Auditing Internal Controls Flashcards

Which component of the COSO Internal Control-Integrated Framework is generally considered the foundation for all other components, encompassing the 'tone at the top' set by the board of directors and senior management?

Answer: Control Environment

The Control Environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline, structure, and ethical values.

A bank's loan origination system is configured to prevent a loan officer from processing a loan application that exceeds their authorized lending limit by automatically rejecting the submission. This system feature is an example of which type of internal control?

Answer: Preventive

Preventive controls are designed to stop an error or irregularity from occurring in the first place. The system's block on exceeding lending limits actively prevents the unauthorized transaction from being completed.

When testing the effectiveness of a bank's internal control over the wire transfer approval process, which of the following audit procedures generally provides the most persuasive evidence?

Answer: Reperforming the approval control for a selected sample of wire transfers.

Reperformance involves the auditor independently executing procedures or controls that were originally performed as part of the entity's internal control. It provides the highest level of assurance because the auditor is directly verifying the control's effectiveness, rather than relying on inquiry (what people say), observation (what people do when watched), or inspection (the paper trail).

An internal auditor discovers that a bank's reconciliation process for a correspondent bank account, which has a material balance, was not performed for three consecutive months due to employee turnover. This failure means that a material misstatement of the financial statements would not be detected in a timely manner. How should this control failure be classified?

Answer: A material weakness.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis. The failure to reconcile a material account for an extended period directly fits this definition.

According to established auditing standards and corporate governance principles, who has the primary responsibility for establishing and maintaining an effective system of internal controls within a bank?

Answer: The bank's management

While the board provides oversight, auditors provide independent assurance, and regulators set requirements, it is the bank's management that has the direct, primary responsibility for designing, implementing, and maintaining the institution's internal control system.

An internal auditor is assessing the overall effectiveness of a bank's internal control framework. Despite a well-designed system with proper segregation of duties, which of the following represents an inherent limitation that could still allow a material fraud to occur?

Answer: Collusion between a loan officer and a credit analyst to approve a fraudulent loan.

Inherent limitations are weaknesses that can exist even in a well-designed internal control system. Collusion, where two or more people work together to circumvent controls, is a classic example that can defeat segregation of duties. The other options are examples of design or operating deficiencies, not inherent limitations of an otherwise effective system.