Internal Controls & Compliance Flashcards
7 cards from real CFC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Internal Controls & Compliance flashcards as text
Under COSO's Internal Control framework, which component addresses an organization's culture and values that influence employee behavior?
Answer: Control Environment
The Control Environment is the foundation of the COSO framework and encompasses the tone at the top, ethical values, and organizational culture.
A company discovers that a single employee can both approve purchase orders and process vendor payments. This represents a failure in which control principle?
Answer: Segregation of duties
Segregation of duties requires that no single individual can both initiate and approve a transaction to prevent fraud and errors.
Which SOX section specifically requires management to assess and report on the effectiveness of internal controls over financial reporting?
Answer: Section 404
SOX Section 404 mandates that management assess and report on the effectiveness of internal controls over financial reporting, with external auditor attestation for large accelerated filers.
When evaluating the design effectiveness of an internal control, an auditor is primarily concerned with:
Answer: Whether the control, if operating as designed, would prevent or detect material misstatements
Design effectiveness asks whether the control, if operating as intended, is capable of preventing or detecting material misstatements.
A company implements a detective control that compares actual expenses to budgeted amounts and investigates significant variances. This is best described as:
Answer: A variance analysis control
Variance analysis is a detective control because it identifies discrepancies after they have occurred rather than preventing them.
The PCAOB's auditing standards for internal controls require external auditors to evaluate which of the following when assessing a company's ICFR?
Answer: Both entity-level and transaction-level controls
PCAOB standards require auditors to evaluate both entity-level controls and transaction-level controls as part of an integrated audit of ICFR.
Which of the following best describes a 'material weakness' in internal controls over financial reporting?
Answer: A deficiency or combination of deficiencies where there is a reasonable possibility of a material misstatement not being prevented or detected
A material weakness is defined as a deficiency where there is a reasonable possibility (more than remote) that a material misstatement will not be prevented or detected on a timely basis.