- You are conducting a financial statement audit of a government entity that processes a high volume of vendor payments. The entity's internal audit function performs periodic reviews of disbursements, but the reviews are informal, results are not documented, and identified issues are not tracked to remediation. Management asserts that "internal audit is monitoring," but cannot demonstrate follow-up. Which internal control component needs strengthening?
Answer: Monitoring activities, because the entity lacks documented evaluations and follow-up on identified control issues.
This question tests understanding of the monitoring activities component within COSO's framework. The critical deficiency is that while internal audit performs reviews, they are informal, undocumented, and lack follow-up on identified issues - failing to meet the requirements for effective monitoring activities. Monitoring activities under COSO include ongoing evaluations and separate evaluations that assess whether controls are present and functioning, with deficiencies communicated and corrected timely. Option A is incorrect because exception reporting is a valuable information tool and should not be eliminated. Option C is incorrect because monitoring activities complement, not replace, governance oversight through the control environment. Option D is incorrect because the vendor master file approval issue relates to control activities, not the broader monitoring deficiency described. The key principle for professional judgment is that monitoring must be systematic, documented, and include mechanisms for tracking remediation of identified deficiencies to be effective.
- The COSO framework emphasizes that internal control is a process. The inherent limitations of internal control mean that it can provide only reasonable assurance, not absolute assurance, of achieving entity objectives. Which of the following is an inherent limitation of internal control?
Answer: Faulty human judgment in decision-making.
The correct answer is A. Inherent limitations are those that exist even in a well-designed system of internal control. These include faulty human judgment, the possibility of management override, collusion among employees, and the fact that controls must be designed with a cost-benefit consideration. B, C, and D are examples of specific control deficiencies or weaknesses, not inherent limitations that would exist in any system.
- This situation raises a concern about the effectiveness of the Control Environment because it may call into question which key COSO principle?
Answer: The board of directors' independence from management.
The correct answer is C. A fundamental principle of the Control Environment is that the board of directors (and its committees, like the audit committee) demonstrates independence from management. If audit committee members have close, long-standing relationships with the executives they are supposed to be overseeing, their objectivity and ability to exercise independent judgment may be impaired. This weakens a critical element of governance and oversight.
- You are auditing an issuer technology company in an integrated audit of financial statements and internal control over financial reporting. Management implemented a new revenue recognition system mid-year due to rapid growth and new contract types, but did not update control documentation or train staff on new approval workflows. Several contracts were processed using default settings without review. Which internal control component needs strengthening?
Answer: Information and communication, because system changes were not communicated and procedures were not updated to support financial reporting controls.
This question examines the information and communication component of the COSO framework in the context of system changes affecting financial reporting. Key facts include the mid-year revenue system implementation without updated documentation or training, leading to un-reviewed contract processing errors. Choice A is correct as it aligns with COSO's emphasis on communicating relevant information and updating procedures to support reliable financial reporting, consistent with PCAOB AS 2201 for integrated audits. Choice B is incorrect because board independence relates to the control environment, not directly to communication failures in system changes. Choice C is wrong as monitoring activities require ongoing evaluations but do not prevent initial configuration issues without proper communication; choice D errs as risk assessment identifies risks but does not automatically correct system settings per COSO. Professionals should assess how changes impact all COSO components and ensure communication flows support control effectiveness. A decision-making framework involves identifying gaps in information flow, recommending enhancements, and verifying remediation through testing to maintain internal control integrity.
- An entity's board of directors is responsible for overseeing the development and performance of internal control. Which COSO principle does this oversight function most directly relate to?
Answer: The board of directors demonstrates independence from management and exercises oversight of internal control.
The correct answer is C. This choice directly quotes a core principle within the Control Environment component of the COSO framework. The board's independence from management and its active oversight role are critical for an effective control environment. While the other choices are also principles within the Control Environment, they relate to competence (A), accountability (B), and organizational structure (D), not the board's specific oversight responsibility.
- An entity's internal audit function periodically audits the company's compliance with its internal control policies and reports its findings directly to the audit committee. This function is an example of which COSO component in action?
Answer: Monitoring Activities
The correct answer is D. The internal audit function performing audits of controls is a form of 'separate evaluation,' which is a key part of the Monitoring Activities component. Monitoring is intended to assess whether controls are operating as intended and are effective. The internal audit function plays a crucial role in monitoring the internal control system's performance and reporting deficiencies to those charged with governance.
- This scenario points to a deficiency in which principle of the COSO framework's Control Environment component?
Answer: The organization demonstrates a commitment to attract, develop, and retain competent individuals.
The correct answer is C. The failure to provide adequate training to ensure staff can perform their duties effectively is a weakness in the company's commitment to competence. This principle within the Control Environment emphasizes the need for the organization to ensure that those performing tasks related to internal control have the necessary skills and knowledge. The controls may be well-designed, but without competent personnel to execute them, they will not be effective.
- Which of the following describes the relationship between the five components of the COSO internal control framework?
Answer: The components are integrated and work together to support the achievement of an entity's objectives.
The correct answer is C. The COSO framework is an integrated framework, meaning all five components must be present and functioning, and operating together in an integrated manner for internal control to be effective. The components are not sequential (A), and a strong control environment cannot compensate for material weaknesses in other components (B). All five components are essential, not categorized as primary and secondary (D).
- In applying the COSO framework, management must first establish clear objectives before it can effectively perform which of the following activities?
Answer: Identify and assess risks to achieving those objectives.
The correct answer is B. A core concept of the COSO framework's Risk Assessment component is that risk is the possibility that an event will occur and adversely affect the achievement of objectives. Therefore, management must first specify objectives with sufficient clarity to enable the identification and assessment of risks related to those objectives. While A and D are part of the Control Environment and C is Monitoring, the Risk Assessment component is directly predicated on having established objectives.
- You are auditing a nonissuer construction company in a financial statement audit. The company's project managers prepare percentage-of-completion estimates and also approve the related journal entries, and there is no independent review of significant estimate changes. Management argues that the project managers are "closest to the jobs" and review would slow reporting. What action should the auditor take to address the control deficiency?
Answer: Increase substantive testing over revenue recognition estimates and communicate the deficiency to those charged with governance if it is significant.
This question evaluates auditor responses to segregation of duties deficiencies in estimates for nonissuer construction audits. Lack of independent review for estimates and approvals, despite management's rationale, indicates a control gap. Choice B is correct as it follows AU-C Section 265 for communicating deficiencies and AU-C Section 330 for increasing substantive testing. Choice A is incorrect because subjectivity does not excuse controls under COSO. Choice C is wrong as inquiry alone is insufficient evidence; choice D fails as deficiencies affect current audit risk per standards. Auditors should classify deficiencies and adjust procedures based on risk. A transferable framework includes evaluating compensating controls, communicating findings, and enhancing testing to mitigate detection risk.
- You are performing an audit of a not-for-profit organization that receives most donations through an online platform. During planning, you learn that a new state privacy law will require stricter handling of donor data and may restrict certain third-party marketing integrations used by the organization. Management has not performed a formal assessment of how the law affects processes and related controls over donor data and revenue recognition. What is the impact of this external factor on the internal control system?
Answer: It primarily affects the risk assessment component because management should identify and analyze external changes that impact objectives and related controls.
This question tests understanding of how external factors impact the risk assessment component of COSO's internal control framework. The critical fact is that a new privacy law affecting donor data handling has been enacted, but management has not performed a formal assessment of its impact on processes and controls. Risk assessment under COSO requires management to identify and analyze risks arising from external changes, including new regulations, that could affect achievement of objectives. Option B is incorrect because external laws do not automatically create segregation of duties; management must still design and implement appropriate control activities. Option C is incorrect because external laws do not eliminate the need for monitoring activities; rather, they may increase monitoring requirements. Option D is incorrect because external laws do not replace management's responsibility for establishing tone at the top and governance structures. The transferable principle is that organizations must continuously assess how external changes, particularly regulatory requirements, affect their risk profile and adjust their internal control system accordingly to maintain effective control over financial reporting.
- You are the auditor of an issuer performing an integrated audit of financial statements and internal control over financial reporting. In interviews, several accounting staff indicate that the chief financial officer pressures them to "make the quarter" and discourages documenting disagreements; two employees report that prior concerns raised through the hotline were not followed up. The audit committee meets quarterly but relies heavily on the chief financial officer's summaries. Based on the entity's control environment, what is the most appropriate response?
Answer: Increase professional skepticism and consider the implications for fraud risk and the reliability of management representations when planning and performing audit procedures.
This question addresses control environment deficiencies and their impact on audit strategy in an integrated audit of an issuer. The key facts indicate a weak control environment: the CFO pressures staff to meet earnings targets, discourages documentation of disagreements, hotline concerns are not investigated, and the audit committee relies heavily on potentially biased CFO summaries. Control environment sets the tone of an organization and influences control consciousness; when compromised, it increases the risk of management override and fraud. Option B is incorrect because control environment issues are pervasive and affect all aspects of internal control, not just journal entry approvals. Option C is incorrect because quarterly meetings alone cannot mitigate a fundamentally weak tone at the top and lack of independent oversight. Option D is incorrect because control environment deficiencies require immediate response in planning audit procedures, not deferral. The professional framework requires auditors to increase skepticism, expand procedures, and consider fraud risks when the control environment shows signs of management pressure and inadequate governance oversight.
- This situation indicates a weakness in which component of the COSO internal control framework?
Answer: Risk Assessment
The correct answer is C. The Risk Assessment component of the COSO framework includes the principle that management should identify and assess changes that could significantly impact the system of internal control. The implementation of a new ERP system is a significant change, and the failure to analyze its impact on internal control is a direct deficiency in the client's risk assessment process. A weakness in control activities would relate to specific actions, a monitoring weakness would relate to evaluating control performance, and an information and communication weakness would relate to the flow of relevant information.
- You are performing an audit of a government entity that administers a benefits program. A recent economic downturn has increased application volume by 40%, and management reassigned experienced reviewers to customer service to handle call volume. As a result, new staff are approving eligibility with limited supervision, and management has not updated its assessment of risks related to improper payments. What is the impact of this external factor on the internal control system?
Answer: It primarily affects risk assessment because management should reassess risks arising from external changes and resource constraints that may increase improper payment risk.
This question examines how external changes impact the risk assessment component of internal control. The critical facts are a 40% volume increase due to economic downturn, reassignment of experienced staff leaving new employees with limited supervision, and management's failure to update its risk assessment for improper payments. Risk assessment under COSO requires identifying and analyzing relevant risks to achieving objectives, including how external changes and internal capability constraints affect risk levels. Option A is incorrect because increased volume actually heightens, not eliminates, the need for supervisory review and monitoring. Option C is incorrect because the issue isn't about changing accounting structure but about reassessing operational risks. Option D is incorrect because while external conditions create challenges, employee competence is still a management responsibility within the control environment. The key principle is that organizations must continuously reassess risks when significant external or internal changes occur and adjust controls accordingly to maintain effectiveness.
- You are auditing a nonissuer professional services firm in a financial statement audit. The firm has a formal client acceptance policy requiring conflict checks and approval by a risk partner, but you find multiple new clients onboarded without documented conflict checks, and engagement teams state the policy is "optional" when business is slow. Which element of the COSO framework is most affected by this issue?
Answer: Control environment, because management's enforcement of policies and commitment to competence and accountability set expectations for adherence to controls.
This question examines the COSO control environment component, which establishes the tone at the top and influences the control consciousness of the organization. The driving facts are the firm's formal client acceptance policy requiring conflict checks and risk partner approval, yet multiple clients were onboarded without documentation, and staff viewed the policy as 'optional' during slow business periods, revealing weak enforcement. Choice A is correct as it aligns with COSO principles emphasizing management's commitment to integrity, accountability, and policy enforcement to set expectations for control adherence, as outlined in COSO's foundational elements. Choice B is incorrect because information and communication pertain to generating and using relevant information, not primarily to conflict checks as a data issue, while choice C is wrong as client acceptance policies can relate to the control environment through tone-setting, contrary to the distractor's claim. Choice D is incorrect because tone at the top and policy enforcement are integral to the control environment and directly impact whether control activities operate effectively under COSO. Professionals should exercise judgment by evaluating indicators of control environment strength, such as policy compliance rates and staff perceptions, to identify risks early. A useful framework is to map observed behaviors to COSO's five components, prioritizing control environment assessments as they underpin the entire internal control system.
- An auditor learns that a company's management team is dominated by a single, long-serving CEO who often overrides established control procedures. This situation represents a significant weakness primarily within which COSO component?
Answer: Control Environment
The correct answer is C. The Control Environment sets the tone of an organization, influencing the control consciousness of its people. A management team dominated by a single individual who overrides controls indicates a poor 'tone at the top' and a flawed management philosophy regarding internal controls. This undermines the entire system and is a fundamental weakness in the Control Environment. While it may lead to failures in Control Activities (B), the root cause lies within the Control Environment.
- You are auditing an issuer in an integrated audit. The company performs quarterly control self-assessments, but results are compiled by the same process owners being evaluated, and negative findings are frequently removed before reporting to management. There is no independent validation by internal audit. Which internal control component needs strengthening?
Answer: Monitoring activities, because evaluations are not sufficiently objective and deficiencies are not being communicated to enable remediation.
This question evaluates the monitoring activities component of COSO in issuer integrated audits. Biased self-assessments without validation compromise objective evaluations and remediation. Choice A is correct as COSO requires independent monitoring for timely deficiency communication, per PCAOB AS 2201. Choice B is incorrect because information and communication need effective flows, not proven by biased assessments. Choice C is wrong as control activities are transaction-level, not evaluations; choice D errs as risk assessment prioritizes but does not equate to removing findings. Professionals must ensure monitoring independence. A decision-making framework involves validating self-assessments, communicating findings, and remediating to enhance control effectiveness.
- You are the auditor of a nonissuer retailer performing a financial statement audit. The company implemented a new cloud-based point-of-sale system midyear; IT management states the vendor "handles security," but the company has not reviewed SOC reports, has no process to approve user access requests, and terminated employees' access is removed only when a store manager remembers to email IT. Which element of the COSO framework is most affected by this issue?
Answer: Control activities, because access controls and vendor SOC report review are policies and procedures that help ensure directives are carried out.
This question examines IT general controls within the control activities component of COSO. The key facts show absent or inadequate control activities: no SOC report review, no formal user access approval process, and untimely removal of terminated employee access. Control activities are the policies and procedures that help ensure management directives are carried out and include both application controls and IT general controls like access management. Option B is incorrect because user access provisioning is an internal control matter, not an external economic condition affecting risk assessment. Option C is incorrect because cloud systems do not eliminate management's accountability for controls; management remains responsible regardless of hosting arrangement. Option D is incorrect because IT general controls must be evaluated during the audit period, not after financial statement issuance. The professional principle is that organizations retain responsibility for control activities even when using third-party service providers and must implement appropriate user access controls and vendor oversight procedures.
- The COSO framework identifies three main categories of objectives for an entity: operations, reporting, and compliance. From an external auditor's perspective, which category of objectives is most relevant to the audit of financial statements?
Answer: Reporting objectives, because they pertain to the reliability of financial reporting.
The correct answer is C. While all three categories of objectives are important to the entity, the auditor's primary focus in a financial statement audit is on controls relevant to the reliability of financial reporting. The reporting objectives directly impact the preparation of reliable financial statements and are therefore the most relevant to the auditor's work. Controls related to operations and compliance may be relevant if they have a material effect on the financial statements, but the primary focus is on the reporting category.
- You are the auditor of an issuer performing an integrated audit. In testing IT general controls over financial reporting, you find that developers have the ability to migrate code changes into production without independent approval, and there is no evidence of review of emergency changes. Management notes that application reports are reconciled monthly by accounting and believes that reduces the risk. Which internal control component needs strengthening?
Answer: Control activities, because change management approvals and segregation of duties are key policies and procedures supporting reliable processing.
This question tests understanding of IT general controls within the control activities component for an integrated audit. The critical deficiency is that developers can migrate code to production without independent approval and emergency changes lack evidence of review, creating risks of unauthorized or erroneous changes affecting financial reporting. Control activities include IT general controls such as program change controls and segregation of duties between development and production environments. Option B is incorrect because change management is an internal control matter, not an external risk. Option C is incorrect because monthly reconciliations of application reports cannot compensate for weak IT general controls that could allow unauthorized changes. Option D is incorrect because the issue is unauthorized system access and change management, not report formatting. The professional principle is that effective IT general controls, including proper segregation of duties and change management procedures, are foundational to relying on IT-dependent controls and system-generated reports.
