Governance & Internal Controls Flashcards

The principle of 'management override' is considered the most significant limitation of internal control because it:

Answer: Allows senior executives to circumvent established controls

Management override allows those with authority to bypass established controls, which cannot be fully prevented by the control system itself and represents its most significant inherent limitation.

When an IG issues a management advisory rather than a formal audit report, the PRIMARY governance implication is that:

Answer: The matter is advisory in nature and management response is not mandated by statute

Management advisories communicate control concerns informally without the statutory follow-up and response requirements triggered by formal audit reports.

Which scenario BEST demonstrates a control activity addressing authorization and approval?

Answer: Requiring the CFO to approve all contracts over $100,000

Requiring CFO approval above a dollar threshold is a classic authorization control that ensures transactions meet management's criteria before execution.

In the context of federal oversight, 'functional independence' for an IG MOST critically means the IG:

Answer: Can conduct audits and investigations without management approval or interference

Functional independence means the IG can plan, conduct, and report on audits and investigations without agency management controlling, limiting, or impeding the work.

A newly appointed IG finds that the agency has no documented risk assessment process. Under the COSO framework, this gap MOST directly undermines which control objective?

Answer: Achievement of operational objectives through informed control design

Without risk assessment, controls cannot be appropriately designed to address relevant threats, undermining the agency's ability to achieve objectives through effective control design.

The Sarbanes-Oxley Act Section 404 requirements, while applicable to public companies, inform federal governance because they established the precedent of:

Answer: Requiring management to assess and attest to the effectiveness of internal controls over financial reporting

SOX Section 404 established that management must formally assess and attest to internal control effectiveness, a model that influenced federal frameworks like OMB Circular A-123.

When evaluating an agency's governance framework, an IG should assess whether the board or audit committee regularly reviews which of the following to fulfill its oversight role?

Answer: Internal audit plans, findings, and management's corrective actions

Effective audit committee governance requires regular review of audit plans, findings, and the status of corrective actions to maintain meaningful oversight of internal controls.