Internal Controls & Audit Processes Flashcards

What does 'inherent risk' represent in the audit risk model?

Answer: The susceptibility of an assertion to material misstatement before considering controls

Inherent risk is the natural susceptibility of an account or assertion to misstatement, independent of any internal controls.

Which type of audit focuses on whether organizational activities conform to established policies and regulations?

Answer: Compliance audit

A compliance audit evaluates whether the organization adheres to applicable laws, regulations, and internal policies.

IT General Controls (ITGCs) primarily address:

Answer: Pervasive controls over the IT environment that affect multiple systems

ITGCs are foundational controls over the IT environment—such as change management, access controls, and operations—that support application-level controls.

Management's response to an audit finding typically includes:

Answer: Agreement or disagreement with the finding and a corrective action plan with a target date

Management responses address whether they concur with the finding and outline planned remediation steps and timelines.

Which principle ensures that internal auditors are free from conditions that threaten their ability to carry out responsibilities objectively?

Answer: Independence and objectivity

Independence and objectivity are foundational to the IIA Standards, ensuring auditors can report findings without bias or conflict of interest.

A 'control gap' is BEST described as:

Answer: A situation where a required control does not exist or is not operating effectively

A control gap exists when an identified risk has no corresponding control or the existing control is insufficient to mitigate that risk.

Under the COSO ERM framework, 'risk appetite' is defined as:

Answer: The amount of risk an organization is willing to accept in pursuit of its objectives

Risk appetite reflects the board-approved level of risk the organization is willing to take on while pursuing strategic goals.