CIA Auditing & Internal Controls 2 — Questions and Answers
Question 1: An internal auditor finds that the same employee can create a new vendor in the master file and approve payments to that vendor. Which control weakness does this represent?
- Inadequate physical safeguards
- Lack of segregation of duties (Correct answer)
- Insufficient independent reconciliation
- Weak IT general controls over change management
Correct answer: Lack of segregation of duties
Combining vendor setup with payment approval lets one person create a fictitious vendor and pay it, which is a segregation of duties failure.
Question 2: Under the COSO Internal Control–Integrated Framework (2013), which component includes the board's oversight responsibility and management's commitment to integrity and ethical values?
- Risk assessment
- Control activities
- Control environment (Correct answer)
- Monitoring activities
Correct answer: Control environment
The control environment sets the tone at the top and includes integrity, ethical values, and board oversight.
Question 3: Which type of control is a monthly bank reconciliation performed by someone independent of cash handling?
- Detective control (Correct answer)
- Preventive control
- Directive control
- Compensating control only
Correct answer: Detective control
A bank reconciliation identifies errors or irregularities after they occur, which makes it a detective control.
Question 4: An auditor wants to test whether all shipments were billed. Which direction of testing is most appropriate?
- Select sales invoices and trace to shipping documents
- Select shipping documents and trace to sales invoices (Correct answer)
- Select customer remittances and trace to the general ledger
- Select general ledger entries and vouch to customer orders
Correct answer: Select shipping documents and trace to sales invoices
Testing completeness means starting from the source event (shipment) and tracing forward to the recorded invoice.
Question 5: Which statement best describes inherent risk?
- The risk that controls will fail to prevent a material error
- The risk that the auditor's procedures will fail to detect an error
- The susceptibility of an assertion to misstatement before considering related controls (Correct answer)
- The risk remaining after management has responded to identified risks
Correct answer: The susceptibility of an assertion to misstatement before considering related controls
Inherent risk is the level of risk that exists before any internal controls are considered.
Question 6: When control risk is assessed as high, how should an auditor generally adjust substantive testing to keep audit risk acceptable?
- Reduce the extent of substantive testing
- Perform substantive tests at an interim date only
- Rely more heavily on management inquiries
- Increase the extent of substantive testing (Correct answer)
Correct answer: Increase the extent of substantive testing
Higher control risk requires lower detection risk, which is achieved by performing more or stronger substantive procedures.
Question 7: A compensating control is best described as:
- A control that offsets a weakness in another control by reducing the same risk (Correct answer)
- A control that pays employees for reporting fraud
- A duplicate control performed by external auditors
- A control used only during system conversions
Correct answer: A control that offsets a weakness in another control by reducing the same risk
Compensating controls reduce the same risk when a primary control is missing or not feasible, such as close supervisory review in a small department.
