CGFO Internal Controls 3 — Questions and Answers
Question 1: Which of the following is an example of a detective internal control in a government setting?
- Requiring dual signatures on checks over $10,000
- Conducting monthly bank reconciliations (Correct answer)
- Restricting physical access to the server room
- Requiring purchase orders before procurement
Correct answer: Conducting monthly bank reconciliations
Bank reconciliations detect discrepancies after transactions occur, making them detective controls.
Question 2: When assessing internal control risk, a finance officer should consider both 'inherent risk' and 'control risk.' Inherent risk is best defined as:
- The risk that a control will fail to prevent a material misstatement
- The risk of a misstatement assuming no related controls exist (Correct answer)
- The risk that auditors will not detect an error
- The risk arising from complex IT systems
Correct answer: The risk of a misstatement assuming no related controls exist
Inherent risk is the susceptibility of an assertion to a material misstatement without considering any related internal controls.
Question 3: In GASB guidance, which type of fund typically carries the greatest internal control complexity due to restricted revenue streams?
- General Fund
- Capital Projects Fund
- Special Revenue Funds (Correct answer)
- Debt Service Fund
Correct answer: Special Revenue Funds
Special revenue funds hold legally restricted revenues requiring controls to ensure compliance with spending restrictions.
Question 4: An IT general control that restricts which employees can post journal entries to the general ledger is an example of:
- Application control
- Logical access control (Correct answer)
- Change management control
- Data backup control
Correct answer: Logical access control
Logical access controls govern who can access systems and perform specific functions within those systems.
Question 5: A government entity implements a policy requiring all capital asset disposals to be approved by the department director and the finance director. This is an example of:
- Dual authorization (Correct answer)
- Segregation of duties
- Management override
- Reconciliation control
Correct answer: Dual authorization
Dual authorization requires sign-off from two separate authorities, reducing the risk of unauthorized asset disposal.
Question 6: The 'tone at the top' concept in internal controls refers primarily to:
- Senior management's commitment to ethical behavior and internal control (Correct answer)
- The highest dollar threshold requiring board approval
- IT security protocols at the system administrator level
- The first item on the agenda at board meetings
Correct answer: Senior management's commitment to ethical behavior and internal control
Tone at the top describes how leadership's attitudes and actions set the ethical culture and control environment for the entire organization.
Question 7: Which activity would MOST directly test the operating effectiveness of a control rather than its design?
- Reading the purchasing policy manual
- Interviewing the CFO about authorization procedures
- Examining a sample of purchase orders for required signatures (Correct answer)
- Reviewing the organizational chart for segregation of duties
Correct answer: Examining a sample of purchase orders for required signatures
Testing a sample of actual transactions determines whether controls are functioning as designed in practice.
CGFO Internal Controls 3
Which of the following is an example of a detective internal control in a government setting?