Compliance and Auditing Internal Controls 1 — Questions and Answers
Question 1: What are the five components of the COSO Internal Control — Integrated Framework?
- Plan, Do, Check, Act, Improve
- Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring (Correct answer)
- Identify, Protect, Detect, Respond, Recover
- Governance, Risk, Compliance, Audit, Reporting
Correct answer: Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring
The COSO Internal Control — Integrated Framework consists of five interrelated components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.
Question 2: What is 'segregation of duties' (SoD) as an internal control?
- Dividing the audit team into specialized groups
- Separating critical business functions among different people to prevent fraud and errors (Correct answer)
- Creating separate departments for compliance and operations
- Isolating sensitive data from general access
Correct answer: Separating critical business functions among different people to prevent fraud and errors
Segregation of duties is an internal control that divides key tasks and responsibilities among multiple employees to prevent any single person from having the ability to execute and conceal fraud or errors.
Question 3: Which type of control is designed to prevent errors or fraud from occurring in the first place?
- Detective control
- Corrective control
- Preventive control (Correct answer)
- Compensating control
Correct answer: Preventive control
Preventive controls are proactive controls designed to stop errors, irregularities, or fraudulent activities before they occur.
Question 4: What is the purpose of a 'compensating control' in internal control design?
- To reward employees for good compliance behavior
- To substitute for a primary control that cannot be implemented (Correct answer)
- To detect and correct errors after they occur
- To compensate auditors for their services
Correct answer: To substitute for a primary control that cannot be implemented
A compensating control is an alternative control that provides an equivalent level of assurance when the primary control cannot be implemented due to operational or practical constraints.
Question 5: Which internal control activity involves comparing actual results to expected outcomes?
- Authorization
- Reconciliation
- Analytical review (Correct answer)
- Physical safeguards
Correct answer: Analytical review
Analytical review compares actual financial or operational results to expected outcomes, budgets, or prior periods to identify significant fluctuations that may indicate errors or fraud.
Question 6: What does 'tone at the top' refer to in the context of internal controls?
- The volume of communication in the organization
- The ethical climate and commitment to compliance set by senior leadership (Correct answer)
- The top-tier level of internal audit findings
- The highest risk items in the risk register
Correct answer: The ethical climate and commitment to compliance set by senior leadership
Tone at the top refers to the ethical climate created by senior leadership whose behavior, values, and commitment to compliance set the cultural foundation for the entire organization's control environment.
Compliance and Auditing Internal Controls 1
What are the five components of the COSO Internal Control — Integrated Framework?