CIG Governance & Internal Controls 2 — Questions and Answers
Question 1: Under the COSO framework, which component addresses an organization's ethical values and commitment to competence?
- Risk Assessment
- Control Environment (Correct answer)
- Monitoring Activities
- Information & Communication
Correct answer: Control Environment
The Control Environment is the foundational COSO component that sets the tone through ethical values, commitment to competence, and board oversight.
Question 2: An Inspector General discovers that a federal agency's control self-assessment (CSA) process consistently rates all controls as 'effective' without supporting evidence. This situation MOST likely indicates:
- A well-functioning governance structure
- Tone-at-the-top deficiency in the control environment (Correct answer)
- Inadequate risk assessment procedures
- Insufficient information technology controls
Correct answer: Tone-at-the-top deficiency in the control environment
Unsupported self-assessments that uniformly show positive results suggest leadership is not genuinely committed to honest control evaluation, reflecting a tone-at-the-top problem.
Question 3: Which governance principle requires that no single individual controls all phases of a transaction from initiation to completion?
- Dual authorization
- Separation of duties (Correct answer)
- Management override
- Independent verification
Correct answer: Separation of duties
Separation of duties divides key functions so no one person can initiate, approve, execute, and record a transaction, reducing fraud and error risk.
Question 4: The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government (Green Book) is organized around how many principles?
- 10
- 17 (Correct answer)
- 22
- 25
Correct answer: 17
The GAO Green Book contains 17 principles organized under the five internal control components aligned with the COSO framework.
Question 5: A material weakness in internal control differs from a significant deficiency primarily because a material weakness:
- Affects only financial reporting, not operational controls
- Represents a reasonable possibility of a material misstatement going undetected (Correct answer)
- Must be reported only to external auditors
- Is identified solely through substantive testing
Correct answer: Represents a reasonable possibility of a material misstatement going undetected
A material weakness is a deficiency where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.
Question 6: Which type of internal control is BEST exemplified by requiring two signatures on checks above a certain dollar threshold?
- Preventive control (Correct answer)
- Detective control
- Corrective control
- Compensating control
Correct answer: Preventive control
Requiring dual signatures prevents unauthorized transactions from occurring in the first place, making it a preventive control.
Question 7: When an IG office performs a follow-up review on prior audit recommendations, the PRIMARY governance purpose is to:
- Identify new fraud schemes within the agency
- Ensure management accountability for implementing corrective actions (Correct answer)
- Satisfy external reporting requirements to OMB
- Fulfill Congressional oversight mandates directly
Correct answer: Ensure management accountability for implementing corrective actions
Follow-up reviews hold management accountable for implementing agreed-upon corrective actions, reinforcing the governance cycle of oversight and improvement.
CIG Governance & Internal Controls 2
Under the COSO framework, which component addresses an organization's ethical values and commitment to competence?