CBA Auditing Internal Controls 3 — Questions and Answers
Question 1: Under FDICIA Section 112, banks with assets above a specified threshold must obtain an external auditor's attestation on management's assessment of:
- Credit risk models
- Internal controls over financial reporting (Correct answer)
- Anti-money laundering programs
- Capital adequacy calculations
Correct answer: Internal controls over financial reporting
FDICIA Section 112 requires larger banks to have management assess internal controls over financial reporting and obtain external auditor attestation of that assessment.
Question 2: A 'material weakness' in internal controls is distinguished from a 'significant deficiency' primarily by:
- The number of control failures identified
- The likelihood and magnitude of potential misstatement (Correct answer)
- Whether management was aware of the issue
- The dollar amount of transactions affected
Correct answer: The likelihood and magnitude of potential misstatement
A material weakness represents a reasonable possibility that a material misstatement will not be prevented or detected, whereas a significant deficiency is less severe.
Question 3: When auditing a bank's wire transfer controls, which risk is MOST relevant that auditors should test specific controls for?
- Duplicate payment processing
- Unauthorized or fraudulent outbound wire transfers (Correct answer)
- Incorrect interest rate calculations
- Late filing of regulatory reports
Correct answer: Unauthorized or fraudulent outbound wire transfers
Unauthorized or fraudulent wire transfers represent the highest risk because they result in immediate, often irreversible loss of funds.
Question 4: In evaluating the design adequacy of a control, an auditor is assessing whether:
- The control has been operating consistently for at least one year
- The control, if operating as intended, would effectively mitigate the risk (Correct answer)
- Management has documented the control in written policies
- Employees have been trained on how to perform the control
Correct answer: The control, if operating as intended, would effectively mitigate the risk
Design adequacy assesses whether a control is theoretically capable of preventing or detecting a misstatement or risk if it operates as intended.
Question 5: Which of the following BEST describes a 'walk-through' in the context of internal control auditing?
- A physical inspection of bank vault contents
- Tracing a transaction from initiation to recording while observing controls (Correct answer)
- An unannounced audit visit to a branch location
- A review of prior year audit workpapers
Correct answer: Tracing a transaction from initiation to recording while observing controls
A walk-through traces a single transaction through the entire process while the auditor observes controls being performed, confirming process understanding.
Question 6: The 'three lines of defense' model in banking assigns internal audit to which line?
- First line — operational management
- Second line — risk management and compliance
- Third line — independent assurance (Correct answer)
- Fourth line — external oversight
Correct answer: Third line — independent assurance
Internal audit represents the third line of defense, providing independent assurance on the effectiveness of the first two lines.
Question 7: An auditor testing a bank's reconciliation controls finds that the reconciliation is prepared but never reviewed or approved. This represents:
- A material weakness because reconciliations are ineffective
- A significant deficiency due to missing supervisory review
- Acceptable practice if discrepancies are below materiality threshold
- A design deficiency because the control is incomplete (Correct answer)
Correct answer: A design deficiency because the control is incomplete
A reconciliation without supervisory review is a design deficiency because an effective reconciliation control requires both preparation and independent review.
CBA Auditing Internal Controls 3
Under FDICIA Section 112, banks with assets above a specified threshold must obtain an external auditor's attestation on management's assessment of: