Payroll Audit & SOX Controls Flashcards

A company's payroll system automatically calculates overtime for hours over 40 per workweek. The auditor verifies the system's calculation logic once and then relies on that automated control going forward. This reliance strategy is called:

Answer: Reliance on IT general controls and automated application controls

Automated application controls are generally tested once; if IT general controls (ITGC) are effective, auditors can rely on the automated control without repeated testing each period.

During a payroll audit, the auditor compares total payroll expense per the general ledger to the sum of all payroll tax returns filed during the year. This procedure is an example of:

Answer: Analytical procedure

Analytical procedures involve comparing financial data across sources or periods to identify unexpected relationships, such as GL payroll vs. tax return totals.

The Sarbanes-Oxley Act was enacted primarily in response to which type of corporate misconduct?

Answer: Major corporate and accounting scandals such as Enron and WorldCom

SOX was enacted in 2002 in direct response to the Enron, WorldCom, and other accounting fraud scandals that destroyed investor confidence.

A payroll department uses a batch control total to verify that all transactions entered equal the total processed by the system. This is an example of which type of control?

Answer: Application-level input control

Batch control totals are application-level input controls that ensure the completeness and accuracy of data entered into the payroll system.

When auditing payroll for a multistate employer, the auditor finds that the company applies the resident state's income tax withholding rules to all employees regardless of where they work. What issue does this create?

Answer: Incorrect state income tax withholding based on work-state sourcing rules, creating potential tax liability for employees and the employer

State income tax withholding is generally based on the state where work is performed (source state), not solely the employee's residence, so applying only residency rules creates withholding errors.

An IT general control (ITGC) weakness that allows unauthorized users to modify payroll master file data would most directly impact which SOX payroll control objective?

Answer: Accuracy and completeness of employee compensation records

If ITGCs are weak and allow unauthorized master file changes, the integrity of employee compensation data (pay rates, deductions, bank accounts) is compromised.

Under SOX, which of the following would be classified as a 'significant deficiency' rather than a 'material weakness'?

Answer: A deficiency that is less severe than a material weakness but important enough to merit attention by those responsible for financial reporting oversight

A significant deficiency is less severe than a material weakness but still requires communication to the audit committee because it is important enough to warrant attention.