CSCP Internal Controls & Auditing 5 — Questions and Answers
Question 1: The 'tone at the top' concept in internal controls refers to:
- The volume of compliance alerts generated by trading systems
- The ethical climate and commitment to compliance demonstrated by senior leadership (Correct answer)
- The hierarchical reporting structure of the compliance department
- The priority ranking of audit findings by severity level
Correct answer: The ethical climate and commitment to compliance demonstrated by senior leadership
Tone at the top reflects how senior management's attitude toward ethics and compliance shapes the overall control environment throughout the organization.
Question 2: An internal auditor at a securities firm identifies a finding where the same individual has the ability to both approve wire transfers and reconcile bank accounts. This represents a failure in:
- The firm's business continuity planning
- Segregation of duties controls (Correct answer)
- The firm's customer identification program
- Trade surveillance procedures
Correct answer: Segregation of duties controls
Segregation of duties requires that incompatible functions—such as initiating, approving, and reconciling transactions—be performed by different individuals to prevent fraud and error.
Question 3: Under SEC regulations, which type of securities firm is required to undergo an annual audit by an independent public accountant?
- All registered investment advisers with more than 50 clients
- Broker-dealers that carry customer accounts or custody customer assets (Correct answer)
- All FINRA member firms regardless of their business model
- Investment companies registered under the Investment Company Act
Correct answer: Broker-dealers that carry customer accounts or custody customer assets
SEC Rule 17a-5 requires broker-dealers that carry customer accounts or hold customer assets (carrying firms) to undergo annual audits by an independent public accountant.
Question 4: A broker-dealer's internal audit department should maintain its independence by reporting to which governance body?
- The Chief Financial Officer
- The Head of Compliance
- The Audit Committee of the Board of Directors (Correct answer)
- The Chief Operating Officer
Correct answer: The Audit Committee of the Board of Directors
Internal audit should functionally report to the Audit Committee of the Board to maintain independence from management and provide objective assurance to the board.
Question 5: When conducting a compliance audit of a broker-dealer's trading practices, which procedure would best detect potential market manipulation?
- Reviewing the firm's written supervisory procedures for trading
- Analyzing trading patterns and comparing them against market data for layering or spoofing indicators (Correct answer)
- Confirming that all traders have completed annual compliance training
- Reviewing the firm's customer complaint log for trading-related grievances
Correct answer: Analyzing trading patterns and comparing them against market data for layering or spoofing indicators
Analyzing trading patterns against market data is the most effective way to identify potential market manipulation schemes like layering or spoofing, which are detectable through behavioral patterns.
Question 6: A securities firm's audit committee receives a report indicating that the same control deficiency was identified in two consecutive audit cycles without remediation. The audit committee should:
- Accept management's explanation and extend the remediation deadline
- Escalate the matter and require an accelerated remediation plan with executive accountability (Correct answer)
- Refer the matter to the external auditors for their assessment
- Remove the finding from the tracking report since it has been previously reported
Correct answer: Escalate the matter and require an accelerated remediation plan with executive accountability
Repeat findings indicate a systemic failure in management's commitment to remediation and should be escalated with enhanced accountability and urgency.
Question 7: Which of the following best describes 'continuous auditing' as applied in a securities firm context?
- The practice of conducting audits every month instead of annually
- Automated, real-time or near-real-time testing of transactions and controls using technology (Correct answer)
- Having multiple audit teams simultaneously reviewing different business units
- The ongoing training and certification of internal audit staff
Correct answer: Automated, real-time or near-real-time testing of transactions and controls using technology
Continuous auditing uses automated tools and data analytics to monitor transactions and test controls on an ongoing basis, providing timely identification of exceptions.
CSCP Internal Controls & Auditing 5
The 'tone at the top' concept in internal controls refers to: