GRC Internal Controls and Auditing 2 — Questions and Answers
Question 1: Which control type is designed to detect errors or irregularities AFTER they have already occurred?
- Preventive control
- Detective control (Correct answer)
- Corrective control
- Directive control
Correct answer: Detective control
Detective controls identify problems that have already occurred, such as reconciliations, audits, and exception reports.
Question 2: An organization separates the duties of transaction authorization, recording, and custody of assets. This is an example of:
- Dual control
- Segregation of duties (Correct answer)
- Job rotation
- Mandatory vacation
Correct answer: Segregation of duties
Segregation of duties divides key tasks among different individuals to reduce fraud and error risk.
Question 3: During an audit, the auditor uses a sample to test transactions rather than reviewing every record. What is this practice called?
- Analytical review
- Audit sampling (Correct answer)
- Substantive testing
- Walkthrough
Correct answer: Audit sampling
Audit sampling involves selecting a representative subset of transactions to draw conclusions about a population.
Question 4: Which framework is most commonly used by US public companies to assess the effectiveness of internal controls over financial reporting?
- ISO 31000
- COBIT
- COSO Internal Control Framework (Correct answer)
- NIST CSF
Correct answer: COSO Internal Control Framework
The COSO Internal Control — Integrated Framework is the standard used for Sarbanes-Oxley Section 404 compliance.
Question 5: A control that automatically prevents a transaction from proceeding when a threshold is exceeded is best described as a:
- Manual control
- Automated preventive control (Correct answer)
- Compensating control
- Detective control
Correct answer: Automated preventive control
Automated preventive controls use system logic to block non-compliant transactions before they are completed.
Question 6: What is the PRIMARY purpose of a control self-assessment (CSA)?
- Replace the external audit
- Allow management and staff to evaluate control effectiveness (Correct answer)
- Eliminate residual risk
- Fulfill regulatory requirements for audits
Correct answer: Allow management and staff to evaluate control effectiveness
CSA empowers process owners to assess the design and operating effectiveness of controls in their own areas.
Question 7: Which internal audit activity focuses on whether controls are actually operating as designed in practice?
- Design effectiveness testing
- Operating effectiveness testing (Correct answer)
- Risk assessment
- Control mapping
Correct answer: Operating effectiveness testing
Operating effectiveness testing determines whether a control is functioning correctly over time, not just whether it exists on paper.
GRC Internal Controls and Auditing 2
Which control type is designed to detect errors or irregularities AFTER they have already occurred?