CBA Auditing Internal Controls 2 — Questions and Answers
Question 1: Under the COSO framework, which component addresses the ongoing processes that monitor the quality of internal control performance over time?
- Control Activities
- Risk Assessment
- Monitoring Activities (Correct answer)
- Information and Communication
Correct answer: Monitoring Activities
Monitoring Activities is the COSO component focused on evaluating whether controls are present and functioning effectively on an ongoing basis.
Question 2: When auditing IT general controls, which area is MOST critical to assess first because weaknesses there can undermine all application controls?
- Change management controls
- Access controls and logical security (Correct answer)
- Data center physical security
- Backup and recovery procedures
Correct answer: Access controls and logical security
Access controls and logical security are foundational IT general controls; compromised access can invalidate the effectiveness of all other controls.
Question 3: A bank auditor discovers that loan officers can both approve loans AND record disbursements in the general ledger. This violates which key internal control principle?
- Dual authorization
- Segregation of duties (Correct answer)
- Management override prevention
- Control environment integrity
Correct answer: Segregation of duties
Segregation of duties requires that authorization, custody, and recording functions be performed by different individuals to prevent fraud and error.
Question 4: Which sampling method requires the auditor to select every nth item from a population, starting from a random point?
- Stratified random sampling
- Systematic sampling (Correct answer)
- Cluster sampling
- Judgmental sampling
Correct answer: Systematic sampling
Systematic sampling selects items at uniform intervals (every nth item) after a random start, making it efficient for large populations.
Question 5: In a bank's loan review process, which compensating control is MOST effective when full segregation of duties cannot be achieved in a small branch?
- Requiring dual signatures on all documents
- Enhanced supervisory review of transactions (Correct answer)
- Mandatory vacation policies for key personnel
- Rotating staff assignments quarterly
Correct answer: Enhanced supervisory review of transactions
Enhanced supervisory review compensates for lack of segregation by having a manager independently review and approve transactions processed by the same employee.
Question 6: The term 'control deficiency' in bank auditing refers to a situation where:
- Management disagrees with the auditor's findings
- A control does not allow timely prevention or detection of misstatements (Correct answer)
- The bank fails to implement recommended audit findings
- An internal auditor lacks sufficient training
Correct answer: A control does not allow timely prevention or detection of misstatements
A control deficiency exists when the design or operation of a control does not allow management or employees to prevent or detect misstatements in a timely manner.
Question 7: Which audit procedure is MOST appropriate for testing the operating effectiveness of an automated system access control?
- Reviewing the access policy documentation
- Interviewing the IT security officer
- Attempting to access the system with revoked credentials (Correct answer)
- Inspecting the organizational chart
Correct answer: Attempting to access the system with revoked credentials
Attempting to access the system with revoked or unauthorized credentials directly tests whether the access control is actually operating as designed.
