Risk-Control Frameworks Flashcards

Auditors learn about internal control of an entity primarily for the following reasons:

Answer: Determining the nature, extent and timing of subsequent audit procedures to be performed.

Auditors gain an understanding of an entity's internal control system primarily to assess control risk. This assessment directly influences the audit strategy, specifically determining the nature (type), extent (quantity), and timing (when) of the substantive audit procedures that will be performed. A stronger internal control system may allow for less extensive substantive testing.

The main factor an auditor looks at when evaluating an entity's internal controls is whether they

Answer: Affect the financial statement assertions.

When evaluating internal controls, an auditor's main concern is how these controls relate to the financial statement assertions (e.g., existence, completeness, valuation, rights and obligations). Effective controls reduce the risk of material misstatements related to these assertions, thereby impacting the auditor's assessment of control risk and the scope of substantive testing.

Which of the following assertions regarding internal control is true?

Answer: The cost-benefit relationship is a primary criterion that should be considered in designing an internal control system.

Internal control systems should be designed with a consideration of the cost-benefit relationship. The cost of implementing and maintaining a control should not exceed the expected benefits derived from it, such as reduced risk of error or fraud. While controls are important, they are not expected to be foolproof or infinitely expensive.

All of the following, with the exception of, are aimed to help the organization meet its goals through internal controls:

Answer: Reduction of debt financing costs.

Internal controls are designed to help an organization achieve its objectives related to the reliability of financial reporting, the effectiveness and efficiency of operations (including safeguarding assets), and compliance with applicable laws and regulations. While strong internal controls can indirectly influence a company's creditworthiness, their direct aim is not the reduction of debt financing costs.

Which of the following is not one of internal control's five main pillars?

Answer: Human resource background checks.

The five main components of internal control, as per the COSO framework, are: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities. Human resource background checks are a specific control activity within the broader 'Control Activities' component, but they are not one of the five overarching pillars themselves.

The COSO Internal Control—Integrated Framework's monitoring section is important. Which of the following statements regarding how the business can implement the monitoring component is false?

Answer: The independent auditor can serve as part of the entity’s control environment and continuous monitoring.

The independent (external) auditor provides an objective opinion on the financial statements and is external to the entity's internal control system. They cannot be part of the entity's control environment or continuous monitoring activities, as this would compromise their independence. Monitoring is an internal management responsibility, which internal auditors can support.

Which of the following is an acceptable excuse for skipping control test procedures?

Answer: The procedures require more audit effort than the projected benefits to be obtained from lowering the control risk.

Auditors perform tests of controls to assess their effectiveness and potentially reduce the extent of substantive testing. However, if the cost (audit effort) of testing controls outweighs the potential benefits (reduction in substantive testing), the auditor may decide to skip control tests and instead rely entirely on substantive procedures. This is a cost-benefit decision in audit planning.

An auditor may determine that particular statements have a high control risk after learning about an entity's internal control system because

Answer: Believes the internal controls are unlikely to be effective.

An auditor determines a high control risk when they assess that the entity's internal controls are unlikely to effectively prevent, or detect and correct, material misstatements. This belief stems from understanding the control system and identifying weaknesses or deficiencies. A high control risk assessment leads to a more extensive substantive audit approach.

Regardless of the estimated level of control risk, an auditor would complete some of the following

Answer: Substantive procedures to restrict detection risk for material transaction classes.

Regardless of the assessed level of control risk (even if it's low), an auditor must always perform some substantive procedures for material account balances and transaction classes. This is because inherent risk and detection risk always exist, and substantive procedures are essential to gather direct evidence about the fairness of financial statement assertions.

Auditors are likely to when preliminary control risk evaluations are set to high:

Answer: Complete little or no tests of controls.

When preliminary control risk evaluations are set to high, it means the auditor believes the internal controls are ineffective or unreliable. In such a scenario, testing controls extensively would be inefficient and yield little benefit. Instead, the auditor will typically choose to perform little or no tests of controls and will rely more heavily on substantive procedures to gather sufficient appropriate audit evidence.

After learning about and documenting the entity's internal controls, which of the following indicates the proper order of audit steps?

Answer: Assess control risk, test of controls, reassess control risk, determine extent of substantive testing.

The proper order of audit steps related to internal controls begins with assessing control risk based on the auditor's understanding of the entity's controls. If controls are deemed potentially effective, the auditor then performs tests of controls to verify their operational effectiveness. Following these tests, the auditor reassesses control risk based on the evidence gathered, which then directly determines the nature, timing, and extent of the substantive testing required.

Which of the following claims about the internal control documents by the auditor for the entity is true?

Answer: The auditor’s assessment of the level of control risk can be documented using a structured working paper, an internal control questionnaire or a memorandum.

Auditing standards require auditors to document their understanding and assessment of internal controls. The method for documenting the auditor's assessment of control risk is flexible and can be achieved through various means, including structured working papers, internal control questionnaires, or narrative memorandums. This allows auditors to choose the most efficient and effective documentation method for a given engagement.

The auditor must do all of the activities listed below with the exception of:

Answer: Identify all general IT controls.

While auditors consider IT controls, their objective is not to identify *all* general IT controls within an entity. Instead, the auditor focuses on identifying specific controls, including relevant IT controls, that are necessary to address risks of material misstatement and upon which they intend to rely to reduce substantive testing. Identifying every single general IT control would be an overly exhaustive and unnecessary task for audit purposes.

All of the following are involved in control risk assessment when it is not high.

Answer: Concluding that controls are ineffective.

If control risk is assessed as *not high*, it implies that the auditor believes the entity's controls are potentially effective and plans to rely on them to some extent. Therefore, concluding that controls are ineffective would contradict this initial assessment. The other options – identifying specific controls, performing tests of controls, and analyzing the achieved level of control risk – are all integral parts of the process when control risk is assessed as not high and controls are expected to be effective.

Which of the following auditing procedures would most likely give an auditor the greatest peace of mind regarding the efficacy of a control's operation?

Answer: Reperformance of the control by the auditor.

Reperformance of a control by the auditor involves the auditor independently executing the control activity to verify its operation. This procedure provides the highest level of assurance regarding the efficacy of a control's operation because the auditor directly observes and verifies the control's effectiveness, rather than relying on inquiries, observations (which are point-in-time), or walk-throughs (which confirm understanding but not necessarily consistent operation).

The best and most trustworthy audit proof that segregation of roles is effectively used is obtained by

Answer: Observation by the auditor of the employees performing control activities.

Direct observation by the auditor of employees performing control activities provides the most trustworthy audit evidence for the effective use of segregation of duties. While inquiries and flowcharts help the auditor understand the prescribed duties, observation confirms whether these duties are actually being performed as intended in practice. This real-time verification offers stronger evidence of operational effectiveness than other methods.