ACFE Auditing and Internal Controls 1 — Questions and Answers
Question 1: Which component of the COSO Internal Control Framework addresses the tone set by leadership regarding ethics and control?
- Control Environment (Correct answer)
- Risk Assessment
- Control Activities
- Monitoring Activities
Correct answer: Control Environment
The Control Environment is the foundation of the COSO framework and encompasses the ethical values, governance structure, and management philosophy that set the tone for internal control.
Question 2: Which type of internal control is designed to detect fraud after it has occurred?
- Detective control (Correct answer)
- Preventive control
- Corrective control
- Directive control
Correct answer: Detective control
Detective controls are designed to identify and surface fraud or errors that have already occurred, such as account reconciliations or exception reports.
Question 3: Segregation of duties is most effective at preventing fraud when it separates which three functions?
- Authorization, custody, and recordkeeping (Correct answer)
- Purchasing, receiving, and shipping
- Payroll, HR, and benefits
- Budgeting, forecasting, and variance analysis
Correct answer: Authorization, custody, and recordkeeping
Effective segregation of duties requires that no single individual can authorize a transaction, maintain physical custody of the related asset, and record the transaction.
Question 4: An internal auditor discovers that the same employee approves purchase orders and signs vendor checks. This is an example of:
- A segregation of duties weakness (Correct answer)
- An adequate compensating control
- A detective control deficiency
- A corrective control failure
Correct answer: A segregation of duties weakness
When one employee controls both the authorization of a purchase and the disbursement of funds, a critical segregation of duties weakness exists that enables fraud.
Question 5: Which COSO framework component involves identifying and analyzing risks that could prevent an organization from achieving its objectives?
- Risk Assessment (Correct answer)
- Control Activities
- Information and Communication
- Monitoring Activities
Correct answer: Risk Assessment
The Risk Assessment component requires management to identify internal and external risks and analyze their likelihood and impact on achieving organizational objectives.
Question 6: A fraud examiner is reviewing an organization's internal controls. Which condition most increases the risk that internal controls will fail to prevent fraud?
- Management override of established controls (Correct answer)
- The use of manual rather than automated controls
- Hiring new employees without industry experience
- Outsourcing payroll to a third-party provider
Correct answer: Management override of established controls
Management override is a significant fraud risk because those with authority can circumvent even well-designed controls, which is why it is identified in both COSO and ISA 240.
ACFE Auditing and Internal Controls 1
Which component of the COSO Internal Control Framework addresses the tone set by leadership regarding ethics and control?