GRC Internal Controls and Auditing 2

Question 1

Which control type is designed to detect errors or irregularities AFTER they have already occurred?

Accepted Answer

Detective control

Answer

Preventive control

Answer

Corrective control

Answer

Directive control

Question 2

An organization separates the duties of transaction authorization, recording, and custody of assets. This is an example of:

Accepted Answer

Segregation of duties

Answer

Dual control

Answer

Job rotation

Answer

Mandatory vacation

Question 3

During an audit, the auditor uses a sample to test transactions rather than reviewing every record. What is this practice called?

Accepted Answer

Audit sampling

Answer

Analytical review

Answer

Substantive testing

Answer

Walkthrough

Question 4

Which framework is most commonly used by US public companies to assess the effectiveness of internal controls over financial reporting?

Accepted Answer

COSO Internal Control Framework

Answer

ISO 31000

Answer

COBIT

Answer

NIST CSF

Question 5

A control that automatically prevents a transaction from proceeding when a threshold is exceeded is best described as a:

Accepted Answer

Automated preventive control

Answer

Manual control

Answer

Compensating control

Answer

Detective control

Question 6

What is the PRIMARY purpose of a control self-assessment (CSA)?

Accepted Answer

Allow management and staff to evaluate control effectiveness

Answer

Replace the external audit

Answer

Eliminate residual risk

Answer

Fulfill regulatory requirements for audits

Question 7

Which internal audit activity focuses on whether controls are actually operating as designed in practice?

Accepted Answer

Operating effectiveness testing

Answer

Design effectiveness testing

Answer

Risk assessment

Answer

Control mapping