounts payable.

B. Specify that all items purchased must pass value-per-unit-of-cost reviews.
C. Direct the purchasing department to maintain records on purchase prices paid, with review of such being required
each 6 months.
D. Rotate purchasing agent assignments periodically.

Question 37 - Internal Control Framework Characteristics and Use

An internal audit of the payroll function revealed several instances in which a payroll clerk had added fictitious
employees to the payroll and deposited the checks in accounts of close relatives. What control should have prevented
such actions?

A. Establishing a policy to deal with close relatives working in the same department.
B. Having the treasurer's office sign payroll checks.
C. Using time cards and attendance records in the computation of employee gross earnings.
D. Allowing changes to the payroll to be authorized only by the personnel department.

Question 38 - Fraud Risk Awareness

Internal auditors are responsible for reporting fraud to senior management and the board when

A. Irregular transactions have been identified and are under investigation.

B. The incidence of significant fraud has been established to a reasonable certainty.
C. Suspicious activities have been reported to the internal auditors.
D. The review of all suspected fraud-related transactions is complete.

Question 39 - Fraud Risk Awareness

A significant employee fraud took place shortly after an internal auditing engagement. The internal auditor may not
have properly fulfilled the responsibility for the deterrence of fraud by failing to note and report that

A. A system of control that depended upon separation of duties could be circumvented by collusion among three
employees.
B. Policies, practices, and procedures to monitor activities and safeguard assets were less extensive in low-risk areas
than in high-risk areas.
C. Divisional employees had not been properly trained to distinguish between bona fide signatures and cleverly forged
ones on authorization forms.
D. There were no written policies describing prohibited activities and the action required whenever violations are
discovered.

Question 40 - Internal Control Framework Characteristics and Use

In an internal audit of a purchasing department, which of the following ordinarily would be considered a risk factor?
A. Purchase specifications are developed by the department requesting the material.
B. Purchases are made from parties related to buyers or other company officials.
C. Purchases are made against blanket or open purchase orders for certain types of items.
D. There is a failure to rotate purchases among suppliers included on an approved vendor list.

Question 41 - Fraud Risk Awareness

The internal audit activity (IAA) has concluded a fraud investigation that revealed a previously undiscovered materially
adverse impact on the financial position and results of operations for 2 years on which financial statements have
already been issued. The chief audit executive (CAE) should immediately inform

A. Senior management and the board.

B. The appropriate governmental or regulatory agency.
C. The internal accounting function ultimately responsible for making corrective journal entries.
D. The external auditing firm responsible for the financial statements affected by the discovery.

Question 42 - Internal Control Framework Characteristics and Use

Corporate directors, management, external auditors, and internal auditors all play important roles in creating a proper
control environment. Top management is primarily responsible for

A. Implementing and monitoring controls designed by the board of directors.

B. Establishing a proper environment and specifying an overall internal control structure.
C. Ensuring that external and internal auditors adequately monitor the control environment.
D. Reviewing the reliability and integrity of financial information and the means used to collect and report such
information.

Question 43 - Internal Control Framework Characteristics and Use

A bank loan officer has the responsibility of making the credit decision, funding, and collecting the loans. A clerk is
responsible for reconciling the respective accounts and posting transactions to the customer subsidiary records.
Reconciliations have not been completed for four months. Previous reconciliations contained minor differences which
were written off.

Based on the scenario above, the internal auditor's primary concern would be

A. There are no deficiency findings.

B. Functions performed by the loan officer are not properly segregated.
C. Reconciliation duties are not properly segregated.
D. Reconciliations have not been completed in a timely manner.

Question 44 - Types of Controls

Organizational procedures allow employees to anticipate problems. This type of control is known as
A. A feedback control.
B. A feedforward control.
C. A performance appraisal.
D. A strategic control.

Question 45 - Fraud Risk Awareness

An internal auditor who suspects fraud should

A. Recommend whatever investigation is considered necessary under the circumstances.

B. Determine that a loss has been incurred.
C. Interview those who have been involved in the control of assets.
D. Identify the employees who could be implicated in the case.

Question 46 - Internal Control Framework Characteristics and Use

Management can best strengthen internal control over the custody of inventory stored in an off-site warehouse by
implementing

A. Reconciliations of transfer slips to/from the warehouse with inventory records.

B. Regular confirmation of the amount on hand with the custodian of the warehouse.
C. Increases in insurance coverage.
D. Regular reconciliation of physical inventories to accounting records.

Question 47 - Types of Controls

Which of the following assures that all inventory shipments are billed to customers?

A. Sales invoices are prenumbered and are independently accounted for and traced to the sales journal.
B. Shipping documents are prenumbered and are independently accounted for and matched with sales invoices.
C. Duties for recording sales transactions and maintaining customer account balances are separated.
D. Customer billing complaints are investigated by the controller's office.

Question 48 - Fraud Risk Awareness

If there is fraud in the marketing department, which of the following is beyond the scope of the internal auditor's
responsibility?

A. Discussing the wrongdoing with an appropriate level of management.

B. Including the wrongdoing in a report that will go to the audit committee.
C. Determining the effects of the wrongdoing.
D. Informing the wrongdoer of his or her legal rights.
Question 49 - Internal Control Framework Characteristics and Use

A retailer of high-priced durable goods operates a catalog ordering division that accepts customer orders by
telephone. The retailer runs frequent price promotions. During these times, the telephone operators enter the
promotional prices. The risk of this practice is that

A. Frequent price changes could overload the order entry system.

B. Customers could systematically be charged lower prices.
C. Operators could collude with outsiders for unauthorized prices.
D. Operators could give competitors notice of the promotional prices.

Question 50 - Internal Control Framework Characteristics and Use

An engagement had been scheduled by the chief audit executive (CAE) to address unusual inventory shortages
revealed in the annual physical inventory process at a large consumer goods warehouse operation. A cycle count
program had been installed in the storeroom at the beginning of the year in place of the disruptive process of counting
one entire product line at the end of each month. The cycle count program appeared effective because only nine
minor adjustments had been made for the entire year on the several thousand different products located in the
storeroom. The storeroom supervisor explained that each of the 15 stockroom personnel selected one item each day
for cycle count based on how efficiently the item could be counted. The opportunity for control related problems
including fraud has been increased in the stockroom because

A. A cycle count program has been installed in place of a less efficient program.
B. Only nine minor adjustments have been recorded as a result of the cycle count process.
C. Items for cycle count are selected by stockroom personnel.
D. Stockroom personnel record cycle count information.

Question 51 - Types of Controls

Which group has the primary responsibility for the establishment, implementation, and monitoring of adequate controls
in the posting of accounts receivable?

A. Accounting management.
B. Internal auditors.
C. Accounts receivable staff.
D. External auditors.

Question 52 - Internal Control Framework Characteristics and Use

In an effort to reduce long-term overhead expenses, an organization wants to cut its workforce through early
retirements. The best alternative to reduce the workforce would be to

A. Conduct negotiations with labor unions in the organization.

B. Provide monetary incentives to individuals meeting certain criteria to retire.
C. Threaten the most senior employees with discharge if they do not voluntarily retire.
D. Provide individual counseling on how to handle retirement or training for a new job.
Question 53 - Internal Control Framework Characteristics and Use

A restaurant food chain has over 680 restaurants. All food orders for each restaurant are required to be input into an
electronic device which records all food orders by food servers and transmits the order to the kitchen for preparation.
All food servers are responsible for collecting cash for all their orders and must turn in cash at the end of their shift
equal to the sales value of food ordered for their I.D. number. The manager then reconciles the cash received for the
day with the computerized record of food orders generated. All differences are investigated immediately by the
restaurant. Corporate headquarters has established monitoring controls to determine when an individual restaurant
might not be recording all its revenue and transmitting the applicable cash to the corporate headquarters. Which one
of the following would be the best example of a monitoring control?

A. Cash is transmitted to corporate headquarters on a daily basis.

B. All food orders must be entered on the computer, and segregation of duties is maintained between the food servers
and the cooks.
C. The restaurant manager reconciles the cash received with the food orders recorded on the computer.
D. Management prepares a detailed analysis of gross margin per store and investigates any store that shows a
significantly lower gross margin.

Question 54 - Fraud Risk Awareness

Internal auditors have been advised to consider red flags to determine whether management is involved in a fraud.
Which of the following does not represent a difficulty in using the red flags as fraud indicators?

A. Some red flags are difficult to quantify or to evaluate.

B. Red flag information is not gathered as a normal part of an engagement.
C. Many common red flags are also associated with situations in which no fraud exists.
D. The red flags literature is not well enough established to have a positive impact on internal auditing.

Question 55 - Management Control Techniques

Internal auditors regularly evaluate controls and control procedures. Which of the following best describes the concept
of control as recognized by internal auditors?

A. Management takes action to enhance the likelihood that established goals and objectives will be achieved.
B. Control represents specific procedures that accountants and auditors design to ensure the correctness of
processing.
C. Control procedures should be designed from the "bottom up" to ensure attention to detail.
D. Management regularly discharges personnel who do not perform up to expectations.

Question 56 - Internal Control Framework Characteristics and Use

A receiving department receives copies of purchase orders for use in identifying and recording inventory receipts. The
purchase orders list the name of the vendor and the quantities of the materials ordered.

A possible error that this system could allow is

A. Overpayment for partial deliveries.

B. Payment to unauthorized vendors.
C. Delay in recording purchases.
D. Payment for unauthorized purchases.

Question 57 - Internal Control Framework Characteristics and Use

One manager has suggested that the audit teams jointly examine the corporate culture and the "tone at the top" to
identify control risks associated with the proposed merger. Which of the following statements is correct?

A. The corporate culture is not a part of the control environment and thus should not be considered for a proposed
audit.
B. Although the corporate culture could be considered part of the control environment, the assessment of such an
environment would be highly subjective, and thus not useful.
C. Differences in the corporate culture should be systematically identified since the differences may present major
risks to the success of the merger. However, identifying differences is not an appropriate audit activity because it is
political and subjective.
D. None of the above.

Question 58 - Internal Control Framework Characteristics and Use

Human resources and payroll are separate departments. Which of the following combinations would provide the best
segregation of duties?

A. Human resources adds employees, reviews and submits payroll hours to payroll for processing, and delivers
paychecks to employees.
B. Human resources adds employees, and payroll processes hours and enters employee bank account numbers.
Paychecks are automatically deposited in the employee's bank account.
C. Payroll adds employees and enters employees' bank account numbers but processes hours only as approved by
human resources. Paychecks are automatically deposited in the employee's bank account.
D. Human resources adds employees, payroll processes hours, and human resources delivers the paychecks to
employees.

Question 59 - Types of Controls

Organizational procedures allow employees to anticipate problems. This type of control is known as

A. A performance appraisal.
B. A strategic control.
C. A feedback control.
D. A feedforward control.

Question 60 - Internal Control Framework Characteristics and Use

Two organizations have recently merged. The audit committee has asked the internal auditors from both organizations
to assess risks that should be addressed after the merger. One manager has suggested that the engagement teams
jointly examine the organizational culture and the "tone at the top" to identify control risks associated with the
proposed merger. Which of the following statements is true?
A. Although the organizational culture could be considered part of the control environment, the assessment of such an
environment would be highly subjective and therefore not useful.
B. The organizational culture is not a part of the control environment and therefore should not be considered for a
proposed engagement.
C. Differences in the organizational culture should be systematically identified because the differences may present
major risks to the success of the merger. However, identifying differences is not an appropriate activity because it is
political and subjective.
D. None of the answers are correct.

Question 61 - Management Control Techniques

Which of the following describes a control weakness?

A. Purchasing procedures are well designed and are followed unless otherwise directed by the purchasing supervisor.
B. The purchasing agent invests in a publicly traded mutual fund that lists the stock of one of the organization's
suppliers in its portfolio.
C. Prenumbered blank purchase orders are secured within the purchasing department.
D. Normal operational purchases fall in the range from $500 to $1,000 with two signatures required for purchases over
$1,000.

Question 62 - Types of Controls

The most important component of quality control is:

A. Ensuring goods and services conform to the design specifications.

B. Conforming to ISO-9000 specifications.
C. Satisfying upper management.
D. Determining the appropriate timing of inspections.

Question 63 - Types of Controls

Effective internal control

A. Cannot be circumvented by management.

B. Reduces the need for management to review exception reports on a day-to-day basis.
C. Is unaffected by changing circumstances and conditions encountered by the organization.
D. Eliminates risk and potential loss to the organization.

Question 64 - Types of Controls

An adequate and effective system of internal control provides reasonable assurance that objectives and goals will be
achieved. Controls may be preventive, detective, or directive. Which of the following is a detective control for the
procurement function?

A. Goods received are counted and compared with quantities on purchase order and receiving reports.
B. Review and approval of each procurement action is required prior to the final issuance of a purchase order.
C. Prenumbered standard purchase order forms include all relevant terms required to be used in all applicable
instances.
D. The procurement function is organizationally separate from receiving, disbursing, and accounting.

Question 65 - Internal Control Framework Characteristics and Use

Appropriate control over obsolete materials requires that they be

A. Carried at cost in the accounting records until the actual disposition takes place.
B. Retained within the regular storage area.
C. Sorted, treated, and packaged before disposition takes place, in order to obtain the best selling price.
D. Determined by an approved authority to be lacking in regular usability.

Question 66 - Fraud Risk Awareness

The chief audit executive (CAE) uncovers a significant fraudulent activity that appears to involve the executive vice
president to whom the CAE reports. Which of the following best describes how the CAE should proceed?

A. Notify regulatory authorities and police.

B. Conduct an investigation to ascertain whether the executive vice president is involved in the fraudulent activity.
C. Report the facts to the chief executive officer and the audit committee.
D. Interview the executive vice president to obtain essential evidence.

Question 67 - Internal Control Framework Characteristics and Use

Checks from customers are received in the organization's mailroom each day. What controls should be in place to
safeguard them?

A. Providing bonding protection for mail clerks.

B. Requiring a specific mail clerk to list and restrictively endorse each check.
C. Establishing a separate post office box for customer payments.
D. Forwarding all checks to the cashier upon receipt.

Question 68 - Fraud Risk Awareness

A preliminary report (oral or written) is issued following the detection phase of a fraud investigation. Such a report
should

A. Include the internal auditor's conclusion as to whether sufficient information exists to conduct an investigation.
B. Identify the perpetrators of the fraud
C. Never be submitted to the board.
D. Never include the observations that serve as the basis for the internal auditor's conclusion.
Question 69 - Internal Control Framework Characteristics and Use

Which of the following is an operating control for a research and development department?

A. Research and development personnel are hired by the payroll department.

B. The research and development budget is properly allocated between new products, product maintenance, and cost
reduction programs.
C. Research and development expenditures are reviewed by an independent person.
D. All research and development costs are charged to expense in accordance with the applicable accounting
principles.

Question 70 - Types of Controls

Which of the following are elements of a feedback control system?

A. Sender, medium, and receiver.

B. Detectors, comparators, and activators.
C. Planning, organizing, and directing.
D. Achievement, recognition, and aptitude.

Question 71 - Fraud Risk Awareness

A chief audit executive (CAE) obtains factual documentation of unethical business dealings by the vice president in
charge of internal auditing. The CAE should

A. Report the facts to the chief executive officer and the audit committee.
B. Conduct an investigation to determine the extent of the vice president's personal involvement in the unethical
conduct.
C. Schedule an engagement to review the involved business function.
D. Confront the vice president with the information before proceeding.

Question 72 - Internal Control Framework Characteristics and Use

A preliminary survey of the purchasing function indicates that: Department managers initiate purchase requests that
must be approved by the plant superintendent, Purchase orders are typed by the purchasing department using
prenumbered and controlled forms, Buyers regularly update the official vendor listing as new sources of supply
become known, Rush orders can be placed with a vendor by telephone but must be followed by a written purchase
order before delivery can be accepted, and Vendor invoice payment requests must be accompanied by a purchase
order and receiving report. One possible fault of this system is that

A. Purchases could be made from a vendor controlled by a buyer at prices higher than normal.
B. Payment can be made for supplies not received.
C. Payment can be made for supplies received but not ordered by the purchasing department.
D. Unnecessary supplies can be purchased by department managers.
Question 73 - Fraud Risk Awareness

One factor that distinguishes fraud from other employee crimes is that fraud involves

A. Intentional deception.
B. Malicious motives.
C. Collusion with a party outside the organization.
D. Personal gain for the perpetrator.

Question 74 - Fraud Risk Awareness

Which of the following is an indicator of increased risk of fraud? The treasurer

A. Takes no vacations and has refused promotion to vice president of finance.

B. Takes all his/her vacations and has refused promotion to vice president of finance.
C. Takes all his/her vacations and has just accepted a promotion to vice president of finance.
D. Takes no vacations and has just accepted a promotion to vice president of finance.

Question 75 - Fraud Risk Awareness

Which of the following describes one of the responsibilities of the internal auditor for the deterrence of fraud in an
organization?

A. Evaluating the adequacy of controls to prevent fraud.

B. Implementation of systems to discourage fraud.
C. Reporting suspected fraud to law enforcement personnel.
D. Prosecuting perpetrators of fraud.

Question 76 - Internal Control Framework Characteristics and Use

Which of the following observations, made during the preliminary survey of a local department store's disbursement
cycle, reflects a control strength?

A. Individual department managers are responsible for the movement of merchandise from the receiving dock to
storage or sales areas as appropriate.
B. The treasurer's office prepares checks for suppliers based on vouchers prepared by the accounts payable
department.
C. The receiving department is given a copy of the purchase order complete with a description of goods, quantity
ordered, and extended price for all merchandise ordered.
D. Individual department managers use prenumbered forms to order merchandise from vendors.

Question 77 - Internal Control Framework Characteristics and Use

An organization manufactures mirror frames. Scrap is adequately accounted for at the point of generation. The scrap
is sorted and sold frequently to the organization's regular buyer at a price negotiated between the scrap manager and
buyer. An exposure caused by these procedures is that
A. The price received for scrap may be inadequate.
B. The production of scrap indicates inefficiencies in production.
C. The collection of amounts receivable from the scrap buyer is questionable.
D. Excessive scrap has been generated.

Question 78 - Fraud Risk Awareness

Which of the following wrongful acts committed by an employee constitutes fraud?

A. Embezzlement.
B. Harassment.
C. Assault.
D. Libel.

Question 79 - Internal Control Framework Characteristics and Use

Which of the following controls could be used to detect bank deposits that are recorded but never made?

A. Having bank reconciliations performed by a third party.

B. Linking receipts to other internal accountabilities (i.e., collections to either accounts receivable or sales).
C. Consolidating cash receiving points.
D. Establishing accountability for receipts at the earliest possible time.

Question 80 - Management Control Techniques

Which of the following is the principal advantage of budgeting?

A. Performance evaluation.
B. Coordination of activities.
C. Employee motivation.
D. Forced planning.

Question 81 - Internal Control Framework Characteristics and Use

One of two office clerks in a small organization prepares a sales invoice; however, the invoice is incorrectly entered by
the bookkeeper in the general ledger and the accounts receivable subsidiary ledger for a smaller amount resulting
from a transposition of digits. The customer subsequently remits the amount on the monthly statement. Assuming only
three employees are in the department, the most effective control to prevent this type of error is

A. Using predetermined totals to control posting routines.

B. Requiring that monthly statements be prepared by the bookkeeper and verified by one of the other office clerks
prior to mailing.
C. Assigning the second office clerk to make an independent check of prices, discounts, extensions, footings, and
invoice serial numbers.
D. Requiring the bookkeeper to perform periodic reconciliations of the accounts receivable subsidiary ledger and the
general ledger.

Question 82 - Fraud Risk Awareness

In the course of their work, internal auditors must be alert for fraud and other forms of white-collar crime. The
important characteristic that distinguishes fraud from other varieties of white-collar crime is that

A. White-collar crime is usually perpetrated by outsiders to the detriment of an organization, whereas fraud is
perpetrated by insiders to benefit the organization.
B. White-collar crime is usually perpetrated for the benefit of an organization, whereas fraud benefits an individual.
C. Fraud encompasses an array of irregularities and illegal acts that involve intentional deception.
D. Unlike other white-collar crimes, fraud is always perpetrated against an outside party.

Question 83 - Fraud Risk Awareness

Internal auditors must exercise due professional care if they are to meet their responsibilities for fraud detection. Thus,
the existence of certain conditions should raise "red flags" and arouse internal auditors' professional skepticism
concerning possible fraud. Which of the following is most likely to be considered an indication of possible fraud?

A. A new management team installed as the result of a takeover.

B. Rapid turnover of financial executives.
C. A taxing authority's audit of tax returns.
D. Rapid expansion into new markets.

Question 84 - Fraud Risk Awareness

An internal auditor has detected probable employee fraud and is preparing a preliminary report for management. This
report should include

A. A statement that an internal audit conducted with due professional care cannot provide absolute assurance that
irregularities have not occurred.
B. The results of a polygraph test administered to the suspected perpetrator(s) of the fraud.
C. A list of proposed audit tests to help disclose the existence of similar frauds in the future.
D. The auditor's conclusion as to whether sufficient information exists to conduct an investigation.

Question 85 - Fraud Risk Awareness

When conducting fraud investigations, internal auditors should

A. Perform its investigation independent of lawyers, security personnel, and specialists from outside the organization
who are involved in the investigation.
B. Assess the probable level of, and the extent of complicity in, the fraud within the organization.
C. Clearly indicate the extent of the internal auditors' knowledge of the fraud when questioning suspects.
D. Assign personnel to the investigation in accordance with the engagement schedule established at the beginning of
the fiscal year.
Question 86 - Internal Control Framework Characteristics and Use

Which of the following activities represents both an appropriate personnel department function and a deterrent to
payroll fraud?

A. Distribution of paychecks.
B. Authorization of additions and deletions from the payroll.
C. Authorization of overtime.
D. Collection and retention of unclaimed paychecks.

Question 87 - Internal Control Framework Characteristics and Use

Management is concerned with the potential for unauthorized changes in the payroll. Which of the following is the
proper organizational structure to prevent such unauthorized changes?

A. The personnel department authorizes the hiring and pay levels of all employees.
B. The payroll department's functions are limited to maintaining the payroll records, distributing paychecks, and
posting the payroll entries to the general ledger.
C. The payroll department maintains and authorizes all changes in the personnel records.
D. The payroll department is supervised by the management of the human resources division.

Question 88 - Fraud Risk Awareness

A disgruntled former employee calls the chief audit executive (CAE) to report misappropriations of funds by the
supervisor of cash operations. Engagement tests subsequently verify the allegations. The CAE should proceed with
which of the following actions based upon the above information?

A. Inform the treasurer and chief financial officer of the suspected fraud.
B. Notify the bonding agency.
C. Confront the supervisor of cash operations with the allegations.
D. Notify local law enforcement authorities.

Question 89 - Fraud Risk Awareness

Internal auditing is responsible for assisting in the prevention of fraud by

A. Informing the appropriate authorities within the organization and recommending whatever investigation is
considered necessary in the circumstances when wrongdoing is suspected.
B. Establishing the organization's governance, operations, and information systems concerning compliance with laws,
regulations, and contracts.
C. Examining and evaluating the adequacy and the effectiveness of control, commensurate with the extent of the
potential exposure or risk in the various segments of the organization's operations.
D. Determining whether operating standards are acceptable and are being met.
Question 90 - Internal Control Framework Characteristics and Use

A means of ensuring that payroll checks are drawn for properly authorized amounts is to

A. Conduct periodic floor verification of employees on the payroll.

B. Require supervisory approval of employee time cards.
C. Require that undelivered checks be returned to the cashier.
D. Witness the distribution of payroll checks.

Question 91 - Internal Control Framework Characteristics and Use

The most appropriate method to control the frequent movement of trailers loaded with valuable metal scrap from the
manufacturing plant to the organization's scrap yard about 10 miles away would be to

A. Contract with an independent hauler for the removal of scrap.

B. Require existing security guards to log the time of plant departure and scrap yard arrival. The elapsed time should
be reviewed by a supervisor for fraud.
C. Perform complete physical inventory of the scrap trailers before leaving the plant and upon arrival at the scrap yard.
D. Use armed guards to escort the movement of the trailers from the plant to the scrap yard.

Question 92 - Fraud Risk Awareness

A fraud report is required

A. At the conclusion of the investigation phase.

B. Neither at the conclusion of the detection phase nor at the conclusion of the investigation phase.
C. At the conclusion of the detection phase.
D. At the conclusion of both the detection and the investigation phases.

Question 93 - Fraud Risk Awareness

During an engagement involving a purchasing department, an internal auditor discovered that many purchases were
made (at normal prices) from an office supplier whose owner was the brother of the director of purchasing. Controls
were in place to restrict such purchases and no fraud appears to have been committed. In this case, the internal
auditor should recommend

A. Establishment of a price policy (range) for all goods.

B. The development of an approved-vendor file initiated by the buyer and approved by the director of purchasing.
C. The inspection of all receipts by receiving inspectors.
D. The initiation of a conflict-of-interest policy.

Question 94 - Fraud Risk Awareness

In an organization with a separate division that is primarily responsible for fraud deterrence, the internal audit activity
(IAA) is responsible for
A. Establishing and maintaining that division's system of internal control.
B. Examining and evaluating the adequacy and effectiveness of that division's actions taken to deter fraud.
C. Controlling that division's fraud deterrence activities.
D. Planning that division's fraud deterrence activities.

Question 95 - Types of Controls

Managerial control can be divided into feedforward and feedback controls. Which of the following is an example of a
feedback control?

A. Forecasting inventory needs.

B. Budgeting.
C. Quality control training.
D. Variance analysis.

Question 96 - Types of Controls

Controls should be designed to provide reasonable assurance that

A. Organizational objectives and goals will be achieved economically and efficiently.

B. The internal audit activity's guidance and oversight of management's performance is accomplished economically
and efficiently.
C. Management's planning, organizing, and directing processes are properly evaluated.
D. Management's plans have not been circumvented by worker collusion.

Question 97 - Fraud Risk Awareness

An adequate system of internal controls is most likely to detect a fraud perpetrated by a

A. Single employee.
B. Group of employees in collusion.
C. Single manager.
D. Group of managers in collusion.

Question 98 - Internal Control Framework Characteristics and Use

Management has a role in the maintenance of control. In fact, management sometimes is a control. Which of the
following involves managerial functions as a control?

A. Monitoring performance.
B. Establishment of an internal audit activity.
C. Maintenance of a quality assurance program.
D. Use of an organizational policies manual.
Question 99 - Management Control Techniques

Activity scheduling information for the installation of a new computer system is given below.
Immediate
ActivityPredecessorDuration (Days)
A - 4
B - 3
C A 9
D A 6
E B, D 5

For this project, the critical path is

A. B-E.
B. A-C.
C. A-D-E.
D. B-D-C.

Question 100 - Internal Control Framework Characteristics and Use

During the preliminary survey phase of an audit of the organization's production cycle, management stated that the
sale of scrap was well controlled. Evidence to verify that assertion can best be gained by

A. Comparing the quantities of scrap expected from the production process with the quantities sold.
B. Comparing current revenue from scrap sales with that of prior periods.
C. Comparing current revenue from scrap sales with industry norms.
D. Interviewing persons responsible for collecting and storing the scrap.

Question 101 - Fraud Risk Awareness

Internal auditors have a responsibility for helping to deter fraud. Which of the following best describes how this
responsibility is usually met?

A. By testing for fraud in every engagement and following up as appropriate.

B. By coordinating with security personnel and law enforcement agencies in the investigation of possible frauds.
C. By assisting in the design of control systems to prevent fraud.
D. By evaluating the adequacy and effectiveness of controls in light of the potential exposure or risk.

Question 102 - Internal Control Framework Characteristics and Use

A purchasing agent acquired items for personal use with the organization's funds. The organization allowed
designated employees to purchase a specified amount per day in merchandise under open-ended contracts.
Supervisory approval of the purchases was required, but that information was not communicated to the vendor.
Instead of reviewing and authorizing each purchase order, supervisors routinely signed the authorization sheet at the
end of the month without reviewing any of the supporting documentation. Because purchases of this nature were not
subject to normal receiving policies, the dishonest employee picked up the supplies at the vendor's warehouse. All
purchases were for items routinely ordered by the organization. During the past year, the employee amassed enough
merchandise to start a printing and photography business.

Which of the following controls would have been most effective in preventing this fraud?

A. Canceling supporting documents such as purchase orders and receiving reports at the time invoices are paid.
B. Establishing separation of duties between the ordering and receiving of merchandise.
C. Allowing purchases only from a list of pre-approved vendors.
D. Requiring the use of prenumbered purchase orders for all purchases of merchandise.

Question 103 - Fraud Risk Awareness

Which of the following policies is most likely to result in an environment conducive to the occurrence of fraud?

A. Budget preparation input by the employees who are responsible for meeting the budget.
B. The division's hiring process frequently results in the rejection of adequately trained applicants.
C. Unreasonable sales and production goals.
D. The application of some accounting controls on a sample basis.

Question 104 - Fraud Risk Awareness

Bank management suspects that a bank loan officer frequently made loans to fictitious entities, disbursed loan
proceeds to personally established accounts, and then let the loans go into default. Some pertinent facts about the
loan officer include:
A high standard of living, explained as the result of sound investments and not taking vacations,
An expensive personal car obtained through business contacts,
Gasoline and repair bills submitted for a car assigned by the bank that are higher than the organization's
average (mileage logs were submitted on a quarterly basis), and
Marked annoyance with questions from internal auditors.

In this situation, typical indicators of the suspected fraud (red flags) include all of the following except

A. Not taking an annual vacation.

B. Becoming easily annoyed with auditor inquiries about questionable loans.
C. Explaining a high standard of living as the result of investments.
D. Submitting gasoline and repair bills that are higher than company average.

Question 105 - Fraud Risk Awareness

Bank management suspects that a bank loan officer frequently made loans to fictitious entities, disbursed loan
proceeds to personally established accounts, and then let the loans go into default. Some pertinent facts about the
loan officer include:
A high standard of living, explained as the result of sound investments and not taking vacations,
An expensive personal car obtained through business contacts,
Gasoline and repair bills submitted for a car assigned by the bank that are higher than the organization's
average (mileage logs were submitted on a quarterly basis), and
Marked annoyance with questions from internal auditors.
The most appropriate trend analysis to indicate this potential fraud is

A. Loan default rates by loan officer.

B. Automobile operating expenses by loan officer.
C. Accumulation of unpaid vacation days.
D. Total monetary volume of loans by loan officer.

Question 106 - Fraud Risk Awareness

Bank management suspects that a bank loan officer frequently made loans to fictitious entities, disbursed loan
proceeds to personally established accounts, and then let the loans go into default. Some pertinent facts about the
loan officer include:
A high standard of living, explained as the result of sound investments and not taking vacations,
An expensive personal car obtained through business contacts,
Gasoline and repair bills submitted for a car assigned by the bank that are higher than the organization's
average (mileage logs were submitted on a quarterly basis), and
Marked annoyance with questions from internal auditors.

The extent of loans made to fictitious borrowers by the loan officer could best be determined by

A. Reviewing a representative sample of the loan officer's transactions for compliance with bank policies and
procedures.
B. Comparing current loan approval balances with those of prior years.
C. Requesting positive confirmations for all outstanding loans made by the loan officer.
D. Reviewing a representative sample of loan files for properly completed documents, such as loan agreements, credit
approvals, and approval of secured collateral.

Question 107 - Fraud Risk Awareness

Bank management suspects that a bank loan officer frequently made loans to fictitious entities, disbursed loan
proceeds to personally established accounts, and then let the loans go into default. Some pertinent facts about the
loan officer include:
A high standard of living, explained as the result of sound investments and not taking vacations,
An expensive personal car obtained through business contacts,
Gasoline and repair bills submitted for a car assigned by the bank that are higher than the organization's
average (mileage logs were submitted on a quarterly basis), and
Marked annoyance with questions from internal auditors.

The extent of loans made to fictitious borrowers by the loan officer is least likely to be discovered by

A. Analysis of total dollar volume of loans by loan officer.

B. Analysis of the number of loans made by each loan officer.
C. Reconciliation of total loans outstanding to the general ledger balance.
D. External audits of loan files.

Question 108 - Management Control Techniques

Which of the following is not involved with facility layout and design issues?

A. Line balancing.
B. Cellular manufacturing.
C. Operations sequence analysis.
D. Program Evaluation and Review Technique (PERT).

Question 109 - Fraud Risk Awareness

A production manager for a moderate-sized manufacturer began ordering excessive raw materials and had them
delivered to a wholesaler he runs as a side business. He falsified receiving documents and approved the invoices for
payment. Which of the following engagement procedures most likely will detect this fraud?

A. Take a sample and confirm the amount purchased, purchase price, and date of shipment with the vendors.
B. Take a sample of cash disbursements; compare purchase orders, receiving reports, invoices, and check copies.
C. Observe the receiving dock and count materials received; compare your counts to receiving reports completed by
receiving personnel.
D. Prepare analytical tests comparing production, materials purchased, and raw materials inventory levels and
investigate differences.

Question 110 - Fraud Risk Awareness

When comparing perpetrators who have embezzled an organization's funds with perpetrators of financial statement
fraud (falsified financial statements), those who have falsified financial statements are less likely to

A. Use organizational expectations as justification for the act.

B. Rationalize the fraudulent behavior.
C. Have experienced an autocratic management style.
D. Be living beyond their obvious means of support.

Question 111 - Fraud Risk Awareness

Internal auditors are more likely to detect fraud if they develop and strengthen their ability to

A. Interrogate fraud perpetrators to discover why the fraud was committed.

B. Develop internal controls to prevent the occurrence of fraud.
C. Recognize and question changes that occur in organizations.
D. Document computerized operating system programs.

Question 112 - Fraud Risk Awareness

When an internal auditor identifies multiple factors that have been linked with possible fraudulent conditions, and
suspects that fraud has taken place, the auditor should

A. Immediately report to senior management and the board.

B. Immediately report to the board.
C. Extend tests to determine the extent of the fraud.
D. Notify the appropriate authorities within the organization and recommend an investigation.

Question 113 - Fraud Risk Awareness

An internal auditor is conducting interviews of three employees who had access to a valuable asset that has
disappeared. In conducting the interviews the internal auditor should

A. Allow a suspect to return to work after the interview so as not to arouse suspicions.
B. Respond to non-cooperation by threatening adverse consequences of such behavior.
C. Not indicate that management will forgo prosecution if restitution is made.
D. Conduct the interviews in a group.

Question 114 - Internal Control Framework Characteristics and Use

Which of the following is not a control strength?

A. Product managers are permanently assigned to specific product lines to develop expertise.
B. The scanned in goods are reconciled with the number of price tags generated and attached to the products.
C. Product managers are given a purchasing budget by the marketing manager which may constrain the amount of
their purchases.
D. Goods received are scanned in to develop an electronic receiving report.

Question 115 - Fraud Risk Awareness

Which of the following statements correctly characterizes the "red flags" literature that has recently developed in the
auditing profession?

I. Red flags are items or actions that have been associated with fraudulent conduct.

II. The auditor should document all red flags that may have been noted on an audit engagement.

III. Many red flags are "subjective" in nature and might not come to the auditor's attention during the course of an audit
that is properly planned and conducted in accordance with the Standards.

A. I and II.
B. II and III.
C. III only.
D. I and III.

Question 116 - Types of Controls

The internal audit activity (IAA) of an organization is an integral part of the organization's risk management, control,
and governance processes because it evaluates and contributes to the improvement of those processes. Select the
type of control provided when the IAA conducts a systems development review.
A. Feedforward control.
B. Feedback control.
C. Strategic plans.
D. Policies and procedures.

Question 117 - Fraud Risk Awareness

The legislative auditing bureau of a country is required to perform compliance auditing of companies that are issued
defense contracts on a cost-plus basis. Contracts are clearly written, defining acceptable costs, including
developmental research cost and appropriate overhead rates. During the past year, the government has engaged in
extensive outsourcing of its activities. The outsourcing included contracts to run cafeterias, provide janitorial services,
manage computer operations and systems development, and provide engineering of construction projects. The
contracts were modeled after those which had been used for years in the defense industry. The legislative auditors
are being called upon to expand their audit effort to include compliance audits of these contracts.

Upon initial investigation of these outsourced areas, the auditor found many areas in which the outsourced
management has apparently expanded its authority and responsibility. For example, the contractor that manages
computer operations has developed a highly sophisticated security program which may represent the most advanced
information security in the industry. The auditor reviews the contract and sees reference only to providing appropriate
levels of computing security. The auditor suspects that the governmental agency may be incurring developmental
costs that the outsourcer may use for competitive advantage in marketing services to other organizations.

Assume the auditor investigates and finds that the company providing the computing services is clearly performing
research and development activities and charging the governmental entity for those activities because it is
experimenting with implementing the security techniques on the governmental entity. Which of the following
statements are correct?

I. Fraud must exhibit intentional deception.

II. Determining whether this is a violation of contract terms is a legal function, not an audit function.

III. It would be fraud only if the outsourcer had implemented similar security measures at other entities.

A. II only.
B. I, II, and III.
C. I only.
D. I and II only.

Question 118 - Management Control Techniques

The purchasing manager of a manufacturing company was concerned with the rising prices of some direct materials
provided by a supplier. The purchasing manager told the supplier to either maintain the current prices or withdraw as a
supplier for the company's direct materials. The supplier devised a plan to circumvent the purchasing manager's intent
without actually violating the purchasing manager's mandate. Which one of the following is the probable action taken
by the supplier?

A. The supplier maintained prices in the short-run but later returned to a pattern of increasing prices.
B. The supplier decided to stop providing the direct materials to the manufacturing company, since holding the line on
prices would have a negative impact.
C. The supplier maintained prices but substituted a lower grade of direct materials.
D. The supplier worked through the president of the manufacturing company to force the purchasing manager to
cancel the mandate.

Question 119 - Types of Controls

Internal auditors can evaluate the management function of controlling by determining if

A. Management is provided with prompt feedback on performance variances.

B. Employee turnover rates are analyzed for trends and investigations are made for adverse trends.
C. Anticipated problems are discussed, identified, and evaluated with possible solutions provided.
D. The grouping of activities in a department meets departmental objectives.

Question 120 - Management Control Techniques

Much non-profit organization fundraising is done over the telephone. Which of the following control procedures would
be least effective in gaining assurance that all of the pledges made by telephone are recorded and designated for
payment to the organization?

A. Automatic computer recording of all phone calls, coupled with supervisory monitoring of randomly selected phone
calls.
B. Periodic monitoring of phone calls by management personnel.
C. Management reports which compare funds raised this year with funds raised last year on a per-call basis.
D. A confirmation program which randomly selects donations received and confirms the amounts with the donors.

Question 121 - Fraud Risk Awareness

Red flags are conditions that indicate a higher likelihood of fraud. Which of the following is not considered a red flag?

A. An individual handling marketable securities is responsible for making the purchases, recording the purchases, and
reporting any discrepancies and gains/losses to senior management.
B. Management has delegated the authority to make purchases under a certain value to subordinates.
C. The assignment of responsibility and accountability in the accounts receivable department is not clear.
D. An individual has held the same cash-handling job for an extended period without any rotation of duties.

Question 122 - Fraud Risk Awareness

Which of the following statements is (are) true regarding the deterrence of fraud?

I. The primary means of deterring fraud is through an effective control system initiated by senior management.

II. Internal auditors are responsible for assisting in the deterrence of fraud by examining and evaluating the adequacy
of the internal control system.

III. Internal auditors should determine whether communication channels provide management with adequate and
reliable information regarding the effectiveness of the control system and the occurrence of unusual transactions.

A. II only.
B. I, II, and III.
C. I only.
D. I and II only.

Question 123 - Types of Controls

The requirement that purchases be made from suppliers on an approved vendor list is an example of a

A. Monitoring control.
B. Corrective control.
C. Preventive control.
D. Detective control.

Question 124 - Fraud Risk Awareness

During an engagement at a bank, the internal auditors discover that one loan officer had approved loans to a number
of related but separate organizations, in violation of regulatory policies. The loan officer indicated that it was an
oversight and it would not happen again. However, the internal auditors believe it may have been intentional because
the officer is related to one of the primary owners of the group that controls the related organizations. The internal
auditors should

A. Inform management of the conflict of interest and the violation of the regulatory requirements and suggest further
investigation.
B. Expand the engagement procedures to determine if there may be fraudulent activity on the part of the loan officer
and communicate the observations to management when the follow-up investigation is complete.
C. Report the violation to the regulatory agency because it constitutes a significant breakdown of the bank's controls.
D. Not report the violation if the loan officer agrees to take corrective action.

Question 125 - Internal Control Framework Characteristics and Use

A major corporation is considering significant organizational changes. Which of the following groups will not be
responsible for implementing these changes?

A. Common shareholders.
B. Top management.
C. Employees.
D. Outside consultants.

Question 126 - Fraud Risk Awareness

Which of the following is most likely to be considered an indication of possible fraud?

A. A government audit of the organization's tax returns.

B. Rapid expansion into new markets.
C. The replacement of the management team after a hostile takeover.
D. Rapid turnover of the organization's financial executives.
Question 127 - Management Control Techniques

Bank tellers might use authorized teller terminals to conceal overdrafts in their personal checking accounts by
transferring funds to and from customer accounts. The best control to detect such unauthorized actions by a teller is to
require

A. Supervisor only authorization for transfers between customer accounts.

B. Overnight balancing of all accounts by the on-line teller system.
C. Annual vacations for employees with access to teller functions.
D. Periodic examination of accounts of employees with access to teller functions.

Question 128 - Fraud Risk Awareness

An audit of an international non-profit organization established to finance medical research revealed the following
amounts (in millions):
Current YearPast Year
Revenue $500 $425
Investments (average balances) $210 $185
Medical research grants made $418 $325
Investment income $16 $20
Administrative expense $10 $8

Which of the following possible frauds or misuses of organization assets should be considered the area of greatest
risk if controls are only marginal?

A. Grants made to organizations that might be associated with the president or not for purposes dictated in the
organization's charter.
B. A payroll clerk adding fictitious employees.
C. A senior manager using company travel and entertainment funds for activities that might be unauthorized.
D. Supplies purchased from fictitious vendors.

Question 129 - Fraud Risk Awareness

An audit of an international non-profit organization established to finance medical research revealed the following
amounts (in millions):
Current YearPast Year
Revenue $500 $425
Investments (average balances) $210 $185
Medical research grants made $418 $325
Investment income $16 $20
Administrative expense $10 $8

Before an audit report is issued, a front-page article appears in a newspaper alleging that the president has been
using the organization's funds for personal purposes. The auditor has enough information to confirm the allegations
made in the newspaper article. The auditor is contacted by a reporter for the newspaper to confirm the facts. Which of
the following would be the best response by the auditor?
A. Respond truthfully and fully since the auditor is able to confirm the facts concerning the president, not the
organization.
B. Provide information "off the record" so that the article does not state who gave the information.
C. Respond that the investigation is not complete.
D. Direct the inquiry to the audit committee or the board of directors.

Question 130 - Fraud Risk Awareness

An audit of an international non-profit organization established to finance medical research revealed the following
amounts (in millions):
Current YearPast Year
Revenue $500 $425
Investments (average balances) $210 $185
Medical research grants made $418 $325
Investment income $16 $20
Administrative expense $10 $8

An examination of grants awarded revealed a number of grants approved and documented by the president rather
than by the grant authorization committee as required by the organization’s charter. If the grant authorization
committee meets and retroactively approves the grants before the audit report is issued, the auditor should

A. Report the breakdown in control structure to the audit committee.

B. Include the grants in question in the audit report as a breakdown of the organization's controls. Detail the nature of
each grant and investigate further for fraud.
C. Not report the grants in question because they were approved before the issuance of the audit report.
D. Discuss the matter with the chairperson of the grant authorization committee to determine the rationale for not
approving the grants earlier. If the grants are routine, then omit discussion in the audit report.

Question 131 - Management Control Techniques

When an office supply company is unable to fill an order completely, it marks the out-of-stock items as back-ordered
on the customer's order and enters these items in a back-order file which management can view or print. The best
approach for ensuring prompt delivery of out-of-stock items is to

A. Increase inventory levels to minimize the number of times that out-of-stock conditions occur.
B. Match the back-order file to goods received daily.
C. Reconcile the sum of filled and back orders with the total of all orders placed daily.
D. Implement electronic data interchange with supply vendors to decrease the time to replenish inventory.

Question 132 - Management Control Techniques

Which internal control would a utility company with a large investment in repair vehicles implement to reduce the risk
of vehicle theft or loss?

A. Physically inventory vehicles and reconcile the results with the accounting records.
B. Maintain vehicles in a secured location with release and return subject to approval by a custodian.
C. Review insurance coverage for adequacy.
D. Systematically account for all repair work orders.
Question 133 - Internal Control Framework Characteristics and Use

An adequate system of internal controls is most likely to detect an irregularity perpetrated by a

A. Group of managers in collusion.

B. Single manager.
C. Group of employees in collusion.
D. Single employee.

Question 134 - Types of Controls

Internal controls are designed to provide reasonable assurance that

A. Management's planning, organizing, and directing processes are properly evaluated.

B. The internal auditing department's guidance and oversight of management's performance is accomplished
economically and efficiently.
C. Material errors or irregularities would be prevented or detected and corrected within a timely period by employees
in the course of performing their assigned duties.
D. Management's plans have not been circumvented by worker collusion.

Question 135 - Fraud Risk Awareness

Which of the following best describes an auditor’s responsibility after noting some indicators of fraud?

A. Report the matter to the audit committee and request funding for outside specialists to help investigate the possible
fraud.
B. Expand activities to determine whether an investigation is warranted.
C. Report the possibility of fraud to top management and ask them how they would like to proceed.
D. Consult with external legal counsel to determine the course of action to be taken, including the approval of the
proposed audit program to make sure it is acceptable on legal grounds.

Question 136 - Fraud Risk Awareness

Even though the chief audit executive (CAE) referred a case of potential fraud to the security department, the
suspected perpetrator continued to defraud the organization until discovered by a line manager two years later. What
should the CAE have done?

A. The CAE should have periodically checked the status of the case with the security department.
B. The CAE's actions were correct.
C. The CAE should have discharged the perpetrator.
D. The CAE should have conducted a fraud investigation.
Question 137 - Types of Controls

Which of the following exemplifies an inherent limitation of internal control?

A. A security guard allows one of the warehouse employees to remove company assets from the premises without
authorization.
B. The company sells to customers on credit without proper credit approval.
C. A controller both makes and records cash deposits.
D. An employee who is unable to read is assigned custody of the company's tape library and run manuals.

Question 138 - Internal Control Framework Characteristics and Use

In which of the following situations would an internal auditor be justified in questioning the adequacy of controls over
the purchasing function?

A. Unpaid voucher files and perpetual inventory records are independently maintained.
B. The original and one copy of the purchase order are mailed to the vendor. The copy is returned to the purchasing
department to acknowledge acceptance.
C. Receiving reports are forwarded to the purchasing department where they are matched to purchase orders and
sent to accounts payable.
D. The accounts payable section prepares documentation for payments.

Question 139 - Internal Control Framework Characteristics and Use

What is the appropriate source of information for determining if all goods shipped are billed to the customer?

A. Prenumbered shipping documents.

B. Accounts receivable files.
C. Customer purchase orders.
D. Prenumbered customer invoices.

Question 140 - Internal Control Framework Characteristics and Use

A payroll computer system automatically initiated scheduled pay raises for some employees who failed to meet
required performance levels. To prevent this situation in the future

A. Scheduled pay raises should be initiated by the payroll department

B. The payroll master file should be compared to the employee master file.
C. Scheduled pay raises should be delayed pending explicit approval by appropriate supervisors
D. The payroll register should be compared to the employee master file.

Question 141 - Internal Control Framework Characteristics and Use

Which of the following explanations suggests the least amount of relative risk stemming from a failure to compare a
purchase order to an approved price list?
A. A temporary employee processed the purchase order.
B. The comparison is not required by company policy.
C. The director of the purchasing department approved the purchase order.
D. The vendor is one used often by the company.

Question 142 - Management Control Techniques

Which of the following could contribute to discrepancies between receiving reports and the number of units in a
shipment?

A. Showing quantities ordered on the receiving department's copy of purchase orders.

B. Using inadequate vendor selection procedures.
C. Accepting improper authorization of purchases.
D. Failing to compare the quality of goods received with specifications.

Question 143 - Internal Control Framework Characteristics and Use

Which of the following controls would prevent disputes over the charges billed by independent contractors?

A. A monthly report comparing actual expenditures with approved budgets.

B. Appropriate segregation of duties between the purchasing and accounts payable departments.
C. Timely recording of both commitments and expenditures.
D. A written agreement containing provisions for billing charges.

Question 144 - Internal Control Framework Characteristics and Use

Which of the following controls would prevent the ordering of quantities in excess of an organization's needs?

A. A policy requiring agreement of the receiving report and packing slip before storage of new receipts.
B. Automatic reorder by the purchasing department when low inventory level is indicated by the system.
C. Review of all purchase requisitions by a supervisor in the user department prior to submitting them to the
purchasing department.
D. A policy requiring review of the purchase order before receiving a new shipment.

Question 145 - Internal Control Framework Characteristics and Use

Maintaining a file of purchase orders in the receiving department for goods ordered but not yet received is a control
meant to ensure that

A. An accurate count of goods is conducted upon receipt.

B. Goods are delivered to the appropriate department in a timely manner.
C. Only authorized shipments are accepted.
D. Goods are not lost after receipt.
Question 146 - Internal Control Framework Characteristics and Use

The cash receipts function should be separated from the related recordkeeping function in an organization in order to

A. Physically safeguard the cash receipts.

B. Establish accountability when the cash is first received.
C. Minimize undetected losses of cash receipts.
D. Prevent the disbursement of cash from cash receipts.

Question 147 - Internal Control Framework Characteristics and Use

Appropriate internal control for a multinational corporation’s branch office that has a monetary transfer unit requires
that

A. The branch manager receives all wire transfers.

B. Foreign currency rates be computed separately by two different employees.
C. The individual who initiates wire transfers not reconcile the bank statement.
D. Corporate management approve the hiring of monetary transfer unit employees.

Question 148 - Management Control Techniques

Which of the following would minimize defects in finished goods caused by poor quality raw materials?

A. Timely follow-up on all unfavorable usage variances.

B. Determination of the amount of spoilage at the end of the manufacturing process.
C. Required material specifications for all purchases.
D. Documented procedures for the proper handling of work-in-process inventory.

Question 149 - Internal Control Framework Characteristics and Use

Preventing someone with sufficient technical skill from circumventing security procedures and making changes to
production programs is best accomplished by

A. Providing suitable segregation of duties.

B. Comparing production programs with independently controlled copies.
C. Running test data periodically.
D. Reviewing reports of jobs completed.

Question 150 - Types of Controls

Senior management has the responsibility to oversee the establishment, administration, and assessment of the
company's risk management and control processes. The purpose of that multifaceted system of control process is to
support people of the organization in the management of risks and the achievement of the established and
communicated objectives of the enterprise. Control processes should provide reasonable assurance that:
I. Financial and operating reports are reliable and possess integrity.

II. Assets are safeguarded.

III. The actions and decisions of the organization are in compliance with laws, regulations, and contracts.

IV. Management’s plans have not been circumvented by worker collusion.

A. I, II and III only.

B. I, II, III and IV.
C. II and IV only.
D. II, III and IV only.

Question 151 - Types of Controls

The control process can be divided into feedforward or feedback controls. Which of the following are considered
feedforward controls?

I. Raw materials variance analysis.

II. 90-day cash budgeting.

III. Product quality control training.

IV. Inventory requirement forecasting.

A. I and II only.
B. I, II, III and IV.
C. II, III and IV only.
D. I, II and III only.

Question 152 - Types of Controls

A processing operation has control procedures in place that make ongoing adjustments to the process based upon
the immediate feedback from the system. What type of control is this?

A. Concurrent.
B. Feedback.
C. Feedforward.
D. Preventive.

Question 153 - Internal Control Framework Characteristics and Use

A rental car agency's fleet maintenance division uses a different code for each type of inventory transaction. A daily
summary report lists activity by part number and transaction code. The report is reconciled by the parts room
supervisor to the day's material request forms and is then forwarded to the fleet manager for approval. The
reconciliation of the summary report to the day’s material request forms by the parts room supervisor

A. Verifies that all material request forms were approved.

B. Confirms that all material request forms are entered for all parts issued.
C. Ensures the accuracy and completeness of data input.
D. Provides documentation as to what material was available for a specific transaction.

Question 154 - Internal Control Framework Characteristics and Use

An auditor noted that the accounts receivable department is separate from other accounting activities. A separate
credit department approves credit. Control accounts and subsidiary ledgers are balanced monthly. Similarly, accounts
are aged monthly. The company's treasurer writes off delinquent accounts after 1 year, or sooner if a bankruptcy or
other unusual circumstances are involved. Credit memoranda are pre-numbered and must be correlated with
receiving reports. Which of the following areas could be viewed as internal control strengths of the above organization?

I. Credit approvals.

II. Write-offs of delinquent accounts.

III. Monthly aging of receivables.

IV. Handling of credit memos.

A. I and IV only.
B. III and IV only.
C. I, III and IV only.
D. I, II, III and IV.

Question 155 - Internal Control Framework Characteristics and Use

One of the most important control activities is the segregation of duties. Which of the following two tasks can be
performed by the same person?

A. Recording of cash receipts and bank reconciliation.

B. Computer programming and data input operations.
C. Signing and distributing payroll checks.
D. All of the answer choices violate the segregation of duties.

Question 156 - Fraud Risk Awareness

Which of the following circumstances most likely heighten an auditor’s concern about the risk of material
misstatements due to fraud in an entity's financial statements?

A. The entity's industry is experiencing declining customer demand.

B. Employees who handle cash receipts are not bonded.
C. Bank reconciliations usually include in-transit deposits.
D. Equipment is often sold at a loss before being fully depreciated.

Question 157 - Internal Control Framework Characteristics and Use

When considering internal control over securities, the auditor is particularly concerned about

A. Access to stock certificates by the corporate treasurer.

B. Access to stock certificates by the corporate controller.
C. Preparation of accrual adjustments on bonds by the corporate controller.
D. Approval of temporary stock investment purchases by the corporate treasurer or company president.

Question 158 - Types of Controls

When an organization has strong internal control, management can expect various benefits. The benefit least likely to
occur is

A. Availability of reliable data for decision-making purposes.

B. Some assurance of compliance with the Sarbanes-Oxley Act of 2002.
C. Elimination of employee fraud.
D. Reduced cost of an external audit.

Question 159 - Internal Control Framework Characteristics and Use

A proper segregation of duties requires

A. That an individual maintaining custody of an asset be entitled to access the accounting records for the asset.
B. That an individual recording a transaction not compare the accounting record of the asset with the asset itself.
C. That an individual authorizing a transaction maintain custody of the asset that resulted from the transaction.
D. That an individual authorizing a transaction records it.

Question 160 - Internal Control Framework Characteristics and Use

One characteristic of an effective internal control structure is the proper segregation of duties. The combination of
responsibilities that would not be considered a violation of segregation of functional responsibilities is

A. Approval of time cards and preparation of paychecks.

B. Timekeeping and preparation of payroll journal entries.
C. Signing of paychecks and custody of blank payroll checks.
D. Preparation of paychecks and check distribution.

Question 161 - Internal Control Framework Characteristics and Use

Internal control should follow certain basic principles to achieve its objectives. One of these principles is the
segregation of functions. Which one of the following examples does not violate the principle of segregation of
functions?

A. The sales manager has the responsibility to approve credit and the authority to write off accounts.
B. The department time clerk is given the undistributed payroll checks to mail to absent employees.
C. The warehouse clerk, who has the custodial responsibility over inventory in the warehouse, may authorize disposal
of damaged goods.
D. The treasurer has the authority to sign checks but gives the signature block to the assistant treasurer to run the
check-signing machine.

Question 162 - Internal Control Framework Characteristics and Use

In a well designed internal control system, two tasks that should be performed by different persons are

A. Approval of bad debt write-offs, and reconciliation of the accounts payable subsidiary ledger and controlling
account.
B. Posting of amounts from both the cash receipts journal and cash payments journal to the general ledger.
C. Recording of cash receipts and preparation of bank reconciliations.
D. Distribution of payroll checks and approval of sales returns for credit.

Question 163 - Internal Control Framework Characteristics and Use

The primary responsibility for establishing and maintaining internal control rests with

A. Management.
B. The treasurer.
C. The internal auditor.
D. The controller.

Question 164 - Types of Controls

Feedback, feedforward, and preventive controls are important types of control systems and procedures for an
accounting information system. Which one of the following is in the correct order of feedback, feedforward, and
preventive control systems?

A. Cost accounting variances, cash budgeting, and organizational independence.

B. Cost accounting variances, separation of duties, and cash planning.
C. Cash budgeting, capital budgeting, and hiring qualified employees.
D. Cash budgeting, cost accounting variances, and separation of duties.

Question 165 - Internal Control Framework Characteristics and Use

Which one of the following is most likely to be considered a reportable condition?

A. A clerk in the invoice processing department fails to match a vendor's invoice with its related receiving report.
Checks are not signed unless all appropriate documents are attached to a voucher.
B. An inventory control clerk at a manufacturing plant has the ability to steal one completed television set from
inventory a year. The theft probably will never be detected.
C. An accounts receivable clerk, who approves sales returns and allowances, receives customer remittances and
deposits them in the bank. Limited supervision is maintained over the employee.
D. The petty cash custodian has the ability to steal petty cash. Documentation for all disbursements from the fund
must be submitted with the request for replenishment of the fund.
Question 166 - Internal Control Framework Characteristics and Use

Which one of the following situations represents an internal control weakness in accounts receivable?

A. Customers' statements are mailed monthly by the accounts receivable department.

B. Internal auditors confirm customer accounts periodically.
C. The cashier is denied access to customers' records and monthly statements.
D. Delinquent accounts are reviewed only by the sales manager.

Question 167 - Internal Control Framework Characteristics and Use

Which one of the following situations represents an internal control weakness in the payroll department?

A. The timekeeping function is independent of the payroll department.

B. Payroll department personnel are rotated in their duties.
C. Paychecks are distributed by the employees' immediate supervisor.
D. Payroll records are reconciled with quarterly tax reports.

Question 168 - Internal Control Framework Characteristics and Use

Which one of the following situations represents a strength of internal control for purchasing and accounts payable?

A. Unmatched receiving reports are reviewed on an annual basis.

B. Prenumbered receiving reports are issued randomly.
C. Vendors' invoices are matched against purchase orders and receiving reports before a liability is recorded.
D. Invoices are approved for payment by the purchasing department.

Question 169 - Internal Control Framework Characteristics and Use

Segregation of duties is required in the processing of customers' orders in order to maintain an internal control
structure. Which one of the following situations is not a proper segregation of duties in the processing of orders from
customers?

A. Approval of a sales credit memo because of a product return by the Sales Department with subsequent posting to
the customer's account by the Accounts Receivable Department.
B. Shipping of goods by the Shipping Department that have been retrieved from stock by the Finished Goods
Storeroom Department.
C. Invoice preparation by the Billing Department and posting to customers' accounts by the Accounts Receivable
Department.
D. Approval by Credit Department of a sales order prepared by the Sales Department.

Question 170 - Internal Control Framework Characteristics and Use

Organizational independence in the processing of payroll is achieved by functional separations that are built into the
system. Which one of the following functional separations is not required for internal control purposes?

A. Separation of timekeeping from payroll preparation.

B. Separation of personnel function from payroll preparation.
C. Separation of payroll preparation and paycheck distribution.
D. Separation of payroll preparation and maintenance of year-to-date records.

Question 171 - Types of Controls

Which one of the following statements pertaining to performance measurement and behavior is false?

A. An organization using measures such as growth in market share, increases in productivity, and throughput time, in
addition to various financial ratios, is relying on a more balanced approach to performance evaluation.
B. The development of information technology can permit organizations to do away with feedback in the design of
management control systems.
C. The use of residual income to measure divisional performance can cause goal congruence problems for
corporations with divisions that have unequal operating asset bases.
D. The lack of commitment on the part of top management can turn budgets into ritualistic exercises without
significance.

Question 172 - Internal Control Framework Characteristics and Use

Which of the following is not a component of the Canadian internal control model (CoCo)?

A. Monitoring and Learning

B. Planning.
C. Capability
D. Commitment

Question 173 - Internal Control Framework Characteristics and Use

The Canadian institute of Chartered Accountants designed an internal control model which is commonly referred to as
the CoCo model. The CoCo model has four components and twenty criteria. The CoCo model comprises those
elements of a company that, taken together, support people in the achievement of the company's objectives. Which of
the following is not a purpose criteria based on the CoCo model?

A. Control activities should be designed and implemented.

B. Significant internal and external risks should be identified and assessed.
C. There should be measurable performance targets in the objectives and plans.
D. Objectives should be established and communicated.

Question 174 - Internal Control Framework Characteristics and Use

Which of the following statements is true concerning the COSO and the CoCo models?
A. The COSO model emphasizes hard controls whereas the CoCo model emphasizes soft controls.
B. The CoCo model emphasizes the importance of ethical values at all levels of the organization whereas the COSO
model only emphasizes the importance of ethical values at the management level.
C. The COSO model holds individual accountable for internal control whereas the CoCo model directly holds the
responsibility of internal control with the organization's directors.
D. Both the CoCo and COSO models emphasize the importance of operational as well as financial controls.

Question 175 - Internal Control Framework Characteristics and Use

The CoCo model consists of four components and twenty criteria. Which of the following is not a criteria of the
capability component?

A. Communications within the organization should support the values and achievement of the organization's
objectives.
B. The decision-making process within the organization should be coordinated between departments.
C. Organizations should periodically review of the effectiveness of their control systems.
D. People within the organization should have the skills and knowledge to support the achievement of the
organization's objectives.

Question 176 - Internal Control Framework Characteristics and Use

Which of the following statements is false concerning what the Turnbull report says about an organization's system of
internal control?

A. Internal control should be capable of responding quickly to evolving risks to the business arising from factors within
the company and to changes in the business environment.
B. Internal control should include guarantees that organizational objectives will be achieved in a timely manner.
C. Internal control should be embedded in the operations of the company and form a part of its culture.
D. Internal control should include procedures for reporting immediately to appropriate levels of management any
significant control failings or weaknesses.

Question 177 - Fraud Risk Awareness

Which of the following would be considered part of the fraud area that the internal auditor needs to be alert to?

A. Regular independent checks.

B. Examine the approval process.
C. Duplication of payments.
D. Backup facilities.

Question 178 - Internal Control Framework Characteristics and Use

All of the following are true concerning the nature of risk assessment except:

A. A precondition to risk assessment is the establishment of a risk committee.

B. Changes in the environment that may have changed the nature and scale of risks should be considered.
C. Risk assessment starts by first identifying the risks that face the business.
D. How often risk assessment will be done in an organization will depend on the nature of the environment in which
the organization operates.

Question 179 - Risk Vocabulary and Concepts

As defined by Statement on Management Accounting: Enterprise Risk Management: Frameworks, Elements and
Integration, the amount of risk that remains after management has taken action to mitigate risk is known as

A. Residual risk.
B. Assessed risk.
C. Remaining risk.
D. Undiversifiable risk.

Question 180 - Risk Vocabulary and Concepts

The basis for the components of an Enterprise Risk Management system as defined by COSO in Enterprise Risk
Management – Integrated Framework is

A. the organization's control activities.

B. the internal environment of the organization.
C. assessment of risk.
D. identification of the organization's strategic objectives.

Question 181 - Risk Vocabulary and Concepts

Which of the following is not a component of a ERM system as defined by COSO in Enterprise Risk Management –
Integrated Framework?

A. Monitoring
B. The control environment
C. Information and communication
D. Event identification

Question 182 - Risk Vocabulary and Concepts

Like traditional risk management, Enterprise Risk Management (ERM) is concerned with identifying and mitigating the
risk from events that, if they occur, have the potential to prevent the company from achieving its objectives. The
COSO document, Enterprise Risk Management — Integrated Framework, grouped these objectives into four
categories. What are the four categories of objectives?

A. Strategic objectives, financial objectives, operational objectives and hazard objectives.

B. Strategic objectives, operations objectives, reporting objectives and governance objectives.
C. Strategic objectives, operations objectives, reporting objectives and compliance objectives.
D. Strategic objectives, marketing objectives, operations objectives and governance objectives.
Question 183 - Risk Vocabulary and Concepts

Which of the following is a benefit of a well developed and implemented Enterprise Risk Management (ERM) system?

A. Reliable information for use in decision making.

B. Higher expected cash flows can be used in capital budgeting analyses because of less uncertainty.
C. Identification and management of cross-enterprise risks.
D. There is less probability of events occurring that would impact the company's ability to achieve its objectives.

Question 184 - Risk Vocabulary and Concepts

DRP Insurance Company wants to be “best in class” in terms of Enterprise Risk Management (ERM) implementation.
To achieve this goal, the company plans to identify events that affect the implementation of strategy and achievement
of objectives. Which of the following best reflects an analysis that would help its identification process?

A. Review of accidents and operational measures.

B. Summary of driving records and age.
C. Analysis of default histories and dispersion.
D. Review of incidents and new market conditions.
Question 1 - Fraud Risk Awareness

A. The internal auditor may recommend whatever investigation is considered necessary in the circumstances.
Thereafter, the auditor should follow up to see that the IAA's responsibilities have been met. Generally, fraud
specialist carries out fraud investigations. Management must authorize any internal auditor involvement in an
investigation.

Question 2 - Types of Controls

C. Planning is the process of an organization setting forth its goals and objectives. It is through the process
of controlling that a company is able to monitor its achievements of those plans. Therefore, without planning
there is no way in which a company can implement a control system.

Question 3 - Fraud Risk Awareness

D. When there is sufficient evidence that fraud has occurred, the internal auditor should notify the appropriate
authorities within the organization, e.g., security, to recommend an investigation.

Question 4 - Types of Controls

D. Feedback controls identify when something has already gone wrong. This is the least efficient and
effective means of control. Examples of feedback controls are financial statement analysis, quality control
procedures, and employee performance evaluations.

Question 5 - Internal Control Framework Characteristics and Use

B. If the accounts receivable manager is both approving the write-offs of delinquent accounts and performing
the write-off, this is a weakness in internal control. The person who authorizes a transaction should be
different from the person who records the transaction.

Question 6 - Internal Control Framework Characteristics and Use

D. If two employees (the security guard and the warehouse employee) collude to defraud their employer, a
control based on segregation of functions can be rendered ineffective. This is an inherent limitation of
internal control.

Question 7 - Internal Control Framework Characteristics and Use

A. If an employee were able to visit the organizations safety deposit box containing investment securities
then it would be possible for this employee to use the securities as collateral for a short-term personal bank
loan.

Question 8 - Internal Control Framework Characteristics and Use

C. Salespeople should not be responsible for monitoring customers' financial condition. Salespeople make
contact with customers and potential customers, make sales and provide customer service where
appropriate. If salespeople are responsible for credit approval, their conflict of interest (desire to make the
sale) could lead to inappropriate approvals. There should be a separate credit approval function.

Question 9 - Types of Controls

B. Directing is a means to motivate people in an organization to work more effectively and efficiently in the
pursuit of the organization's goals and objectives. Thus, informing purchasing personnel of the future need
for long-lead-time products in ample time is a directing function.

Question 10 - Types of Controls

B. Directive controls cause or encourage a desirable event to occur. Providing management with assurance
of the realization of specified minimum gross margins on sales is an example of a directive control.

Question 11 - Internal Control Framework Characteristics and Use

C. A payroll clerk is involved in payroll preparation. The payroll checks should be signed by someone else
who has the authority to do so, and the signature stamp should be kept in the custody of the person whose
signature is on it. Therefore, the payroll clerk having custody of the check signature stamp is a violation of
segregation of duties.

Question 12 - Fraud Risk Awareness

A. Fraud is something that is done intentionally. Fraud is committed when there is false representation or
concealment of a material fact.

Question 13 - Fraud Risk Awareness

D. The IAA must evaluate the potential the potential for the occurrence of fraud and how the organization
manages fraud risk (Standard 2120.A2). It is recommended that a draft of the proposed final communications
on fraud should be submitted to legal counsel for review. When the internal auditor wants to invoke client
privilege, consideration should be given to addressing the report to legal counsel.

Question 14 - Internal Control Framework Characteristics and Use

C. The person who prepares attendance data should not be the same person who also prepares the payroll,
because of the opportunity to create a fictitious employee and then pay that fictitious employee without it
being noticed.

Question 15 - Types of Controls

D. The internal auditor evaluates the effectiveness and efficiency of operations. In addition, the internal
auditor will ascertain the extent to which management has established the adequate criteria to determine
whether objectives and goals have been accomplished. If adequate, internal auditors should use such criteria
in their evaluation.

Question 16 - Management Control Techniques

D. A budget is a realistic plan for the future expressed in quantitative terms. A budget serves as a planning,
control, and evaluation tool. As such, the use of a budget helps to allocate resources efficiently.

Question 17 - Types of Controls

A. It is important to establish accountability for cash received at the earliest possible point. Use of
prenumbered receipts assures that all receipts are accounted for, and having a different employee do the
reconciliation is an additional control against misappropriation of funds.

Question 18 - Fraud Risk Awareness

A. The responsibility of the internal auditor is to inform the appropriate authorities within the organization of
the wrongdoing. The internal auditor should also recommend any necessary investigation, and follow up to
make sure that the internal audit activity's responsibilities have been met.

Question 19 - Fraud Risk Awareness

A. The role of the internal auditor in fraud detection is to notify the appropriate authorities within the
organization if a determination is made that fraud has occurred to recommend an investigation.
Question 20 - Types of Controls

D. There has to be a cost-benefit to any control that is established. In this case the cost outweighs the benefit
by $8,000. If the cost of purchases is $1,800,000 ($3,000,000 x (1 - 40% gross margin)) then an estimated
$36,000 of goods do not reach inventory because of breakage and employee theft ($1,800,000 x 2%). If losses
can be reduced to .5% (reduction of 1.5%) then the benefit for putting in the controls would be only $27,000
[(2% - 0,5%) x $1,800,000]. Thus, if the company decides to put in the controls, the cost would outweigh the
benefit by $8,000 ($35,000 - $27,000). Hence, the cost exceeds the benefit so the controls should not be
recommended.

Question 21 - Types of Controls

A. Prelisting incoming cash receipts is a preventive control designed to prevent undesirable events from
occurring. In this case, an undesirable event is the disappearance of cash payments. The prelist should be
made at the earliest possible time, in order to establish accountability for the cash.

Question 22 - Internal Control Framework Characteristics and Use

C. People who make disbursements should not also reconcile the bank statement. Making disbursements is a
custody function, whereas reconciling the bank statement is a reconciliation function. If the same person
were to perform both of these functions, that person could have an opportunity to misappropriate funds and
conceal the misappropriation.

Question 23 - Internal Control Framework Characteristics and Use

D. Senior management establishes and maintains an organizational culture, including an ethical climate that
fosters control.

Question 24 - Internal Control Framework Characteristics and Use

D. The approval of the supervisor on time cards of employees supervised should prevent employees being
paid for hours they did not work.

Question 25 - Types of Controls

D. Developing and implementing specifications for purchases of raw materials is a preventive control, as it
should limit the purchase of defective raw materials.

Question 26 - Internal Control Framework Characteristics and Use

C. The following four functions must always be done by different people: (1) Authorizing a transaction; (2)
Recording the transaction, preparing source documents, maintaining journals; (3) Keeping physical custody
of the related asset - for instance, receiving checks in the mail; and (4) The periodic reconciliation of the
physical assets to the recorded amounts for those assets. Because the treasurer is performing two duties
that are not compatible, making disbursements by check (a custody function) and reconciling the checking
account (a reconciliation function), the treasurer is in a position to make and conceal unauthorized payments.

Question 27 - Types of Controls

A. An operational engagement is concerned with examining and evaluating systems of internal control,
overall company operations, and the quality of performance in carrying out assigned responsibilities. The
purpose of an operational engagement is to assist management in its evaluation of effectiveness and
efficiency. A comparison between actual costs and standard costs can be used to fulfill that purpose.

Question 28 - Types of Controls

C. Sawyer list six elements of a closed control system, including: (1) setting standards, (2) measuring
performance, (3) analyzing performance and comparing it with the standards, (4) evaluating deviations and
bringing them to the attention of appropriate persons, (5) correcting deviations, and (6) following up on
corrective action.

Question 29 - Types of Controls

C. An organization control system help keep companies focused. This is done through the establishment of
objectives and standards. An evaluation-reward system helps keep employees motivated and focused on
performance improvement.

Question 30 - Types of Controls

C. Feedforward controls are control activities that detect the problem before it occurs. Notifying the treasurer
60 days in advance allows the treasurer time to liquidate the company's investments on favorable terms so
payment for the equipment can be made.

Question 31 - Management Control Techniques

A. Slack time is the amount of time by which a step in the process could be delayed without delaying the
overall completion of the project.
Question 32 - Types of Controls

A. Compensation programs are ways for companies to attract needed personnel. A compensation program
needs to high enough to attract these needed personnel, but not too high as to be excessive. In the long-term
the best way for an organization to control this program is for it to be based on predefined evaluation criteria.

Question 33 - Types of Controls

A. Requiring all members of the internal auditing department to be CIAs is a directive control. It increases the
probability that the internal auditors will have the requisite knowledge, experience and professionalism to
perform their jobs.

Question 34 - Fraud Risk Awareness

A. The internal auditor's responsibility is to assist in the deterrence of fraud by examining and evaluating the
adequacy and effectiveness of the system of internal control. However, internal auditors cannot ensure that
fraud will not occur.

Question 35 - Types of Controls

C. Control is "any action taken by management, the board, and other parties to enhance risk management and
increase the likelihood that established objectives and goals will be achieved."

Question 36 - Fraud Risk Awareness

D. Rotating purchasing agent assignments periodically will limit the risk of agents using their positions for
personal gain, because it will discourage long-term agent relationships with particular vendors.

Question 37 - Internal Control Framework Characteristics and Use

D. Only the personnel department should be authorized to make changes to the payroll, while only the payroll
department should process payroll checks. Furthermore, to prevent an unauthorized person from adding a
name of a fictitious employee to the payroll, payroll records should be reconciled with the active employee list
from the personnel department each payday.

Question 38 - Fraud Risk Awareness

B. When an internal auditor suspects fraud, he or she should determine the possible effects and discuss the
matter with the appropriate level of management, who should then initiate an investigation. However, the
internal auditor should have solid reasons to suspect that fraud has taken place before reporting it to senior
management and the board.

Question 39 - Fraud Risk Awareness

D. Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is
managed by the organization, but are not expected to have the expertise of a person whose primary
responsibility is detecting and investigating fraud (Standard 1210.A2). The internal auditor can assist in the
deterrence of fraud by examining and evaluating the adequacy and the effectiveness of the system of internal
control, commensurate with the extent of the potential exposure/risk in the various segments of the
organization's operations.

Question 40 - Internal Control Framework Characteristics and Use

B. Making purchases from related parties is a control risk because the purchasing agent may have a conflict
of interest.

Question 41 - Fraud Risk Awareness

A. The CAE is responsible for reporting immediately any incident of significant fraud to senior management
and the board. However, before any fraud reporting is made, a sufficient investigation should establish with
reasonable certainty that a fraud occurred.

Question 42 - Internal Control Framework Characteristics and Use

B. It is management's responsibility to establish the proper control environment and to design an overall
internal control structure.

Question 43 - Internal Control Framework Characteristics and Use

B. The primary audit deficiency is that loan officer functions are not properly segregated. Failure to segregate
the collection, approval, and funding functions could lead to improper use of company assets which would
go undetected.

Question 44 - Types of Controls

B. Procedures provide guidance on how tasks should be accomplished.

Question 45 - Fraud Risk Awareness

A. When an internal auditor suspects fraud, it is recommended that he or she should determine the possible
effects and discuss the matter with the appropriate level of management, who should then initiate an
investigation.

Question 46 - Internal Control Framework Characteristics and Use

D. Regular physical inventory should be taken and the results compared with accounting inventory records.

Question 47 - A. Types of Controls

B. Matching shipping documents with the sales invoices will prevent and detect unbilled shipments.

Question 48 - Fraud Risk Awareness

D. The internal auditor does not have the responsibility or possess the proper authority to inform the
wrongdoer of his or her legal rights.

Question 49 - Internal Control Framework Characteristics and Use

C. If an operator who makes sales has the authority to also change prices in the system, that operator could
temporarily change a price without authorization and then make a prearranged sale of the item to a friend.
This would be of concern with any inventory item, but it is even more of a concern when the product being
sold is a high-priced consumer item. This is an example of the importance of segregation of duties.

Question 50 - Internal Control Framework Characteristics and Use

C. Based on segregation of duties, personnel who do not have custodial recordkeeping responsibilities
should control the counts. Thus, the stockroom personnel should not be selecting the items for cycle counts.

Question 51 - Types of Controls

A. Management is responsible for controls.

Question 52 - Internal Control Framework Characteristics and Use

B. This may be the most effective incentive for individuals to retire.

Question 53 - CIA 1195 I.16 - C-D. Internal Control Framework Characteristics and Use

D. There are five interrelated components that comprise internal control. They are: (1) control environment, (2)
risk assessment, (3) control activities, (4) information and communication, and (5) monitoring. Monitoring is
an activity of management. Monitoring assesses the quality of the internal control system's performance over
time. Monitoring can be done in two ways: (1) through ongoing monitoring during normal operations, and (2)
separate evaluations by management with the assistance of the internal audit activity. If monitoring is done
regularly during normal operations, it lessens the need for separate evaluations. When management prepares
a detailed analysis of gross margin per store and investigates any store that shows a significantly lower
gross margin, it is performing a monitoring activity.

Question 54 - Fraud Risk Awareness

D. There has been numerous research information published on the subject, so getting information is not
difficult.

Question 55 - Management Control Techniques

A. A control is any action taken by management to enhance the likelihood that established goals and
objectives will be achieved.

Question 56 - CIA 1196 1.1 - C-D. Internal Control Framework Characteristics and Use

A. The risk of telling the receiving department the quantities ordered is that the receiving department may fail
to make an accurate count of the materials received. The receiving department needs to know quantities, but
the receiving clerk counting materials received does not.

Question 57 - Internal Control Framework Characteristics and Use

D. None of the statements are correct. An organization's control environment and corporate culture are
integral parts of its control structure.

Question 58 - Internal Control Framework Characteristics and Use

B. This is the best response because it goes one step further by keeping the completed checks out of the
hands of human resources.

Question 59 - Types of Controls

D. Procedures provide guidance on how tasks should be accomplished.

Question 60 - Internal Control Framework Characteristics and Use

D. The control environment influences the control consciousness of all the people in the organization. It sets
the tone for the entire organization. Control environment factors include: (1) The integrity, ethical values and
competence of the entity's people; (2) Management's philosophy and operating style; (3) The way
management assigns authority and responsibility and organizes and develops its people; and (4) The
attention and direction provided by the board of directors.

Question 61 - Management Control Techniques

A. Purchasing procedures that are followed unless otherwise directed by the purchasing supervisor is a
control weakness.

Question 62 - Types of Controls

A. The primary purpose of quality control is to ensure that goods and services conform with design
specifications.

Question 63 - Types of Controls

B. An effective internal control structure should prevent exceptions as well as detect exceptions after the fact.
Thus, with an effective internal control structure, management's need to review exception reports daily
should be reduced.

Question 64 - Types of Controls

A. Detective controls are designed to detect and correct undesirable event that have occurred. Received
goods that are counted and compared with quantities on purchase order and receiving report is an example
of a detective control.
Question 65 - Internal Control Framework Characteristics and Use

D. An accountant or auditor is not the appropriate person to determine when inventory is obsolete. That
determination should be made by someone with the necessary knowledge to make the determination.
Furthermore, the person who makes the determination of inventory's usability should be a different person
from the person who has custody over the inventory and also should be a different person from the one who
authorizes its disposal. Otherwise, a person with the authority to declare inventory unusable and therefore
valueless might subsequently "dispose" of it by selling it and pocketing the proceeds.

Question 66 - Fraud Risk Awareness

C. When an internal auditor suspects fraud, he or she should determine the possible effects and discuss the
matter with the appropriate level of management, who should then initiate an investigation.

Question 67 - Internal Control Framework Characteristics and Use

B. Segregation of duties is the best control to safe guard the customer checks. In this case the mail clerk
does not have access to any other records.

Question 68 - Fraud Risk Awareness

A. A preliminary or final report may be desirable at the conclusion of the detection phase. The report should
include the internal auditor’s conclusion as to whether sufficient information exists to conduct a full
investigation. It should also summarize observations and recommendations that serve as the basis for such
decision.

Question 69 - Internal Control Framework Characteristics and Use

B. Operating controls are non-financial. The proper allocation (budgeting) of resources is one aspect of
operating control. Thus, properly allocating new products, product maintenance, and cost reduction
programs would be an operating control for the R&D department.

Question 70 - Types of Controls

B. Feedback control systems identify when something has already gone wrong. Detectors, comparators and
activators are elements of a feedback control system. Detectors measures what is happening in the control
object (variable being controlled). Comparators (analyzer) is a devise for assessing the significance of what is
happening, usually by comparing information supplied by the detector (what is actually happening) with the
established reference points (what should be happening). Activators is a decision maker.
Question 71 - Fraud Risk Awareness

A. The first obligation of the CAE is to notify the appropriate authorities within the organization. Under these
circumstances, the CAE should report the facts to the CEO and the audit committee.

Question 72 - Internal Control Framework Characteristics and Use

A. A general weakness in purchasing systems is the potential of conflict of interest between the buyers and
vendors where the result could be excessive prices being charged to the company.

Question 73 - Fraud Risk Awareness

A. Fraud encompasses a range of irregularities and illegal acts characterized by intentional deception or
misrepresentation, which an individual knows to be false or does not believe to be true. Fraud is perpetrated
by a person knowing that it could result in some unauthorized benefit to him, or her, to the organization, or to
another person, and can be perpetrated by persons outside and inside the organization.

Question 74 - Fraud Risk Awareness

A. According to Sawyer's Internal Auditing, one of the 20 danger signs of embezzlement is an employee who
refuses to take vacations and shuns promotions for fear of detection.

Question 75 - Fraud Risk Awareness

A. The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization
manages fraud risk (Standard 2120.A2). Internal auditors are responsible for assisting companies prevent
fraud by examining and evaluating the adequacy and the effectiveness of their controls’ system,
commensurate with the extent of the potential exposure with the organization.

Question 76 - Internal Control Framework Characteristics and Use

B. The treasurer's office should prepare vendor checks (the custody function), while accounting for payables
is a recording function.

Question 77 - Internal Control Framework Characteristics and Use

A. There are various problems that arise from this situation. For example, there may be collusion between the
scrap manager and buyer to establish an inadequate price, or the scrap manager may not be an expert
negotiator, or some other factors that lead to an inadequate price.
Question 78 - Fraud Risk Awareness

A. Embezzlement is the intentional misappropriation of money or property and falsification of financial

records to cover up the act, thus making detection difficult.

Question 79 - Internal Control Framework Characteristics and Use

A. Since a bank reconciliation compares the bank statement with the company records, a bank reconciliation
prepared by a person not involved in preparing the deposit or posting the entry to reflect the receipt would
detect whether bank deposits that have been recorded have not been made.

Question 80 - Management Control Techniques

D. Budgeting is a realistic plan for the future expressed in quantitative terms. Budgeting serves as planning,
control, coordination, evaluation tool, etc. However, based on the definition of budgeting, the principal
advantage is forced planning.

Question 81 - Internal Control Framework Characteristics and Use

A. Using predetermined totals to control posting routines is a preventive control.

Question 82 - Fraud Risk Awareness

C. Fraud can encompass an array of irregularities and illegal acts characterized by intentional deception.
Persons outside as well as inside the organization can perpetrate fraud.

Question 83 - Fraud Risk Awareness

B. The rapid turnover of financial executives may be considered an indication of possible fraud. It may be an
indication of weak performance and ineffective internal controls.

Question 84 - Fraud Risk Awareness

D. In the event that an internal auditor detects probable employee fraud, the auditor's responsibility is to
immediately report the findings to management and to make a recommendation as to whether sufficient
information exists to conduct an investigation.

Question 85 - Fraud Risk Awareness

B. When conducting fraud investigations, internal auditors should assess the probable level of, and the extent
of complicity in, the fraud within the organization. It is important to know how many people may be involved
and who they are.

Question 86 - Internal Control Framework Characteristics and Use

B. Authorization of additions to and deletions from the payroll should come from the personnel department.

Question 87 - Internal Control Framework Characteristics and Use

A. This is the proper organizational structure to prevent unauthorized changes in the payroll. The personnel
office is responsible for hiring, firing and changes in pay levels of all employees. The payroll office is
responsible for maintaining the payroll records. Segregating these functions will help to prevent fraud.

Question 88 - Fraud Risk Awareness

A. The CAE has the responsibility to report immediately any incident of significant fraud to senior
management and the board. Thus, the CAE should inform the treasurer and CFO of the suspected fraud.

Question 89 - Fraud Risk Awareness

C. The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization
manages fraud risk (Standard 2120.A2). Internal auditors are responsible for assisting companies prevent
fraud by examining and evaluating the adequacy and effectiveness of their internal controls’ system,
commensurate with the extent of a potential exposure within the organization.

Question 90 - Internal Control Framework Characteristics and Use

B. It is appropriate to require supervisory approval of employee time cards, because supervisors are in a
position to know whether their employees' time is being reported accurately.

Question 91 - Internal Control Framework Characteristics and Use

B. Requiring existing security guards to log in and out the times of plan departure and scrap yard arrival
would seem to be logical since it would add no additional cost to the organization.

Question 92 - Fraud Risk Awareness

A. A written report or other formal communication should be issued at the conclusion of the investigation
phase. It should include all observations, conclusions, recommendations, and corrective action taken.

Question 93 - Fraud Risk Awareness

D. The internal auditor should recommend the initiation of a conflict-of-interest policy. A conflict-of-interest
policy is a guideline that restricts business dealings with relatives unless fully disclosed and approved by
senior management.

Question 94 - Fraud Risk Awareness

B. Internal auditors are responsible for assisting in the deterrence of fraud by examining and evaluating the
adequacy and the effectiveness of the system of internal control, commensurate with the extent of the
potential exposure/risk in the various segments of the organization's operations.

Question 95 - Types of Controls

D. Feedback controls identify when something has already gone wrong. Variance analysis reviews deviation
from a standard, so therefore it is a feedback control.

Question 96 - Types of Controls

A. Control is any action taken by management, the board, and other parties to enhance risk management and
increase the likelihood that established objectives and goals will be achieved.

Question 97 - Fraud Risk Awareness

A. An adequate system of internal controls is most likely to detect a fraud perpetrated by a single employee.
Because of segregation of duties, one employee acting alone may not have the ability to commit a fraud; or if
one employee were to commit a fraud, the chances would be greater that other employees would detect it.
Question 98 - Internal Control Framework Characteristics and Use

A. Management's monitoring of performance is a control process.

Question 99 - Management Control Techniques

C. The critical path is the path that takes the longest to complete. In this case, it is A-D-E, which takes 15 days.

Question 100 - Internal Control Framework Characteristics and Use

A. Comparing the quantities of scrap expected from the production process with quantities sold should verify
whether sale of scrap is well controlled. If the quantities of scrap sold are approximately the same as
quantities produced, the sale of the scrap is well controlled.

Question 101 - Fraud Risk Awareness

D. Internal auditors are responsible for assisting in the deterrence of fraud by examining and evaluating the
adequacy and the effectiveness of controls, commensurate with the extent of the potential exposure/risk in
the various segments of the organization's operations.

Question 102 - Internal Control Framework Characteristics and Use

B. The most effective control to prevent the fraud would be separating of duties between the ordering and
receiving of merchandise. By separating these duties, the goods would have been sent to the organization,
thus, eliminating the opportunity for the employee to pick up the supplies at the vendor's warehouse.

Question 103 - Fraud Risk Awareness

C. There's more of an incentive to falsify information, etc., if unreasonable sales and production goals are set.

Question 104 - Fraud Risk Awareness

D. Submitting gasoline and repair bills that are higher than company average is not an indication of fraudulent
loans. These are factors that are not entirely controllable by the loan officer. For example, if the car is older it
may require more maintenance repair, etc.
Question 105 - Fraud Risk Awareness

A. A trend analysis could help detect an unexplained increase in loan default caused by bogus loans.

Question 106 - Fraud Risk Awareness

D. Reviewing a sample of loan documents, such as loan agreements, credit approvals and approval of
secured collateral could determine the presence of fraudulent loans. For example, it is unlikely that a
fraudulent loan would have secured collateral.

Question 107 - Fraud Risk Awareness

C. Reconciling the outstanding loans to the general ledger balance would not indicate fraudulent activity
since the fraudulent loans would be properly accounted for.

Question 108 - Management Control Techniques

D. PERT is a project management technique; it is not related to facility layout and design (The other three
techniques are related).

Question 109 - Fraud Risk Awareness

D. By conducting an analytical test comparing production, materials purchased, and raw materials inventory
levels the internal auditor would be able to show that there was unexplained increase in material usage.

Question 110 - Fraud Risk Awareness

D. Living beyond one's means is an example of where a person has embezzled organization's funds.

Question 111 - Fraud Risk Awareness

C. The responsibilities of internal auditors for detecting fraud including having sufficient knowledge of fraud
to be able to identify indicators that fraud may have been committed. Negative organizational changes may be
an indication of fraud. Thus, recognizing and questioning changes that occur in the organization is critical for
fraud detection.
Question 112 - Fraud Risk Awareness

D. When an internal auditor suspects wrongdoing, the appropriate authorities within the organization should
be informed. The internal auditor may recommend whatever investigation is considered necessary in the
circumstances. Furthermore, only when the incidence of significant fraud has been established to a
reasonable certainty, senior management and the board should be notified immediately.

Question 113 - Fraud Risk Awareness

C. An internal auditor should not indicate that management will forgo prosecution if restitution is made.

Question 114 - Internal Control Framework Characteristics and Use

A. This is not a control strength. Periodic rotation of duties among product lines would be a control strength
to prevent buyers from becoming too familiar with particular vendors. Too much familiarity could lead to
kickbacks or less emphasis on negotiating prices more favorable to the organization.

Question 115 - Fraud Risk Awareness

D. Red flags are associated with fraudulent conduct. However, many red flags are personal in nature and
would not necessarily come to the attention of the auditor. These would include items such as excessive
living style of a manager or excessive gambling.

Question 116 - Types of Controls

A. Feedforward controls are control activities that detect the problem before it occurs.

Question 117 - Fraud Risk Awareness

D. Fraud encompasses a range of irregularities and illegal acts characterized by intentional deception or
misrepresentation, which an individual knows to be false or does not believe to be true. In this situation, the
use of an expert (in this case a lawyer) would be necessary to determine if the activity is in violation of the
contract. If it is not in violation, then it could not be considered an intentional deception.

Question 118 - Management Control Techniques

C. This would permit the supplier to increase profit without actually raising the price.
Question 119 - Types of Controls

A. Verifying that the prompt feedback on variances is provided to management is one way internal auditors
facilitate the management function of controlling.

Question 120 - Management Control Techniques

D. This would be the least effective because it is based only on those people who send in donations. The
concern is that callers will send their donations to other locations suggested by the phone solicitors.

Question 121 - Fraud Risk Awareness

B. Delegating authority to make purchases under a certain value is not considered a red flag.

Question 122 - Fraud Risk Awareness

B. All items are true regarding the deterrence of fraud. Internal auditors are responsible for assisting in the
deterrence of fraud by examining and evaluating the adequacy and the effectiveness of the system of internal
control, commensurate with the extent of the potential exposure/risk in the various segments of the
organization's operations.

Question 123 - Types of Controls

C. Preventive controls are actions taken prior to the occurrence of transactions with the intent of stopping
errors from occurring. Use of an approved vendor list is a control to prevent the use of unacceptable
suppliers.

Question 124 - Fraud Risk Awareness

A. When an internal auditor suspects wrongdoing, the appropriate authorities within the organization should
be informed. The internal auditor may recommend whatever investigation is considered necessary in the
circumstances. Thereafter, the auditor should follow up to see that the internal auditing activity's
responsibilities have been met.

Question 125 - Internal Control Framework Characteristics and Use

A. Common shareholders are not responsible for implementing organizational change.

Question 126 - Fraud Risk Awareness

D. This is considered a "red flag" that indicates possible fraud.

Question 127 - Management Control Techniques

D. Periodic examination of accounts of employees with access to automated teller functions may detect
unusual activity to and from employees' accounts.

Question 128 - Fraud Risk Awareness

A. This would be the area of greatest risk because the dollars expended are very large and inadequate
controls could lead to grants used for fraudulent purposes.

Question 129 - Fraud Risk Awareness

D. The board of directors and audit committee are responsible for the oversight function and are the
appropriate authorities to respond to press inquiries.

Question 130 - Fraud Risk Awareness

A. Auditors are required to report the results of their audit work. The results indicate a breakdown in an
important control procedure that should be brought to the attention of senior oversight officials.

Question 131 - Management Control Techniques

B. Reconciling the back-order file to shipments daily would identify unfilled orders for appropriate action.

Question 132 - Management Control Techniques

B. This policy would offer the best means of physical custody to prevent loss or theft.

Question 133 - Internal Control Framework Characteristics and Use

D. A good system of internal controls is likely to expose an irregularity if it is perpetrated by one employee,
without the aid of others.

Question 134 - Types of Controls

C. Internal control can only provide reasonable assurance regarding the achievement of an entity's
objectives, not a guarantee. Controls may be preventive (to deter undesirable events from occurring),
detective (to detect and correct undesirable events which have occurred), or directive (to cause or encourage
a desirable event to occur). Thus, prevention, detection, and correction are three functions of internal
controls.

Question 135 - Fraud Risk Awareness

B.

In conducting audit assignments, the internal auditor should have sufficient knowledge of fraud to identify
red flags indicating fraud may have been committed. If fraud is indicated then the internal auditor should
expand activities to determine whether an investigation is warranted.

Question 136 - Fraud Risk Awareness

A. When an internal auditor suspects wrongdoing, the appropriate authorities within the organization should
be informed. The internal auditor may recommend whatever investigation is considered necessary in the
circumstances. Thereafter, the auditor should follow up to see that the internal auditing department's
responsibilities have been met.

Question 137 - Types of Controls

A. Collusion will circumvent the impact of the best of controls.

Question 138 - Internal Control Framework Characteristics and Use

C. Receiving reports should go directly to accounts payable to achieve proper segregation of duties.

Question 139 - Internal Control Framework Characteristics and Use

A. This will allow matching all recorded shipments to related billings.

Question 140 - Internal Control Framework Characteristics and Use

C. After initiation by the personnel department, the functional department should have approval authority.

Question 141 - Internal Control Framework Characteristics and Use

A. The relative risk of loss to the company would be lower if a temporary employee were responsible for the
error. This suggests an isolated incident, as the employee will not be able to repeat the error once he or she
has left the purchasing department. However, the error should still be reported to manage-ment.

Question 142 - Management Control Techniques

A. This may encourage receiving personnel to merely write the same quantity on the receiving report, without
honestly counting the shipment. Omitting the quantity on the copy of the purchase order would force
receiving personnel to count each shipment.

Question 143 - Internal Control Framework Characteristics and Use

D. The existence of such a contract would prevent disputes relating to recoverability of charges and
expenses.

Question 144 - Internal Control Framework Characteristics and Use

C. Supervisory review at the originating department level is one means of control over the number of items
ordered.

Question 145 - Internal Control Framework Characteristics and Use

C. A shipment should be rejected if it is not documented by a purchase order in the open file.

Question 146 - Internal Control Framework Characteristics and Use

C. Separating the cash receipts and recordkeeping functions prevents an employee from misappropriating
cash and altering the records to conceal it.
Question 147 - Internal Control Framework Characteristics and Use

C. Independent reconciliation of bank accounts is necessary for good internal control.

Question 148 - Management Control Techniques

C. Specifications for materials purchased provide an objective means of determining that the materials meet
the minimum quality level required for production.

Question 149 - Internal Control Framework Characteristics and Use

A. When duties are separated, users cannot obtain a detailed knowledge of programs and computer operators
cannot gain unsupervised access to production programs.

Question 150 - Types of Controls

A.

Control should be designed to provide reasonable assurance that:

Financial and operational information is reliable and possesses integrity.
Operations are performed efficiently and achieve effective results.
Assets are safeguarded.
Actions and decisions of the organization are in compliance with laws, regulations, and contracts.

Question 151 - Types of Controls

C. Feedforward controls are instigated to prevent a problem from occurring. Examples of feedforward
controls are budgeting, training, and forecasting. Policies and procedures are other examples.

Question 152 - Types of Controls

A. Concurrent controls are in operation at the same time as the production process itself.

Question 153 - Internal Control Framework Characteristics and Use

C. Reconciliation would verify that data entry is accurate and complete.

Question 154 - Internal Control Framework Characteristics and Use

D. All items would be considered internal control strengths of the organization.

Question 155 - Internal Control Framework Characteristics and Use

C. Signing and distributing payroll checks is not a violation of segregation of duties since the person is not
authorizing or reporting payroll.

Question 156 - Fraud Risk Awareness

A. There are certain risk factors that are related to the fraudulent misstatement of financial reports. These risk
factors include (1) incentives/pressures, (2) opportunities, and (3) attitudes/rationalization. The risks factors
in the incentives/pressures category concerns threats to financial stability or profitability by economic,
industry, or entity operating conditions, such as an industry that is experiencing declining customer demand.

Question 157 - Internal Control Framework Characteristics and Use

B. The controller has responsibility for the recordkeeping functions relating to stock certificates. The
controller should not have access to the assets, because that is a custody function.

Question 158 - Types of Controls

C. While strong internal control can limit employee fraud, complete elimination of employee fraud is not
possible, and so this cannot be considered a benefit of a strong internal control system.

Question 159 - Internal Control Framework Characteristics and Use

B. An individual performing the recordkeeping function should not be able to compare the accounting record
of the asset with the asset itself, because this is a reconciliation function and the reconciliation function
should be separate from the recordkeeping function.

Question 160 - Internal Control Framework Characteristics and Use

B.
The rule in segregation of duties is that one person should not be in a position to commit fraud and also to
cover it up.

Timekeeping and preparation of payroll journal entries are two duties that can be done by the same person.
Preparation of payroll journal entries is creating the entries to the accounting system that are used to record
the payroll. It does not involve writing the payroll checks. So a person who records time for others can also
create the entries to record the payroll in the accounting system, because there is nothing in those two duties
that would give that person any additional opportunity to commit fraud and also cover it up.

Question 161 - Internal Control Framework Characteristics and Use

D. Check signing is a custodial function. By giving the signature block to the assistant treasurer, the treasurer
is delegating the check-signing function. As long as neither the treasurer nor the assistant treasurer performs
the authorization, recordkeeping, or reconciliation functions as well, there is no violation of the principle of
segregation of functions.

Question 162 - Internal Control Framework Characteristics and Use

C. Recording of cash receipts is a recordkeeping function and preparation of bank reconciliations is a

reconciliation function. If the same person were to perform both functions, that person could misappropriate
cash payments and conceal the misappropriation by falsifying the reconciliation.

Question 163 - Internal Control Framework Characteristics and Use

A. Internal control is a method, or process, that is carried out by an entity's board of directors, CEO, senior
management and other personnel, and designed to provide reasonable assurance that the company's
objectives will be achieved.

Question 164 - Types of Controls

A. Feedback, feedforward and preventive control systems do not necessarily take place in any given order,
and this question is not saying that they should or do. It is simply asking you to give an example of each of
the types of control systems in the order given in the question. Cost accounting variances are an example of
a feedback control system, the first type of control listed in the question. Cash budgeting is an example of a
feedforward control, the second type of control listed in the question. And organizational independence is an
example of a preventive control, the third type of control listed in the question.

Question 165 - Internal Control Framework Characteristics and Use

C. An accounts receivable clerk who receives customer remittances, deposits funds in the bank, and who has
the authority to approve sales returns and allowance is a reportable condition. The clerk could steal a
customer remittance and cover up the theft by approving a credit memo to the customer's account.
Question 166 - Internal Control Framework Characteristics and Use

D. If delinquent accounts are reviewed only by the sales manager, this is an internal control weakness. The
sales manager may have a conflict of interest, not wanting to report an account as delinquent if it means
additional sales cannot be made to that customer. Delinquent accounts should be reviewed regularly by the
credit manager and the accounts receivable manager.

Question 167 - Internal Control Framework Characteristics and Use

C. If supervisors are permitted to distribute paychecks, a supervisor could terminate an employee but not
report the termination, then continue to clock the employee in and out and receive the employee's paycheck.

Question 168 - Internal Control Framework Characteristics and Use

C. Vendor's invoices should be matched against purchase requisitions, purchase orders, and receiving
reports before any liability is recorded. When the payment has been approved, the accounts payable
department should prepare a voucher, which is an internal document that is the authorization for payment.

Question 169 - Internal Control Framework Characteristics and Use

A. The Sales Department should not have authority to approve a sales credit memo because of a product
return. Credit memos should be approved only upon receipt of a receiving report evidencing the product's
return, and the approval should not come from the Sales Department because of the potential for booking
sales in one period and reversing them the next.

Question 170 - Internal Control Framework Characteristics and Use

D.

The rule in segregation of duties is that one person should not be in a position to commit fraud and also to
cover it up. It would be appropriate for the person who prepares the payroll to also maintain year-to-date
records. There is nothing in these two duties that would give one person doing both of them an opportunity
to commit fraud and also to cover it up.

Furthermore, payroll preparation and maintenance of year-to-date records are both recordkeeping functions
and for that reason, they are not incompatible. It is acceptable for both functions to be performed by the same
person.

Question 171 - Types of Controls

B. Depending on the production process, there are 3 types of controls, including feedforward controls,
concurrent controls, and feedback controls. Feedback controls identify when something has already gone
wrong. Thus, the development of IT will not eliminate the need for feedback controls.

Question 172 - Internal Control Framework Characteristics and Use

B. Planning is one of the twenty criteria, as identified in the CoCo model. However, planning is not a
component of the model. The CoCo model consists of four components: Purpose, Commitment, Capability,
and Monitoring and Learning.

Question 173 - Internal Control Framework Characteristics and Use

A. Putting in controls is a capability criteria, not a purpose criteria.

Question 174 - Internal Control Framework Characteristics and Use

D. Both models emphasize the importance of internal control for the achievement of objectives, which
includes both financial, compliance and operational objectives, not just financial objectives.

Question 175 - Internal Control Framework Characteristics and Use

C. This criteria belongs with the monitoring and learning component.

Question 176 - Internal Control Framework Characteristics and Use

B. Internal controls cannot provide a guarantee that objectives will be achieved in a timely manner.

Question 177 - Fraud Risk Awareness

C. Duplication of payments is an area of fraud that the internal auditor should be alert to.

Question 178 - Internal Control Framework Characteristics and Use

A. This is a false statement about risk assessment. A precondition to risk assessment is the establishment of
objectives, not the establishment of a risk committee. A risk committee is established to assist the board in
managing risks.

Question 179 - Risk Vocabulary and Concepts

A. As defined by Statement on Management Accounting: Enterprise Risk Management: Frameworks,

Elements and Integration, the amount of risk that remains after management has taken action to mitigate the
risk is known as residual risk. There will almost always be some amount of residual risk.

Question 180 - Risk Vocabulary and Concepts

B. The internal environment of the organization − the attitude in the organization toward risk and risk
management − is the basis for all the other components of an Enterprise Risk Management (ERM) system.

Question 181 - Risk Vocabulary and Concepts

B. The control environment is not a component of an ERM system as defined by COSO. The control
environment is a component of internal control as defined by COSO in the document Internal Control —
Integrated Framework.

Question 182 - Risk Vocabulary and Concepts

C. These are the four categories of objectives identified by the COSO ERM document.

Question 183 - Risk Vocabulary and Concepts

C. Identification and management of multiple and cross-enterprise risks is a benefit of an effective ERM
system. Enterprise Risk Management is different from traditional risk management where the heads of the
various units identify and manage the risks they perceive as affecting their own unit's ability to achieve its
objectives. With ERM, risks that affect the whole enterprise -- cross-enterprise risks -- that may be missed by
individual department or division heads are recognized and managed.

Question 184 - Risk Vocabulary and Concepts

D. Enterprise risk management (ERM) is defined as "a process, effected by an entity’s board of directors,
management and other personnel, applied in strategy setting and across the enterprise, designed to identify
potential events that may affect the entity, and manage risk to be within its risk appetite, to provide
reasonable assurance regarding achievement of entity objectives." A review of incidents and new market
conditions is a strategy designed to identify potential events that may affect the entity and to manage risk.