CFC Internal Controls & Compliance 5

Question 1

A controller is evaluating whether a compensating control adequately offsets a control deficiency. Which criterion is MOST important in this evaluation?

Accepted Answer

The compensating control must achieve the same control objective as the missing or deficient control

Answer

A compensating control must address the same risk and achieve the same control objective as the deficient control to be considered an effective substitute.

Question 2

Under GDPR compliance requirements for U.S. companies doing business with EU customers, which role is responsible for overseeing data protection activities and serving as the point of contact with supervisory authorities?

Accepted Answer

Data Protection Officer

Answer

GDPR requires certain organizations to appoint a Data Protection Officer (DPO) who oversees data protection strategy, ensures compliance, and acts as liaison with supervisory authorities.

Question 3

A company's internal controls require that all journal entries above $50,000 have supporting documentation and a second reviewer's approval. An employee posts a $49,999 entry without documentation to avoid review. This is an example of:

Accepted Answer

Control circumvention through threshold manipulation

Answer

Structuring transactions just below control thresholds to avoid triggering required reviews is a form of control circumvention that exploits rigid threshold-based controls.

Question 4

Which COSO principle states that an organization should identify and analyze risks to the achievement of its objectives as a basis for determining how risks should be managed?

Accepted Answer

Principle 7 — Identifies and Analyzes Risk

Answer

COSO Principle 7 under the Risk Assessment component requires organizations to identify and analyze risks relevant to achieving objectives to determine how they should be managed.

Question 5

An organization's compliance program includes a helpline that allows employees to report violations anonymously. Under SOX, which provision requires public companies to establish such procedures?

Accepted Answer

SOX Section 301

Answer

SOX Section 301 requires audit committees of public companies to establish procedures for confidential, anonymous submission of employee concerns regarding accounting or auditing matters.

(CFC) Certified Financial Controller Practice Test

(CFC) Certified Financial Controller Practice Test

CFC Internal Controls & Compliance 5