Evaluate Internal Control Components
Help Questions
CPA Business Analysis and Reporting (BAR) › Evaluate Internal Control Components
A payroll authorization control requires written manager approval for all new hires before HR processes them in the system. Testing reveals that managers routinely approve new hires verbally without completing the required written form. Which conclusion is most appropriate?
The control is neither designed nor operating effectively
The control is designed effectively but not operating effectively because verbal approvals do not satisfy the written documentation requirement
The control has an operating effectiveness deficiency specifically because the written authorization is not consistently completed, leaving no auditable evidence that approvals occurred
The control is both designed and operating effectively because approvals are occurring verbally
Explanation
The control was properly designed - requiring written authorization before system processing is sound control design. However, it is not operating effectively because managers are not following the written documentation requirement. Without written approval, there is no auditable evidence that proper authorization occurred, creating a gap in the control's operating effectiveness. Option A incorrectly accepts verbal approvals as equivalent to the designed written control. Option B is directionally correct but understates the specific problem, which is both the absence of written evidence and the inability to audit the authorization trail. Option C incorrectly concludes the design is also flawed.
An accounts payable control evaluation finds: purchase orders exist for 94% of transactions, receiving reports exist for 89% of transactions, and invoice approvals exist for 97% of transactions. The 11% of transactions missing receiving reports have an average amount of $8,500. Which assessment is most accurate?
The missing receiving reports are a deficiency only if they resulted in an actual payment error
Controls are operating effectively because all compliance rates exceed 85%
Missing receiving reports represent a control gap - without confirmation of receipt, the company cannot verify that goods were delivered before payment is made
Receiving reports are a secondary control compensated by the high invoice approval rate
Explanation
The receiving report is a critical control in the three-way match process because it confirms that goods were actually received before payment is authorized. An 11% gap means that for roughly one in nine transactions, the company has no documented confirmation of receipt. This creates a real risk of paying for undelivered goods or fictitious invoices. Option A applies an arbitrary threshold without considering the purpose of the control. Option B requires a realized loss to classify a deficiency, which is incorrect - risk potential determines deficiency status. Option D incorrectly treats the approval control as compensating for missing receipt confirmation; they serve different verification purposes.
A company uses a three-tier control model with preventive, detective, and corrective controls. An evaluation finds the financial reporting process relies primarily on detective and corrective controls with minimal preventive controls. Which analytical concern does this raise?
The balance is optimal because corrective controls can fix any error that detective controls identify
Detective controls are superior to preventive controls because they provide evidence of actual errors
Relying primarily on detective and corrective controls means errors must occur before they can be caught; preventive controls stop errors from entering the system, reducing the likelihood of undetected misstatements
Minimal preventive controls are acceptable as long as detective controls have a 100% detection rate
Explanation
A well-designed control system uses preventive controls as the first line of defense because they stop errors and irregularities before they enter financial records. Detective and corrective controls are essential complements, but they cannot fully substitute for prevention because: detection always occurs after the fact, some errors may not be detected, and correction is more costly than prevention. Over-reliance on detective controls means the financial reporting process depends on finding and fixing errors rather than preventing them. Option A incorrectly ranks detective controls above preventive. Option B assumes 100% correction effectiveness, which is unrealistic. Option C's 100% detection rate assumption is not achievable in practice.
A company's monitoring activities include: monthly management reviews of budget-to-actual variances, quarterly control self-assessments by department heads, and an annual internal audit of key processes. None of these activities are performed by individuals independent of the processes being monitored. Which concern does this raise?
Self-monitoring is always sufficient as long as it is documented and reviewed by management
Control self-assessments by department heads are the strongest monitoring form because they have direct process knowledge
Monthly budget reviews are sufficient monitoring for all financial reporting risks
When monitoring is performed exclusively by those responsible for the processes, objectivity is reduced, limiting the ability to detect control deficiencies that those individuals may have contributed to or have an interest in concealing
Explanation
Effective monitoring requires an appropriate degree of independence. When management reviews its own variances, department heads self-assess their own controls, and the internal audit function lacks independence, the monitoring system has a structural limitation: those doing the monitoring have a potential conflict of interest in identifying and reporting problems in their own areas. COSO emphasizes that the objectivity of the evaluator is critical to monitoring effectiveness. The degree of independence needed varies with the significance of the risk, but some level of independence is essential for credible monitoring. Options A and C incorrectly treat process proximity as an advantage that outweighs independence concerns. Option B understates the breadth of monitoring needed.
A board of directors evaluates its internal control system by relying exclusively on management self-assessment reports that consistently show all controls as effective. No independent verification is performed. Which concern does this evaluation process raise?
Management self-assessments are the most reliable source of control information because management has direct operational knowledge
The board is not responsible for internal control evaluation; this is solely the external auditor's role
Exclusive reliance on management self-assessments creates a conflict of interest; management evaluating its own controls lacks the objectivity required for effective board oversight
This approach is consistent with SEC regulations and no additional procedures are necessary
Explanation
Effective board oversight requires independent verification of control effectiveness, not merely management's representation. When management is both responsible for implementing controls and the sole source of information about their effectiveness, there is an inherent conflict of interest. The board's oversight function requires it to obtain some independent assurance - through internal audit, external audit, or other means - to challenge and verify management's self-assessment. Option A confuses operational knowledge with independent objectivity. Option B is incorrect; SEC rules require rigorous internal control assessment and attestation, not unchallenged self-reporting. Option D understates the board's governance responsibility for internal control oversight.
A policy requires controller approval for all journal entries above $50,000. Testing of 40 such entries finds that 6 (15%) were posted without controller approval. How should this deficiency be assessed?
A minor deficiency - the 85% compliance rate indicates the control is generally functioning
A monitoring deficiency only - the control design is sound but the exception was not caught in review
A control operating effectiveness deficiency - a 15% exception rate for a key authorization control is a significant failure that elevates the risk of unauthorized entries reaching the financial statements
Not a deficiency - 15% exceptions are within normal tolerance for large organizations
Explanation
A 15% exception rate for a journal entry authorization control is a meaningful operating effectiveness failure. Journal entries above $50,000 represent high-risk transactions; the authorization requirement exists specifically to prevent unauthorized or erroneous entries with significant financial impact. A 15% bypass rate means that one in six high-value journal entries circumvents the control. Options A and B apply subjective tolerance percentages that have no basis in control evaluation standards. Option C is incorrect; the issue is that the control activity itself is not being followed, not merely that a monitoring mechanism failed to catch exceptions.
An IT application controls evaluation shows all 15 payroll control tests functioning correctly. However, the IT general controls review found that payroll application code can be modified by IT staff without an independent change management process. Which conclusion is most analytically sound?
The IT general control weakness undermines reliance on application control test results - unauthorized program changes could alter how controls function after testing
Expanding application testing to 30 samples would provide sufficient additional assurance
Application controls are effective and no further concern exists since testing passed
The IT general control weakness is irrelevant because application controls passed all tests
Explanation
IT general controls provide the environment in which application controls operate. If the change management process does not prevent unauthorized program modifications, then application controls may have functioned correctly at the time of testing but could be altered afterward without detection. This is a fundamental principle of IT audit: weak ITGCs reduce the reliability of application control testing results because the tested controls may not represent the controls actually operating in the system over the full period. Option A and B ignore this dependency relationship. Option D treats sample size as a substitute for addressing the ITGC weakness.
An information and communication evaluation finds that financial reports are produced accurately but operational managers do not receive timely notification of control exceptions, and control failures are not escalated to the board. Which evaluation is most appropriate?
The information and communication component is effective because financial report accuracy is confirmed
Effective information and communication requires that control failure information be communicated to those with oversight responsibility; accuracy of external financial reports alone does not satisfy this COSO component
Control exception reporting is part of monitoring activities and is outside the scope of information and communication
Operational managers are not responsible for receiving internal control information
Explanation
The information and communication component of COSO requires that relevant information - including information about control deficiencies and failures - be communicated throughout the organization to those who need it to fulfill their control responsibilities. This includes upward communication to the board about significant control failures. Accurate financial reporting satisfies only the external reporting aspect of information and communication; the internal flow of control-relevant information is equally important. Option A narrowly focuses on one output of the information system. Option B incorrectly limits the audience for control information. Option C incorrectly separates exception reporting from information and communication, when both components are involved.
A company installs a whistleblower hotline to strengthen its control environment. After six months, zero reports have been received, and management concludes the control environment is strong. Which analytical challenge is most relevant?
An absence of hotline reports does not confirm the absence of control issues; it may reflect employee unawareness, fear of retaliation, or lack of trust in the anonymity process
Whistleblower hotlines are only required for public companies and are not relevant to control environment assessment
Zero reports confirm a positive control environment and management's conclusion is well-supported
Six months is too short to evaluate a hotline's effectiveness and management should wait longer before drawing conclusions
Explanation
The effectiveness of a whistleblower hotline cannot be measured solely by the volume of reports received. Zero reports in the first six months may indicate: employees are unaware the hotline exists; employees fear retaliation despite stated protections; employees do not trust that reports are truly anonymous; or the hotline process is inaccessible. A genuinely effective hotline requires employee awareness, credible anonymity protections, and a demonstrated culture in which reports are taken seriously without retaliation. Management must assess these conditions rather than treating silence as evidence of a healthy control environment. Option A accepts an unsupported inference. Option C incorrectly limits hotline relevance to public companies. Option D is a valid timing concern but does not identify the most fundamental analytical issue.
A company's cash management function includes: a combination safe with access restricted to the treasurer; daily cash counts reconciled to the general ledger; dual custody required for transfers exceeding $25,000; and a mandatory vacation policy requiring two consecutive weeks. Which of these is best classified as a detective control?
The combination safe with access restricted to the treasurer
Daily cash counts reconciled to the general ledger, identifying discrepancies after transactions are recorded
Dual custody required for all cash transfers exceeding $25,000
The mandatory vacation policy requiring two consecutive weeks away
Explanation
A detective control identifies errors or irregularities after they have occurred. Daily cash counts reconciled to the GL detect discrepancies by comparing physical cash to recorded amounts - a post-event check. The combination safe (Option B) prevents unauthorized access - a preventive control. Dual custody (Option C) prevents unauthorized transfers by requiring two parties - preventive. Mandatory vacation (Option D) reduces fraud opportunities by forcing rotation - preventive, as it deters and uncovers ongoing schemes through coverage by others.