GRC Internal Controls and Auditing 3

Question 1

Under the Sarbanes-Oxley Act Section 404, who is responsible for assessing the effectiveness of internal controls over financial reporting?

Accepted Answer

Management and the external auditor

Answer

SOX 404 requires management to assess ICFR effectiveness, and the external auditor to attest to that assessment.

Question 2

A company's accounts payable clerk also approves invoices for payment. This represents a failure in:

Accepted Answer

Segregation of duties

Answer

When one individual both authorizes and processes payments, a key segregation of duties requirement is violated.

Question 3

What is a 'compensating control'?

Accepted Answer

An alternative control that mitigates risk when the primary control is not feasible

Answer

Compensating controls provide alternative risk mitigation when standard controls cannot be implemented due to cost or operational constraints.

Question 4

Which type of audit evidence is generally considered the MOST reliable?

Accepted Answer

Externally obtained documentary evidence

Answer

Evidence obtained from independent third parties outside the entity is considered more reliable than internally produced records.

Question 5

An auditor discovers that a key control has not been operating for six months. How should this be classified?

Accepted Answer

Significant deficiency or material weakness depending on severity

Answer

The severity determines whether a control failure is a control deficiency, significant deficiency, or material weakness under PCAOB/COSO standards.

(GRC) Governance, Risk, and Compliance Certification Practice Test