CPM Payroll Audit & SOX Controls 2 — Questions and Answers
Question 1: Under SOX Section 302, which officer must personally certify that the company's financial disclosures are accurate and that internal controls have been evaluated within 90 days?
- Chief HR Officer and Payroll Director
- CEO and CFO (Correct answer)
- Internal Audit Director and Controller
- Board of Directors Audit Committee Chair
Correct answer: CEO and CFO
SOX Section 302 requires the CEO and CFO to personally certify the accuracy of financial reports and the effectiveness of disclosure controls.
Question 2: A payroll auditor discovers that three terminated employees continued to receive paychecks for two months after separation. Which SOX control failure does this most directly represent?
- Inadequate segregation of duties in payroll processing
- Failure of the employee termination notification process and access revocation controls (Correct answer)
- Weakness in the payroll tax deposit schedule
- Insufficient bonding of payroll employees
Correct answer: Failure of the employee termination notification process and access revocation controls
Ghost employee payments after termination indicate a breakdown in the termination notification process and the control requiring timely removal from payroll.
Question 3: Which COSO framework component addresses the company's commitment to integrity, ethical values, and competence as it relates to payroll internal controls?
- Risk Assessment
- Control Activities
- Control Environment (Correct answer)
- Monitoring Activities
Correct answer: Control Environment
The Control Environment is the COSO component that sets the tone at the top, including management's philosophy, ethical values, and commitment to competence.
Question 4: An organization uses the same employee to both authorize new hires in the HRIS and process the initial payroll setup. This violates which key internal control principle?
- Dual authorization
- Segregation of duties (Correct answer)
- Physical access controls
- Compensating controls
Correct answer: Segregation of duties
Segregation of duties requires that no single employee control all phases of a transaction, preventing unauthorized additions to payroll.
Question 5: During a payroll SOX audit, the auditor selects a sample of 25 payroll transactions from a population of 10,000. The sampling method selects every 400th item after a random start. What sampling technique is being used?
- Judgmental sampling
- Random number table sampling
- Systematic sampling (Correct answer)
- Stratified sampling
Correct answer: Systematic sampling
Systematic sampling selects items at a fixed interval (every nth item) after a random starting point.
Question 6: SOX Section 404 requires management to include in the annual report an assessment of internal controls over financial reporting. Which framework is most commonly referenced for this assessment?
- GAAP framework
- COSO Internal Control – Integrated Framework (Correct answer)
- ISO 27001 framework
- PCAOB Auditing Standard No. 2
Correct answer: COSO Internal Control – Integrated Framework
The COSO Internal Control – Integrated Framework is the most widely accepted framework used for management's Section 404 internal control assessment.
Question 7: A payroll manager wants to implement a preventive control to reduce the risk of unauthorized wage rate changes. Which control best addresses this risk?
- Monthly reconciliation of payroll registers to the general ledger
- Requiring dual approval in the HRIS before any wage rate change takes effect (Correct answer)
- Running a payroll exception report after each processing cycle
- Performing annual W-2 reconciliation to payroll records
Correct answer: Requiring dual approval in the HRIS before any wage rate change takes effect
Requiring dual approval before a change takes effect is a preventive control that stops unauthorized wage rate modifications before processing occurs.
CPM Payroll Audit & SOX Controls 2
Under SOX Section 302, which officer must personally certify that the company's financial disclosures are accurate and that internal controls have been evaluated within 90 days?