GRC Internal Controls and Auditing 2

Question 1

Which control type is designed to detect errors or irregularities AFTER they have already occurred?

Accepted Answer

Detective control

Answer

Detective controls identify problems that have already occurred, such as reconciliations, audits, and exception reports.

Question 2

An organization separates the duties of transaction authorization, recording, and custody of assets. This is an example of:

Accepted Answer

Segregation of duties

Answer

Segregation of duties divides key tasks among different individuals to reduce fraud and error risk.

Question 3

During an audit, the auditor uses a sample to test transactions rather than reviewing every record. What is this practice called?

Accepted Answer

Audit sampling

Answer

Audit sampling involves selecting a representative subset of transactions to draw conclusions about a population.

Question 4

Which framework is most commonly used by US public companies to assess the effectiveness of internal controls over financial reporting?

Accepted Answer

COSO Internal Control Framework

Answer

The COSO Internal Control — Integrated Framework is the standard used for Sarbanes-Oxley Section 404 compliance.

Question 5

A control that automatically prevents a transaction from proceeding when a threshold is exceeded is best described as a:

Accepted Answer

Automated preventive control

Answer

Automated preventive controls use system logic to block non-compliant transactions before they are completed.

(GRC) Governance, Risk, and Compliance Certification Practice Test