GRC - Governance, Risk, and Compliance Internal Controls and Auditing Questions and Answers

Question 1

A financial services company is preparing for its annual audit. The internal audit team wants to ensure that controls are in place to stop incorrect data from being entered into the financial system in the first place. Which type of internal control is MOST relevant to this objective?

Accepted Answer

Preventive controls

Answer

Preventive controls are designed to stop errors or irregularities from occurring. In this scenario, the goal is to prevent incorrect data entry, which is a proactive measure. Detective controls would identify errors after they happen, and corrective controls would fix them.

Question 2

Which of the following is a primary responsibility of the internal audit function within a Governance, Risk, and Compliance (GRC) framework?

Accepted Answer

Providing independent assurance on the effectiveness of risk management processes.

Answer

The internal audit function's key role is to provide independent and objective assurance to management and the board. This includes evaluating the effectiveness of governance, risk management, and control processes. While internal audit may advise on controls and risk, management is ultimately responsible for designing, implementing, and making decisions.

Question 3

According to the COSO Internal Control-Integrated Framework, which component establishes the 'tone at the top' and includes the ethical values and integrity of the organization?

Accepted Answer

Control Environment

Answer

The Control Environment is the foundation for all other components of internal control, providing discipline and structure. It encompasses the integrity, ethical values, and competence of the entity's people, as well as management's philosophy and operating style.

Question 4

A company's external auditor is required to provide an opinion on management's assessment of the internal controls over financial reporting. This requirement is a key provision of which regulation?

Accepted Answer

The Sarbanes-Oxley Act (SOX)

Answer

Section 404 of the Sarbanes-Oxley Act (SOX) specifically requires management to report on the effectiveness of their internal controls over financial reporting, and it mandates that an external auditor attests to, and reports on, that assessment.

Question 5

An IT auditor is reviewing the security of a specific accounting application. They are testing controls that check for valid data formats in entry fields and ensure that users can only approve transactions within their authorized limits. These controls are best classified as:

Accepted Answer

IT Application Controls (ITACs)

Answer

IT Application Controls (ITACs) are specific to individual software applications and focus on the integrity of data being processed within that single application, such as input validation and authorization checks. IT General Controls (ITGCs) are broader and apply to the entire IT environment, like network security or change management.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC - Governance, Risk, and Compliance Internal Controls and Auditing Questions and Answers