Audit Planning: Assessment of Control Risk

MULTIPLE CHOICE:

1. Which of the following is ordinarily considered a test of

internal control procedures?
a. Send confirmation letters to banks.
b. Count and list cash on hand.
c. Examine signatures on checks.
d. Obtain or prepare reconciliations of bank accounts as
of the balance sheet date.

2. When obtaining an understanding of an entity's control

environment, an auditor should concentrate on the substance
of management's policies and procedures rather than their
form because
a. The auditor may believe that the policies and
procedures are inappropriate for that particular
entity.
b. The board of directors may not be aware of
management's attitude toward the control environment.
c. Management may establish appropriate policies and
procedures but not act on them.
d. The policies and procedures may be so weak that no
reliance is contemplated by the auditor.

3. After the study and evaluation of a client's internal

control policies and procedures has been completed, an
auditor might decide to
a. Increase the extent of substantive testing in areas
where the internal control policies and procedures are
strong.
b. Reduce the extent of control testing in areas where the
internal control policies and procedures are strong.
c. Reduce the extent of both substantive and control
testing in areas where the internal control policies
and procedures are strong.
d. Increase the extent of substantive testing in areas
where the internal controls are weak.

4. A conceptually logical approach to the auditor's evaluation

of internal accounting control consists of the following
four steps:
I. Determine whether the necessary procedures are
prescribed and are being followed satisfactorily.
II. Consider the types of errors and fraud that could

96
97 Chapter 7 Audit Planning: Assessment of Control Risk

occur.
III. Determine the internal control policies and procedures
that should prevent or detect errors and fraud.
IV. Evaluate any weakness to determine its effect on the
nature, timing, or extent of auditing procedures to be
applied and suggestions to be made to the client.

What should be the order in which these four steps are

performed?
a. III, IV, I, II
b. III, I, II, IV
c. II, III, I, IV
d. II, I, III, IV

5. An auditor evaluates the existing internal control

in order to
a. Determine the extent of substantive tests which must be
performed.
b. Determine the extent of control tests which must be
performed.
c. Ascertain whether irregularities are probable.
d. Ascertain whether any employees have incompatible
functions.

6. The auditor is studying internal control policies and

procedures within the sales, shipping, and billing subset of
the revenue cycle. Which of the following conditions
suggests a need for additional testing of controls?
a. Internal control is found to be weak with regard to
shipping and billing.
b. Internal control over sales, billing, and shipping
appears strong, but 80% of sales revenue is
attributable to three major customers.
c. Internal control over billing and shipping is thought
to be strong and the auditor considers additional
testing of selected controls will result in a major
reduction in substantive testing.
d. Internal control over the recording of sales is found
to be weak and the sales are evenly divided among a
large number of customers.

7. A secondary objective of the auditor's study and evaluation

of internal control is that the study and evaluation provide
a. A basis for constructive suggestions concerning
improvements in internal control.
b. A basis for reducing the auditor's assessed level of
control risk below the maximum level.
Chapter 7 Audit Planning: Assessment of Control Risk 98

c. An assurance that the records and documents have been

maintained in accordance with existing company policies
and procedures.
d. A basis for determination of the resultant extent of
the tests to which auditing procedures are to be
restricted.

8. In studying the design and implementation of a client's

internal controls, the auditor needs to identify necessary
control points. Controls existing at these points may be
classified as "accuracy" controls and "safeguard" controls.
Which of the following controls may be regarded as a
safeguard control?

a. In processing sales orders, the computer is programmed

to compare the customer's credit limit minus the prior
balance with the current sales order amount.
b. Sales prices are stored in computer memory and are
automatically applied as stock numbers are entered from
customer orders.
c. Although the payroll is prepared manually, a second
employee recalculates gross pay, withholdings, and net
pay.
d. Negotiable securities are kept in a locked vault and
are accessible only by the treasurer accompanied by one
of her assistants.

9. The auditor's review of the client's internal control is

documented in order to substantiate
a. Conformity of the accounting records with generally
accepted accounting principles.
b. Representation as to adherence to requirements of
management.
c. Representation as to compliance with generally accepted
auditing standards.
d. The fairness of the financial statement presentation.

10. An internal control questionnaire indicates that an approved

receiving report is required to accompany every check
request for payment of merchandise. Which of the following
procedures provides the greatest assurance that this control
is operating effectively?
a. Select and examine canceled checks and ascertain that
the related receiving reports are dated no earlier than
the checks.
99 Chapter 7 Audit Planning: Assessment of Control Risk

b. Select and examine canceled checks and ascertain that

the related receiving reports are dated no later than
the checks.
c. Select and examine receiving reports and ascertain that
the related canceled checks are dated no earlier than
the receiving reports.
d. Select and examine receiving reports and ascertain that
the related canceled checks are dated no later than the
receiving reports.

11. When considering internal control, an auditor must be aware

of the concept of reasonable assurance which recognizes that
a. The employment of competent personnel provides
assurance that the objectives of internal control will
be achieved.
b. The establishment and maintenance of a system of
internal control is an important responsibility of the
management and not of the auditor.
c. The cost of internal control should not exceed the
benefits expected to be derived from internal control.
d. The segregation of incompatible functions is necessary
to obtain assurance that the internal control is
effective.

12. Statement on Auditing Standards No. 60 requires the auditor

to communicate "reportable conditions" to the audit
committee of the board of directors or, in the absence of an
audit committee, to a body having similar oversight
authority. Of the following, which does not represent a
reportable condition?
a. Bank accounts have not been reconciled in the last nine
months, including the last month of the fiscal year.
b. The corporate controller, unknown to the board of
directors, has submitted her resignation effective two
months from now.
c. Perpetual inventory records contain numerous errors and
can no longer be relied upon to reflect proper
inventory levels.
d. Although documents are prenumbered, they are not
safeguarded and are not being used in numerical
sequence.

13. In connection with the examination of financial statements

by an independent auditor, the client suggests that members
of the internal audit staff be utilized to minimize audit
costs. Which of the following tasks could most
appropriately be delegated to the internal audit staff?
Chapter 7 Audit Planning: Assessment of Control Risk 100

a. Selection of accounts receivable for confirmation,

based upon the internal auditor's judgment as to how
many accounts and which accounts will provide
sufficient coverage.
b. Preparation of schedules for negative accounts
receivable responses.
c. Evaluation of the internal control for accounts
receivable and sales.
d. Determination of the adequacy of the allowance for
doubtful accounts.

14. An auditor uses the knowledge provided by the understanding

of internal control and the final assessed level of control
risk primarily to determine the nature, timing, and extent
of the
a. Attribute tests.
b. Compliance tests.
c. Tests of controls.
d. Substantive tests.

15. Flowcharting as a means of internal control evaluation

provides the following advantage over the use of
questionnaires and descriptive narratives:
a. Ease of preparation.
b. Comprehensive coverage of controls.
c. Simplicity.
d. Ease in following information flow.

16. Which of the following factors most likely affects the

auditor's judgment about the quantity, type, and content of
working papers?
a. The effectiveness of the existing internal control.
b. The content of the client's representation letter.
c. The timing of substantive tests completed prior to the
balance sheet date.
d. The usefulness of the working papers as a reference
source for the client.

17. If the independent auditors decide that the work performed

by the internal auditor may have a bearing on their own
procedures, they should consider the internal auditor's
a. Competence and objectivity.
b. Efficiency and experience.
c. Independence and review skills.
d. Training and supervisory skills.
101 Chapter 7 Audit Planning: Assessment of Control Risk

18. An auditor's purpose for further testing of internal control

procedures is to
a. Provide a basis for reducing the assessed level of
control risk below that which resulted from the
auditor's initial understanding of internal control.
b. Reduce the risk that errors or fraud which are not
prevented or detected by internal control are not
detected by the independent audit.
c. Provide assurance that transactions are executed in
accordance with management's authorization and accessed
to assets is limited by a segregation of functions.
d. Provide assurance that transactions are recorded as
necessary to permit the preparation of the financial
statements in conformity with GAAP.

19. Control testing is performed in order to determine whether

or not
a. The assessed level of control risk can be reduced.
b. Necessary controls are absent.
c. Incompatible functions exist.
d. Material dollar errors exist.

20. The independent auditor should acquire an understanding of

the internal audit function as it relates to the independent
auditor's study and evaluation of internal control because
a. The audit programs, working papers, and reports of
internal auditors can often be used as a substitute for
the work of the independent auditor's staff.
b. The procedures performed by the internal audit staff
may eliminate the independent auditor's need for an
extensive study and evaluation of internal control.
c. The work performed by internal auditors may be a factor
in determining the nature, timing, and extent of the
independent auditor's procedures.
d. The understanding of the internal audit function is an
important substantive test to be performed by the
independent auditor.

21. In the assessment of control risk, the auditor is basically

concerned that the client's internal control provides
reasonable assurance that

a. Management cannot override the system.

b. Operational efficiency has been achieved in accordance
with management plans.
c. Errors and fraud have been prevented or detected.
d. Controls have not been circumvented by collusion.
Chapter 7 Audit Planning: Assessment of Control Risk 102

22. Which of the following may be considered an appropriate

means for further testing controls over vendor payments?
a. Confirm year-end balances with vendors.
b. Search for unrecorded invoices at year-end.
c. Develop a set of hypothetical transactions designed to
test existing controls over vendor payments (e.g.,
introduce into the system, a voucher containing an
invoice for raw materials but lacking a purchase order
and/or receiving report.)
d. Construct an internal control flowchart covering the
payment processing function.

23. Which of the following statements concerning the independent

auditor's required communication of material weaknesses in
internal control is correct?
a. Weaknesses reported at interim dates must be repeated
in the final communication.
b. If the auditor does not become aware of any material
weaknesses during the examination, that fact must be
communicated.
c. Weaknesses that had been reported in prior years'
communications and have not been corrected need not be
repeated in the current year's communication.
d. Although written communication is preferable, the
auditor may communicate the findings orally.

24. Which of the following would be the best procedure to

determine whether purchases were properly authorized?
a. Discuss authorization procedures with personnel in the
controller's and purchasing functions.
b. Review and evaluate a flowchart of purchasing
procedures.
c. Determine whether a sample of entries in the purchase
journal is supported by properly executed purchase
orders.
d. Vouch payments for selected purchases to supporting
receiving reports.

25. After studying and evaluating a client's existing internal

control, an auditor has concluded that the policies and
procedures are well designed and functioning as intended.
Under these circumstances, the auditor would most likely
a. Perform further control tests to the extent outlined in
the audit program.
b. Determine the control policies and procedures that
should prevent or detect errors and fraud.
103 Chapter 7 Audit Planning: Assessment of Control Risk

c. Set detection risk at a higher level than would be set

under conditions of weak internal control.
d. Set detection risk at a lower level than would be set
under conditions of weak internal control.

26. An auditor is required to obtain a basic understanding of

the client's internal control to plan the audit. The
auditor may then decide to perform tests of controls on all
internal control procedures
a. That would aid in preventing fraud.
b. Documented in the flowchart.
c. Considered to be weaknesses that might allow errors to
enter the accounting system.
d. Considered to be strengths for which the auditor
desires further reduction in the assessed level of
control risk.

27. The auditor's understanding of the client's internal control

is documented in order to substantiate
a. Conformity of the accounting records with generally
accepted accounting principles.
b. Compliance with generally accepted auditing standards.
c. Adherence to requirements of management.
d. The fairness of the financial statement presentation.

28. To determine whether the client's system of internal control

operated effectively to minimize errors of failure to
invoice a shipment, the auditor would select a sample of
transactions from the population represented by the
a. Customer order file.
b. Bill of lading file.
c. Open invoice file.
d. Sales invoice file.

29. When evaluating a client's system of internal control to

determine whether the necessary procedures are prescribed
and have been implemented satisfactorily, an auditor must
a. Develop questionnaires and checklists.
b. Obtain an understanding of internal control.
c. Perform tests of internal control procedures.
d. Evaluate administrative policies.

30. Of the following internal control policies or procedures,

which would most likely allow for a reduction in the scope
of the auditor's tests of depreciation expense?
Chapter 7 Audit Planning: Assessment of Control Risk 104

a. Review and approval of the periodic equipment

depreciation entry by a supervisor who does not
actively participate in its preparation.
b. Comparison of equipment account balances for the
current year with the current-year budget and prior-
year actual balances.
c. Review of the miscellaneous income account for salvage
credits and scrap sales of partially depreciated
equipment.
d. Authorization of payment of vendors' invoices by a
designated employee who is independent of the equipment
receiving function.

31. Tracing copies of sales invoices to shipping documents will

provide evidence that all
a. Shipments to customers were recorded as receivables.
b. Billed sales were shipped.
c. Debits to the subsidiary accounts receivable ledger are
for sales shipped.
d. Shipments to customers were billed.

32. In assessing control risk, the auditor must, as a minimum

a. Perform tests of all significant controls.
b. Obtain an understanding of the design and
implementation of the client's internal control.
c. Obtain an understanding of the design of the client's
internal control.
d. Obtain an understanding of the design, implementation,
and operating effectiveness of the client's internal
control.

33. An independent auditor has concluded that the client's

records, procedures and representations can be relied upon
based on tests made during the year when internal control
was found to be effective. The auditor should test the
records, procedures, and representations again at year-end
if
a. Inquiries and observations lead the auditor to believe
that conditions have changed significantly.
b. Comparisons of year-end balances with like balances at
prior dates revealed significant fluctuations.
c. Unusual transactions occurred subsequent to the
completion of the interim audit work.
d. Client records are in a condition that facilitate
effective and efficient testing.
105 Chapter 7 Audit Planning: Assessment of Control Risk

34. An auditor is least likely to further test control

procedures by examining documents with respect to controls
relating to
a. Segregation of the functions of recording disbursements
and reconciling the bank account.
b. Comparison of receiving reports and vendors' invoices
with purchase orders.
c. Approval of the purchase and sale of marketable
securities.
d. Classification of revenue and expense transactions by
product line.

35. An auditor usually examines receiving reports to support

entries in the
a. Voucher register and sales returns journal.
b. Sales journal and sales returns journal.
c. Voucher register and sales journal.
d. Check register and sales journal.

36. Regardless of whether the auditor decides to test controls

for operating effectiveness, he/she must fully document his
or her understanding of the internal control policies and
procedures obtained through whatever means. Which of the
following does not describe an appropriate means for
documenting such understanding?
a. Internal control flowchart.
b. Internal control implementation.
c. Internal control memorandum.
d. Internal control questionnaire.

37. Which of the following best describes the primary reason for
the auditor's use of flowcharts during an audit engagement?
a. To comply with the requirements of generally accepted
auditing standards.
b. To classify the client's documents and transactions by
major operating functions, e.g., cash receipts, cash
disbursements, etc.
c. To record the auditor's understanding of the client's
internal control policies and procedures.
d. To interpret the operational effectiveness of the
client's existing organizational structure.

38. An auditor generally tests physical security controls over

inventory by
a. Test counts and cutoff procedures.
b. Examination and reconciliation.
Chapter 7 Audit Planning: Assessment of Control Risk 106

c. Inspection and recomputation.

d. Inquiry and observation.

39. Which of the following is not an auditing procedure that is

commonly used in performing control tests?
a. Inquiring.
b. Observing.
c. Confirming.
d. Inspecting.

40. If the independent auditor decides that the work performed

by internal auditors may have a bearing on the independent
auditor's own procedures, the independent auditor should
consider the objectivity of the internal auditors. One
method of judging objectivity is to
a. Review the recommendations made in the reports of the
internal auditor.
b. Examine, on a test basis, documentary evidence of the
work performed by internal auditors.
c. Inquire of management about the qualifications of the
internal audit staff.
d. Consider the client's practices for hiring, training,
and supervising the internal audit staff.

41. Tracing bills of lading to sales invoices will provide

evidence that
a. Recorded sales were shipped.
b. Invoiced sales were shipped.
c. Shipments to customers were invoiced.
d. Shipments to customers were recorded as sales.

42. The development of constructive suggestions to clients for

improvements in internal accounting control is
a. A requirement of the auditor's study and evaluation of
internal accounting control.
b. A desirable byproduct of an audit engagement.
c. Addressed by the auditor only during a special
engagement.
d. As important as establishing a basis for reliance upon
the internal accounting control system.

43. Which of the following statements with respect to the

independent auditor's evaluation of internal control is
correct?
107 Chapter 7 Audit Planning: Assessment of Control Risk

a. The auditor should decrease control testing when

weaknesses in cash receipts are mitigated by strong
controls in cash disbursement procedures.
b. The auditor should increase control testing when
weaknesses in billing procedures are mitigated by
strong controls in collection procedures.
c. The auditor generally should not evaluate the overall
effectiveness of internal control, but should
separately evaluate each of the transaction cycles.
d. The auditor should evaluate all internal control
weaknesses before determining the control procedures
that should prevent or detect errors or irregularities.

44. Which of the following statements best describes the

auditor's responsibility regarding the detection of material
fraud?
a. Because of the inherent limitations of an audit, the
auditor is not responsible for the failure to detect
material fraud.
b. The auditor is responsible for the failure to detect
material fraud when such failure results from
nonperformance of audit procedures specifically
described in the engagement letter.
c. The auditor should design audit programs that will
provide reasonable assurance that material errors and
fraud will be detected in the ordinary course of the
examination.
d. The auditor is responsible for the failure to detect
material fraud when the auditor's evaluation of
internal control procedures indicates that they are
ineffective.

45. Which of the following procedures most likely would be

included as part of an auditor's tests of control
procedures?
a. Inspection.
b. Reconciliation.
c. Confirmation.
d. Analytical procedures.

46. If, after obtaining an initial understanding of a client's

internal control, the auditor wishes to further reduce the
assessed level of control risk relating to plant asset
transactions, the auditor should next
a. Make extensive substantive tests of plant asset
balances.
Chapter 7 Audit Planning: Assessment of Control Risk 108

b. Establish the physical existence of current year

additions.
c. Complete the plant asset section of the internal
accounting control questionnaire.
d. Further test those internal control procedures relating
to processing and recording plant asset transactions.

47. The auditor is most likely to presume that a high risk of

defalcation exists if
a. The client is a multinational company that does
business in numerous foreign countries.
b. The client does business with several related parties.
c. Inadequate segregation of duties places an employee in
a position to perpetrate and conceal thefts.
d. Inadequate employee training results in lengthy CBIS
exception reports each month.

48. After obtaining an understanding of the client’s internal

control, the auditor should consider whether
a. The projected degree of effectiveness of internal
control is justified.
b. The evidential matter obtained from the study of the
internal control system can provide a reasonable basis
for an opinion.
c. Further testing of internal control procedures is
likely to permit further reduction of assessed control
risk.
d. Sufficient knowledge has been obtained about the
entity's entire system of internal control.

49. Which of the following is the correct order of performing

the auditing procedures A through C below?
A = Tests of internal control procedures.
B = Preparation of a flowchart depicting the client's
internal control system.
C = Substantive tests.

a. ABC.
b. ACB.
c. BAC.
d. BCA.

50. Auditors frequently use flowcharts in connection with which

of the following
a. Preparation of generalized computer audit programs.
109 Chapter 7 Audit Planning: Assessment of Control Risk

b. Review of the client's internal control procedures.

c. Use of statistical sampling in performing an audit.
d. Performance of analytical review procedures of account
balances.

51. Which of the following conditions suggest a lowering of the

aggregate materiality threshold?

a. Internal controls in the area of payroll processing are

found to be much stronger than the auditor's initial
assessment.
b. The application of analytical procedures reveals a
favorable sales budget variance that is material and
that remains unexplained.
c. Study of the business and industry reveals a material
decline in both industry and client revenue during the
current year.
d. Tests of internal controls in nearly all transaction
cycle subsets have produced numerous and widespread
errors.

52. If, during the course of an annual audit of a publicly held

manufacturing company, an independent auditor becomes aware
of a material weakness in the company's internal control,
the auditor is required to communicate the weakness to
a. The audit committee of the board of directors, or to a
similar body having financial oversight responsibility.
b. The senior management of the company.
c. The board of directors of the company.
d. The treasurer and controller of the client entity.

53. Under which of the following conditions would you consider

lowering individual item materiality thresholds.
a. Study of the business and industry, together with the
application of analytical procedures, reveals that the
client has enjoyed a surge in sales and gross profit
during an industry downturn.
b. Application of analytical procedures shows that the
client's gross profit rate is significantly below last
year and also is materially lower than the industry
average.
c. Study of internal controls within the revenue cycle
reveal material weaknesses.
d. Study of internal controls within the payroll cycle
confirm the auditor's belief that few errors have
occurred.
Chapter 7 Audit Planning: Assessment of Control Risk 110

54. Which of the following is not a medium that can normally be

used by an auditor to record information concerning a
client's internal control policies and procedures?
a. Narrative memorandum.
b. Procedures manual.
c. Flowchart.
d. Questionnaire.

55. With respect to the client's system of internal control, the

auditor is concerned that the existing policies and
procedures provide reasonable assurance that
a. Operational efficiency has been achieved in accordance
with management plans.
b. Errors and fraud have been prevented or detected.
c. Controls have not been circumvented by collusion.
d. Management cannot override the internal controls.