Internal Controls & Auditing Flashcards
7 cards from real CFS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Internal Controls & Auditing flashcards as text
Which concept describes the risk that remains after management has implemented controls to reduce inherent risk?
Answer: Residual risk
Residual risk is the remaining exposure after controls have been applied; it represents the risk that the organization accepts or must further mitigate.
An employee in accounts receivable who also handles cash receipts and posts to the customer ledger poses what type of internal control risk?
Answer: Inadequate segregation of duties
Allowing one person to receive cash, record it, and maintain customer accounts creates an opportunity to steal payments and conceal the theft through record manipulation.
A fraud examiner reviewing IT general controls would focus on all of the following EXCEPT:
Answer: Gross profit margin trends
Gross profit margin trends are a financial analytical procedure, not an IT general control; IT general controls cover access, change management, operations, and physical security.
When an internal auditor discovers evidence of fraud during a routine audit, the recommended next step is to:
Answer: Expand audit procedures and notify appropriate management or legal counsel
Upon discovering fraud indicators, the auditor should expand testing to understand the scope and promptly inform appropriate management or legal counsel rather than self-investigate.
The 'reasonable assurance' concept in internal controls means that:
Answer: The cost of controls should not exceed the expected benefit
Reasonable assurance acknowledges that controls involve cost-benefit tradeoffs and that no system can eliminate all risk, but costs of controls should not exceed their benefits.
Which of the following is an example of a detective control in a procurement process?
Answer: Performing three-way matching of purchase order, receiving report, and invoice
Three-way matching detects discrepancies between what was ordered, received, and invoiced after the fact, making it a detective rather than preventive control.
A significant deficiency in internal controls differs from a material weakness in that:
Answer: A material weakness represents a higher probability of material misstatement than a significant deficiency
A material weakness indicates a reasonable possibility of material misstatement, while a significant deficiency is a lesser but still noteworthy control gap that warrants attention.