CFC Internal Controls & Compliance 4 — Questions and Answers
Question 1: Which concept ensures that IT systems' data inputs, processing, and outputs are complete, accurate, and authorized?
- IT general controls
- Application controls (Correct answer)
- Change management controls
- Logical access controls
Correct answer: Application controls
Application controls are embedded within specific software applications to ensure the completeness, accuracy, and authorization of data processed by those systems.
Question 2: Under Dodd-Frank, the SEC's whistleblower program provides financial incentives to individuals who report securities law violations. What is the minimum percentage of sanctions that a whistleblower may receive?
- 5%
- 10% (Correct answer)
- 15%
- 25%
Correct answer: 10%
Under Dodd-Frank's SEC whistleblower program, eligible whistleblowers may receive between 10% and 30% of sanctions collected when the total exceeds $1 million.
Question 3: A controller discovers that the company's revenue recognition policy allows premature recognition of sales before delivery. Which COSO component has most clearly failed?
- Monitoring Activities
- Control Activities
- Risk Assessment
- Control Environment (Correct answer)
Correct answer: Control Environment
The Control Environment includes the ethical tone, policies, and management's commitment to integrity; a policy that allows improper revenue recognition reflects a failed Control Environment.
Question 4: An organization uses a 'three lines of defense' model. Which line is represented by the internal audit function?
- First line
- Second line
- Third line (Correct answer)
- Fourth line
Correct answer: Third line
In the three lines of defense model, the third line is internal audit, which provides independent assurance; the first line is operational management, and the second line is risk and compliance functions.
Question 5: A company's external auditors issue an adverse opinion on internal controls over financial reporting. What does this mean for investors?
- The financial statements contain a material error
- There is a material weakness that could result in a material misstatement (Correct answer)
- The company must immediately restate its financial statements
- The company's stock will be delisted from exchanges
Correct answer: There is a material weakness that could result in a material misstatement
An adverse ICFR opinion means the auditor has identified one or more material weaknesses, indicating the controls may not prevent or detect material misstatements.
Question 6: Which regulation requires financial institutions to implement programs to detect and prevent money laundering, including filing Suspicious Activity Reports (SARs)?
- Sarbanes-Oxley Act (SOX)
- Bank Secrecy Act (BSA) (Correct answer)
- Dodd-Frank Wall Street Reform Act
- USA PATRIOT Act Section 302
Correct answer: Bank Secrecy Act (BSA)
The Bank Secrecy Act (BSA) requires financial institutions to assist government agencies in detecting and preventing money laundering, including SAR filing requirements.
Question 7: When assessing the risk of fraud in a financial reporting context, which of the following factors would MOST increase the risk of management override of controls?
- Strong board oversight and an active audit committee
- Management compensation tied heavily to short-term earnings targets (Correct answer)
- Comprehensive whistle-blower policies
- Frequent rotation of external auditors
Correct answer: Management compensation tied heavily to short-term earnings targets
When management compensation is heavily tied to short-term financial results, there is a strong incentive to manipulate reported earnings, increasing the risk of management override.
CFC Internal Controls & Compliance 4
Which concept ensures that IT systems' data inputs, processing, and outputs are complete, accurate, and authorized?