CIG Governance & Internal Controls 5 — Questions and Answers
Question 1: The principle of 'management override' is considered the most significant limitation of internal control because it:
- Requires additional budget authority to implement
- Allows senior executives to circumvent established controls (Correct answer)
- Mandates Congressional approval for routine transactions
- Eliminates the need for independent audit committees
Correct answer: Allows senior executives to circumvent established controls
Management override allows those with authority to bypass established controls, which cannot be fully prevented by the control system itself and represents its most significant inherent limitation.
Question 2: When an IG issues a management advisory rather than a formal audit report, the PRIMARY governance implication is that:
- The issue requires immediate referral to law enforcement
- The matter is advisory in nature and management response is not mandated by statute (Correct answer)
- Congressional notification is still required within 30 days
- The deficiency is too minor to warrant any documentation
Correct answer: The matter is advisory in nature and management response is not mandated by statute
Management advisories communicate control concerns informally without the statutory follow-up and response requirements triggered by formal audit reports.
Question 3: Which scenario BEST demonstrates a control activity addressing authorization and approval?
- Storing blank checks in a locked safe
- Requiring the CFO to approve all contracts over $100,000 (Correct answer)
- Reconciling bank statements monthly
- Training employees on ethics policies annually
Correct answer: Requiring the CFO to approve all contracts over $100,000
Requiring CFO approval above a dollar threshold is a classic authorization control that ensures transactions meet management's criteria before execution.
Question 4: In the context of federal oversight, 'functional independence' for an IG MOST critically means the IG:
- Has an unlimited investigative budget
- Can conduct audits and investigations without management approval or interference (Correct answer)
- Reports directly to the President on all matters
- Is exempt from civil service employment rules
Correct answer: Can conduct audits and investigations without management approval or interference
Functional independence means the IG can plan, conduct, and report on audits and investigations without agency management controlling, limiting, or impeding the work.
Question 5: A newly appointed IG finds that the agency has no documented risk assessment process. Under the COSO framework, this gap MOST directly undermines which control objective?
- Safeguarding of assets
- Compliance with laws and regulations
- Reliability of financial reporting
- Achievement of operational objectives through informed control design (Correct answer)
Correct answer: Achievement of operational objectives through informed control design
Without risk assessment, controls cannot be appropriately designed to address relevant threats, undermining the agency's ability to achieve objectives through effective control design.
Question 6: The Sarbanes-Oxley Act Section 404 requirements, while applicable to public companies, inform federal governance because they established the precedent of:
- Eliminating the need for external auditors in government
- Requiring management to assess and attest to the effectiveness of internal controls over financial reporting (Correct answer)
- Mandating criminal penalties for all financial restatements
- Requiring quarterly IG reporting to legislative bodies
Correct answer: Requiring management to assess and attest to the effectiveness of internal controls over financial reporting
SOX Section 404 established that management must formally assess and attest to internal control effectiveness, a model that influenced federal frameworks like OMB Circular A-123.
Question 7: When evaluating an agency's governance framework, an IG should assess whether the board or audit committee regularly reviews which of the following to fulfill its oversight role?
- Individual employee performance evaluations
- Internal audit plans, findings, and management's corrective actions (Correct answer)
- Day-to-day procurement decisions and vendor selections
- Personnel security clearance records
Correct answer: Internal audit plans, findings, and management's corrective actions
Effective audit committee governance requires regular review of audit plans, findings, and the status of corrective actions to maintain meaningful oversight of internal controls.
CIG Governance & Internal Controls 5
The principle of 'management override' is considered the most significant limitation of internal control because it: