Internal Controls and Auditing Flashcards

Which control type is designed to detect errors or irregularities AFTER they have already occurred?

Answer: Detective control

Detective controls identify problems that have already occurred, such as reconciliations, audits, and exception reports.

An organization separates the duties of transaction authorization, recording, and custody of assets. This is an example of:

Answer: Segregation of duties

Segregation of duties divides key tasks among different individuals to reduce fraud and error risk.

During an audit, the auditor uses a sample to test transactions rather than reviewing every record. What is this practice called?

Answer: Audit sampling

Audit sampling involves selecting a representative subset of transactions to draw conclusions about a population.

Which framework is most commonly used by US public companies to assess the effectiveness of internal controls over financial reporting?

Answer: COSO Internal Control Framework

The COSO Internal Control — Integrated Framework is the standard used for Sarbanes-Oxley Section 404 compliance.

A control that automatically prevents a transaction from proceeding when a threshold is exceeded is best described as a:

Answer: Automated preventive control

Automated preventive controls use system logic to block non-compliant transactions before they are completed.

What is the PRIMARY purpose of a control self-assessment (CSA)?

Answer: Allow management and staff to evaluate control effectiveness

CSA empowers process owners to assess the design and operating effectiveness of controls in their own areas.

Which internal audit activity focuses on whether controls are actually operating as designed in practice?

Answer: Operating effectiveness testing

Operating effectiveness testing determines whether a control is functioning correctly over time, not just whether it exists on paper.