7.6 Explain how to assess and respond to risk using the Enterprise Risk Management (ERM)
model.
1) ________ is not a risk responses identified in the COSO Enterprise Risk Management
Framework.
A) Acceptance
B) Avoidance
C) Monitoring
D) Sharing
2) Best Friends, Incorporated is a publicly traded company where three BFF’s (best friends
forever) serve as its key officers. This situation
A) is a violation of the Sarbanes-Oxley Act.
B) violates the Securities and Exchange Act.
C) increases the risk associated with an audit.
D) must be changed before your audit firm could accept the audit engagement.
3) ________ remains after management implements internal control(s).
A) Inherent risk
B) Residual risk
C) Risk appetite
D) Risk assessment
4) ________ is the risk that exists before management takes any steps to mitigate it.
A) Inherent risk
B) Residual risk
C) Risk appetite
D) Risk assessment
5) How is expected loss calculated when performing risk assessment?
A) impact times expected loss
B) impact times likelihood
C) inherent risk times likelihood
D) residual risk times likelihood
6) The first step of the risk assessment process is generally to
A) identify controls to reduce all risk to zero.
B) estimate the exposure from negative events.
C) identify the threats that the company currently faces.
D) estimate the risk probability of negative events occurring.
7) Whitewater Rapids provides canoes to tourists eager to ride Whitewater River’s rapids.
Management has determined that there is one chance in a thousand of a customer being injured
or killed. Settlement of resulting lawsuits has an average cost of $650,000. Insurance with a
$50,000 deductible is available. It covers the costs of lawsuits, unless there is evidence of
criminal negligence. What is the impact of this risk without insurance?
A) $50
B) $650
C) $50,000
D) $650,000
8) Whitewater Rapids provides canoes to tourists eager to ride Whitewater river’s rapids.
Management has determined that there is one chance in a thousand of a customer being injured
or killed. Settlement of resulting lawsuits has an average cost of $650,000. Insurance with a
$50,000 deductible is available. It covers the costs of lawsuits, unless there is evidence of
criminal negligence. What is the expected loss without insurance?
A) $50
B) $650
C) $50,000
D) $650,000
9) Whitewater Rapids provides canoes to tourists eager to ride Whitewater river’s rapids.
Management has determined that there is one chance in a thousand of a customer being injured
or killed. Settlement of resulting lawsuits has an average cost of $650,000. Insurance with a
$50,000 deductible is available. It covers the costs of lawsuits, unless there is evidence of
criminal negligence. What is the expected loss with insurance?
A) $50
B) $650
C) $50,000
D) $650,000
10) Whitewater Rapids provides canoes to tourists eager to ride Whitewater river’s rapids.
Management has determined that there is one chance in a thousand of a customer being injured
or killed. Settlement of resulting lawsuits has an average cost of $650,000. Insurance with a
$50,000 deductible is available. It covers the costs of lawsuits, unless there is evidence of
criminal negligence. Based on cost-benefit analysis, what is the most that the business should
pay for the insurance?
A) $50
B) $500
C) $600
D) $650
11) According to the COSO Enterprise Risk Management Framework, the risk assessment
process incorporates all of the following components except
A) reporting potential risks to auditors.
B) identifying events that could impact the enterprise.
C) evaluating the impact of potential events on achievement of objectives.
D) establishing objectives for the enterprise.
12) As a result of an internal risk assessment, Allstate Insurance decided it was not profitable to
provide hurricane insurance in the state of Florida. Allstate apparently chose to ________ the
risk of paying hurricane claims in Florida.
A) reduce
B) share
C) avoid
D) accept
13) Upon getting into your new car, you suddenly became worried that you might become
injured in an auto accident. You decided to buckle your seat belt in response. You chose to
________ the risk of being injured in an auto accident.
A) reduce
B) share
C) avoid
D) accept
14) Upon getting into your new car, you suddenly became worried that you might become
injured in an auto accident. In response, you decided to drive 5 miles under the speed limit. You
chose to ________ the risk of being injured in an auto accident.
A) reduce
B) share
C) avoid
D) accept
15) Upon getting into your new car, you suddenly became worried that you might become
injured in an auto accident. In response, you decided to ride your bike instead. You chose to
________ the risk of being injured in an auto accident.
A) reduce
B) share
C) avoid
D) accept
7.7 Describe control activities commonly used in companies.
1) At a movie theater box office, all tickets are sequentially prenumbered. At the end of each
day, the beginning ticket number is subtracted from the ending number to calculate the number
of tickets sold. Then, ticket stubs collected at the theater entrance are counted and compared with
the number of tickets sold. Which of the following situations does this control detect?
A) Some customers presented tickets purchased on a previous day when there wasn’t a ticket
taker at the theater entrance (so the tickets didn’t get torn.)
B) A group of kids snuck into the theater through a back door when customers left after a show.
C) The box office cashier accidentally gives too much change to a customer.
D) The ticket taker admits his friends without tickets.
2) At a movie theater box office, all tickets are sequentially prenumbered. At the end of each
day, the beginning ticket number is subtracted from the ending number to calculate the number
of tickets sold. Cash is counted and compared with the number of tickets sold. Which of the
following situations does this control detect?
A) Some customers presented tickets purchased on a previous day when there wasn’t a ticket
taker at the theater entrance (so the tickets didn’t get torn.)
B) A group of kids snuck into the theater through a back door when customers left after a show.
C) The box office cashier accidentally gives too much change to a customer.
D) The ticket taker admits his friends without tickets.
3) Independent checks on performance include all the following except
A) data input validation checks.
B) reconciling hash totals.
C) preparing a trial balance report.
D) supervisor review of journal entries and supporting documentation.
4) One of the key objectives of segregating duties is to
A) ensure that no collusion will occur.
B) achieve an optimal division of labor for efficient operations.
C) make sure that different people handle different transactions.
D) make sure that different people handle different parts of the same transaction.
5) Identify the statement below which is true.
A) Requiring two signatures on checks over $20,000 is an example of segregation of duties.
B) Although forensic specialists utilize computers, only people can accurately identify fraud.
C) Internal auditors, rather than external auditors, can conduct evaluations of effectiveness of
Enterprise Risk Management processes.
D) Re-adding the total of a batch of invoices and comparing the total with the first total you
calculated is an example of an independent check.
6) Of the following examples of fraud, which will be the most difficult to prevent and detect?
Assume the company enforces adequate segregation of duties.
A) A mail room employee steals a check received from a customer and destroys the
documentation.
B) The accounts receivable clerk does not record sales invoices for friends or family, so they can
receive free goods.
C) An employee puts inventory behind the dumpster while unloading a vendor’s delivery truck,
then picks up the inventory later in the day and puts it in her car.
D) Mike issues credit cards to him and Maxine, and when the credit card balances are just under
$1,000, Maxine writes off the accounts as bad debt. Mike then issues new cards.
7) Which of the following is a control related to design and use of documents and records?
A) locking blank checks in a drawer or safe
B) sequentially prenumbering sales invoices
C) reconciling the bank statement to the general ledger
D) comparing physical inventory counts with perpetual inventory records
8) Which of the following duties could be performed by the same individual without violating
segregation of duties controls?
A) approving accounting software change requests and testing production scheduling software
changes
B) programming new code for accounting software and testing accounting software upgrades
C) approving software changes and implementing the upgraded software
D) managing accounts payable function and revising code for accounting software to more
efficiently process discount due dates on vendor invoices
9) With a limited work force and a desire to maintain strong internal control, which combination
of duties would result in the lowest risk exposure?
A) updating the inventory subsidiary ledgers and recording purchases in the purchases journal
B) approving a sales return on a customer’s account and depositing customers’ checks in the bank
C) updating the general ledger and working in the inventory warehouse
D) entering payments to vendors in the cash disbursements journal and entering cash received
from customers in the cash receipts journal
10) A store policy that allows retail clerks to process sales returns for $500 or less, with a receipt
dated within the past 30 days, is an example of
A) general authorization.
B) specific authorization.
C) special authorization.
D) generic authorization.
11) An accounting policy that requires a purchasing manager to sign off on all purchases over
$5,000 is an example of
A) general authorization.
B) specific authorization.
C) special authorization.
D) generic authorization.
12) A document that shows all projects that must be completed and the related IT needs in order
to achieve long-range company goals is known as a
A) performance evaluation.
B) project development plan.
C) data processing schedule.
D) strategic master plan.
13) A ________ is created to guide and oversee systems development and acquisition.
A) performance evaluation
B) project development plan
C) steering committee
D) strategic master plan
14) A ________ shows how a project will be completed, including tasks and who will perform
them as well as a timeline and cost estimates.
A) performance evaluation
B) project development plan
C) steering committee
D) strategic master plan
15) The organization chart for Renata Corporation includes a controller and an information
processing manager, both of whom report to the vice president of finance. Which of the
following would be a control weakness?
A) assigning the programming and operating of the computer system to an independent control
group which reports to the controller
B) providing for maintenance of input data controls by an independent control group which
reports to the controller
C) periodically rotating assignment of application processing among machine operators, who all
report to the information processing manager
D) providing for review and distribution of system-generated reports by an independent control
group which reports to the controller
16) Which of the following is an independent check on performance?
A) The Purchasing Agent physically reviews the contents of shipments and compares them with
the purchase orders he has placed.
B) Production teams perform quality evaluations of the products that they produce.
C) The General Manager compares budgeted amounts with expenditure records from all
departments.
D) Petty cash is disbursed by Fred Haynes. He also maintains records of disbursements, places
requests to finance to replace expended funds, and periodically reconciles the petty cash balance.
17) Petty cash is disbursed by the Manuela Luisina in the Cashier’s Office. Manuela also
maintains records of disbursements, places requests to the Finance Department to replace
expended funds, and periodically reconciles the petty cash balance. This represents a(n)
________ segregation of duties.
A) ideal
B) effective
C) ineffective
D) limited
18) Hiring decisions at Maarja’s Razors are made by Maimu Maarja, the Director of Human
Resources. Pay rates are approved by the Vice President for Operations. At the end of each pay
period, supervisors submit time cards to Kasheena, who prepares paycheck requisitions.
Paychecks are then distributed through the company’s mail room. This represents a(n) ________
segregation of duties.
A) partial
B) effective
C) ineffective
D) limited
19) The Director of Information Technology for the city of Tampa, Florida formed a company to
sell computer supplies and software. All purchases made on behalf of the City were made from
her company. She was later charged with fraud for overcharging the City, but was not convicted
by a jury. The control issue in this case arose because the Director had both ________ and
________ duties.
A) custody; authorization
B) custody; recording
C) recording; authorization
D) management; custody
20) Describe the differences between general and specific authorization.
21) Explain how a company could be the victim of fraud, even if ideal segregation of duties is
enforced.
7.8 Describe how to communicate information and monitor control processes in organizations.
1) Which component of the COSO Enterprise Risk Management Integrated Framework is
concerned with understanding how transactions are initiated, data are captured and processed,
and information is reported?
A) information and communication
B) internal environment
C) event identification
D) objective setting
2) Which of the following is not a principle related to information and communicating in the
updated COSO Integrated Control framework?
A) Communicate relevant internal control matters to external parties.
B) Obtain or generate relevant, high-quality information to support internal control.
C) Surround internal control processes with information technology that enables discrepancies to
be identified.
D) Internally communicate the information necessary to support the other components of internal
control.
3) COSO requires that any internal deficiencies identified through monitoring be reported to
whom?
A) the external auditor
B) appropriate federal, state, or local authorities
C) the board of directors
D) the audit committee
4) Which of the following is not a key method of monitoring performance?
A) performing internal control evaluation
B) employing a chief risk officer
C) implementing effective supervision
D) monitoring system activities
5) To ensure compliance with copyrights and to protect itself from software piracy lawsuits,
companies should ________.
A) periodically conduct software audits
B) update the operating system frequently
C) buy software from legitimate suppliers
D) adopt cloud operating platforms
6) Which type of audits can detect fraud and errors?
A) external audits
B) internal audits
C) network security audits
D) all of the above
7) Which of the following is not an example of something monitored by a responsibility
accounting system?
A) budgets
B) quotas
C) vendor analysis
D) quality standards
8) Which type of audit assesses employee compliance with management policies and
procedures?
A) external audit
B) internal audit
C) network security audit
D) all of the above
9) Which of the following factors is not a reason forensic investigators are increasingly used in
accounting?
A) the Sarbanes-Oxley Act
B) new accounting rules
C) audit fee increases
D) pressure from boards of directors
10) A neural network is a software program that has
A) the ability to read text.
B) the ability to learn.
C) the capability to extract information from an individual’s brain.
D) the capability to inject information into an individual’s brain.