CHAPTER # 9: INTERNAL CONTROL
1. ISA 315 (Revised) identifying and assessing the
risks of material misstatement through
understanding the entity and its environment deals
with the whole area of control whereby internal
control has:
(a) Four components
(b) Three components
(c) Five components (correct)
(d) Six components
Answer (c)
Explanation:
Five components:
I. The control environment
II. The entity’s risk assessment process
III. The information system relevant to financial
reporting
IV. Control activities
V. Monitoring of controls
2. _____________________ is a component of
internal control that includes the governance and
management functions and the attitudes,
awareness and actions of those charged with
governance and management concerning the
entity’s internal control and its importance in the
entity:
(a) Control environment (correct)
(b) Information system relevant to financial
reporting
(c) Monitoring of controls
1
(d) Control activities
Answer (a)
Explanation:
(a) Control environment is a component of
internal control that includes the governance
and management functions and the
attitudes, awareness and actions of those
charged with governance and management
concerning the entity’s internal control and
its importance in the entity.
(b) Information system relevant to financial
reporting is a component of internal control
that includes the financial reporting system,
and consists of the procedures and records
established to initiate record, process and
report entity transactions and to maintain
accountability for the related assets,
liabilities and equity.
(c) Monitoring of controls is a process to assess
the effectiveness of internal control
performance over time.
(d) Control activities are those policies and
procedures that help ensure that
management directives are carried out.
3. The auditors must keep a record of the client’s
systems which must be updated each year. This
can be done through the use of one or more of the
following:
I. Narrative notes
II. Flowcharts
III. Questionnaires
IV. Checklists
2
V. Segregation of duties
VI. Close involvement
(a) III, IV, V and/or VI
(b) I, II, III and/or IV (correct)
(c) II, III, IV and/or V
(d) I, II, V and/or VI
Answer (b)
Explanation:
There are several techniques for recording the
assessment of control risk, that is, the system.
One or more of the following may be used
depending on the complexity of the system.
• Narrative notes
• Flowcharts
• Questionnaires
• Checklists
4. Point out which functions should ideally be
segregated because an effective system of
internal control requires segregation of duties?
I. Authorization of transactions
II. Custody or handling of assets
III. Recording of transactions
IV. Preparation of financial statements
V. Budgetary control
(a) I, III and V
(b) I, II and III (correct)
(c) I, II and V
(d) III, IV and V
3
Answer (b)
Explanation:
Authorization of transactions, custody or handling
of assets and recording of transactions are the
three functions which should ideally be separated
such that no one can initiate the transaction,
record that transaction in the accounting records
and have custody of assets which arise from that
transaction.
5. Point out which one is part of the control
environment component within an internal control
system?
(a) The governance and management function
(correct)
(b) Segregation of duties
(c) The attitude, actions and awareness of all
personnel within an entity
Answer (a)
Explanation:
The control environment includes the attitude,
actions and awareness of those responsible for
the design, implementation and monitoring internal
controls. Segregation of duties is a control activity.
6. Which two of the following are application controls
(i.e. application controls relate to procedures used
to initiate, record, process and report transactions
and other financial data)?
I. Virus checks
II. Batch reconciliations
III. Document counts
4
IV. Records of program changes
(a) I and II
(b) I and IV
(c) II and III (correct)
(d) III and IV
Answer (c)
Explanation:
Records of program changes and virus checks are
general IT controls.
7. Which of the following constitutes an Entity's
Control Environment?
(a) The information system, including the
related business processes relevant to
financial reporting, and communication,
control activities, and monitoring the design
and effectiveness of controls on financial
reporting.
(b) The entity's risk assessment process, the
information system, communication, control
activities; and monitoring of controls.
(correct)
(c) The entity's risk assessment process, the
information system, includes the related
business processes relevant to financial
reporting, and communication, control
activities, and monitoring the design and
effectiveness of controls on management
reporting.
5
Answer (b)
Explanation:
Entity's Control Environment constitutes the
entity's risk assessment process, the information
system, communication, control activities; and
monitoring of controls.
8. Some advantages are:
I. They are relatively simple to record and can
facilitate understanding by all audit team
members.
II. After a little experience they can be
prepared quickly.
III. As the information is presented in a
standard form, they are fairly easy to follow
and to review.
IV. They can be used for any system due to the
method’s flexibility.
V. Editing in future years can be relatively easy
if they are computerized.
Which of the above are the advantages of
narrative notes?
(a) I, III and V
(b) II, III and IV
(c) I, IV and V (correct)
(d) I, II and III
Answer (c)
Explanation:
Advantages of Narrative Advantages of
Notes Flowcharts
They are relatively After a little
simple to record and experience they can
6
can facilitate be prepared quickly.
understanding by all
audit team members.
They can be used for As the information is
any system due to the presented in a
method’s flexibility. standard form, they
are fairly easy to
follow and to review.
Editing in future years
can be relatively easy
if they are
computerized.
9. Point out which one is used by the auditor to
determine if a deficiency in internal control is
significant?
(a) Professional skepticism
(b) Professional judgment (correct)
(c) Performance materiality
Answer (b)
Explanation:
Definition from ISA 265 Communicating
Deficiencies in Internal Control to Those Charged
With Governance and Management.
10. Which two of the following are general controls
(i.e. general controls are policies and procedures
that support the effective functioning of application
controls)?
7
I. Regular back up of programs
II. Sequence checks
III. Authorization for the acquisition of new
software
IV. Exception reporting
(a) I and III (correct)
(b) I and II
(c) II and IV
(d) III and IV
Answer (a)
Explanation:
II and IV are application controls.
11. According to ISA 315 (Revised) the auditor shall
identify and assess the risks of material
misstatement at:
(a) The financial statement level, notes to the
financial statement level and disclosures
(b) The financial statement level, account
balances, and disclosures
(c) The financial statement level, the assertion
level for classes of transactions, account
balances, and supplementary information
level
(d) The financial statement level, the assertion
level for classes of transactions, account
balances, and disclosures (correct)
Answer (d)
8
Explanation:
ISA 315 (Revised) identifying and assessing the
risks of material misstatement through
understanding the entity’s and its environment
says that the auditor shall identify and assess the
risks of material misstatement at the financial
statement level and at the assertion level for
classes of transactions, account balances and
disclosures.
12. Qasim Co. ensures that two individuals are always
present when the post is opened. Which control
objective does this help to achieve?
(a) That cash and cheques are not
misappropriated. (correct)
(b) That cash is banked on a regular basis.
(c) That cash and cheques are accurately
recorded in the general ledger.
Answer (a)
Explanation:
Although it is possible for two individuals to collude
the risk of fraud and/or theft is reduced. The
control is only effective at the point it occurs so it
will not have any effect on the subsequent
recording or banking of the cash.
13. Name two key inherent limitations of an internal
control system:
I.
___________________________________
______________________________
9
II.
___________________________________
______________________________
Answer:
I. Human error
II. Possibility of staff colluding in fraud
14. Find out the primary reasons why organizations
need to have effective systems of control?
I. Managing going concern risk
II. Maximizing its profitability
III. Managing its assets and liabilities
IV. Cutting down the time needed for the audit
V. Complying with laws and regulations
(a) I and III
(b) I and V (correct)
(c) IV and V
(d) II and III
Answer (b)
Explanation:
Going concern risk (as the ultimate business risk)
and complying with laws and regulations are two
of the primary reasons why organizations need
effective systems of control (effectiveness and
efficiency of operations is a third). The other
reasons given may result from the operation of an
effective and efficient internal control system.
15. While performing the audit you have identified and
assessed the risks of material misstatement at
10
various levels prescribed in ISA 315. What will be
your further course of action?
(a) You will use the above risk assessment as
basis of forming opinion.
(b) You will use the above risk assessment as
evidence and will not perform any further
procedures
(c) You will use the above risk assessment to
provide a basis for designing, and
performing further audit procedures (correct)
(d) All of the above
Answer (c)
Explanation:
ISA 315 (Revised) identifying and assessing the
risks of material misstatement through
understanding the entity’s and its environment
points out that there is a direct relationship
between an entity’s objectives and the controls it
implements to provide reasonable assurance
about their achievement. Many of these controls
will relate to financial reporting, operations and
compliance, but not all of the entity’s objectives
and controls will be relevant to the auditor’s risk
assessment. In obtaining an understanding of
internal control, the auditor must understand the
design of the internal control and the
implementation of that control.
16. In relation to documenting internal control
systems, which method is described by the
following statement?
11
“A questionnaire listing control objectives, which
require the client to explain how they meet each
objective.”
(a) Narrative notes
(b) Internal Control Evaluation Questionnaire
(correct)
(c) Internal Control Questionnaire
Answer (b)
Explanation:
Narrative notes are the auditor’s description of a
system. Internal Control Questionnaires list
possible controls, and the client simply confirms
which controls are applicable to their system.
17. Is the following statement true or false?
“An effective internal control system provides the
auditor with absolute assurance that control
objectives have been achieved.”
(a) True
(b) False (correct)
Answer (b)
Explanation:
Even the most effective internal control system
can only provide reasonable assurance that
control objectives are met due to its inherent
limitations. These include in particular human error
and the possibility of fraud.
18. Complete the definition taking the words
given below:
Attitudes Control Environment Importance
12
Governance Awareness Control Actions
The (1) ____________ (2) ___________ includes
the governance and management functions and
the (3) _________________, (4)
_______________ and (5) _____________ of
those charged with (6) ___________________
and management concerning the entity’s internal
(7) _____________ and its (8) _______________
in the entity.
Answer:
(1) Control
(2) Environment
(3) Attitudes
(4) Awareness
(5) Actions
(6) Governance
(7) Control
(8) Importance
19. As per ISA 315 which of the following is part of the
risk assessment procedure?
(a) Obtaining an understanding of the design of
the internal controls of the entity (correct)
(b) Determining the strategy to be adopted
during the course of the audit
(c) Designing tests to perform on the controls of
the Company
(d) Selecting a sample on which to perform
substantive procedures
13
Answer (a)
Explanation:
ISA 315 says the auditor shall obtain an
understanding of whether the entity has a process
for
Identifying business risks relevant to financial
reporting objectives
Estimating the significance of the risks
Assessing the likelihood of their occurrence
Deciding upon actions to address those risks
If the entity has established such a process, the
auditor shall obtain an understanding of it. If there
is not a process, the auditor shall discuss with
management whether relevant business risks
have been identified and how they have been
addressed.
20. Is this statement true or false?
“As a number of deficiencies within the sales cycle
are individually not significant, there is no
requirement to discuss or report any of them to
those charged with governance.”
(a) True
(b) False (correct)
Answer (b)
Explanation:
The statement is false. Although each deficiency
may be insignificant, the auditor may decide that a
certain combination of the deficiencies is
significant. The auditor may also, using
14
professional judgment, decide to discuss any
deficiency with those charged with governance. In
addition, if the entity is subject to a corporate
governance code, many codes require the auditor
to discuss all deficiencies with the audit committee
before issuing a report on those considered
significant.
21. Which of the following statements is correct
regarding the report to management sent by the
auditor?
I. The report states that the results of the audit
work have enabled the auditor to express an
opinion on the operating effectiveness of
internal control.
II. The report must include a description of the
deficiencies and an explanation of their
potential effects.
III. The report includes an explanation of the
purpose of the audit.
(a) I and II only
(b) I and III only
(c) II and III only (correct)
(d) I, II and III
Answer (c)
Explanation:
ISA 265 Communicating deficiencies in internal
control to those charged with governance and
management states that consideration of internal
control is to enable suitable audit procedures to be
designed, not to enable the auditor to express an
opinion on the effectiveness of controls.
15
22. Find out which one indicates the presence of a
significant deficiency?
(a) The presence of an audit committee
(b) Lack of oversight and scrutiny by
management (correct)
(c) Management implementation of controls to
remedy control deficiencies once identified
Answer (b)
Explanation:
If management do not scrutinize transactions and
keep control of the organization, significant
deficiencies can occur.
23. Which of the following are components of an
entity's risk assessment process, as per ISA 315?
(a) Identifying inherent risks relevant to financial
reporting objectives
(b) Assessing the materiality of the significant
risks
(c) Assessing the likelihood of the occurrence of
significant risks (correct)
(d) All of the above
Answer (c)
Explanation:
ISA 315 says the auditor shall obtain an
understanding of whether the entity has a process
for:
Identifying business risks relevant to financial
reporting objectives
16
Estimating the significance of the risks
Assessing the likelihood of their occurrence
Deciding upon actions to address those risks
If the entity has established such a process, the
auditor shall obtain an understanding of it. If there
is not a process, the auditor shall discuss with
management whether relevant business risks
have been identified and how they have been
addressed.
24. Which of the following methods of recording an
accounting and controls system is a series of
questions used to determine whether controls
exists which meet specific control objectives?
(a) Flowchart
(b) Internal control questionnaire (correct)
(c) Internal control evaluation questionnaire
Answer (b)
Explanation:
An internal control evaluation questionnaire asks
questions to determine whether there are controls
which prevent or detect specified errors or
omissions. (a) flowchart is a diagram showing the
physical flow of information through the system.
25. Which of the following is not a test of control?
(a) Verification of value to invoice (correct)
(b) Observation of controls
(c) Reperformance of control procedures
(d) Inspection of documents
Answer (a)
Explanation:
17
Tests of control may include the following:
• Inspection of documents
• Inquiries of internal control
• Reperformance of control procedures
• Observation of controls
26. According to ISA 265 (Communicating
Deficiencies in Internal Control to those Charged
with Governance and Management), the external
auditor has identified a deficiency in the internal
controls of ABC Co. Identify the factors which
indicates that the deficiency is a significant
deficiency?
I. The likelihood of the deficiency leading to
material misstatement is low
II. There is a risk of fraud
III. The number of transactions affected by the
deficiency is low
IV. The deficiency interacts with other
deficiencies identified
(a) I and II
(b) II and IV (correct)
(c) I and III
(d) III and IV
Answer (b)
Explanation:
In accordance with guidance given in ISA 265, the
factors which indicate that the deficiency is a
significant deficiency are II and IV.
27. Under Company H's process, the advance against
salary request is submitted to the assistant
18
accountant. Approval of the advance is made by
Chief Accountant and payment is done by the
Cashier. Which does this process called?
(a) Segregation of Duties (correct)
(b) Performance Reviews
(c) Control Environment
(d) Check and Balance
Answer (a)
Explanation:
Segregation implies a number of people being
involved in the accounting process. This makes it
more difficult for fraudulent transactions to be
processed (since a number of people would have
to collude in the fraud), and it is also more difficult
for accidental errors to be processed (since the
more people are involved, the more checking
there can be).
28. Identify which one would not normally be
considered to be a significant deficiency by an
auditor?
(a) An immaterial fraud carried out by a senior
manager had not been detected by the
internal control system
(b) Transactions in which directors have
financial interests are not being scrutinized
by the audit committee
(c) No action has been taken to address a
significant deficiency reported during the
audit of the previous year
19
(d) No sensitivity analysis was carried out on
the objective determination of estimates
contained within the financial statements
(correct)
Answer (d)
Explanation:
As the determination of the estimate is based on
objective criteria, there will be no need for a
sensitivity analysis. With (a), any fraud carried out
by management is significant. Similarly with (b) as
directors are involved, independent scrutiny is
essential.
29. ISA 315 Identifying and Assessing the Risks of
Material Misstatement through Understanding the
Entity and Its Environment sets out the five
components of internal control. Which of the
following is not set out as a component of internal
control within ISA 315?
(a) Control environment
(b) The information system relevant to financial
reporting
(c) Human resource policies and practices
(correct)
Answer (c)
Explanation:
Human resource policies and practices is an
element of a control environment which is itself a
component of internal control.
20
30. Which of the following statements is true regarding
the controls in a small company?
I. The external auditor will never be able to
rely on the controls in a small company.
II. Segregation of duties may be inadequate
due to staff numbers.
III. Evidence of the operation of controls if more
likely to be available in documentary form.
IV. The external auditor will assess the
attitudes, awareness, and actions of
management.
(a) I and III
(b) II and IV (correct)
(c) I and IV
(d) II and III
Answer (b)
Explanation:
Staff numbers are likely to be lower in a small
company making segregation of duties more
difficult. The external auditor will assess the
attitudes, awareness and actions of management
as part of the assessment of the control
environment. Although controls may be less
sophisticated in a small company the auditor may
be able to rely on controls in some areas
depending on the overall assessment and results
of tests of controls (I). Controls are likely to be
operated less formally therefore documentary
evidence is less likely to exist (III).
31. Which of the following is a type of control activity
within an internal control system?
21
(a) Information system
(b) Information processing (correct)
(c) Risk assessment
Answer (b)
Explanation:
(a) and (c) are elements of an internal control
system, but are not a control activity.
32. Which of the following is an example of Application
Controls?
(a) Controls over system software that restrict
access to or monitor the use of system
utilities that could change financial data
(b) Controls over the implementation of new
releases of packaged software applications
(c) Checking the arithmetical accuracy of
records (correct)
(d) All of the above
Answer (c)
Explanation:
The purpose of application controls is to establish
specific control procedures over the accounting
applications in order to provide reasonable
assurance that all transactions are authorized and
recorded, and are processed completely,
accurately and on a timely basis.
33. A control objective of Hafiz Co. is that goods and
services are sold only to credit-worthy customers.
22
Which control activity would assist Hafiz Co. in
achieving this objective?
(a) All sales orders are based on authorized
price lists.
(b) Overdue debts are chased each month by
the credit controller.
(c) Credit limits are checked before sales
orders are accepted. (correct)
(d) The aged-debt listing is reviewed by the
finance director on a monthly basis.
Answer (c)
Explanation:
This means that customers are not able to exceed
their credit limits and are therefore more likely to
be able to pay. (a) helps to ensure that goods are
sold at the right price. (b) and (d) are effective
controls regarding the recovery of debts but do not
prevent sales being made to customers who are
unlikely to pay as the sale has already been made
by this stage.
34. After the controls have been assessed, the audit
plan may be modified:
(a) True (correct)
(b) False
Answer (a)
35. Which of the following is not an inherent limitation
of internal control systems?
(a) Insufficient segregation of duties (correct)
(b) Possibility that employees may collude
together fraudulently
23
(c) Possibility of human error in undertaking
tasks
Answer (a)
Explanation:
(a) is incorrect as it is not an inherent limitation of
an internal control system; rather it is an internal
control deficiency.
36. Is the following statement true or false?
“Internal control questionnaires are used to
determine whether there are controls which
prevent or detect specified errors or omissions.”
(a) True
(b) False (correct)
Answer (b)
Explanation:
Internal control evaluation questionnaires (ICEQs)
are used to determine whether there are controls
which prevent or detect specified errors or
omissions. Internal control questionnaires (ICQs)
are used to ask whether controls exists which
meet specific control objectives.
37. Which of the following are examples of general IT
controls?
(a) Reviewing accounts and trial balances.
(b) Edit checks of input data
(c) Program change controls (correct)
24
(d) All of the above
Answer (c)
Explanation:
General IT controls are policies and procedures
that relate to many applications and support the
effective functioning of application controls by
helping to ensure the continued proper operation
of information systems. They commonly include
controls over data center and network operations,
system software acquisition, change and
maintenance, access security, and application
system acquisition, development and
maintenance.
38. Which of the following items may be included
within the report to management?
I. An indication of areas in which the client can
assist in improving audit efficiency.
II. Details of the audit work carried out to
detect deficiencies.
III. Constructive feedback on business systems,
risk systems and risk management.
IV. Details of additional extensive work that
could have been carried to try and detect
further significant deficiencies.
(a) I and II only
(b) I and III only (correct)
(c) I, II and IV only
(d) II, III and IV only
Answer (b)
Explanation:
25
The detail of the audit work carried out would
never be revealed to the client. If the client were to
require a more detailed review of the systems
beyond that required for audit, this entails
additional assurance services to be agreed with
the client. ISA 265 suggests that items I and III
may be included within the report to management
to enhance the audit service provided.
39. Find out which control objective would be satisfied
by the authorization of capital expenditure by the
board?
(a) To ensure that expenditure is correctly
classified as capital expenditure
(b) To ensure that investment in non-current
assets is made for valid business purposes
(correct)
(c) To ensure that all non-current assets are
recognized in the non-current asset register
(d) To ensure that non-current assets are
valued correctly
Answer (b)
Explanation:
Capital expenditure will often involve significant
amounts. It is important therefore that it is for valid
business purposes and that appropriate decisions
are made by senior individuals.
40. According to ISA 265, auditors are required to
communicate deficiencies in internal control to
those charged with governance and management.
Which statement is true in respect of this
communication?
26
(a) The auditor can communicate deficiencies in
internal control verbally or in writing
(b) The auditor must communicate all
deficiencies identified during the audit
(c) The auditor must communicate those
deficiencies identified during the audit which
they believe merit the attention of those
charged with governance and management
(correct)
Answer (c)
Explanation:
Insignificant deficiencies are not required to be
communicated. Communication of significant
deficiencies must be in writing.
41. What does this symbol is
used for in a flow chart?
(a) Connector
(b) Decision (correct)
(c) Operations
(d) Start
Answer (b)
Explanation:
Connector
Operations
27
Decision
Start/End
42. A control objective of Basit Co. is that all liabilities
for purchases are valid obligations of the
company. Which control activity would help Basit
Co. in achieving this objective?
(a) Reconciliation of the payables control
account to the purchase ledger
(b) Checking of the mathematical accuracy of
the supplier invoice
(c) Sequential numbering of goods received
notes
(d) Matching of suppliers' invoices to purchase
orders and goods received notes (correct)
Answer (d)
Explanation:
Matching of suppliers' invoices to purchase orders
and goods received notes ensures that liabilities
are only recognized for goods which have been
received by the company. The reconciliation of the
payables control account and purchase ledger and
checking of calculation of invoices are accuracy
checks. Sequential numbering of documentation
helps to ensure completeness.
43. Which of the following is not a general control?
(a) Training
(b) Virus checks
(c) Passwords
28
(d) Record counts (correct)
Answer (d)
Explanation:
A record count is included in the category of
application controls.
44. Which of the following symbol is used as a
connector in a flow chart?
(a)
(b)
(c)
(d) (correct)
Answer (d)
Explanation:
Connector
Operations
29
Decision
Start/End
45. Auditor identified several weaknesses during the
audit of a new client therefore the auditor is
considering the content and format of his report to
management (letter of weakness). Point out which
one best summarizes the auditor's approach to the
report?
(a) Report only major points to be dealt with by
directors, leaving less important items to be
discussed informally with members of the
client's staff
(b) Report only those matters which potentially
have a material effect on the true and fair
view shown by the financial statements,
indicating that this should not be regarded
as a comprehensive statement of all
weaknesses that exist
(c) Include all matters of sufficient importance
identified, but structure the letter to take
account of the varying levels of significance
of matters included (correct)
(d) Issue separate reports for each area to the
executive directors with specific
responsibility in those areas
Answer (c)
Explanation:
All significant deficiencies and other matters that
are deemed of sufficient importance should be
reported to those charged with governance (as
30
well as separately to relevant management).
Those matters considered significant should be at
the forefront of the report.
46. Which two of the following are general IT controls
(i.e. general IT controls are policies and
procedures that support the effective functioning of
application controls)?
I. One for one checking
II. Disaster recovery procedures
III. Hash totals
IV. Testing procedures using test data
(a) I and III
(b) I and IV
(c) II and III
(d) II and IV (correct)
Answer (d)
Explanation:
One for one checking and hash totals are
application controls.
47. Is the following statement true or false?
“All deficiencies in internal controls which the
auditor judges should be reported to management
must be reported in writing. “
(a) True
(b) False (correct)
Answer (b)
Explanation:
31
Significant deficiencies must be reported in writing.
Other deficiencies which are not significant but
which warrant management attention may be
reported in writing or orally.
48. What does a flow line indicates in a flow chart?
(a) Continuation of the process
(b) A link of a step to another step
(c) Direction flow of the process (correct)
(d) All of the above
Answer (c)
Explanation:
Flowcharts can take many forms, but in general
are graphic illustrations of the physical flow of
information through the accounting system. Flow
lines represent the sequences of processes, and
other symbols represent the inputs and outputs to
a process.
32