- A nonprofit organization receives donations through multiple channels: online payments, mailed checks, and cash collected at events. The organization's treasurer handles all donation processing and maintains the donor database. Recent internal audit findings indicate that some donations may not have been properly recorded. Which control enhancement would provide the strongest detective control over donation completeness?
Answer: Send annual donation summaries to all donors and investigate any discrepancies they report
Annual donor summaries provide the strongest detective control because donors will report if their donations aren't reflected, catching both intentional omissions and recording errors. This creates external verification of completeness. Choice A is preventive rather than detective and only works for donations that generate receipts. Choice B is good but only covers large donations, not the completeness of all donations. Choice C is preventive (segregation of duties) rather than detective, and while important, doesn't directly detect missing donations.
- What does the result of the surprise count most likely indicate about the petty cash controls?
Answer: A breakdown in control has occurred, resulting in a $10 cash shortage.
The fund should have a total of $300 in cash and/or receipts. The count revealed $185 in receipts and $105 in cash, for a total of $290. This means there is a $10 shortage ($300 - $290). This shortage, regardless of the cause, represents a failure or breakdown in the control over the fund. The other options are possibilities but are not directly and certainly proven by the information given.
- In evaluating a company's internal controls over cash, an auditor would be most concerned about which of the following situations?
Answer: The monthly bank reconciliation is prepared by the treasurer, who also signs checks.
This is a critical violation of segregation of duties. The bank reconciliation is a key independent verification control. If the person who has custody of assets and executes transactions (the treasurer signing checks) is also responsible for the reconciliation, they could conceal fraudulent activities. For example, the treasurer could write a fraudulent check and then omit it from the bank reconciliation to hide the theft. The other options represent weaker controls but are not as severe a violation of a core principle.
- Which of the following procedures performed by a company's internal audit department best exemplifies the principle of independent internal verification over cash?
Answer: Conducting surprise counts of cash on hand in the petty cash fund and at cash registers.
Independent internal verification involves the review, comparison, and reconciliation of data prepared by other employees. A surprise cash count is a classic example. The internal audit department, which is independent of the cash-handling and recording functions, periodically verifies that the physical cash on hand matches the amount shown in the accounting records. This provides a powerful, unannounced check on the system's integrity.
- A company is experiencing a significant increase in "lapping" of its accounts receivable. Lapping involves an employee stealing a payment from Customer A and then applying a later payment from Customer B to Customer A's account to hide the theft. Which of the following internal controls is most effective at detecting this type of fraud?
Answer: Comparing the details on the bank deposit slip to the details on the remittance advices.
Lapping involves manipulating the crediting of customer accounts. A control that compares the specifics of the deposit (who paid and how much, from the deposit slip) with the specifics of the payments recorded (from remittance advices) would detect a discrepancy. For example, the deposit slip would show a check from Customer B, but the records would show a credit to Customer A's account. This comparison provides direct evidence of lapping. Daily deposits (A) and G/L reconciliation (C) are good controls but are less specific for detecting lapping. Petty cash (D) is irrelevant.
- A company's policy requires two signatures on any check exceeding $10,000. This policy is an example of which internal control principle?
Answer: Establishment of responsibility.
Requiring two signatures on large checks is a form of establishing shared responsibility. It ensures that for significant transactions, no single individual has the authority to disburse funds. Both signatories are held responsible for the validity of the payment. While it involves a form of verification (B), its primary purpose is to strengthen authorization by requiring the consent of two designated individuals, which is a specific application of establishing responsibility.
- Which of the following human resource controls provides the most effective deterrent and detection mechanism for fraud that requires ongoing concealment by an employee?
Answer: Implementing a mandatory vacation policy that requires employees to be away for at least one consecutive week.
Many fraud schemes (like lapping or creating fictitious vendors) require the perpetrator to constantly manage the cover-up. A mandatory vacation policy forces the employee to be away from their duties, allowing another person to step in. This substitute employee is likely to uncover irregularities that the perpetrator was actively concealing. Background checks (A) are preventative. Bonding (B) is a recovery measure, not a deterrent/detection mechanism. Training (D) is a good general control but less direct in detecting an ongoing fraud.
- A retail company implements a new cash handling procedure where the person who prepares daily bank deposits also reconciles the bank statements and maintains the cash receipts journal. The company's auditor identifies this as a significant internal control deficiency. Which principle of internal control is primarily violated, and what is the most likely consequence?
Answer: Segregation of duties is violated; the employee could manipulate bank reconciliations to conceal theft from daily deposits
The primary violation is segregation of duties - the same person handles custody of cash (preparing deposits), recording (maintaining cash receipts journal), and reconciliation functions. This allows the employee to steal cash and then manipulate the bank reconciliation to hide the theft. Choice B is incorrect because physical controls relate to safes, locks, etc. Choice C is wrong because documentation isn't the main issue here. Choice D is incorrect because while verification is compromised, the root problem is lack of segregation of duties.
- An internal auditor is reviewing a company's cash disbursement process. They note that the accounts payable department authorizes payments, the treasurer signs and mails the checks, and the accounting department records the payments. The auditor finds this arrangement acceptable. Which control principle is most critical to making this segregation of duties effective?
Answer: The accounts payable department should not have access to blank checks.
The scenario describes the classic segregation of duties for disbursements: Authorization (A/P), Custody (Treasurer), and Record-keeping (Accounting). For this to be effective, the separation must be complete. The most critical aspect is that the department authorizing payments (Accounts Payable) must not have access to the asset they are authorizing payment for (the blank checks). If A/P had blank checks, they could authorize and create a fraudulent payment, bypassing the entire control structure.
- A retail store's daily cash reconciliation shows consistent shortages of $10-20 per day across multiple cashiers and shifts. Management reviews security cameras and finds no evidence of theft. The store uses an electronic register system that tracks all transactions. Which internal control analysis would be most appropriate for this situation?
Answer: Examine whether cashiers are properly trained on handling complex transactions like returns and discounts
Consistent small shortages across multiple cashiers suggest systematic operational errors rather than theft or system problems. Complex transactions like returns, voids, and discounts are common sources of cash handling errors when cashiers aren't properly trained. Choice A is less likely since camera surveillance showed no theft evidence. Choice C is possible but less probable since the pattern suggests human error rather than systematic register malfunction. Choice D assumes the reconciliation process is wrong, but the consistency across multiple people suggests the shortages are real.
- An analysis of the company's cash account reveals frequent and unexplained shortages. Which of the following control enhancements would most directly address the likely cause of these shortages?
Answer: Separating the function of cash handling from the function of recording entries in the accounts receivable ledger.
The most significant control weakness is the lack of segregation of duties. The cashier has custody of assets (cash), maintains records (posts to A/R), and has a role in authorization. This combination allows the cashier to potentially misappropriate cash and conceal it by manipulating customer accounts (a scheme known as lapping). Separating cash handling from record-keeping is the most direct and effective control to prevent this.
- A company discovers that its bookkeeper has been intercepting customer checks, depositing them into a personal account, and then applying subsequent customer payments to the accounts of customers whose checks were stolen (lapping). Which internal control procedure would be most effective at preventing this type of fraud in the future?
Answer: Requiring that the person who opens mail and lists cash receipts be different from the person who posts to customer accounts
Lapping fraud requires the perpetrator to control both the initial receipt of payments and the posting to customer accounts. Segregating these duties makes lapping impossible because different people handle each step. Choice A is impractical and may not be acceptable to customers. Choice B might eventually detect lapping but wouldn't prevent it. Choice C helps with general check security but doesn't prevent lapping since the bookkeeper could still intercept checks before they're endorsed.
- A company implements electronic funds transfer (EFT) for all payments over $1,000. The system requires two-person authorization: one person initiates the transfer and a second person approves it. However, the same individual who approves EFT payments also performs the monthly bank reconciliation. From an internal control perspective, what is the primary risk created by this arrangement?
Answer: Improper EFT payments could be concealed through manipulation of the bank reconciliation process
The person who approves EFT payments should not also reconcile bank statements because they could approve inappropriate payments and then manipulate the bank reconciliation to hide them. This violates segregation of duties between authorization and reconciliation functions. Choice A is incorrect because the two-person system should prevent unauthorized payments. Choice B addresses system overrides, which isn't the main issue described. Choice D concerns record alteration, but the primary risk is reconciliation manipulation, not record tampering.
- A restaurant chain implements a policy requiring managers to make surprise cash counts at random times during each shift. During one such count, the manager finds that the cash register contains $50 less than the amount indicated by the register tape. The cashier explains that she made change for a $50 bill earlier but forgot to ring up the corresponding sale. What should be the manager's primary concern from an internal control perspective?
Answer: The shortage indicates possible theft, as legitimate transactions should always be recorded before accessing cash
From a control perspective, accessing cash without recording the sale first violates basic cash handling procedures and creates an environment where theft can occur and be explained away. Even if this instance was innocent, the practice enables fraud. Choice A treats this as merely a training issue rather than a control violation. Choice B incorrectly focuses on the register rather than the procedural violation. Choice D suggests abandoning a valid control procedure rather than addressing the underlying issue.
- A manufacturing company requires that all cash disbursements over $500 be supported by approved purchase orders, receiving reports, and vendor invoices before payment authorization. However, the accounts payable clerk has been creating fictitious vendor invoices and processing payments without corresponding purchase orders or receiving reports. Which combination of internal control weaknesses most likely enabled this fraud?
Answer: Absence of independent verification of three-way matching, combined with weak vendor establishment procedures
The fraud succeeded because: (1) no independent person verified that all three documents (PO, receiving report, invoice) actually existed and matched, and (2) the clerk could add fictitious vendors without proper authorization controls. Choice A is partially correct about segregation but focuses on check signing rather than the three-way matching failure. Choice B misidentifies the core issues - the problem isn't physical check security. Choice D is incorrect because supervision and bank reconciliation, while important, wouldn't necessarily catch fictitious invoices if the three-way matching appeared complete.
- A small business owner is concerned about the theft of cash receipts from mail-in payments. Due to limited staff, one employee opens the mail, lists the receipts, prepares the deposit slip, and makes the bank deposit. Which of the following would be the most effective and feasible compensating control for this lack of segregation of duties?
Answer: Having the business owner obtain the bank statement directly from the bank and promptly prepare the bank reconciliation.
In a small business where segregation of duties is not possible, a strong compensating control is critical. Having the owner (an independent party) receive the bank statement directly and perform the reconciliation provides a powerful independent check on the employee's work. The owner can compare the recorded receipts to the actual deposits shown on the bank statement, which would likely detect any misappropriation of mailed-in receipts. Bonding (A) is protective, not preventative/detective. Surprise counts (B) are ineffective for mail receipts already deposited or stolen. Changing customer behavior (C) is a business model change, not an internal control for the current process.
- Which of the following represents the most significant weakness in this cash disbursement process?
Answer: The supporting voucher packages should be canceled or stamped 'PAID' by the treasurer after signing.
A critical control in the disbursement cycle is to prevent the reuse of supporting documentation. After the treasurer reviews the voucher package and signs the check, they should immediately cancel the documents (e.g., with a 'PAID' stamp). In the described process, the uncanceled documents are sent to another department, creating the risk that they could be intercepted and resubmitted to generate a duplicate, fraudulent payment.
- A company requires all cash receipts to be deposited intact into the bank on a daily basis. What is the primary internal control benefit of the 'intact' requirement?
Answer: It prevents employees from using current cash receipts to make small, unauthorized disbursements.
Depositing receipts 'intact' means depositing the full amount of cash received for the day, without making any payments or withdrawals from it. This prevents employees from using the day's receipts for unauthorized payments (e.g., cashing an IOU or paying a small expense) and then depositing the remainder. This practice ensures a clear audit trail, as the total on the deposit slip should exactly match the total on the cash register tape or remittance list for that day.
- A company's petty cash fund of $500 is replenished monthly. During the monthly count, the custodian presents $75 in currency and coins plus expense receipts totaling $430. The receipts include: office supplies $180, postage $95, taxi fare $85, and a restaurant meal $70. What internal control deficiency is most apparent, and what action should be taken?
Answer: Personal meal expenses are included; the $70 receipt should be rejected and the custodian should reimburse the fund
The restaurant meal likely represents a personal expense inappropriately paid from petty cash. Personal expenses violate petty cash policies. The custodian should reimburse the fund $70 for this inappropriate expense. While the total of cash plus receipts ($75 + $430 = $505) exceeds the $500 fund limit by $5, this overage resulted from the improper meal expense. Choice A identifies the mathematical discrepancy but not the underlying policy violation. Choice C assumes documentation problems without evidence. Choice D addresses procedural frequency rather than the immediate control violation.
- A voucher system is used to enhance control over cash disbursements. A complete voucher package typically includes a purchase order, receiving report, and vendor invoice. Which internal control principle is best exemplified by requiring an accounts payable clerk to match these three documents before approving a payment?
Answer: Independent internal verification.
While a voucher system involves documentation (C) and establishing responsibility (A), the specific act of an employee comparing documents prepared by different departments (purchasing, receiving, and the external vendor) before authorizing payment is a prime example of independent internal verification. It verifies that the company is paying only for goods that were properly ordered and actually received.
