Auditing Internal Controls Flashcards

An auditor discovers that a bank's model risk management controls lack independent validation for a credit scoring model. Under which regulatory guidance is this deficiency evaluated?

Answer: SR 11-7 / OCC 2011-12 on Model Risk Management

SR 11-7 (Federal Reserve) and OCC 2011-12 provide the U.S. supervisory guidance on model risk management, including requirements for independent model validation.

In the context of internal controls, 'management override' is dangerous primarily because:

Answer: It bypasses established controls and can be used to conceal fraud

Management override allows executives to circumvent controls, which is a key fraud risk since it can be used to misstate financial results without detection.

When a bank auditor concludes that a control reliance strategy is appropriate, what is the PRIMARY benefit over a substantive-only approach?

Answer: Reduces the volume of substantive procedures needed to achieve audit objectives

Effective controls reduce the risk of material misstatement, allowing auditors to perform less extensive substantive procedures while still meeting audit objectives.

Which of the following BEST illustrates a key risk indicator (KRI) for monitoring internal control effectiveness in a bank's payment processing department?

Answer: Number of payment exceptions requiring manual intervention

Payment exceptions requiring manual intervention signal potential control failures in automated processing and indicate areas of heightened control risk.

Under the IIA Standards, internal auditors must maintain independence from the activities they audit. This independence is BEST achieved by:

Answer: Reporting functionally to the audit committee rather than management

Functional reporting to the audit committee ensures internal audit is not subordinate to the management whose activities it reviews, preserving independence.

A bank's internal audit charter should PRIMARILY document which of the following?

Answer: The purpose, authority, responsibility, and independence of internal audit

The internal audit charter formally establishes the function's mandate, defines its authority to access records and personnel, and affirms its independence.

Which PCAOB standard most directly guides auditors in assessing whether identified control deficiencies rise to the level of material weaknesses at publicly held bank holding companies?

Answer: AS 2201 — An Audit of Internal Control Over Financial Reporting

AS 2201 (formerly AS 5) provides the integrated audit framework for evaluating ICFR, including the criteria for classifying deficiencies as material weaknesses.