GRC Internal Controls & Audit Processes 3 — Questions and Answers
Question 1: In SOX compliance, which section requires management to assess and report on internal controls over financial reporting?
- Section 302
- Section 404 (Correct answer)
- Section 409
- Section 802
Correct answer: Section 404
SOX Section 404 mandates that management assess the effectiveness of internal controls over financial reporting annually.
Question 2: What is the primary purpose of a 'compensating control'?
- To pay employees for identifying control gaps
- To mitigate a risk when a primary control cannot be implemented (Correct answer)
- To reward auditors who find deficiencies
- To duplicate an existing control for redundancy
Correct answer: To mitigate a risk when a primary control cannot be implemented
A compensating control provides alternative risk mitigation when the ideal primary control is not feasible.
Question 3: Which audit opinion indicates that financial statements are presented fairly in all material respects?
- Adverse opinion
- Disclaimer of opinion
- Qualified opinion
- Unmodified (clean) opinion (Correct answer)
Correct answer: Unmodified (clean) opinion
An unmodified or clean opinion means the auditor found no material misstatements and statements conform to GAAP.
Question 4: The concept of 'materiality' in auditing refers to:
- The physical existence of assets being audited
- The significance of an error or misstatement that could influence users' decisions (Correct answer)
- The type of material used in audit documentation
- The number of transactions selected for testing
Correct answer: The significance of an error or misstatement that could influence users' decisions
Materiality defines the threshold above which misstatements could reasonably influence decisions of financial statement users.
Question 5: Which of the following is an example of an application control?
- Badge access to the server room
- Automated input validation that rejects non-numeric values in a numeric field (Correct answer)
- Mandatory vacation policy for employees
- Fire suppression system in the data center
Correct answer: Automated input validation that rejects non-numeric values in a numeric field
Application controls are automated controls built into software, such as input validation routines.
Question 6: What is the role of an 'engagement letter' in an external audit?
- To communicate audit findings to management
- To formally document the terms, objectives, and responsibilities of the audit engagement (Correct answer)
- To notify regulators that an audit will begin
- To provide the auditor's opinion on financial statements
Correct answer: To formally document the terms, objectives, and responsibilities of the audit engagement
An engagement letter establishes the agreement between the auditor and client regarding scope, timing, and responsibilities.
Question 7: Which internal control principle requires that no single individual can initiate, approve, and record a transaction?
- Least privilege
- Defense in depth
- Segregation of duties (Correct answer)
- Need to know
Correct answer: Segregation of duties
Segregation of duties (SoD) divides critical tasks among multiple people to prevent fraud and errors.
GRC Internal Controls & Audit Processes 3
In SOX compliance, which section requires management to assess and report on internal controls over financial reporting?