GRC Internal Controls & Audit Processes 2 — Questions and Answers
Question 1: Which control type is designed to detect errors or irregularities AFTER they have occurred?
- Preventive control
- Detective control (Correct answer)
- Corrective control
- Directive control
Correct answer: Detective control
Detective controls identify problems after they occur, such as reconciliations and audits.
Question 2: The COSO Internal Control framework consists of how many components?
- 3
- 4
- 5 (Correct answer)
- 7
Correct answer: 5
COSO identifies five components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring.
Question 3: An audit committee is PRIMARILY responsible for:
- Approving all financial transactions
- Overseeing the external and internal audit functions (Correct answer)
- Hiring and firing employees
- Approving the annual budget
Correct answer: Overseeing the external and internal audit functions
The audit committee provides independent oversight of financial reporting and both internal and external audit activities.
Question 4: Which of the following best describes 'tone at the top'?
- The pitch of voice used in management meetings
- Management's commitment to ethics and internal controls that sets the cultural tone (Correct answer)
- The volume of communication sent from executives
- A control that monitors the highest-risk transactions
Correct answer: Management's commitment to ethics and internal controls that sets the cultural tone
Tone at the top refers to senior leadership's demonstrated commitment to ethical behavior and robust internal controls.
Question 5: What does 'control self-assessment' (CSA) involve?
- External auditors evaluating management's controls
- Management and staff evaluating the effectiveness of their own controls (Correct answer)
- IT staff testing cybersecurity defenses
- Regulators reviewing compliance with laws
Correct answer: Management and staff evaluating the effectiveness of their own controls
CSA is a technique where operational staff and management assess control effectiveness within their own units.
Question 6: A walkthrough in an audit context is used to:
- Physically inspect inventory on hand
- Trace a transaction from initiation to recording to verify controls work as described (Correct answer)
- Walk auditors through the office floor plan
- Test all transactions in a population
Correct answer: Trace a transaction from initiation to recording to verify controls work as described
A walkthrough traces a single transaction end-to-end to confirm that described controls are actually operating.
Question 7: Which element is LEAST likely to be part of an internal audit charter?
- Purpose and authority of the internal audit function
- Responsibilities of the internal audit department
- Detailed salaries of internal auditors (Correct answer)
- Independence requirements for internal auditors
Correct answer: Detailed salaries of internal auditors
The internal audit charter establishes authority, scope, and independence but does not include compensation details.
GRC Internal Controls & Audit Processes 2
Which control type is designed to detect errors or irregularities AFTER they have occurred?