CMFO Internal Control and Auditing Practice Exam

These questions are part of the practice quiz. Start practicing

• True or False: The oversight body should oversee the entity's internal control system.
• Succession planning is NOT: Planning for the next mayor.
• The type of audit that is NOT a part of GAGAS.
• Which statement best describes the control environment in an organization?
• Which term describes a tendency to excessively control to avoid bad publicity?
• The three parts of the Fraud Triangle are Opportunity, Pressure, and Rationalization.
• Which of the following is NOT an example of detective controls?
• The mayor is responsible for ensuring that procedures are working properly through ongoing and special evaluations.
• True or False: Most municipalities have an updated personnel policy manual that reflects current practices.
• In internal control, balancing risks and controls aims to achieve what level of assurance?
• The ____ of internal control should be implemented to the extent required to achieve objectives and ensure proper segregation of duties.
• Which description best captures the impact areas affected by risk in a municipality?
• Auditors use the term "_______________" rather than accuracy because they do not test every internal control, transaction, and balance.
• Which term best describes the means by which policies are implemented to achieve the policy goal?
• The statement 'Weak risk identification can result from a lack of support from the top' is:
• Risks to consider regarding ______ involve unauthorized access, use, disclosure, disruption, modification, or destruction.
• Municipalities are required to convert their audited accounting information into a standard format known as what?
• The __________ is what we want to achieve.
• Which entity is primarily responsible for establishing and maintaining internal control within an organization?
• Designing and controlling an internal control system requires employees to analyze management's operations. True or False?
• A ______ should consist of calling personal and professional references to get a sense of the applicant's work history and personal integrity and contracting for a criminal background check.
• Which of the following is least aligned with strong internal control?
• What must be documented regarding monitoring and evaluations?
• In which form of government is the mayor the official responsible for day-to-day management of personnel and operations?
• Studies have shown that ______ when the opportunity presents itself on a daily basis.
• Internal control is affected by people and is not merely policy manuals and forms, but people at every level of an organization.
• Management should identify, analyze, and respond to ___________________ that could impact the internal control system.
• Which item would NOT typically be considered when identifying fraud risks in a municipality?
• Red Flag Rules are associated with which federal act relevant to municipal utilities?
• Is asking 'What could go wrong?' a bad way to check risk assessment?
• Management should design general control activities over information technology to mitigate risks to achieving the entity's objectives to acceptable levels.
• Management monitors the internal control system to ensure ...
• Which outcome is achieved when risk and control are balanced to meet objectives?
• Regularly scheduled internal reviews and annual audits are excellent steps in establishing internal control.
• Which organization defines the internal audit function as independent, objective assurance and consulting activity?
• Management is _____________ to document the process to assess the effect of both internal and external changes.
• Having standard operating procedures will help strengthen the manner in which information is communicated.
• Yellow Book independence standards have been strengthened over the years, resulting in less scrutiny of government audit engagements. True or False?
• What is the primary purpose of segregation of duties in internal control?
• Which of the following describes a quantitative cost?
• Criteria for promotion should be clear and the ______ for determining the promotion should be transparent.
• Application control activities are primarily aimed at ensuring data integrity during processing. Which statement best describes this focus?
• Internal reporting objectives are described as being what?
• External quality control reviews are conducted by what kind of organization?
• Management's independent objective assurance and consulting activity is provided by which function?
• They cannot transfer or surrender the responsibility.
• ________________ is often a difficult concept for management and finance officers.
• Which term best describes ongoing evaluation of internal control performance over time?
• What are application controls designed for?
• What is NOT part of the responsibility of management?
• Which of the following is NOT a part of the control environment?
• Which term describes granting explicit permission to perform a particular financial action?
• Which practice strengthens information communication in internal control?
• Which statement best describes the roles of management and auditors regarding internal controls?
• Refers to an appointed body designated to perform oversight at the direction of the governing body.
• An ________________ opinion is the best opinion auditors can issue.
• What do the Red Flag Rules pertain to?
• Which type of internal controls deter or prevent undesirable events?
• Which item can occur through human error, unclear procedures, system failure, etc.?
• Control activities must provide for ______ to execute transactions over the system while limiting other users to information access only.
• Management must be attentive to the impact of internal and external factors that never change.
• Which statement about the cost of a control is correct?
• Excessive risks are NOT associated with which of the following?
• Why should a "checks and balances" system be a requirement?
• Which principle should guide the design of internal controls to ensure they are cost-effective?
• Which statement best describes accountability for internal control performance?
• What at all levels of the entity are instrumental in holding individuals accountable for assigned responsibilities contributing to the success of the organization?
• What process is affected by an entity's oversight body, management, and other personnel and designed to provide reasonable assurance that objectives will be achieved?
• Which description best applies to the structure of a municipality with a manager-form government?
• The Red Flag Rules are primarily concerned with which risk?
• The law allows local governments to procure the assistance of which type of professional to help develop a work plan for the implementation process?
• Which focus is most closely associated with protecting information assets such as data and software?
• In which form of government is the structure described as ideal to support internal control?
• Which statement best describes reporting lines in an organization?
• In designing incentives for internal control systems, the goal is to avoid creating unrealistically high targets.
• What is the audit period?
• Management should establish and operate ______ activities to monitor the internal control system and evaluate the results.
• Which agency issues the Yellow Book?
• When employees are caught committing fraud, they frequently rationalize which statement?
• In the control framework, procedures are defined as which of the following?
• If management is involved in unethical activities, what should the policy direct employees to do?
• Which factor often comes from within the employees themselves?
• What is the purpose of defining objectives in specific and measurable terms in internal control?
• What is the mission of the municipality?
• __________________ is that which a reasonable person would consider improper or deficient given the situation; including misuse of authority or personal gain.
• When must independent auditors report fraud?
• Which component involves ongoing or separate evaluations of the effectiveness of internal control?
• In a municipal context, which report type might involve occupancy taxes?
• Which concept is described as simple in the material?
• Management should ensure that time and performance expectations placed on employees are reasonable and attainable.
• This is the delegation of authority.
• A secure area for expensive electronic components is an example of ...
• An outdated personnel manual can be misleading.
• The job of independent auditors is to gather sufficient appropriate audit evidence that will allow them to opine on the material accuracy of the financial statements.
• An ________ is any payment that should not have been made, made in the incorrect amount, or has insufficient or lack of proper documentation.
• Which concept must spread throughout the entire organization?
• Failure to take action by a required position of authority is a lapse of which attribute?
• What statement best expresses the relationship of cost versus benefit in internal controls?
• Which statement accurately reflects reporting structure in an organization?
• Management should identify, ____, and respond to risks related to achieving the defined objectives.
• Which term refers to granting someone the authority to perform a function?
• General controls commonly apply to which domain?
• _________ includes traits such as a questioning mind, awareness of conditions that could result in errors or fraud, and critical assessments of issues that don't look reasonable.
• City managers, mayors, city administrators, finance officers, or department heads.
• Who would see the lack of clarity as an opportunity to exploit the resources of the municipality for their own purposes?
• Why is quality external reporting critical?
• This type of control reveals bad activities.
• Senior management should provide clarity in expectations of behavior for all employees and outsourced service providers.
• Should standards of conduct be monitored by management?
• The oversight body and management should demonstrate a commitment to which value?
• Which action would best support internal controls?
• What term best describes the qualification to carry out assigned responsibilities and the relevant knowledge, skills and abilities?
• The competence of an employee is the guiding principle behind hiring and promoting decisions.
• According to the Federal Trade Commission's Fair and Accurate Credit Transactions Act of 2003, which rules apply to all municipal utilities?
• What does setting objectives at a department level mean in internal control practice?
• Delegating the authority to review transactions or processes may speed up reaction time but may also increase risks.
• Contingency plans address the need to ________________________ that could jeopardize the internal control system.
• Management should communicate relevant and quality information with appropriate external parties regarding matters ____________ the functioning of the internal control system.
• Which element is the foundation for all internal controls?
• External communications should be used to share quality information with external parties when matters impact the functioning of the internal control system.
• The primary purpose of a financial statement audit is to provide reasonable assurance through an opinion about whether a municipality's financial statements are ________ in all material respects in conformity with GAAP.
• Reasonable assurance is NOT:
• The personnel manual must be updated on a regular basis to ensure the accurate, fair, and consistent application of human resource policies.
• Refers to an employee or elected official who has direct responsibility for the day-to-day operations of the entity including implementation of internal controls.
• Which factor is commonly viewed as a weakness that can undermine the control environment?
• What reflects management's focus on how each function will utilize resources to achieve the goals of each component?
• Communicating proposed changes to employees will _________ the chance of rumors and their effect on employee morale.
• What is the process that compares two separate sets of data?
• Do user control activities include artificial intelligence using information technology?
• Infers a transaction has been reviewed and is appropriate, accurate, and compliant.
• Which action demonstrates formal acceptance of standards by employees?
• Which element helps determine the scope of a contingency plan?
• Which term best describes communications that are delivered to the right people at the right time and in the right format?
• This include such items as the cost of property, equipment, or inventory; cash dollar loss; fines associated with violation of laws or rules; damage and repair costs; cost of defending a lawsuit, etc.
• Who should report deficiencies to the governing body?
• What is the key objective of segregation of duties?
• The purpose of internal control includes providing reasonable assurance that objectives will be achieved and safeguarding assets. Which of the following is also a typical component?
• Which type of controls are designed to reveal unintended events?
• Setting objectives at the organizational level (government-wide) means engaging in which activities?
• Who is primarily responsible for designing and implementing internal controls?
• What do general controls support?
• A third thing a contingency plan defines is the ....
• Application control activities focus on which stages of data in an information system?
• If information comes too late to allow appropriate action, is it valuable to the organization?
• Which entity is typically responsible for approving the audit committee's responsibilities and duties?
• Most ______________ have a rationalization to justify what they do.
• A common type of report that may apply to municipalities includes occupancy taxes and annual reports by which groups?
• These are usually related to loss of public trust, loss of future grants, injury to the municipality's reputation, increased legislation or regulatory oversight, default on a project, bad publicity, and poor employee morale.
• Who usually performs a single audit?
• How are personnel held accountable?
• Auditors are responsible for designing and implementing the internal control system.
• All audits and attestation engagements begin with ____, and those objectives determine the type of audit to be performed and the applicable standards to be followed.
• Which of the following is NOT a characteristic of preventive controls?
• Managers must analyze what type of information their key employees need and provide it on a timely basis.
• Personnel are not accountable through tools such as performance evaluations or disciplinary actions. This statement is:
• The statement 'Accountability for performance of internal control responsibility supports day-to-day decision-making, attitudes, and behaviors' is:
• Information and communication are ______________ concepts.
• How often must independent audits be performed?
• Approval of a transaction means that the approver has reviewed the supporting documentation to ensure all necessary information is present to justify the transaction and has questioned any unusual items.
• Supervision is to ensure ______________ information is being furnished promptly.
• Which concept describes the combination of opportunity, pressure, and rationalization that enables fraud?
• Which component provides the foundation for all other components of internal control?
• Which form of standards of conduct should be distributed within the organization?
• Under standard governance charters, which statement is true about directives to employees?
• What action most strongly discourages dishonest behavior?
• Which type of risk includes economic, regulatory, social and technological factors, and natural disasters?
• GAGAS follows the ____ book standards.
• The purpose of segregation of duties is to prevent what?
• Which of the following is an example of an external risk?
• Which of the following is NOT one of the ethical principles that auditors must use to guide their work to maintain independence?
• What must the governing body delegate to senior management to ensure accountability?
• Segregation of duties is critical to effective internal control.
• Giving someone permission to approve invoices or sign checks demonstrates which concept?
• __________ is the delegation of authority; it may be general or specific.
• Which statement best describes the stance of many fraud perpetrators?
• The audit committee shall establish responsibilities and duties to be approved by which body?
• The purpose of monitoring is to determine if internal controls are NOT:
• What is the role of auditors regarding internal controls?
• With the internal control objectives, the reporting category applies to which aspect?
• What is the primary purpose of establishing compliance procedures?
• Which factor makes it difficult for management to prevent fraud?
• In every auditor's report, there must be a statement to the effect that the audit was made in accordance with GAGAS.
• When selecting a CPA to conduct an audit, they must be in ______ in their profession.
• Which statement reflects the principle that controls should be cost-effective?
• Which action regarding standards from employees is recommended, along with the distribution of periodic updates?
• Management should implement control activities through policies and ______________.
• Which statement best describes the function of the compliance component within internal control objectives?
• A __________ opinion means the auditor had to modify the opinion because of problems.
• Which component requires management to identify potential barriers to achieving operating goals?
• Pressure can take many ______.
• If you suspect fraud in your city, who must you inform?
• Management's philosophy and operating style sets the tone for entity-wide compliance in internal control.
• The _________ of the municipality can affect the control environment.
• Which component focuses on information and communication necessary to run and monitor control activities?
• Placing limits on access helps protect which aspect of information quality?
• Reconciling a bank statement to the general ledger cash balance is an example of which type of control?
• Which description best captures internal reporting objectives?
• One way to demonstrate commitment to competence is to ________ that meet the stated criteria in the job description and to do a thorough background check on candidates before making an offer.
• What term describes factors that affect the municipality's ability to survive, maintain financial strength, public image, and service quality?
• In Tennessee, municipal officials must report reasonable suspicion of fraud to the Comptroller of the Treasury within how many working days?
• What action is most associated with the approval process in internal control?
• Tests of ________ determine whether the stated controls are working effectively.
• Smaller municipalities may consider contracting the services of a CPA to evaluate the municipality and conduct an audit.
• Management ______ what impact the occurrence of such an event might have on the organization in achieving its goals.
• Which term best describes openness in governance to avoid manipulation by relationships?
• If a process lacks a clear purpose, resources may...
• What actually threatens the performance of a municipality and its departments?
• What should management NOT do during documentation of a risk assessment?
• 'Tone at the top' refers to which concept?
• Which statement best describes the relationship of internal control to objectives?
• A lack of written policies can lead to which risk?
• Which function do application controls perform as transactions pass through the system?
• External reporting requires compliance with what?
• What should be established and communicated throughout the entity?
• Management ______ fraud risks and assesses the significance of the occurrence of these risks.
• External reporting requires compliance with which type of requirements?
• Which term completes the Fraud Triangle along with Opportunity and Pressure?
• Financial audits involve an independent assessment of ...
• Financial statements are the ______ responsibility.
• Management should communicate delegation of internal control responsibilities to whom?
• Which statement about access controls is true?
• Which type of action plan is required by statute to be included in the audit report?
• The Green Book emphasizes controls must be documented.
• Attestation engagements result in an examination, a review, or an agreed-upon procedures report.
• A critical part of reconciliations is to ________________.
• Under the Green Book standards, a system of internal control is based on five components: control environment, risk assessment, control activities, information and communication, and monitoring. Which of the following is NOT a component?
• Preventive controls are proactive and emphasize quality, and detective controls provide evidence that the preventive controls are functioning and preventing losses.
• Which statement about risk documentation is accurate?
• Accurate documentation explains how internal controls support and contribute to achieving the entity's operational objectives.
• What risk arises when workloads are not balanced?
• What term describes the qualification to carry out assigned responsibilities, requiring knowledge, skills, and abilities?
• Which office is typically notified regarding suspected fraud to ensure proper investigation?
• Which component refers to having the opportunity to commit fraud due to weak controls or access?
• How are performance measures or incentives effective for an internal control system?
• What dimensions are used to categorize risks after broad categories are identified?
• When assessing the skills needed for a position, which should be identified and include specialized expertise for that position?
• Which of the following is a likely key activity in reconciliations?
• What is the primary description of activities performed by an internal audit department?
• Which of the following is NOT an example of access controls?
• _______________ helps prevent rumors that relationships with other municipal employees or elected officials drive decision-making.
• What is often required to provide reasonable assurance that federal awards are spent properly?
• Which of the following is NOT a trait of professional skepticism?
• Setting objectives generally are not needed with establishing an effective system of internal control.
• The two-person rule is an example of which internal control concept?
• Senior management will further delegate _____ but shall maintain overall responsibility for the unit.
• A risk analysis does NOT involve which of the following?
• Who should be responsible for developing and maintaining documentation of delegated internal control responsibilities?
• The term for a finding indicating a deficiency in internal control that could prevent reliable financial reporting is called?
• Which aspect do managers NOT need to evaluate when assessing communication?
• What is the primary purpose of control activities?
• Fraud risk is at its highest opportunity when which condition exists?
• A _____________________ defines key personnel, then a candidate is chosen and cross training performed.
• Which entity holds responsibility for the municipality's financial statements?
• How would you categorize controls that are designed to prevent problems before they occur versus those that detect problems after they happen?
• What are the five components of internal control of the Green Book?
• What type of control activity includes a secure area for expensive electronic components?
• Which statement best describes the role of the control environment?
• Which action describes management's estimation of the impact of risk events on organizational goals?
• Which term is used for the process by which promotions are determined, which should be transparent?
• Internal risks are NOT which of the following?
• What does the reconciliation process primarily involve?
• Internal control procedures should adapt to changes in structure, objectives and priorities.
• Automated controls that are embedded in software applications are known as:
• _______________________ should perform ongoing evaluations to determine that lines of communication are effective and appropriate.
• What is the most severe type of audit finding?
• Which of the following does NOT affect the control environment?
• The responsibility for financial reporting in municipalities is shared between management and which other group?
• What is the term used to describe the mental process of justifying illegal acts in fraud?
• The ______________ are how we achieve it.
• True or false: Employees are paying more attention to management's actions than to its words.
• "Two sets of eyes" relates to which control activity?
• Management addresses ______________ identified within the internal control system on a timely basis.
• What is a primary purpose of performance measures within internal control?
• Which function is defined by the IIA as 'an independent, objective assurance and consulting activity designed to add value and improve an organization's operations'?
• Which audit type is required for municipalities that spend at least $1,000,000 in federal awards?
• Which component requires integrity and ethical values?
• Management balances risks and controls to attain what?
• GAGAS follows which standards or book?
• If good employees come to believe that 'who you know' is more important than 'what you know', they may become disgruntled.
• Which action would NOT contribute to a municipality achieving its objectives?
• Which option most closely describes control activities?
• The auditor for the financial statements must meet criteria established by the Comptroller's Office. What word completes: The ______ auditor?
• Preventive controls are often more costly and less effective against mitigating fraud and improper payments.
• Which principle should guide hiring and promotion decisions?
• What outcome is expected from supervision regarding workflow obstructions?
• The auditor's firm must participate in an external ______ review conducted by an independent organization.
• Which of the following is a potential consequence of incentives in internal control systems?
• Security of assets is NOT:
• What are the three elements of the fraud triangle?
• Management compares actual performance to budgets, forecasts, prior periods, and other benchmarks.
• Which approach demonstrates commitment to competence in hiring?
• Which element must be developed, maintained and documented?
• Management should internally communicate relevant and quality information, including objectives and responsibilities for internal control, necessary to support the ______ of the internal control system.
• Tennessee requires public officials to disclose which of the following?
• Risk tolerances are defined as which of the following?
• Which objectives include external and internal applications?
• When management documents efforts to identify risks related to fraud, improper payments, and information security, they will NOT include:
• The tone at the top is an example of which internal control concept?
• Which group is charged with verifying that the channels of communication remain effective in the internal control framework?
• Which statement is true about supervision's focus in internal control?
• Which authority often requires special tracking of certain funds?
• What is the primary purpose of audit evidence?
• Excessive controls are NOT which of the following?
• Preventive controls may be automated or manual.
• What trait requires carrying out assigned duties, relevant knowledge, skills, and abilities?
• Management should demonstrate a commitment to recruit, develop, and retain competent individuals.
• Risk tolerances that management designs can include ...
• What must the auditor issue on the various financial statements presented in the audit?
• Management should obtain or generate relevant, quality information and use it to __________ the functioning of the internal control system.
• Which of the following are the typical categories of objectives under internal control?
• COSO is a joint initiative of five major professional accounting associations and institutes.
• What is the purpose of quality external reporting?
• What policy ensures fairness in hiring and promotions by avoiding influence from relationships?
• Deviations from expected ____________ should be addressed swiftly and consistently.
• Which of the following statements is true?
• Non-financial external reports commonly address which set of performance issues?
• _______________ relate different sets of data to one another, identify and investigate differences, and take corrective action when necessary.
• Competent personnel are acquired largely from professional experience, training, and which of the following?
• Which control activity is primarily designed to prevent fraud by dividing responsibilities among roles?
• When the audit report is prepared by the auditor, who must review and approve the draft and compare significant balances?
• Preventive controls do NOT:
• Which component consists of policies and procedures that help ensure management directives are carried out?
• Which statement correctly defines risk?
• State law requires audits be submitted to the Comptroller's Office within ____ months after fiscal year end.
• With internal control objectives, the operations category applies to which area?
• Which is NOT one of the three categories of objectives in the Green Book standards for managing internal control?
• What is the purpose of control activities in mitigating risks to achieving the entity's objectives?
• Accessibility to the information system by internal and external sources presents a unique set of risks for management to consider.
• Which party is primarily responsible for ensuring that established controls operate effectively and are updated as needed?
• Which type of controls include password policies, access reviews, and change management?
• Which of the following statements is true about the emphasis of the Green Book regarding internal controls?
• In internal control objectives, the compliance category addresses which of the following?
• A _____ provides less assurance than an audit.
• Which statement best describes collusion in the context of fraud risk?
• Which of the following should the governing body provide input to management's plan for in the internal control system?
• What is NOT an example of a control activity?
• Which activities are automated and incorporated directly in the software applications?
• What discourages dishonest behavior?
• Changes in the external environment will require modifications to the way the organization provides service.
• Which entity is primarily responsible for the day-to-day implementation of internal controls within the entity?
• Which statement accurately describes the role of monitoring in internal control?
• Which of the following is NOT a qualitative cost example?
• The results of ________________ monitoring and specific evaluations must be documented.
• If financial statements do not comply with GAAP, what opinion would you issue?
• Assessment of fraud, improper payments, and information security risks must NOT include which of the following?
• An example that must be set by officials and management.
• What does risk tolerance refer to in internal control planning?
• The objective of a _____ is to determine whether the municipality's expenditures of federal awards were compliant with the terms of the award.
• The component focused on ensuring information is captured, processed, and communicated to the right people is which of the five Green Book components?
• Does the entity have a greater assurance of achieving its objectives when operating within defined risk tolerances?
• If workloads are not balanced, what is the most likely risk?
• Which of the following should not be a control procedure?
• Which item should management NOT consider when searching for competent personnel and after hiring?
• Level of risk that management will accept in relation to the achievement of goals and objectives in specific and measurable terms describes which term?
• Why must compliance procedures be established?
• What can management do to ease the audit process?
• What is the primary purpose of separating duties in internal control?
• The risk cost that relates to physical and financial assets is described as which type of cost?
• Which type of control is designed to detect errors or irregularities after they occur?
• Which statement best reflects the governing body's role in reviewing management's activities and addressing wrongdoing?
• Which of the following is an example of a qualitative cost?
• Which statement best describes the audit process?
• Municipalities that expend $1,000,000 or more in federal awards in a fiscal year are required to have a _____ or program-specific audit in addition to the financial audit.
• Management should establish an organizational structure, assign responsibility, and what to achieve the entity's objectives?
• 2025 Green Book changes have incorporated changes that will take place beginning Fiscal Year 2026.
• Application control activities include control over data inputs, processing, and data outputs. True or False?
• What is commonly known as management's independent objective assurance and consulting activity?
• The statement 'Effective communications are those sent to the right employees, at the right time and in the right format' is accurate.
• The ______ of information security are confidentiality, integrity and availability.
• Criteria for which committee stipulate that a candidate for membership may not be a member of management?
• What best describes the shared responsibility for financial reporting in municipalities?
• Which mechanism would most directly combat the risk of management overriding internal controls?
• Which statement best describes the overall purpose of internal controls documentation?
• Documentation of delegated internal control responsibilities should be cost-effective and accurate.
• Which control category is primarily designed to prevent fraud by requiring separation of responsibilities and approvals?
• Are auditors responsible for designing and implementing the internal control system?
• A term used because auditors did not test every internal control, transaction, and account balance.
• Improper payments are NOT: which of the following?
• Municipalities are required to have the official government books closed and ready for audit by ...
• What are put in place to help an entity continue to achieve its objectives?
• Which statement best describes the purpose of risk management within an organization?
• What type of audit provides assurance based on evaluating evidence against established performance criteria, measures, or practices?
• Succession plans address the need to __________________ over the long term.
• Supervision is to ensure workflow obstructions are ______.
• Which type of professional may assist local governments in developing a work plan for the implementation process?
• Do internal auditors have unrestricted access to all parts of the organization?
• Should the governing body oversee the design, implementation, and operation of the internal control system and provide input to remediation plans?
• Management should set objectives in broad categories before risk assessment. Which categories are these broad categories?
• Operational objectives describe management's focus on resource use within which scope?
• Management designs risk responses to fit within the parameters of risk tolerances for specific organizational objectives.
• In a mayor form of government, who is the official responsible for day-to-day management of personnel and operations?
• Which type of standards of conduct should be distributed throughout the organization?
• Which statement best describes the responsibility of senior management after delegation?
• What is a disbursement that is incorrect or lacking adequate documentation defined as?
• To achieve the entity's objectives, management should delegate authority.
• Is it true that the internal audit function cannot be independent from the activities being audited?
• As part of the control environment, management must set internal expectations and requirements through _________________________.
• Which statement best describes non-financial external reports?
• Which question would you NOT ask when identifying risks to the municipality as a whole or within each department?
• What should be reported to the governing body by management about remediation efforts in the internal control system?
• If an employee has concerns about the actions of the City Manager, they should ...
• Risk cost that relates to loss of public trust is considered which type of cost?
• What are the primary categories of risk?
• Internal audit engagements typically include which of the following activities?
• Which factor can weaken risk identification?
• Who should ensure that established controls are working properly?
• When establishing an audit committee, members may be appointed from which groups?
• Anything that may jeopardize the achievement of a objective describes which concept?
• Which action should Human Resources NOT take?
• Supervision is intended to ensure bank accounts and control accounts are being ________________ timely.
• Which statement about information security risk is true?
• General control activities include all of the following EXCEPT which?
• Which is NOT an example of a quantitative cost?
• Refers to the city council, board of aldermen, commissioners, directors, or similar authorities and are responsible for the oversight of the system of internal controls.
• An ________________ opinion means the financial statements do not comply with GAAP.
• Which statement best summarizes the purpose of internal controls?
• Controls can be either ....
• Which of the following does not necessarily involve illegal or fraudulent acts, yet indicates a heightened risk of fraud?
• Which component of the Fraud Triangle is driven by external pressure such as debt or financial need?
• What kind of transaction does not pose special risk and deserve special attention?
• Which of the following is a type of attestation engagement?
• Which document governs fair and consistent application of HR policies?
• The best system of internal control can be rendered worthless if _____________ the controls it established.
• The typical _________ begins with a meeting between the auditor and management.
• Detective controls are NOT:
• General control activities include which of the following?
• Which statement best captures the internal audit function as defined by the IIA?
• Which practice helps hold personnel accountable?
• Which statement best describes the function of materiality in auditing?
• The oversight body should _________ the entity's internal control system.
• Supervision is to ensure personnel are ______ the prescribed routines.
• What is one thing that must be assessed once risks have been identified?
• In the absence of written policies, the employee may feel vulnerable to ______ on issues such as sick and vacation leave, break time, misuse of municipal property, flexibility of work hours, etc.
• How can you monitor the internal control system?
• The internal control process is designed to do regarding achievement of objectives?
• Management should _____________ identified internal control deficiencies on a timely basis.
• If a risk does not have a significant impact, does it require a response?
• What is the primary purpose of supervising bank accounts and control accounts?
• Fundamental concepts for internal control do NOT include: A process that is the means to an end in itself.
• Supervision is intended to ensure procedures are effective and ________________.
• Which term describes the three core aims of information security?
• Which component involves identifying and analyzing relevant risks to the achievement of objectives?
• A lack of clear purpose for control procedures may lead to what outcome?
• Which level does management NOT evaluate communication?
• Auditing ________ helps ensure that internal auditors will not use their position for inappropriate ends.
• What is the best protection against unwarranted suspicions and false accusations?
• If the auditor and management disagree on the appropriateness of corrective actions, what should be reflected?
• An outdated personnel manual leaves employees to wonder what parts of the manual are optional.
• True/False: General controls do not affect application controls.
• Which option would not be part of a risk management process as described?
• The objective of a Single Audit is to determine whether expenditures of federal awards were compliant with the terms of the award.
• Which statement best describes detective controls?
• Which of the following is NOT typically considered a control activity?
• A _______________ is a pattern, practice, or specific activity that indicates the possible existence of identity theft.
• Which type of opinion indicates the auditor had to modify the opinion because of problems?
• Which item must be periodically counted and compared to amounts shown on control records?
• Excessive risk is NOT associated with which of the following?
• Once management determines its tolerance for accepting risks, it must ______ of those decisions on the operation.
• Which description best captures the concept of reasonable assurance in internal control?
• Which of the following describes a hallmark of a strong internal control policy framework?
• Which description best defines a transaction-level risk?
• Management is sometimes tempted to _______________ in order to avoid the possibility of bad publicity.
• Which statement describes the purpose of internal communication within control systems?
• Management should evaluate performance and ______ for their internal control responsibilities.
• What is one of the pressures that incentives implemented for an internal control system cause?
• For some forms of government, the lines of authority are ______, and elected officials (other than the mayor) have no authority to give directives to employees.
• Internal control policy should address which of the following elements?
• When setting goals and expectations, which factors should be considered?
• The government auditing standards are commonly known as the ______.
• A critical element of the reconciliation process is to ...
• Fraud risk has the highest opportunity when which condition exists?
• Is segregation of duties a deterrent to fraud?
• Which two activities are described as the core components of internal audit services according to the IIA?
• What is internal control?
• If records and accounting data are missing or in disarray preventing an opinion, the auditor would issue which type of opinion?
• Who defines the levels of risk tolerance?
• Financial reports for external purposes may...
• "________________________" can be very burdensome and inefficient.
• Which concept spreads accountability throughout the organization?
• Should external or internal requirements be considered when defining objectives to enable the design of internal controls?
• The standard for governments and federal grant recipients is ...
• What type of assurance does the internal control system provide?
• COSO is dedicated to providing leadership through which activity?
• Who must analyze its organizational structure to determine the best reporting process?
• Employees who commit fraud will often point to ...
• Management should define objectives clearly to enable which process?
• Which statement about bottom-up reporting is correct?
• Which of the following items is an example of a quantitative cost?
• Risks categorized into broad categories can be further classified as which pairings?
• This is the type of audit opinion local governments do NOT want.
• What term is used to describe the practice of not testing every internal control, transaction, and account balance?
• In the risk analysis process, where should specific attention be given?
• Opportunity develops when employees have access to a situation where a fraud can happen.
• ____________________ is a burdensome practice adopted by some managers.
• It is not very useful for the manager to identify the most effective communicator of information.
• Who publishes the Green Book?
• Auditing standards allow auditors to design or implement the system of internal control.
• What should the governing body NOT oversee?
• What is the purpose of monitoring?
• What is the primary source of evidence about an applicant's history and integrity in the hiring process?
• Which fraud risk factor must management NOT be mindful of?
• Which action best describes the relationship between monitoring and external communication of control information?
• Employees often rate knowing what is going on in their organization more highly than which of the following in terms of job satisfaction?
• Sensitive or vital assets need to be safeguarded with what?
• When setting goals and expectations for personnel, what should you consider?
• Which statement best defines competence?
• Which statement about accountability tools is accurate?
• What is NOT one of the problems of accepting excessive risks?
• Which option best describes the scope of a financial statement audit?
• Which statement about the role of the personnel manual is most accurate?
• Effective communications are sent ...
• Which component must address documentation requirements, approval authorizations, and checkpoints over the acquisition, development, and maintenance of technology?
• A contingency plan also is defined by the importance of _______________________ in the internal control system.
• External risks are NOT which of the following?
• Management should consider risks related to fraud, improper payments and _____________________ when identifying, analyzing, and responding to risks.
• Which of the following is a component of the Green Book internal control framework?
• Which specialized skill would the governing body NOT need?
• The governing body is responsible for ____________ including the development of and compliance with an effective system of internal controls.
• Who may add additional policies that support day-to-day procedures?
• Which term describes sharing risk with another party?
• Which statement about contingency planning is true?
• Sometimes auditors will issue a __________ of opinion, meaning that records and accounting data are in disarray or missing, and cannot issue an opinion.
• The __________ in the Green Book are organized by the five components of internal control.
• When weak controls are identified, which option must NOT be considered?
• When identifying internal control deficiencies, management should do what?
• Which component involves justifications that rationalize fraudulent behavior?
• Which statement best describes independence in auditing?
• Which term describes plans that ensure key personnel are ready to take over critical roles?
• Which activity provides a basis for detecting problems in performance?
• What are control activities?
• Management's role in the internal control system is critical to its effectiveness.
• Under FACTA, what program must account holders develop and implement in writing?
• _______________ communications are those sent to the right employees, at the right time and in the right format.
• Contingency planning is primarily concerned with preparing for changes that could jeopardize internal controls.
• Accountability for compliance with internal control policies and procedures must spread throughout the organization at all functional levels.
• Which statement about management's role in internal control is true?
• Which arrangement is mentioned as a possibility for smaller municipalities to obtain evaluation and audit services?
• The governing body can avoid specialists when deficiencies are observed in the internal control system.
• _________ is the wanton act of careless, extravagant, or unneeded use of resources.
• Which term describes the practice of separating duties to reduce risk?
• Management must select appropriate methods of external ____________________ so that the entity shares quality information inside and outside the organization on a timely basis.
• Which statement about internal control policy scope is correct?
• Which internal control objective category focuses on the reliability of reporting for internal and external use?
• Which item must NOT be included in documentation of a risk assessment?
• What term describes anything that may jeopardize the achievement of an objective?
• What are some forms of misconduct?
• Which statement best describes the relationship between general controls and application controls?
• Comparisons of budgets, forecasts, and other benchmarks help to ___________ the extent to which goals and objects are being achieved.
• Additional policies may be added by ________________ that support day-to-day procedures.
• Supervision is to ensure internal controls are ______.
• Which combination of evaluations is used to monitor internal controls?
• Which risks occur within the functional or departmental units of the entity?
• Which statement best describes the relationship between contingency plans and internal control?
• A _________________ defines the plan for assigning responsibilities if a key position is vacated without advance notice.