CPA Bar Quiz: Evaluate Internal Control Components

What this quiz covers

This quiz focuses on Evaluate Internal Control Components, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Bar.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. The control is both designed and operating effectively because approvals are occurring verbally
2. The control is designed effectively but not operating effectively because verbal approvals do not satisfy the written documentation requirement
3. The control is neither designed nor operating effectively
4. The control has an operating effectiveness deficiency specifically because the written authorization is not consistently completed, leaving no auditable evidence that approvals occurred (correct answer)

Explanation: The control was properly designed - requiring written authorization before system processing is sound control design. However, it is not operating effectively because managers are not following the written documentation requirement. Without written approval, there is no auditable evidence that proper authorization occurred, creating a gap in the control's operating effectiveness. Option A incorrectly accepts verbal approvals as equivalent to the designed written control. Option B is directionally correct but understates the specific problem, which is both the absence of written evidence and the inability to audit the authorization trail. Option C incorrectly concludes the design is also flawed.

Question 2

1. Controls are operating effectively because all compliance rates exceed 85%
2. The missing receiving reports are a deficiency only if they resulted in an actual payment error
3. Missing receiving reports represent a control gap - without confirmation of receipt, the company cannot verify that goods were delivered before payment is made (correct answer)
4. Receiving reports are a secondary control compensated by the high invoice approval rate

Explanation: The receiving report is a critical control in the three-way match process because it confirms that goods were actually received before payment is authorized. An 11% gap means that for roughly one in nine transactions, the company has no documented confirmation of receipt. This creates a real risk of paying for undelivered goods or fictitious invoices. Option A applies an arbitrary threshold without considering the purpose of the control. Option B requires a realized loss to classify a deficiency, which is incorrect - risk potential determines deficiency status. Option D incorrectly treats the approval control as compensating for missing receipt confirmation; they serve different verification purposes.

Question 3

1. Detective controls are superior to preventive controls because they provide evidence of actual errors
2. The balance is optimal because corrective controls can fix any error that detective controls identify
3. Minimal preventive controls are acceptable as long as detective controls have a 100% detection rate
4. Relying primarily on detective and corrective controls means errors must occur before they can be caught; preventive controls stop errors from entering the system, reducing the likelihood of undetected misstatements (correct answer)

Explanation: A well-designed control system uses preventive controls as the first line of defense because they stop errors and irregularities before they enter financial records. Detective and corrective controls are essential complements, but they cannot fully substitute for prevention because: detection always occurs after the fact, some errors may not be detected, and correction is more costly than prevention. Over-reliance on detective controls means the financial reporting process depends on finding and fixing errors rather than preventing them. Option A incorrectly ranks detective controls above preventive. Option B assumes 100% correction effectiveness, which is unrealistic. Option C's 100% detection rate assumption is not achievable in practice.

Question 4

1. Self-monitoring is always sufficient as long as it is documented and reviewed by management
2. Monthly budget reviews are sufficient monitoring for all financial reporting risks
3. Control self-assessments by department heads are the strongest monitoring form because they have direct process knowledge
4. When monitoring is performed exclusively by those responsible for the processes, objectivity is reduced, limiting the ability to detect control deficiencies that those individuals may have contributed to or have an interest in concealing (correct answer)

Explanation: Effective monitoring requires an appropriate degree of independence. When management reviews its own variances, department heads self-assess their own controls, and the internal audit function lacks independence, the monitoring system has a structural limitation: those doing the monitoring have a potential conflict of interest in identifying and reporting problems in their own areas. COSO emphasizes that the objectivity of the evaluator is critical to monitoring effectiveness. The degree of independence needed varies with the significance of the risk, but some level of independence is essential for credible monitoring. Options A and C incorrectly treat process proximity as an advantage that outweighs independence concerns. Option B understates the breadth of monitoring needed.

Question 5

1. Management self-assessments are the most reliable source of control information because management has direct operational knowledge
2. This approach is consistent with SEC regulations and no additional procedures are necessary
3. Exclusive reliance on management self-assessments creates a conflict of interest; management evaluating its own controls lacks the objectivity required for effective board oversight (correct answer)
4. The board is not responsible for internal control evaluation; this is solely the external auditor's role

Explanation: Effective board oversight requires independent verification of control effectiveness, not merely management's representation. When management is both responsible for implementing controls and the sole source of information about their effectiveness, there is an inherent conflict of interest. The board's oversight function requires it to obtain some independent assurance - through internal audit, external audit, or other means - to challenge and verify management's self-assessment. Option A confuses operational knowledge with independent objectivity. Option B is incorrect; SEC rules require rigorous internal control assessment and attestation, not unchallenged self-reporting. Option D understates the board's governance responsibility for internal control oversight.

Question 6

1. Not a deficiency - 15% exceptions are within normal tolerance for large organizations
2. A minor deficiency - the 85% compliance rate indicates the control is generally functioning
3. A monitoring deficiency only - the control design is sound but the exception was not caught in review
4. A control operating effectiveness deficiency - a 15% exception rate for a key authorization control is a significant failure that elevates the risk of unauthorized entries reaching the financial statements (correct answer)

Explanation: A 15% exception rate for a journal entry authorization control is a meaningful operating effectiveness failure. Journal entries above $50,000 represent high-risk transactions; the authorization requirement exists specifically to prevent unauthorized or erroneous entries with significant financial impact. A 15% bypass rate means that one in six high-value journal entries circumvents the control. Options A and B apply subjective tolerance percentages that have no basis in control evaluation standards. Option C is incorrect; the issue is that the control activity itself is not being followed, not merely that a monitoring mechanism failed to catch exceptions.

Question 7

1. Application controls are effective and no further concern exists since testing passed
2. The IT general control weakness is irrelevant because application controls passed all tests
3. The IT general control weakness undermines reliance on application control test results - unauthorized program changes could alter how controls function after testing (correct answer)
4. Expanding application testing to 30 samples would provide sufficient additional assurance

Explanation: IT general controls provide the environment in which application controls operate. If the change management process does not prevent unauthorized program modifications, then application controls may have functioned correctly at the time of testing but could be altered afterward without detection. This is a fundamental principle of IT audit: weak ITGCs reduce the reliability of application control testing results because the tested controls may not represent the controls actually operating in the system over the full period. Option A and B ignore this dependency relationship. Option D treats sample size as a substitute for addressing the ITGC weakness.

Question 8

1. The information and communication component is effective because financial report accuracy is confirmed
2. Operational managers are not responsible for receiving internal control information
3. Control exception reporting is part of monitoring activities and is outside the scope of information and communication
4. Effective information and communication requires that control failure information be communicated to those with oversight responsibility; accuracy of external financial reports alone does not satisfy this COSO component (correct answer)

Explanation: The information and communication component of COSO requires that relevant information - including information about control deficiencies and failures - be communicated throughout the organization to those who need it to fulfill their control responsibilities. This includes upward communication to the board about significant control failures. Accurate financial reporting satisfies only the external reporting aspect of information and communication; the internal flow of control-relevant information is equally important. Option A narrowly focuses on one output of the information system. Option B incorrectly limits the audience for control information. Option C incorrectly separates exception reporting from information and communication, when both components are involved.

Question 9

1. Zero reports confirm a positive control environment and management's conclusion is well-supported
2. An absence of hotline reports does not confirm the absence of control issues; it may reflect employee unawareness, fear of retaliation, or lack of trust in the anonymity process (correct answer)
3. Whistleblower hotlines are only required for public companies and are not relevant to control environment assessment
4. Six months is too short to evaluate a hotline's effectiveness and management should wait longer before drawing conclusions

Explanation: The effectiveness of a whistleblower hotline cannot be measured solely by the volume of reports received. Zero reports in the first six months may indicate: employees are unaware the hotline exists; employees fear retaliation despite stated protections; employees do not trust that reports are truly anonymous; or the hotline process is inaccessible. A genuinely effective hotline requires employee awareness, credible anonymity protections, and a demonstrated culture in which reports are taken seriously without retaliation. Management must assess these conditions rather than treating silence as evidence of a healthy control environment. Option A accepts an unsupported inference. Option C incorrectly limits hotline relevance to public companies. Option D is a valid timing concern but does not identify the most fundamental analytical issue.

Question 10

1. Daily cash counts reconciled to the general ledger, identifying discrepancies after transactions are recorded (correct answer)
2. The combination safe with access restricted to the treasurer
3. Dual custody required for all cash transfers exceeding $25,000
4. The mandatory vacation policy requiring two consecutive weeks away

Explanation: A detective control identifies errors or irregularities after they have occurred. Daily cash counts reconciled to the GL detect discrepancies by comparing physical cash to recorded amounts - a post-event check. The combination safe (Option B) prevents unauthorized access - a preventive control. Dual custody (Option C) prevents unauthorized transfers by requiring two parties - preventive. Mandatory vacation (Option D) reduces fraud opportunities by forcing rotation - preventive, as it deters and uncovers ongoing schemes through coverage by others.

Question 11

1. Ongoing monitoring focuses on financial controls while separate evaluations address operational controls
2. Ongoing monitoring is embedded in routine business operations and occurs continuously, while separate evaluations are periodic assessments conducted apart from day-to-day processes (correct answer)
3. Separate evaluations are performed exclusively by external auditors while ongoing monitoring is management's responsibility
4. Ongoing monitoring applies only to IT controls and separate evaluations address all other control areas

Explanation: COSO distinguishes between ongoing monitoring - which is built into normal operations (such as supervisory review of work, system-generated exception reports, and management dashboard reviews) - and separate evaluations, which are periodic assessments conducted specifically to evaluate control effectiveness (such as internal audits and control self-assessments). Both types contribute to the monitoring component. Option A introduces a financial vs. operational distinction that does not exist in the COSO framework. Option C is incorrect; management performs both types of monitoring. Option D incorrectly limits the scope of each.

Question 12

1. The override process lacks a compensating detective control; post-override review is needed to ensure supervisors are not approving unauthorized transactions (correct answer)
2. The $500,000 threshold is too low and should be raised to reduce the volume of overrides
3. Application validation controls are sufficient and post-override review provides no additional assurance
4. The 12 overrides during the year automatically constitute a material weakness regardless of amounts

Explanation: Override capabilities in application controls require compensating detective controls to remain effective. Without after-the-fact review of overrides, a supervisor could approve fraudulent or unauthorized invoices without any subsequent detection. The review of overrides serves as a detective control that preserves the overall effectiveness of the exception process. Option B addresses threshold calibration, which is a separate concern from the missing review. Option C incorrectly dismisses the value of post-override review. Option D is incorrect; frequency alone does not determine whether overrides constitute a material weakness - the absence of a review mechanism is the substantive issue.

Question 13

1. The control is well-designed because the finance team has the necessary technical expertise to evaluate their own work
2. Having preparers review their own work creates a self-review threat that fails to provide independent challenge of the assumptions and methods used (correct answer)
3. Fair value measurement is inherently subjective and no controls can effectively address this risk
4. The control is adequate because management is ultimately accountable for the accuracy of its estimates

Explanation: A fundamental principle of control design is that review controls must be performed by individuals independent of the preparation process. When the finance team reviews its own fair value estimates, there is no independent challenge of the assumptions, inputs, or methodology. This self-review threat is particularly significant for complex estimates where subjectivity and management bias are identified risks. Effective control design would require review by an independent group - a valuation committee, internal audit, or external specialist. Option A confuses technical expertise with independence. Option C incorrectly dismisses the possibility of effective controls. Option D identifies accountability without addressing independence.

Question 14

1. Physical access risk to server hardware
2. Data backup and recovery risk
3. Logical access control risk - IT can provision unauthorized system access that allows individuals to execute transactions beyond their authorization (correct answer)
4. Change management risk related to application program updates

Explanation: Unilateral IT authority over user provisioning is a logical access control weakness. Without HR or management approval, IT staff could create fictitious accounts, grant excessive privileges to existing users, or retain access for terminated employees. This creates the ability for unauthorized transactions to be executed in financial and operational systems, directly affecting data integrity and financial reporting. Option A addresses physical server security. Option B addresses availability and recovery. Option D addresses application change management, a separate IT general control domain.

Question 15

1. ERP systems always improve control effectiveness and documentation of the system selection process is sufficient
2. System implementations require reassessment of controls because automated controls in the new system may function differently from the manual controls they replaced, and continuity cannot be assumed without evidence (correct answer)
3. Since the underlying control objectives are unchanged, testing is not required after a system change
4. Year 1 testing results can be carried forward if no exceptions were identified in Year 1

Explanation: When an organization transitions to a new system, the specific controls change even if the objectives remain the same. Manual authorization processes and automated system validation rules are different in nature, design, and failure modes. A new ERP system may have configuration gaps, interface errors, or missing controls that only become apparent through testing. Prior-year results cannot be extrapolated to a new system environment because the system being tested is fundamentally different. Option A makes an unsupported assumption about ERP improvements. Option C correctly identifies that objectives are consistent but incorrectly uses this as a justification for skipping testing. Option D is incorrect; prior-year results do not extend to changed system environments.

Question 16

1. A technology implementation deficiency only, correctable through system configuration
2. A control design gap - automated revenue recognition lacks a control to verify that the triggering event actually occurred before recording revenue (correct answer)
3. No gap exists because automated controls apply rules consistently without human error
4. A monitoring deficiency correctable by reviewing exception reports after posting

Explanation: Revenue under ASC 606 should be recognized when performance obligations are satisfied - typically upon delivery and transfer of control/title. If revenue is automatically triggered by a system status change without independent verification that the physical event occurred, the control does not confirm the underlying economic event. An employee could mark an order as shipped without actually shipping it, prematurely triggering revenue recognition. Option A narrowly frames this as a technology issue. Option C ignores that consistent application of a flawed rule still produces misstatements. Option D proposes a detective response to what is fundamentally a preventive control design gap.

Question 17

1. Strong monitoring activities compensate for a weak control environment and the overall system is effective
2. The audit committee's oversight is the most critical element and fully offsets the CEO's behavior
3. The control environment is the foundation; even robust monitoring cannot fully compensate for a CEO who circumvents controls, because management override undermines the integrity of the entire system (correct answer)
4. Only the external auditor's findings are relevant; internal audit effectiveness does not affect the assessment

Explanation: COSO explicitly identifies the control environment as the foundation upon which all other components rest. A CEO who circumvents controls represents the most serious type of control environment failure - management override - because it undermines the reliability of all other controls. Monitoring activities can detect some issues, but they cannot prevent a determined executive from overriding controls in the moment. Additionally, internal audit and monitoring effectiveness depends on management's willingness to act on findings, which is compromised when the top executive circumvents rather than supports the control system. Options A and B overstate the compensating power of monitoring and oversight against a culture of executive override.

Question 18

1. Control environment
2. Information and communication
3. Risk assessment and control activities (correct answer)
4. Monitoring activities

Explanation: Identifying and analyzing a new risk (warranty estimation uncertainty) is part of risk assessment. Designing a response - documenting methodology and requiring CFO approval - represents control activities. Together, these two COSO components address the identification of the risk and the establishment of controls to manage it. Option A (control environment) relates to the broader organizational culture and governance structure. Option B relates to how information flows within the organization. Option D involves evaluating whether controls are functioning as intended over time.

Question 19

1. Likely a significant deficiency - the reconciliation meaningfully reduces, but does not eliminate, the risk of material misstatement below the threshold for a material weakness (correct answer)
2. Definitely a material weakness because only one employee prepares the estimate
3. Not a deficiency because the reconciliation fully compensates for the single-preparer risk
4. A control deficiency only because an 80% detection rate is nearly perfect

Explanation: The compensating reconciliation control reduces, but does not eliminate, the risk. An 80% detection rate means 20% of errors may not be caught. For a significant accounting estimate like bad debt reserves, a 20% undetected error rate may still be sufficient to create more than a remote possibility of material misstatement - which would support a material weakness. However, the reconciliation provides meaningful mitigation. This nuanced scenario is most consistent with a significant deficiency - more severe than a simple control deficiency but with a compensating control that reduces the risk below the material weakness threshold. Option B overstates severity without considering the compensating control. Option C overstates the reconciliation's effectiveness given the 80% detection rate. Option D understates severity.

Question 20

1. The documented policies demonstrate a well-designed control environment, but the operating culture undermines their effectiveness - the tone at the top is inconsistent with the written standards (correct answer)
2. The company has an effective control environment because written policies and codes of ethics are the primary evidence of control environment quality
3. The informal management overrides are a monitoring issue, not a control environment issue
4. Employee perceptions of pressure are subjective and should not influence the control environment assessment

Explanation: The COSO framework recognizes that the control environment reflects the actual behavior of the organization, not just its written policies. When management's actions contradict documented standards - overriding controls, creating pressure to compromise compliance - the effective control environment is weak despite the paper documentation. This disconnect between formal documentation and actual behavior is a critical finding. Option B confuses documentation quality with actual environment effectiveness. Option C incorrectly reclassifies a behavioral control environment failure as a monitoring problem. Option D dismisses compelling evidence of real control environment weakness.