Modern auditing assurance services and the integrity of financial reporting 8th edition boynton test

Modern Auditing Assurance Services and the Integrity of Financial Reporting 8th Edition Boynton Test Bank Visit to download the full and correct content document: https://testbankdeal.com/dow nload/modern-auditing-assurance-services-and-the-integrity-of-financial-reporting-8thedition-boynton-test-bank/

CHAPTER 10: Understanding Internal Controls QUESTIONS True/False REQUIRED: For each of the following items, indicate whether it is (T) True or (F) False. For those marked “False,” identify the error(s) and indicate the change or changes that are needed to make the statement true.

1.

The Foreign Corrupt Practices Act is administered by the Federal Trade Commission.

2.

Under the Foreign Corrupt Practices Act, management and directors are both subject to fines, penalties, and/or imprisonment.

3.

The auditor's consideration of internal controls relates primarily to nonfinancial objectives.

4.

The COSO report concludes that a few key people in an organization has some responsibility the organization’s internal controls.

5.

All internal control systems are subject to inherent limitations.

6.

Internal auditors have primary responsibility for establishing and maintaining internal controls.

7.

Legislators and regulators establish minimum statutory and regulatory requirements for the establishment of internal controls by certain entities.

8.

Utility programs contain instructions that enable the computer to perform specific data processing tasks for the user.

9.

Under the traditional file method of data organization, transaction files contain the details of individual transactions of the same class such as a day’s credit sales or a day’s cash disbursements.

10.

The database method of data organization is the main alternative to the traditional file method.

11.

It is management’s responsibility to establish and maintain effective internal controls.

12.

To minimize the risks associated with on-line entry/batch processing, some companies use memo updating of the master file at the time of data entry.

13.

Application controls are designed to provide reasonable assurance that IT records, processes, and reports data properly for specific applications.

14.

Computer general controls represent a lower level of controls.

15.

The organizational structure of a company is usually depicted graphically in an organization chart.

16.

Management’s risk assessment for financial reporting purposes is similar to the internal 1

auditor’s concern with inherent risks.

17.

A major focus of the accounting system is on transactions.

18.

A company's accounting system should provide a complete “chain of evidence” for every major transaction.

19.

To enhance controls, it is normally desirable to have a single employee handle a transaction from beginning to end.

20.

The accounting records for an asset should normally be maintained by the same individual who controls that asset.

21.

The auditor would expect a lesser degree of segregation of duties in a small company than in a large company.

22.

The echo check involves transmitting data received by an output device back to the source unit for comparison with the original data.

23.

Access controls relate to both the accounting records and the physical assets.

24.

General authorization relates to the granting of the authorization on a case by case basis.

25.

General controls provide a framework for controlling daily computer operations, minimizing the likelihood of processing errors, and assuring the continuity of operations in the event of a physical disaster of computer failure.

26.

A before-and-after report shows a summary of the contents of a master file before and after each update.

27.

Security measures include limiting access to storage areas to authorized personnel.

28.

A report that summarizes gross margin by region is an example of a procedure review.

29.

Monitoring is a process that assesses the quality of the internal controls performance over time.

30.

The IT Manager’s primary responsibilities include maintaining custody of systems documentation, programs and files.

31.

The risk of misstatement is associated with changes in the content or form of information.

32.

The external auditor is not required to test the work of internal auditors that pertains to obtaining an understanding.

33.

Standardized internal control questionnaires are used on a minority of audits.

34.

In an audit of a small company, a narrative memorandum may serve as the only documentation of the auditor’s understanding of internal controls.

35.

A very detailed flowchart would be prepared for the accounting system as a whole.

36.

Organization and operation controls address risks related to the authorization, completeness, and accuracy of transactions.

2

37.

Parity check involves transmitting data received by an output device back to the source unit for comparison with the original data.

38.

Transactions consist of exchanges of assets and services between an entity and outside parties, as well as the transfer or use of assets and services within an entity.

39.

Communication includes making sure that personnel involved in the financial reporting system understand how their activities relate to the work of others inside the organization.

40.

Some auditors associate controls related to recording transactions in the correct accounting period with a separate objective identified as the extension objective.

41.

In database management systems, an important documentation control is the data repository.

42.

In the example system of cash receipts, the cashier prepares the bank deposit slip and makes the daily bank deposit.

Answers to True/False 1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25.

26.

27.

28.

29.

F: Federal Trade Commission should be Securities and Exchange Commission.

T. F: Nonfinancial should be financial.

F: A few key people should be everyone.

T. F: Have should be do not have.

T. F: Utility should be Application.

T. T. T. F: After should be at.

T. F: Lower should be higher.

T. F: Internal should be external.

T. F: Every major transaction should be every transaction.

F: A single employee should be different employees.

F: Should should be should not.

T. T. T. F: General should be specific.

F: General should be data and procedural.

T. T. F: Procedure should be performance.

T. 3

30.

31.

32.

33.

34.

35.

36.

37.

38.

39.

40.

41.

42.

F: IT Manager should be Librarian.

T. T. F: Minority should be majority.

T. F: Very detailed should be broad overview.

F: Organization and operation controls should be Information processing controls.

F: Parity should be echo.

T. F: Inside should be both inside and outside.

F: Extension should be cutoff.

F: Data repository should be data dictionary/directory.

T.

Multiple Choice REQUIRED: Indicate the best answer choice for each of the following.

1.

Which of the following is an incorrect quotation from the second field work standard? a.

“A sufficient understanding...” b. “of the internal control structure is...” c. “to be obtained to...” d. “plan the audit and to...” e. “determine the nature, timing, and extent of compliance tests...”

2.

The Foreign Corrupt Practices Act (FCPA) is administered by the: a.

IRS. b.

SEC. c.

CIA. d. NCFFR. e.

COSO.

3.

Which of the following requires managements of pubic companies to assess the adequacy of internal controls over financial reporting and further requires their auditors to audit management’s assessment of internal controls over financial reporting and the actual effectiveness of the system of internal controls? a.

Foreign Corrupt Practices Act b.

Securities Exchange Act of 1934 c.

SAS 55, Consideration of the Internal Control Structure in a Financial Statement Audit d. Section 404 of Sarbanes-Oxley e.

PCAOB Standard No. 9

4.

The COSO report identified five interrelated components of internal control. Since then, a sixth category has been identified, which is: a. monitoring. b. risk assessment. c. information and communication. d. control activities e. antifraud programs and controls 4

5.

Which of the following is not one of the fundamental concepts in the COSO report’s definition of internal control? a.

Internal control is a process. b.

Internal control is effected by people. c.

Internal control is a guarantee. d. Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board. e.

Internal control is geared to the achievement of objectives in the overlapping categories of financial reporting, compliance, and operations.

6.

Which of the following is not one of the interrelated components of internal controls identified by the COSO report? a. control activities b. control environment c. information and communication d. regulating e. risk assessment

7.

Which one of the following is not an inherent limitation in an entity’s internal controls? a. mistakes in judgment b. collusion c. cost versus market d. breakdowns e. management override

8.

Which of the following systems programs perform common data processing tasks? a. utility programs b. operating systems c. compilers d. assemblers e. database management systems

9.

Which of the following is a widely used data processing method? a. batch entry/on-line processing b. off-line entry/batch processing c. off-line entry/on-line processing d. off-line entry/off-line processing e. on-line entry/batch processing

10.

Which of the following is not normally a characteristic of batch entry/batch processing in a small system? a. processing of similar transactions together b. audit trail in machine readable form only c. master file update only after batch data accumulation d. delays in correcting processing errors e. control totals generated prior to processing

5

11.

With which of the following data processing methods may validation checks be used and data be screened for errors at the time of entry? a. batch entry/batch processing b. batch entry/on-line processing c. on-line entry/on-line processing d. off-line entry/batch processing e. on-line entry/batch processing

12.

The use of a transaction log is most commonly associated with which of the following data processing methods? a. batch entry/batch processing b. batch entry/on-line processing c. on-line entry/on-line processing d. off-line entry/batch processing e. on-line entry/batch processing

13.

From a control standpoint, which one of the following is a benefit of IT systems over manual systems? a. information in machine-sensible form only b. decrease in human involvement c. reduction in documentation d. consistency in processing e. a more distinct transaction trail

14.

Which of the following control program development, program changes, computer operations, and access to programs and data? a. general controls b. application controls c. access controls d. process controls e. system controls

15.

Which of the following factors are included in a firm’s control environment?

a. b. c. d. e.

Board of Directors No Yes Yes Yes Yes

Integrity and Ethical Values Yes Yes No Yes No

Commitment to Competence Yes Yes No No Yes

16.

Which of the following is not one of the factors that make up the control environment? a. accounting personnel b. board of directors and audit committee c. organizational structure d. human resource policies and practices e. assignment of authority and responsibility

17.

In order to emphasize the importance of integrity and ethical values among all personnel 6

or an organization, the CEO and other top managers should do all of the following except: a. set the tone by example. b. communicate to all employees. c. send email messages to all employees promoting ethical values. d. reduce or eliminate incentives and temptations. e. provide moral guidance to employees.

18.

Which of the following is not one of the characteristics of management's philosophy and operating style? a. approach to taking and monitoring business risks b. monitoring policies for developing and modifying accounting systems c. conscientiousness and conservatism in developing accounting estimates d. its attitudes and actions toward financial reporting e. its attitudes toward information processing and accounting functions and personnel

19.

An effective accounting system should identify and record only the valid transaction of the entity that occurred in the current period, which relates to the: a. rights and obligations assertion. b. presentation and disclosure assertion. c. valuation or allocation assertion. d. existence or occurrence assertion. e. completeness assertion.

20.

Management’s risk assessment should include the following special consideration of the risks that can arise from changed circumstances except: a. new personnel. b. rapid growth. c. new technology. d. corporate restructurings. e. domestic operations.

21.

An effective accounting system should measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements, which relates to the: a. rights and obligations assertion. b. presentation and disclosure assertion. c. valuation or allocation assertion. d. existence or occurrence assertion. e. completeness assertion.

22.

Essential to both management and auditors is a chain of evidence in the accounting system provided by coding, cross references, and documentation connecting account balances and other summary results with original data. This chain of evidence is referred to as the: a. control trail. b. vouching or tracing trail. c. system reference trail. d. audit or transaction trail. e. accounting trail.

7

23.

Incompatible duties are those that allow an irregularity to be perpetrated: a. and concealed by a single employee. b. and concealed through collusive actions. c. by a single employee. d. by accounting personnel. e. and concealed by a group of two or more employees.

24.

Which of the following is incorrect concerning the segregation of duties within an organization? a.

The various steps involved in authorizing and executing a transaction should be separated. b.

Responsibility for certain accounting operations should be segregated, e.g., the cash receipts person should not reconcile the bank account. c.

The IT department should be segregated from the user departments. d. Responsibility for executing, recording, and maintaining assets custody for a transaction should be separated. e.

Responsibility for executing transactions may be assigned to those who have access to the assets, but not to the books.

25.

Which of the following is not an example of incompatible duties? a. the authorized check signer prepares the bank reconciliation. b. the individual who prepares the bank deposit also takes it to the bank. c. the individual who approves the vouchers signs and mails the checks. d. the warehouse manager maintains the perpetual inventory records. e. the individual who processes cash remittances from customers also has authority to approve and record credits to customers’ accounts for sales returns and allowances or write-offs.

26.

PCAOB standards require the auditor to evaluate the effectiveness of the audit committee as part of understanding the control environment and monitoring. Which of the following is not a factor the auditor should consider in making this evaluation? a.

The audit committee’s responsiveness to issues raised by the auditor. b.

The independence of the audit committee from management. c.

Compensation practices with respect to members of the audit committee. d. The clarity with which the audit committee’s responsibilities are articulated. e.

The audit committee’s interaction with key members of financial management.

27.

Which of the following management responsibilities is not established under PCAOB standards? a.

To present a written assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year. b.

To accept responsibility for the effectiveness of the company’s internal control over financial reporting. c.

To evaluate the effectiveness of the company’s internal control over financial reporting using suitable criteria. d. To perform cost-benefit analysis with respect to internal controls relating to assertions having a material effect on the financial statements. e.

To support it’s evaluation of internal control with sufficient evidence, including documentation.

8

28.

Which one of the following is not recognized as one of the types of general controls? a. processing controls b. organization and operation controls c. access controls d. data and procedural controls e. hardware and system software controls

29.

Which one of the following positions maintains custody of systems documentation, programs, and files? a.

IT Manager b.

Programmer c.

Computer Operator d. Network Administrator e.

Librarian

30.

Which of the following is not a hardware and systems software control? a. echo check b. read after write c. data dictionary/directory d. dual read e. parity check

31.

Which of the following is not considered an access control? a. the use of a librarian b. management review of computer utilization reports c. parity check d. the use of passwords e. limited access to data files and programs

32.

The grandfather-father-son concept is an example of a(n): a. systems development and documentation control. b. hardware and systems software control. c. access control. d. data and procedural control. e. general control.

33.

When planning an audit of internal controls over financial reporting, the auditor needs a comprehensive knowledge of the company and its environment. This knowledge might include: a. preliminary judgments about the results of operations. b. assessments about the efficiency of operations. c. conclusions about the effectiveness of internal controls. d. an assessment of the effectiveness of the audit committee. e. legal or regulatory matters of which the company is aware.

34.

Input controls include controls over: a. conversion of input data to machine-sensible form. b. visual scanning. c. comparison to source documents. d. process tracing data. e. sequence tests.

9

35.

The rekeying of all or a portion of the input data is an example of a: a. missing data check. b. verification control. c. parity check. d. limit (reasonableness) check. e. hash total.

36.

For planning purposes, obtaining an understanding of internal controls involves performing procedures to understand the design of policies and procedures and: a. to evaluate their effectiveness. b. to determine their impact on the audit strategy. c. to ascertain whether they are operating as described. d. to determine whether they have been placed in operation. e. to assess their efficiency.

37.

Which of the following is not a widely recognized type of computer general controls? a. organization and operation controls b. hardware and system software controls c. access controls d. data and procedural controls e. information processing controls

38.

The auditor’s primary interest in the control environment is on the: a. effectiveness of detailed policies and procedures that have been built into the system. b. pervasive effects that the attitudes and actions of management may have on the effectiveness of other internal controls. c. existence of external factors such as absentee owners and/or regulators such as the SEC. d. impact that the economic environment will have upon client operations. e. classes of transactions in the entity’s operations that are significant to the financial statements.

39.

The least likely procedure to obtain an understanding of internal controls would be: a. reviewing previous experience with the client. b. inspecting documents and records. c. confirming transactions. d. inquiring of appropriate management. e. observing entity operations.

40.

Which one of the following is a key component of a decision table? a. conditions related to accounting transactions b. actions taken by the computer operator c. decision rules that are used to predict results of procedures d. procedures executed by the computer program e. functions completed by the accounting system

10

Answers to Multiple Choice 1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

e b d e c d c a e b

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

e c d a b a c b d e

21.

22.

23.

24.

25.

26.

27.

28.

29.

30.

c d a e b c d a e c

31.

32.

33.

34.

35.

36.

37.

38.

39.

40.

c d e a b d e b c a

Matching 10-1 (10 minutes) An entity's internal controls consist of five interrelated components (plus an overriding concern with fraud prevention and detection): A: B: C: D: E:

control environment risk assessment information and communication control activities monitoring

REQUIRED: Using the appropriate letter, identify the component to which each of the following control activities or considerations pertains.

1. Performance reviews 2. Commitment to competence 3. System should provide a complete audit or transaction trail 4. Integrity and ethical values 5. Access controls 6. Changes in operating environment 7. Board of directors and audit committee 8. Segregation of duties 9. Organizational structure 10. Reporting exceptions for follow-up 11. Management’s philosophy and operating style 12. Internal audit function 11

13. Physical controls 14. New accounting pronouncements 15. Assignment of authority and responsibility 16. Human resource policies and procedures 17. Organization and operation control 18. Input controls 19. Data and procedural controls 20. Processing controls

Answers — Matching 10-1 1.

2.

3.

4.

D A C A

5.

6.

7.

8.

D B A D

9.

10.

11.

12.

A C A E

13.

14.

15.

16.

D B A A

17.

18.

19.

20.

D D D D

Matching 10-2 (10 minutes) Listed below are eight positions within an IT department coded by the letters A through H. A. B. C. D.

IT manager Systems analyst Programmer Computer operator

E. F. G. H.

Security administrator Librarian Data control group Database administrator

REQUIRED: Match the primary responsibilities below with the codes for the positions above.

1. Flowcharts logic of computer programs, develops and documents programs, and debugs programs.

2. Manages security of IT systems, including hardware, security software and monitors access to programs and data, and follows-up on security breaches.

3. Exercises overall control, develops short and long range plans, and approves systems.

4. Designs content and organization of the database and controls access to and use of the database.

5. Evaluates existing systems, designs new systems, outlines the systems, and prepares specifications for programmers.

6. Acts as liaison with user departments and monitors input, processing, and output.

7. Maintains custody of systems documentation, programs, and files.

12

8. Operates the computer hardware and executes the program according to operating instructions.

Answers — Matching 10-2 1. C 2. E

3. A 4. H

5. B 6. G

7. F 8. D

Short Answer 10-1 (4 minutes) What procedures are normally used by the auditor to obtain an understanding of internal controls?

Answers — Short Answer 10-1 The auditor normally obtains an understanding of the internal control structure by: 1.

2.

3.

4.

5.

reviewing previous experience with the client inquiring of appropriate management, supervisory, and staff personnel inspecting documents and records observing entity activities and operations tracing transactions through the information and communication system

Short Answer 10-2 (3 minutes) Distinguish between the transaction trail and a transaction walk-through review.

Answers — Short Answer 10-2 1.

2.

A transaction trail is a chain of evidence provided by coding, cross references, and documentation connecting account balances and other summary results with original transaction data.

A transaction walk-through review involves tracing one or a few transactions within each major class of transactions through the transaction trail and identifying and observing related control procedures.

Short Answer 10-3 (10 minutes) List the fundamental concepts that are embodied in the definition of internal control as per the COSO report.

Answers — Short Answer 10-3 1.

2.

3.

Internal control is a process that is integrated with, not added onto, an entity’s infrastructure. . It is a means to an end, not an end in itself.

Internal control is effected by people. It is not merely policy manuals and forms, but people at every level of an organization, including the board of directors, management, and other personnel.

Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board because of limitations inherent in all internal control systems.

13

4.

Internal control is geared to the achievement of objectives in the overlapping categories of financial reporting, compliance, and operations.

Short Answer 10-4 (3 minutes) Distinguish between systems programs and application programs, and identify four types of systems programs.

Answers — Short Answer 10-4 Systems programs perform general functions required for the operation of the computer as it executes specific tasks. In contrast, application programs contain instructions that enable the computer to perform specific data processing tasks from the user. Systems programs include: 1. operating systems, 2. utility programs, 3. compilers and assemblers, and 4. security programs 5. database management systems.

Short Answer 10-5 (5 minutes) Why is a preliminary audit strategy important to the auditor?

Answers — Short Answer 10-5 A greater understanding of internal control is required under the lower assessed level of control risk approach than under a primarily substantive approach. This is especially true of the control activities component.

For some factors involved in understanding the components of internal control, additional knowledge may be necessary for the lower assessed level of control risk approach.

A more extensive understanding of risk assessment is usually required under the lower assessed level of control risk strategy than under primarily substantive audit strategies.

Generally, higher levels of understanding of the information and communication component are required for the more sophisticated and complex parts of information systems that affect assertions for which the auditor elects to use the lower assessed level of control risk approach.

When the auditor plans a primarily substantive approach, additional knowledge of control procedures may not be necessary to identify the factors that affect the risk of misstatement, assess the risk of misstatement, and design substantive tests.

However, for assertions for which the auditor hopes to use the lower assessed level of control risk approach, he or she will likely want to obtain an understanding of additional control activities relevant to specific assertions.

Short Answer 10-6 (10 minutes) 1.

What is the purpose of general controls?

2.

Why are general controls important to the auditor?

3.

What is the purpose of application controls?

14

Answers — Short Answer 10-6 1.

The purpose of general controls is to control program development, program changes, computer operations, and to secure access to programs and data. The following five types of general controls are widely recognized: a. organization and operation controls, b. systems development and documentation controls, c. hardware and system software controls, d. access controls, and e. data and procedural controls.

Computer general controls pertain to the IT environment and all IT activities as opposed to a single IT application. Therefore, these controls are pervasive in their effect.

2.

If the auditor is able to obtain evidence that general controls function effectively, then the auditor also has assurance that individual applications may be properly designed and operate effectively. Alternatively, deficiencies in general controls may affect many applications and may prevent the auditor from assessing control risk below the maximum for many applications and transaction cycles.

3.

The following three groups of application controls are widely recognized: a. input controls, b. processing controls, and c. output controls.

These controls are designed to provide reasonable assurance that the recording, processing, and reporting of data by IT are properly performed for specific applications.

Analysis 10-1 (10 minutes) In obtaining an understanding of the ABC Company's internal control structure, you discover the following circumstances: 1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

The cashier makes bank deposits and records all cash transactions.

Raw materials are stored in an unlocked warehouse.

Prenumbered receiving reports are not used in the receiving department.

Monthly statements of account are sent to customers by personnel who maintain the accounts in the accounts receivable ledger.

Accounts receivable ledger clerks write-off accounts as uncollectible when they are more than 90 days past due.

The shipping department orally notifies the billing department that goods have been shipped.

The treasurer approves bills for payment, prepares the checks, and signs the checks.

Petty cash counts are made periodically by the petty cash custodian.

The company does not have a chart of accounts.

Each employee has direct access to his/her payroll records.

15

REQUIRED: For each circumstance, indicate from the list below, which category the control procedure that has been violated belongs to: Control Procedures Categories: A. Segregation of duties B. Physical controls C. Documents and records D. Independent checks E. Proper authorization

Answers — Analysis 10-1 A. B. C. D. E. C. A. D. C. B.

Segregation of duties Physical controls Documents and records Independent checks Proper authorization Documents and records Segregation of duties Independent checks Documents and records Physical controls

Analysis 10-2 (10 minutes) The purpose of computer general controls is to control program development, program changes, computer operations, and to secure access to programs and data.

1.

Briefly identify the important aspects that would be expected as part of computer general controls.

2.

What is meant by the notion that general controls have a pervasive effect on computer application controls?

Answers — Analysis 10-2 1.

a.

b.

c.

Organization and operation controls relate to the management philosophy and operating style and organizational structure control environment factors. In addition, these general controls pertain to the segregation of duties within the IT department and between the IT and user departments. Weakness in these controls usually affect all IT applications.

Systems development and documentation controls are an integral part of the information and communication component of internal control. Systems development controls relate to (1) review, testing, and approval of new systems; (2) control of program changes; and (3) documentation procedures.

Hardware and systems software controls are an important factor that contributes to the high degree of reliability of today’s information technology. Hardware and software controls are designed to detect any malfunctioning of the equipment.

16

d.

e.

2.

Access controls should prevent unauthorized use of IT equipment, data files, and computer programs. The specific controls include physical, software, and procedural safeguards.

Data and procedural controls provide a framework for controlling daily computer operations, minimizing the likelihood of processing errors, and assuring the continuity of operations in the event of a physical disaster or computer failure.

If the auditor is able to obtain evidence that general controls function effectively, then the auditor also has assurance that individual applications may be properly designed and operate effectively. Alternatively, deficiencies in general controls may affect many applications and may prevent the auditor from assessing control risk below the maximum for many applications and transaction cycles.

17