Internal Controls & Risk Assessment Flashcards

Which control activity ensures that no single employee can both authorize a transaction and record it in the accounting system?

Answer: Segregation of duties

Segregation of duties divides authorization, recording, and custody functions among different employees to prevent fraud and error.

An organization's risk appetite is BEST described as:

Answer: The level of risk the organization is willing to accept in pursuit of its objectives

Risk appetite defines how much risk management is prepared to accept when pursuing strategic objectives.

Which type of control is designed to discover errors or irregularities AFTER they have occurred?

Answer: Detective control

Detective controls identify problems that have already happened, such as bank reconciliations or exception reports.

A company requires two authorized signatures on all checks exceeding $10,000. This is an example of:

Answer: Dual authorization

Dual authorization requires more than one person to approve high-value transactions, reducing the risk of unauthorized payments.

Residual risk is defined as the risk that remains:

Answer: After management has responded to the risk

Residual risk is the exposure that still exists after management applies controls or other risk responses.

Which component of the COSO Internal Control framework addresses the organization's commitment to integrity and ethical values?

Answer: Control Environment

The Control Environment sets the tone at the top, including ethical values, governance structure, and management's commitment to competence.

A purchasing manager who also approves invoices from the same vendor presents which type of risk?

Answer: Conflict of interest risk

When the same person selects vendors and approves their invoices, there is a conflict of interest that may lead to fraudulent or biased payments.