Internal Controls & Auditing Flashcards
7 cards from real CCS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Internal Controls & Auditing flashcards as text
When auditing a company's anti-money laundering (AML) program, which is the MOST critical control to evaluate first?
Answer: Customer due diligence (CDD) and Know Your Customer (KYC) procedures
CDD and KYC procedures are foundational AML controls that determine whether the institution properly identifies, verifies, and understands its customers and their risk profiles.
A compliance audit reveals that a company's records retention policy has not been updated since 2010 and does not reflect current regulatory requirements. This is BEST categorized as a:
Answer: Policy gap
An outdated policy that no longer aligns with regulatory requirements represents a policy gap, meaning the written governance document itself is deficient.
Which of the following BEST illustrates the concept of 'tone at the middle'?
Answer: Mid-level managers enforcing compliance policies consistently in their departments
Tone at the middle refers to how supervisors and mid-level managers reinforce and model the ethical and compliance expectations set by senior leadership.
Which internal control objective is PRIMARILY addressed by requiring two authorized signatures on checks above a certain threshold?
Answer: Authorization and approval
Dual-signature requirements ensure that disbursements above a threshold receive proper authorization from two individuals, preventing unauthorized payments.
An auditor uses Computer-Assisted Audit Techniques (CAATs) to test 100% of transactions. What is the PRIMARY advantage of this approach?
Answer: It provides complete population coverage, reducing sampling risk to zero
CAATs allow auditors to test entire transaction populations, eliminating sampling risk and enabling detection of anomalies that sampling might miss.
Which of the following describes a 'compensating control'?
Answer: An alternative control that mitigates risk when a primary control cannot be implemented
A compensating control is an alternative measure put in place to address a risk when the ideal primary control is not feasible or cost-effective to implement.
In continuous auditing, data analytics are used to monitor controls on which basis?
Answer: On an ongoing or near-real-time basis
Continuous auditing leverages automated data analytics to monitor transactions and controls on an ongoing or near-real-time basis, allowing faster identification of anomalies.