Payroll Audit & SOX Controls Flashcards
7 cards from real CPM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Payroll Audit & SOX Controls flashcards as text
Under SOX Section 302, which officer must personally certify that the company's financial disclosures are accurate and that internal controls have been evaluated within 90 days?
Answer: CEO and CFO
SOX Section 302 requires the CEO and CFO to personally certify the accuracy of financial reports and the effectiveness of disclosure controls.
A payroll auditor discovers that three terminated employees continued to receive paychecks for two months after separation. Which SOX control failure does this most directly represent?
Answer: Failure of the employee termination notification process and access revocation controls
Ghost employee payments after termination indicate a breakdown in the termination notification process and the control requiring timely removal from payroll.
Which COSO framework component addresses the company's commitment to integrity, ethical values, and competence as it relates to payroll internal controls?
Answer: Control Environment
The Control Environment is the COSO component that sets the tone at the top, including management's philosophy, ethical values, and commitment to competence.
An organization uses the same employee to both authorize new hires in the HRIS and process the initial payroll setup. This violates which key internal control principle?
Answer: Segregation of duties
Segregation of duties requires that no single employee control all phases of a transaction, preventing unauthorized additions to payroll.
During a payroll SOX audit, the auditor selects a sample of 25 payroll transactions from a population of 10,000. The sampling method selects every 400th item after a random start. What sampling technique is being used?
Answer: Systematic sampling
Systematic sampling selects items at a fixed interval (every nth item) after a random starting point.
SOX Section 404 requires management to include in the annual report an assessment of internal controls over financial reporting. Which framework is most commonly referenced for this assessment?
Answer: COSO Internal Control – Integrated Framework
The COSO Internal Control – Integrated Framework is the most widely accepted framework used for management's Section 404 internal control assessment.
A payroll manager wants to implement a preventive control to reduce the risk of unauthorized wage rate changes. Which control best addresses this risk?
Answer: Requiring dual approval in the HRIS before any wage rate change takes effect
Requiring dual approval before a change takes effect is a preventive control that stops unauthorized wage rate modifications before processing occurs.