CBA Auditing Internal Controls 2 — Questions and Answers
Question 1: Under the COSO framework, which component addresses the ongoing processes that monitor the quality of internal control performance over time?
- Control Activities
- Risk Assessment
- Monitoring Activities (Correct answer)
- Information and Communication
Correct answer: Monitoring Activities
Monitoring Activities is the COSO component focused on evaluating whether controls are present and functioning effectively on an ongoing basis.
Question 2: When auditing IT general controls, which area is MOST critical to assess first because weaknesses there can undermine all application controls?
- Change management controls
- Access controls and logical security (Correct answer)
- Data center physical security
- Backup and recovery procedures
Correct answer: Access controls and logical security
Access controls and logical security are foundational IT general controls; compromised access can invalidate the effectiveness of all other controls.
Question 3: A bank auditor discovers that loan officers can both approve loans AND record disbursements in the general ledger. This violates which key internal control principle?
- Dual authorization
- Segregation of duties (Correct answer)
- Management override prevention
- Control environment integrity
Correct answer: Segregation of duties
Segregation of duties requires that authorization, custody, and recording functions be performed by different individuals to prevent fraud and error.
Question 4: Which sampling method requires the auditor to select every nth item from a population, starting from a random point?
- Stratified random sampling
- Systematic sampling (Correct answer)
- Cluster sampling
- Judgmental sampling
Correct answer: Systematic sampling
Systematic sampling selects items at uniform intervals (every nth item) after a random start, making it efficient for large populations.
Question 5: In a bank's loan review process, which compensating control is MOST effective when full segregation of duties cannot be achieved in a small branch?
- Requiring dual signatures on all documents
- Enhanced supervisory review of transactions (Correct answer)
- Mandatory vacation policies for key personnel
- Rotating staff assignments quarterly
Correct answer: Enhanced supervisory review of transactions
Enhanced supervisory review compensates for lack of segregation by having a manager independently review and approve transactions processed by the same employee.
Question 6: The term 'control deficiency' in bank auditing refers to a situation where:
- Management disagrees with the auditor's findings
- A control does not allow timely prevention or detection of misstatements (Correct answer)
- The bank fails to implement recommended audit findings
- An internal auditor lacks sufficient training
Correct answer: A control does not allow timely prevention or detection of misstatements
A control deficiency exists when the design or operation of a control does not allow management or employees to prevent or detect misstatements in a timely manner.
Question 7: Which audit procedure is MOST appropriate for testing the operating effectiveness of an automated system access control?
- Reviewing the access policy documentation
- Interviewing the IT security officer
- Attempting to access the system with revoked credentials (Correct answer)
- Inspecting the organizational chart
Correct answer: Attempting to access the system with revoked credentials
Attempting to access the system with revoked or unauthorized credentials directly tests whether the access control is actually operating as designed.
CBA Auditing Internal Controls 2
Under the COSO framework, which component addresses the ongoing processes that monitor the quality of internal control performance over time?