Certified Management Accountant Internal Controls 3 — Questions and Answers
Question 1: According to Sarbanes-Oxley Section 302, who must certify the effectiveness of disclosure controls and procedures?
- Chief Audit Executive and CFO
- CEO and CFO (Correct answer)
- Board of Directors and CEO
- External auditors and audit committee
Correct answer: CEO and CFO
SOX Section 302 requires the CEO and CFO to personally certify the effectiveness of the company's disclosure controls quarterly.
Question 2: Which of the following is an example of an application control rather than a general IT control?
- Disaster recovery planning
- Access management policies
- Input validation edits on a data entry screen (Correct answer)
- Change management procedures
Correct answer: Input validation edits on a data entry screen
Input validation edits are application controls that operate within a specific application to ensure data integrity at the transaction level.
Question 3: The 'control environment' in the COSO framework is often called the foundation of internal control because it:
- Includes all physical security measures
- Sets the tone and culture influencing how other controls operate (Correct answer)
- Defines specific control procedures for each transaction type
- Provides the risk assessment methodology
Correct answer: Sets the tone and culture influencing how other controls operate
The control environment establishes the tone at the top and organizational culture, which directly affects the effectiveness of all other control components.
Question 4: A walkthrough in internal control testing involves:
- Reviewing a large sample of transactions statistically
- Tracing a transaction from initiation to final recording (Correct answer)
- Interviewing all employees in a department
- Comparing financial results to prior periods
Correct answer: Tracing a transaction from initiation to final recording
A walkthrough traces a single transaction through all process steps to confirm controls are designed as described and are operating.
Question 5: Which internal control principle requires that employees' recorded responsibilities match their actual duties?
- Establishment of responsibility (Correct answer)
- Segregation of duties
- Documentation procedures
- Physical controls
Correct answer: Establishment of responsibility
Establishment of responsibility assigns specific duties to specific individuals so accountability can be maintained.
Question 6: A 'significant deficiency' in internal controls under PCAOB standards is:
- Less severe than a material weakness but still warrants attention by management (Correct answer)
- More severe than a material weakness
- Equivalent to a material weakness
- Only relevant for non-public companies
Correct answer: Less severe than a material weakness but still warrants attention by management
A significant deficiency is a control deficiency less severe than a material weakness but important enough to merit attention from those charged with governance.
Question 7: Preventive controls in accounts payable would include which of the following?
- Reviewing vendor invoices after payment
- Requiring three-way matching before approving payment (Correct answer)
- Reconciling the accounts payable ledger monthly
- Investigating duplicate payments after processing
Correct answer: Requiring three-way matching before approving payment
Three-way matching (purchase order, receiving report, invoice) prevents unauthorized or erroneous payments before they occur.
Certified Management Accountant Internal Controls 3
According to Sarbanes-Oxley Section 302, who must certify the effectiveness of disclosure controls and procedures?