Internal Controls & Risk Assessment Flashcards
7 cards from real CAT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Internal Controls & Risk Assessment flashcards as text
Which COSO framework component focuses on ongoing evaluations and separate evaluations to ascertain whether internal controls are present and functioning?
Answer: Monitoring Activities
Monitoring Activities involve continuous or periodic reviews to confirm that controls operate as designed and remain effective over time.
A company discovers that a staff accountant has been creating fictitious vendors and diverting payments. Which control failure MOST likely allowed this to occur?
Answer: Lack of segregation between vendor setup and payment approval
When one employee can add vendors and also authorize payments, there is no independent check to detect fictitious vendor fraud.
In enterprise risk management (ERM), 'portfolio view of risk' means:
Answer: Management views risks collectively across the organization to assess their combined effect
A portfolio view aggregates risks across the entity so management can see interdependencies and the total risk profile.
Which of the following is an example of a corrective control?
Answer: Restoring data from a backup after a system failure
Corrective controls remedy problems after they are discovered, such as restoring data from a backup following a system failure.
Control risk, as used in audit risk assessment, refers to the risk that:
Answer: Internal controls will fail to prevent or detect a material misstatement
Control risk is the possibility that a client's internal controls will not catch or prevent a material error or fraud.
A company's policy requires all wire transfers over $50,000 to be confirmed by a callback to a pre-approved telephone number. This is BEST classified as:
Answer: A preventive control
The callback procedure prevents unauthorized wire transfers from being executed by verifying the transaction before it is processed.
Which risk treatment option is MOST appropriate when the cost of controlling a risk exceeds the potential loss from the risk event?
Answer: Risk acceptance
When the cost-benefit analysis shows that controls cost more than the potential loss, accepting the risk (doing nothing) is the rational choice.