CFA Internal Control Evaluation 2 — Questions and Answers
Question 1: Which control activity is most effective at preventing fictitious vendor payments?
- Mandatory vendor approval and verification before setup in accounts payable system (Correct answer)
- Monthly bank reconciliations performed by accounts payable staff
- Requiring dual signatures on all checks over $500
- Rotating accounts payable clerks quarterly
Correct answer: Mandatory vendor approval and verification before setup in accounts payable system
Preventing fictitious vendors requires a robust vendor vetting and approval process before any payment can be initiated.
Question 2: A company's IT department has unrestricted access to both program source code and production data. This represents a failure in which control principle?
- Risk assessment
- Segregation of duties (Correct answer)
- Control environment
- Monitoring activities
Correct answer: Segregation of duties
When the same individuals control programming and live data, they can alter programs and conceal the changes, violating segregation of duties.
Question 3: Under the COSO framework, 'tone at the top' is a component of which element?
- Risk Assessment
- Control Activities
- Control Environment (Correct answer)
- Information and Communication
Correct answer: Control Environment
Tone at the top — management's ethical stance and commitment to integrity — is the foundation of the Control Environment component.
Question 4: An auditor discovers that purchase orders are approved by the same employee who receives goods. What type of fraud risk does this create?
- Financial statement fraud through revenue manipulation
- Misappropriation of assets through fictitious purchases or theft of inventory (Correct answer)
- Corruption through undisclosed conflicts of interest
- Expense reimbursement fraud
Correct answer: Misappropriation of assets through fictitious purchases or theft of inventory
When one person approves purchases and receives goods, they can order fictitious items or personally steal received inventory without detection.
Question 5: Which of the following best describes a 'preventive control'?
- A reconciliation that identifies discrepancies after transactions are posted
- A physical lock on a storage room that stops unauthorized access before it occurs (Correct answer)
- An alarm that alerts management when unusual transactions are detected
- A monthly exception report sent to the CFO
Correct answer: A physical lock on a storage room that stops unauthorized access before it occurs
Preventive controls stop fraud or errors before they occur, such as physical barriers that block unauthorized access.
Question 6: Which scenario represents a control deficiency classified as a 'material weakness' under internal control standards?
- A minor typographical error in an accounting policy document
- A single missing signature on a low-value purchase order
- The complete absence of a period-end financial close review process (Correct answer)
- A temporary delay in updating a vendor's address
Correct answer: The complete absence of a period-end financial close review process
A material weakness is a deficiency where there is a reasonable possibility that a material misstatement will not be prevented or detected, such as lacking a financial close review.
Question 7: An organization uses a compensating control because segregating payroll processing duties is not cost-effective with its small staff. Which control would best compensate?
- Hiring additional payroll clerks to enforce separation
- Having an independent manager review and approve the final payroll register before disbursement (Correct answer)
- Requiring payroll clerks to obtain external certification
- Automating the payroll system to reduce manual entries
Correct answer: Having an independent manager review and approve the final payroll register before disbursement
An independent managerial review of the payroll register provides oversight that compensates for the inability to segregate duties in a small organization.
CFA Internal Control Evaluation 2
Which control activity is most effective at preventing fictitious vendor payments?