CPM Payroll Audit & SOX Controls 3 — Questions and Answers
Question 1: When performing a payroll compliance audit, an auditor reviews I-9 documentation and finds several forms with Section 1 completed after the employee's first day of work. What is the correct I-9 completion deadline for employees?
- By the end of the employee's first day of work
- No later than three business days after the first day of employment (Correct answer)
- Within one week of the hire date
- At the time of the job offer acceptance
Correct answer: No later than three business days after the first day of employment
Employees must complete Section 1 of Form I-9 no later than the end of their first day of work, but employers have three business days to complete Section 2.
Question 2: A material weakness in payroll internal controls under SOX is best defined as:
- A deficiency that is less severe than a significant deficiency but nonetheless warrants management's attention
- A deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis (Correct answer)
- Any error in payroll processing that results in an overpayment or underpayment
- A control gap identified by external auditors but not internal auditors
Correct answer: A deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis
A material weakness is the most severe classification of internal control deficiency, indicating a reasonable possibility that material misstatement will not be caught in time.
Question 3: Which type of payroll audit test directly verifies that recorded payroll transactions actually occurred and involved real employees?
- Completeness test
- Existence/occurrence test (Correct answer)
- Valuation test
- Rights and obligations test
Correct answer: Existence/occurrence test
The existence/occurrence assertion tests whether recorded transactions actually happened, which in payroll means confirming that paid employees are real and worked as recorded.
Question 4: An external auditor performing a SOX-related payroll audit sends a letter directly to employees asking them to confirm their year-to-date earnings. This procedure is called:
- Analytical review
- Physical inspection
- Positive confirmation (Correct answer)
- Reperformance
Correct answer: Positive confirmation
A positive confirmation requires the recipient to respond regardless of whether they agree or disagree with the information, making it a strong form of third-party evidence.
Question 5: Under SOX, what is the primary responsibility of the external auditor with respect to management's Section 404 assessment for accelerated filers?
- Prepare management's assessment on their behalf
- Attest to and report on the effectiveness of internal control over financial reporting (Correct answer)
- Train management on control design improvements
- Approve the internal audit work plan
Correct answer: Attest to and report on the effectiveness of internal control over financial reporting
For accelerated filers, the external auditor must independently attest to and report on the effectiveness of the company's ICFR, not just review management's assessment.
Question 6: A payroll auditor is testing controls over overtime authorization. The auditor reviews 40 timesheets and finds that 4 lack a supervisor's signature. What should the auditor conclude?
- The control is effective because 90% of timesheets were properly approved
- The control has a 10% failure rate, which may constitute a significant deficiency or material weakness depending on risk assessment (Correct answer)
- The four exceptions are immaterial and no further action is required
- The payroll department should be retrained and the audit can be closed
Correct answer: The control has a 10% failure rate, which may constitute a significant deficiency or material weakness depending on risk assessment
A 10% exception rate on a key authorization control is significant and must be evaluated against risk thresholds to determine if it rises to significant deficiency or material weakness.
Question 7: Which document serves as the primary evidence that management has designed, implemented, and assessed payroll-related internal controls for SOX Section 404 compliance?
- The payroll register
- The risk and control matrix (RCM) (Correct answer)
- The employee handbook
- The payroll tax return (Form 941)
Correct answer: The risk and control matrix (RCM)
The Risk and Control Matrix (RCM) documents each identified risk, the corresponding control, control owner, testing method, and results, serving as the backbone of SOX 404 documentation.
CPM Payroll Audit & SOX Controls 3
When performing a payroll compliance audit, an auditor reviews I-9 documentation and finds several forms with Section 1 completed after the employee's first day of work.
What is the correct I-9 completion deadline for employees?