Payroll Audit & SOX Controls Flashcards
7 cards from real CPM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Payroll Audit & SOX Controls flashcards as text
When performing a payroll compliance audit, an auditor reviews I-9 documentation and finds several forms with Section 1 completed after the employee's first day of work. What is the correct I-9 completion deadline for employees?
Answer: No later than three business days after the first day of employment
Employees must complete Section 1 of Form I-9 no later than the end of their first day of work, but employers have three business days to complete Section 2.
A material weakness in payroll internal controls under SOX is best defined as:
Answer: A deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis
A material weakness is the most severe classification of internal control deficiency, indicating a reasonable possibility that material misstatement will not be caught in time.
Which type of payroll audit test directly verifies that recorded payroll transactions actually occurred and involved real employees?
Answer: Existence/occurrence test
The existence/occurrence assertion tests whether recorded transactions actually happened, which in payroll means confirming that paid employees are real and worked as recorded.
An external auditor performing a SOX-related payroll audit sends a letter directly to employees asking them to confirm their year-to-date earnings. This procedure is called:
Answer: Positive confirmation
A positive confirmation requires the recipient to respond regardless of whether they agree or disagree with the information, making it a strong form of third-party evidence.
Under SOX, what is the primary responsibility of the external auditor with respect to management's Section 404 assessment for accelerated filers?
Answer: Attest to and report on the effectiveness of internal control over financial reporting
For accelerated filers, the external auditor must independently attest to and report on the effectiveness of the company's ICFR, not just review management's assessment.
A payroll auditor is testing controls over overtime authorization. The auditor reviews 40 timesheets and finds that 4 lack a supervisor's signature. What should the auditor conclude?
Answer: The control has a 10% failure rate, which may constitute a significant deficiency or material weakness depending on risk assessment
A 10% exception rate on a key authorization control is significant and must be evaluated against risk thresholds to determine if it rises to significant deficiency or material weakness.
Which document serves as the primary evidence that management has designed, implemented, and assessed payroll-related internal controls for SOX Section 404 compliance?
Answer: The risk and control matrix (RCM)
The Risk and Control Matrix (RCM) documents each identified risk, the corresponding control, control owner, testing method, and results, serving as the backbone of SOX 404 documentation.