Risk Assessment and Internal Control - Test 2: answer key

Question 1 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s Sharma & Associates has been appointed statutory auditor of Alpha Infotech Ltd, a listed technology company operating through three Indian offices. Its business involves cloud-based subscription services, software implementation and customised enterprise solutions. The company recently migrated its accounting operations to an integrated ERP platform. The Managing Director, who is also the promoter, takes significant operating decisions without consulting departmental heads. Although the board has constituted an audit committee, its meetings are infrequent and management generally provides information only immediately before meetings. During the audit, the engagement team observes that the finance department has experienced considerable staff turnover. Several newly recruited accountants have received no formal training regarding the company's financial reporting responsibilities. The company's code of conduct is circulated annually, but disciplinary action against senior employees violating it is rarely documented. The ERP system automatically generates monthly exception reports for unusual journal entries, overdue customer balances and unmatched transactions. However, the finance controller admits that nobody has formally reviewed these reports for the last six months. Further, the system administrator possesses unrestricted access to vendor master records, customer balances and journal-entry functions. Changes made by this administrator are not independently approved. The company has also experienced unsuccessful ERP upgrades, resulting in missing supporting vouchers for certain transactions. Management states that it has a formal risk management policy identifying operational and financial reporting risks. However, the policy has not been updated following the ERP migration. Internal audit submits quarterly reports, but management does not maintain evidence of corrective action. The statutory auditor must evaluate the five components of internal control and determine whether the apparent existence of policies and procedures provides a sufficiently reliable control foundation.

The Managing Director routinely takes financial and operating decisions without consulting the audit committee. The committee rarely challenges management's explanations. Which component is most directly affected, and what should the auditor particularly evaluate?

1. Entity risk assessment process, particularly whether management has identified and quantified every possible operational risk.
2. Control activities, particularly whether purchase and payment transactions are independently authorised before recording.
3. Control environment, particularly the participation, independence and oversight exercised by those charged with governance. (correct answer)
4. Monitoring of controls, particularly whether internal audit performs periodic inspections of accounting records.

Answer: C — Control environment, particularly the participation, independence and oversight exercised by those charged with governance.

Explanation. SA 315, ICAI Study Material Chapter 3, §4.5(A), identifies participation by those charged with governance as an element of the control environment. Relevant considerations include independence from management, experience, involvement, information received and scrutiny of activities. Here, ineffective challenge and management dominance indicate weaknesses in governance oversight. The other options concern separate components. Purchase authorisation does not resolve governance deficiencies, and internal audit monitoring cannot substitute for effective participation by those charged with governance.

Where it goes wrong. Confusing governance participation, which is part of the control environment, with monitoring activities performed by internal audit.

Authority. SA 315

Question 2 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Alpha circulates a code of conduct annually, but disciplinary action against senior employees violating its provisions is rarely documented. Which conclusion is most appropriate?

1. The control environment is necessarily satisfactory because written ethical policies have been communicated to employees.
2. The auditor should evaluate both communication and practical enforcement of integrity and ethical values by management. (correct answer)
3. The deficiency exclusively concerns monitoring because ethical standards are unrelated to management's control consciousness.
4. The auditor should disregard the issue unless an actual financial misstatement arising from unethical behaviour is identified.

Answer: B — The auditor should evaluate both communication and practical enforcement of integrity and ethical values by management.

Explanation. SA 315, Chapter 3, §4.5(A)(a), identifies communication and enforcement of integrity and ethical values as an important element of the control environment. Circulating a code of conduct demonstrates communication, but ineffective enforcement undermines its practical significance. Option a wrongly equates written policies with actual ethical behaviour. A deficiency should be considered during risk assessment even when a specific misstatement has not yet been identified. The auditor must evaluate management's actions and the culture demonstrated in practice.

Where it goes wrong. Assuming that issuing an ethics policy automatically establishes an effective control environment.

Authority. SA 315

Question 3 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The ERP administrator possesses unrestricted access to customer balances, vendor masters and journal-entry functions. No independent approval or review of these changes exists. Which assessment is most appropriate?

1. This is exclusively a limitation of human judgment because system administrators are expected to exercise professional discretion.
2. This concerns only the entity's risk assessment process because management has not updated its ERP-related risk policy.
3. This is merely a monitoring deficiency because access restrictions are unnecessary when a computerised system exists.
4. The information system and related control activities have significant weaknesses that may permit unauthorised changes to financial information. (correct answer)

Answer: D — The information system and related control activities have significant weaknesses that may permit unauthorised changes to financial information.

Explanation. SA 315, Chapter 3, §§4.5(C) and 4.5(D), require understanding the financial reporting information system and relevant control activities. The unrestricted administrator access creates risks of unauthorised data changes and inadequate segregation of duties. It also undermines the reliability of system-generated information. Merely automating transaction processing does not establish control effectiveness. The auditor should evaluate the access arrangements, journal-entry controls and related approval mechanisms rather than treating the issue as an ordinary administrative inconvenience.

Where it goes wrong. Assuming that automated processing inherently provides reliable financial reporting despite excessive privileged access.

Authority. SA 315

Question 4 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The ERP generates exception reports identifying unusual journal entries and unmatched transactions. However, these reports remain unreviewed for six months. Which component is most directly deficient?

1. Monitoring of controls, because the continuing functioning of the controls is not being evaluated and deficiencies are not being addressed. (correct answer)
2. Control environment, because every automatically generated financial report forms part of the organisation's ethical culture.
3. Entity risk assessment process, because exception reports must be prepared exclusively by the department identifying operational risks.
4. Information system, because an exception report cannot be generated unless management first performs a substantive audit.

Answer: A — Monitoring of controls, because the continuing functioning of the controls is not being evaluated and deficiencies are not being addressed.

Explanation. SA 315, Chapter 3, §4.5(E), describes monitoring as the process of assessing the effectiveness of internal control performance over time. Monitoring includes evaluating whether controls are functioning as intended and taking necessary remedial actions. The reports are generated by the information system, but their failure to receive review indicates an ineffective monitoring arrangement. Option b confuses reporting information with ethical values. The existence of an automated report does not demonstrate that monitoring has occurred.

Where it goes wrong. Mistaking automatic generation of exception reports for actual monitoring of controls.

Authority. SA 315

Question 5 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s V. Raman & LLP is conducting the statutory audit of Zenith Manufacturing Pvt Ltd, a rapidly expanding automobile-component manufacturer. The company processes approximately 18,000 purchase and production transactions monthly through an automated ERP system. Raw materials are received at three factories, transferred between warehouses and issued to production departments. Finished goods are dispatched against electronically generated customer orders. During the audit, the engagement team discovers that purchase orders, goods-received notes and supplier invoices are maintained in different modules. The ERP system automatically posts transactions to the general ledger, but certain manual journal adjustments can also be entered directly by the finance manager. The system does not retain a complete audit trail for journal entries modified after initial posting. Several physical vouchers relating to machinery purchases are missing, and management has refused to provide alternative supporting records for two substantial transactions. The company has prescribed approval limits for purchases, segregation between purchase initiation and payment authorisation, and monthly reconciliation of supplier accounts. However, the same employee is responsible for preparing and approving certain reconciliation statements. The finance head claims that this arrangement is necessary because of staff shortages. The internal audit department conducts periodic reviews of purchase controls and inventory movements. Nevertheless, its reports reveal repeated exceptions involving unapproved purchases and unmatched goods-received notes. No documented follow-up has been undertaken for several months. The CFO insists that the company has a comprehensive internal control system because every transaction passes through the ERP platform. The engagement partner must evaluate the information system, control activities, risk assessment process and monitoring arrangements rather than relying merely on management's description of the system.

Zenith's internal audit department repeatedly reports unapproved purchases and unmatched goods-received notes. Management takes no documented corrective action. What is the strongest conclusion?

1. The information system is necessarily effective because internal audit has successfully identified the exceptions.
2. The entity's risk assessment process is automatically effective because all deficiencies have been reported to management.
3. The monitoring component is deficient because identified control deficiencies are not being followed up or corrected. (correct answer)
4. The control environment is necessarily satisfactory because management has retained an internal audit department.

Answer: C — The monitoring component is deficient because identified control deficiencies are not being followed up or corrected.

Explanation. SA 315, Chapter 3, §4.5(E), requires an understanding of how the entity monitors controls and addresses identified deficiencies. Internal audit reports may provide evidence of monitoring activities, but repeated exceptions without corrective action indicate that the monitoring process is not functioning effectively. The existence of an internal audit department does not automatically establish effective monitoring. Likewise, identifying a risk does not mean that management has adequately responded to it.

Where it goes wrong. Equating the detection and reporting of deficiencies with their actual correction.

Authority. SA 315

Question 6 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Zenith's ERP automatically posts purchases and production transactions to the general ledger. Certain finance personnel can also modify journal entries without a complete audit trail. Which element requires particular attention?

1. The control environment, because the general ledger is part of the organisational structure and reporting hierarchy.
2. The information system, including journal-entry processing, accounting records, supporting information and the transfer of transactions to the general ledger. (correct answer)
3. Monitoring of controls, because all journal entries must be reviewed exclusively by the internal audit department.
4. The entity's risk assessment process, because automated posting eliminates the need to understand transaction-processing procedures.

Answer: B — The information system, including journal-entry processing, accounting records, supporting information and the transfer of transactions to the general ledger.

Explanation. SA 315, Chapter 3, §4.5(C), requires understanding the information system and related business processes relevant to financial reporting. This includes transaction initiation, recording, processing, correction, transfer to the general ledger, supporting information and controls surrounding journal entries. Direct journal modifications without a complete audit trail can undermine completeness and accuracy. The other components remain relevant, but the specific weakness concerns how financial information is processed and recorded.

Where it goes wrong. Confusing the information system with monitoring merely because journal entries may subsequently be reviewed.

Authority. SA 315

Question 7 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The same Zenith employee prepares and approves certain supplier reconciliations because management considers segregation of duties operationally inconvenient. Which conclusion should the auditor draw?

1. The control is satisfactory because the employee's familiarity with the transactions reduces the possibility of errors.
2. The matter concerns only human resource policies and cannot influence the reliability of financial reporting.
3. The arrangement is necessarily acceptable because segregation of duties is relevant only to large listed companies.
4. The control activity is inadequately designed because the absence of independent review increases the possibility of undetected errors. (correct answer)

Answer: D — The control activity is inadequately designed because the absence of independent review increases the possibility of undetected errors.

Explanation. SA 315, Chapter 3, §4.5(D), requires understanding relevant control activities that help ensure management directives are carried out. Independent review and segregation of duties reduce the possibility that one individual can initiate, process and conceal erroneous transactions. Operational inconvenience does not establish that the arrangement is effective. The auditor should evaluate whether an alternative independent review control exists. The relevant deficiency concerns the design of the control activity and its ability to prevent or detect misstatements.

Where it goes wrong. Assuming that familiarity with transactions compensates for the absence of independent verification.

Authority. SA 315

Question 8 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Management argues that the ERP platform itself guarantees effective internal control because every purchase transaction is electronically processed. Which response is most appropriate?

1. Accept management's assertion because electronic processing automatically establishes all five components of internal control.
2. Evaluate only the purchase approval limits because system processing cannot influence financial reporting reliability.
3. Evaluate the system's reliability together with relevant general control arrangements, control activities and monitoring procedures. (correct answer)
4. Disregard the ERP system because automated controls are not relevant when conducting a statutory financial statement audit.

Answer: C — Evaluate the system's reliability together with relevant general control arrangements, control activities and monitoring procedures.

Explanation. SA 315, Chapter 3, §4.5, identifies five interrelated components of internal control. Automated transaction processing does not establish that the control environment, risk assessment, financial reporting information system, control activities and monitoring are effective. In Zenith's case, missing audit trails and unauthorised modifications demonstrate that automation may introduce additional risks. The auditor must understand and evaluate relevant controls throughout the system rather than rely solely on its technological features or management's description.

Where it goes wrong. Treating automation as a substitute for evaluating the design and functioning of internal control.

Authority. SA 315

Question 9 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s K. Mehta & Co has been appointed statutory auditor of Suryodaya Foods Pvt Ltd, a family-owned food processing company operating a single manufacturing facility. The company employs approximately 45 people and has limited finance personnel. Its Managing Director personally supervises purchasing, approves substantial payments, authorises salary revisions and reviews monthly financial statements. Management claims that this close supervision compensates for the company's inability to maintain extensive segregation of duties. During the audit, the engagement team observes that the purchase executive can create supplier accounts, prepare purchase orders and initiate payment instructions. The Managing Director approves payments through internet banking, but the same individual frequently communicates payment instructions directly to the bank. Two employees have access to the inventory adjustment module and have occasionally agreed to amend stock quantities without independent verification. The company has suffered duplicate vendor payments during the year. A particularly significant incident involves the Managing Director asking the finance manager to bypass an automated credit-limit check for a longstanding customer. The transaction was processed without the normal approval documentation. Separately, the finance manager generated an exception report identifying unusual stock adjustments, but the report was not reviewed because the employee responsible for monitoring it did not understand the report's purpose. Management argues that all reported weaknesses arose from genuine operational difficulties and that its directors remain personally involved in all important decisions. The audit team must evaluate the reliability of the company's control environment, the implications of limited segregation of duties, the possibility of collusion and management override, and the extent to which internal control can realistically provide assurance in a small owner-managed enterprise.

The Managing Director personally approves major payments and reviews monthly financial statements. The company cannot maintain extensive segregation of duties because of limited staffing. Which assessment is most appropriate?

1. The company necessarily has ineffective internal control because every employee must perform only one financial reporting function.
2. The auditor may consider whether owner-manager oversight compensates for limited segregation, while recognising the possibility of management override. (correct answer)
3. The company necessarily has an effective control system because direct involvement of an owner-manager eliminates control risk.
4. The auditor must ignore segregation concerns because the company is privately owned and has relatively few employees.

Answer: B — The auditor may consider whether owner-manager oversight compensates for limited segregation, while recognising the possibility of management override.

Explanation. SA 315, Chapter 3, §4.4(vi), discusses limitations in smaller entities. Smaller entities may have fewer employees, making segregation of duties impracticable. However, an owner-manager may provide more effective oversight and compensate for limited segregation. Conversely, the owner-manager may be better positioned to override less structured controls. Accordingly, the auditor must evaluate both the potential benefit of direct oversight and the increased risk of management override rather than reaching an automatic conclusion.

Where it goes wrong. Treating limited segregation as automatically fatal or owner-manager supervision as automatically sufficient.

Authority. SA 315

Question 10 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The Managing Director asks the finance manager to bypass the ERP credit-limit check for a longstanding customer. The transaction is processed without normal approval documentation. Which limitation is most directly demonstrated?

1. Limitation arising from human judgment, because every manual override necessarily results from an accidental processing error.
2. Limitation arising from inadequate employee training, because the finance manager has not understood the customer's creditworthiness.
3. Limitation arising from management's resource constraints, because the company employs relatively few personnel.
4. Limitation arising from management override, because a person with authority has deliberately bypassed an established control. (correct answer)

Answer: D — Limitation arising from management override, because a person with authority has deliberately bypassed an established control.

Explanation. SA 315, Chapter 3, §4.4(iv), identifies inappropriate management override as an inherent limitation of internal control. A senior manager may deliberately circumvent established procedures, including automated checks, even when controls are properly designed. Here, the Managing Director directly instructs the finance manager to bypass the credit-limit restriction. This is not merely an accidental human error or ordinary staffing difficulty. The auditor should assess the implications of management's ability and willingness to override controls.

Where it goes wrong. Classifying every failure of an automated control as technical failure rather than distinguishing deliberate management override.

Authority. SA 315

Question 11 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Two employees jointly alter inventory records without independent verification, enabling duplicate payments and concealment of discrepancies. Which inherent limitation is principally illustrated?

1. Management's judgment regarding the nature and extent of the controls it chooses to implement.
2. Human judgment in decision-making, causing unavoidable mistakes in the design of accounting procedures.
3. Collusion among people, through which two or more individuals may circumvent otherwise established controls. (correct answer)
4. Lack of understanding the purpose of exception reports, resulting in ineffective monitoring of controls.

Answer: C — Collusion among people, through which two or more individuals may circumvent otherwise established controls.

Explanation. SA 315, Chapter 3, §4.4(iv), expressly recognises collusion among two or more people as an inherent limitation of internal control. Employees acting together may circumvent procedures and conceal irregularities that individual controls were designed to prevent or detect. The facts indicate deliberate joint alteration rather than isolated human error. Lack of segregation increases the opportunity, but the defining limitation in the stated circumstances is collusion.

Where it goes wrong. Confusing collusion with individual human error or inadequate design of controls.

Authority. SA 315

Question 12 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The finance manager generates an exception report identifying unusual inventory adjustments. However, the designated reviewer does not understand the report and takes no action. Which limitation is most directly involved?

1. Lack of understanding the purpose of information produced for internal control, resulting in ineffective operation of the control. (correct answer)
2. Collusion among employees, because the failure to review an exception report necessarily requires two people to act together.
3. Management override, because the generation of an exception report establishes that senior management has bypassed a control.
4. Limitations in small entities, because every failure to review information arises from insufficient employee numbers.

Answer: A — Lack of understanding the purpose of information produced for internal control, resulting in ineffective operation of the control.

Explanation. SA 315, Chapter 3, §4.4(iii), identifies lack of understanding the purpose of information produced for internal control as an inherent limitation. An exception report may be generated correctly, but the control is ineffective when the responsible person does not understand its purpose or fails to take appropriate action. The facts do not establish collusion or deliberate management override. Although staffing limitations may contribute to weaknesses, the immediate limitation is the reviewer's lack of understanding.

Where it goes wrong. Assuming that successful generation of an internal control report proves that the underlying review control operates effectively.

Authority. SA 315

Question 13 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. During the audit of a company, the engagement team discovers that management designed a procurement approval process requiring three levels of authorisation. However, certain transactions are incorrectly processed because the approval matrix was designed using an erroneous interpretation of procurement responsibilities. Which inherent limitation is most directly demonstrated?

During the audit of a company, the engagement team discovers that management designed a procurement approval process requiring three levels of authorisation. However, certain transactions are incorrectly processed because the approval matrix was designed using an erroneous interpretation of procurement responsibilities. Which inherent limitation is most directly demonstrated?

1. Collusion among employees, because several authorisation levels necessarily involve cooperation to circumvent controls.
2. Management override, because every incorrectly designed approval matrix is evidence of deliberate interference.
3. Human judgment in decision-making, because faulty judgment may cause errors in the design or modification of controls. (correct answer)
4. Limitations in small entities, because procurement approval arrangements are necessarily restricted by employee numbers.

Answer: C — Human judgment in decision-making, because faulty judgment may cause errors in the design or modification of controls.

Explanation. SA 315, Chapter 3, §4.4(ii), identifies faulty human judgment and human error as limitations of internal control. Such errors may occur during the initial design of controls or when existing controls are modified. Here, the approval matrix is incorrectly designed because of an erroneous understanding of responsibilities. There is no evidence of deliberate circumvention or collusion. The issue is a human judgment failure affecting control design rather than management override.

Where it goes wrong. Confusing an accidental design error with intentional circumvention of an established control.

Authority. SA 315

Question 14 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company has an established internal control procedure requiring monthly reconciliation of its bank accounts. The finance manager argues that the auditor should conclude that the control is effective simply because it is documented in the accounting manual. Which response is most appropriate?

A company has an established internal control procedure requiring monthly reconciliation of its bank accounts. The finance manager argues that the auditor should conclude that the control is effective simply because it is documented in the accounting manual. Which response is most appropriate?

1. The auditor should accept the control because documented procedures provide sufficient evidence of effective operation throughout the year.
2. The auditor should distinguish the documented design from actual implementation and assess whether the control is operating as intended. (correct answer)
3. The auditor should reject the control because bank reconciliations are substantive procedures rather than internal control activities.
4. The auditor should consider the control effective unless the company's statutory auditor has previously reported a bank-related fraud.

Answer: B — The auditor should distinguish the documented design from actual implementation and assess whether the control is operating as intended.

Explanation. SA 315 requires the auditor to understand relevant internal control, including relevant control activities under Chapter 3, §4.5(D). Understanding a documented procedure does not establish that it has been implemented or operated effectively. The auditor must understand the control's actual operation and, when relying on it, perform appropriate procedures to evaluate its effectiveness. A manual or policy statement is evidence of intended design, not conclusive evidence of consistent performance.

Where it goes wrong. Confusing existence of a written policy with implementation and operating effectiveness.

Authority. SA 315

Question 15 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A manufacturing entity maintains an effective system for identifying financial reporting risks. However, management estimates the likelihood of identified risks inaccurately and does not determine appropriate responses. Which component is most directly deficient?

A manufacturing entity maintains an effective system for identifying financial reporting risks. However, management estimates the likelihood of identified risks inaccurately and does not determine appropriate responses. Which component is most directly deficient?

1. Control environment, because the effectiveness of financial reporting depends exclusively on ethical values and governance participation.
2. Information system, because every inaccurate risk estimate necessarily results from incomplete transaction-processing records.
3. Control activities, because risk identification and risk evaluation are performed only through authorisation and segregation procedures.
4. Entity's risk assessment process, because significance, likelihood and appropriate responses must be considered. (correct answer)

Answer: D — Entity's risk assessment process, because significance, likelihood and appropriate responses must be considered.

Explanation. SA 315, Chapter 3, §4.5(B), requires understanding whether the entity has a process for identifying business risks relevant to financial reporting objectives, estimating their significance, assessing their likelihood and deciding actions to address them. Merely identifying risks does not establish a complete risk assessment process. The absence of reliable estimation and appropriate responses indicates a deficiency in this component. The other components address different aspects of the internal control system.

Where it goes wrong. Equating risk identification alone with a complete entity risk assessment process.

Authority. SA 315

Question 16 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company's accountant records supplier invoices directly into the general ledger. The system does not preserve the original invoice reference, and unmatched goods-received notes are not communicated to the finance department. Which component is most directly affected?

A company's accountant records supplier invoices directly into the general ledger. The system does not preserve the original invoice reference, and unmatched goods-received notes are not communicated to the finance department. Which component is most directly affected?

1. Control environment, because the absence of invoice references necessarily demonstrates weak management integrity.
2. Monitoring of controls, because supplier invoices cannot be recorded unless internal audit first reviews them.
3. Information system and communication, because relevant accounting information and the flow of transaction data are not adequately maintained. (correct answer)
4. Entity risk assessment process, because unmatched goods-received notes are exclusively an operational risk identification issue.

Answer: C — Information system and communication, because relevant accounting information and the flow of transaction data are not adequately maintained.

Explanation. SA 315, Chapter 3, §4.5(C), requires understanding the information system, related business processes, supporting information and communication relevant to financial reporting. Supplier invoice references and goods-received information support the completeness and accuracy of purchase recording. Failure to retain or communicate such information can lead to incomplete or inaccurate financial records. It is not automatically an ethical or monitoring deficiency merely because supporting documents are missing.

Where it goes wrong. Misclassifying weaknesses in transaction information and communication as monitoring deficiencies.

Authority. SA 315

Question 17 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company's management has established a policy requiring supervisory approval of every capital expenditure above a specified threshold. During the year, the policy is applied inconsistently, with several major purchases processed without approval. How should this arrangement be classified?

A company's management has established a policy requiring supervisory approval of every capital expenditure above a specified threshold. During the year, the policy is applied inconsistently, with several major purchases processed without approval. How should this arrangement be classified?

1. As an effective monitoring arrangement because the policy establishes a formal procedure for reviewing capital expenditure.
2. As a deficiency in relevant control activities because prescribed authorisation procedures are not being consistently applied. (correct answer)
3. As a satisfactory control environment because the board has approved the capital expenditure policy in writing.
4. As an appropriate risk assessment process because the purchase threshold identifies all possible business risks.

Answer: B — As a deficiency in relevant control activities because prescribed authorisation procedures are not being consistently applied.

Explanation. SA 315, Chapter 3, §4.5(D), describes control activities as policies and procedures that help ensure management directives are carried out. Approval of significant capital expenditure is an authorisation control activity. Inconsistent application indicates that the control is not functioning as intended, notwithstanding its written existence. Board approval of the policy does not establish operating effectiveness. The auditor should consider the nature and implications of the deviations when assessing control risk.

Where it goes wrong. Treating an approved authorisation policy as effective even when employees routinely bypass its requirements.

Authority. SA 315

Question 18 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company has installed a sophisticated monitoring system that generates daily reports identifying deviations from approved production parameters. The designated production controller receives the reports but does not investigate exceptions or communicate them to management. Which conclusion is most appropriate?

A company has installed a sophisticated monitoring system that generates daily reports identifying deviations from approved production parameters. The designated production controller receives the reports but does not investigate exceptions or communicate them to management. Which conclusion is most appropriate?

1. The monitoring component is necessarily effective because technology automatically identifies deviations.
2. The information system is necessarily deficient because monitoring reports cannot be generated electronically.
3. The control environment is necessarily satisfactory because management has invested in monitoring technology.
4. Monitoring is deficient because identifying exceptions without evaluating and addressing them does not establish effective monitoring. (correct answer)

Answer: D — Monitoring is deficient because identifying exceptions without evaluating and addressing them does not establish effective monitoring.

Explanation. SA 315, Chapter 3, §4.5(E), requires an understanding of the entity's process for assessing the effectiveness of internal control over time. Effective monitoring involves evaluating whether controls are functioning as intended and addressing identified deficiencies. A technology platform may generate information, but that information must be evaluated and appropriate action taken. The generation of reports alone cannot establish effective monitoring, particularly where exceptions remain uninvestigated.

Where it goes wrong. Mistaking automated exception identification for effective monitoring and corrective action.

Authority. SA 315

Question 19 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A small trading company employs one accountant who prepares purchase orders, records supplier invoices and initiates payments. The proprietor reviews the monthly bank statements and supplier balances independently. What is the most appropriate auditor's assessment?

A small trading company employs one accountant who prepares purchase orders, records supplier invoices and initiates payments. The proprietor reviews the monthly bank statements and supplier balances independently. What is the most appropriate auditor's assessment?

1. The company must have ineffective controls because the proprietor's involvement cannot compensate for limited staffing.
2. The company must have effective controls because owner-manager involvement automatically eliminates the risk of fraud.
3. The auditor should consider whether proprietor oversight provides compensating control while evaluating the proprietor's ability to override controls. (correct answer)
4. The auditor should disregard the matter because segregation of duties is not relevant to financial reporting in small companies.

Answer: C — The auditor should consider whether proprietor oversight provides compensating control while evaluating the proprietor's ability to override controls.

Explanation. SA 315, Chapter 3, §4.4(vi), explains that smaller entities may lack sufficient personnel for extensive segregation of duties. Effective owner-manager oversight may compensate for this limitation. However, an owner-manager may also be more capable of overriding the less structured internal control system. Therefore, the auditor must evaluate both aspects rather than assume either automatic effectiveness or automatic failure. Independent review of bank statements and supplier balances may be a relevant compensating arrangement.

Where it goes wrong. Ignoring the dual effect of owner-manager involvement in a small entity.

Authority. SA 315

Question 20 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. During the audit, management states that its internal control system provides absolute assurance that material fraud cannot occur because every material transaction requires managerial authorisation. Which response is most consistent with the principles of internal control?

During the audit, management states that its internal control system provides absolute assurance that material fraud cannot occur because every material transaction requires managerial authorisation. Which response is most consistent with the principles of internal control?

1. Internal control can provide reasonable assurance only, because inherent limitations may prevent controls from achieving their intended objectives. (correct answer)
2. Internal control provides absolute assurance whenever management implements authorisation controls for all material transactions.
3. Internal control provides reasonable assurance only where the auditor independently approves each transaction before management records it.
4. Internal control eliminates fraud risk when all transactions are processed through formally documented approval procedures.

Answer: A — Internal control can provide reasonable assurance only, because inherent limitations may prevent controls from achieving their intended objectives.

Explanation. SA 315, Chapter 3, §4.4(i), explains that internal control, irrespective of its effectiveness, can provide only reasonable assurance regarding achievement of the entity's objectives. Inherent limitations include human error, collusion, management override and management judgment. Authorisation controls reduce risk but cannot guarantee that fraud will never occur. The auditor should therefore reject assertions of absolute assurance and maintain professional skepticism when evaluating the system.

Where it goes wrong. Confusing reasonable assurance provided by internal control with absolute prevention of material fraud.

Authority. SA 315

Question 21 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. The board of a company delegates responsibility for financial reporting to an inexperienced finance manager who has not received adequate training. Although reporting deadlines are met, frequent errors are identified in financial reconciliations. Which element of the control environment is most directly involved?

The board of a company delegates responsibility for financial reporting to an inexperienced finance manager who has not received adequate training. Although reporting deadlines are met, frequent errors are identified in financial reconciliations. Which element of the control environment is most directly involved?

1. Participation by those charged with governance, because the issue exclusively concerns attendance at board meetings.
2. Management's philosophy and operating style, because every reconciliation error necessarily represents management's attitude towards risk.
3. Organisational structure, because finance personnel are not permitted to work independently of other departments.
4. Commitment to competence, because management must consider the skills and knowledge required for particular responsibilities. (correct answer)

Answer: D — Commitment to competence, because management must consider the skills and knowledge required for particular responsibilities.

Explanation. SA 315, Chapter 3, §4.5(A)(b), identifies commitment to competence as an element of the control environment. It involves management's consideration of competence levels for particular jobs and the corresponding skills and knowledge required. Assigning important financial reporting duties to inadequately trained personnel can weaken the control environment and increase the possibility of material misstatement. Meeting deadlines alone does not demonstrate that personnel are competent to perform their responsibilities accurately.

Where it goes wrong. Confusing the presence of qualified job titles or completed reporting deadlines with actual competence.

Authority. SA 315

Question 22 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company has a written risk management policy identifying risks of unauthorised payments. However, after introducing a new online payment facility, management does not reassess whether the existing controls adequately address the changed risks. Which component is most directly deficient?

A company has a written risk management policy identifying risks of unauthorised payments. However, after introducing a new online payment facility, management does not reassess whether the existing controls adequately address the changed risks. Which component is most directly deficient?

1. Monitoring of controls, because the company has failed to examine the operating effectiveness of every existing bank reconciliation.
2. Entity risk assessment process, because management has not reassessed the significance and likelihood of risks arising from a changed operating environment. (correct answer)
3. Control environment, because introducing electronic payments automatically changes the ethical values of management.
4. Information system, because the risk assessment process cannot consider risks associated with electronic payment arrangements.

Answer: B — Entity risk assessment process, because management has not reassessed the significance and likelihood of risks arising from a changed operating environment.

Explanation. SA 315, Chapter 3, §4.5(B), requires understanding the entity's process for identifying, estimating and responding to business risks relevant to financial reporting objectives. The introduction of a new payment facility changes the operating environment and may create additional risks requiring reassessment. A written risk policy is insufficient if management does not update it when circumstances change. The deficiency relates primarily to the entity's risk assessment process, although information-system controls may also require evaluation.

Where it goes wrong. Assuming that the existence of a written risk management policy eliminates the need for continuous risk reassessment.

Authority. SA 315

Question 23 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company operates an automated credit approval system. Its programmers initially install a maximum credit-limit restriction, but management later instructs them to modify the system so selected customers can obtain credit beyond the approved limits without independent review. Which conclusion is most appropriate?

A company operates an automated credit approval system. Its programmers initially install a maximum credit-limit restriction, but management later instructs them to modify the system so selected customers can obtain credit beyond the approved limits without independent review. Which conclusion is most appropriate?

1. The circumstances demonstrate management override, which may circumvent otherwise properly designed automated controls. (correct answer)
2. The circumstances demonstrate only human judgment, because programming changes cannot result in the circumvention of internal controls.
3. The circumstances demonstrate only limitations in smaller entities, because automated credit systems require several levels of staffing.
4. The circumstances demonstrate effective monitoring, because management retains authority to change automated approval parameters.

Answer: A — The circumstances demonstrate management override, which may circumvent otherwise properly designed automated controls.

Explanation. SA 315, Chapter 3, §4.4(iv), recognises inappropriate management override as an inherent limitation. The study material specifically discusses software edit checks designed to identify transactions exceeding specified credit limits that may be overridden or disabled. Here, management deliberately instructs programmers to bypass the restriction without independent review. This is not merely an ordinary system modification. The auditor should evaluate the override risk and its implications for credit exposure and financial reporting.

Where it goes wrong. Treating deliberate disabling of a control as a normal technological change rather than management override.

Authority. SA 315

Question 24 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. Management of a medium-sized enterprise decides not to introduce an independent verification system for every low-value operational transaction, stating that the cost of maintaining such controls would exceed their expected benefit. Which inherent limitation is most closely reflected?

Management of a medium-sized enterprise decides not to introduce an independent verification system for every low-value operational transaction, stating that the cost of maintaining such controls would exceed their expected benefit. Which inherent limitation is most closely reflected?

1. Collusion, because management's decision not to employ additional reviewers necessarily involves employees acting together.
2. Lack of understanding the purpose, because management's assessment of control costs is always an operational misunderstanding.
3. Judgments by management, because management determines the nature and extent of controls it implements and the risks it chooses to assume. (correct answer)
4. Human error, because any decision not to introduce additional controls constitutes an accidental design mistake.

Answer: C — Judgments by management, because management determines the nature and extent of controls it implements and the risks it chooses to assume.

Explanation. SA 315, Chapter 3, §4.4(v), recognises that management makes judgments regarding the nature and extent of internal controls it chooses to implement and the risks it chooses to assume. Consequently, some risks may remain insufficiently controlled even where management has deliberately considered the control arrangements. The described decision is not automatically collusion or accidental human error. The auditor must evaluate whether the resulting control arrangements create relevant risks of material misstatement.

Where it goes wrong. Confusing a deliberate management decision about control design with accidental human error or employee collusion.

Authority. SA 315

Question 25 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company has maintained a satisfactory control environment, an independent audit committee and documented approval procedures for several years. During the current year, the auditor discovers that senior executives and finance personnel jointly entered undisclosed side agreements with customers, resulting in improper revenue recording. Which statement is most appropriate?

A company has maintained a satisfactory control environment, an independent audit committee and documented approval procedures for several years. During the current year, the auditor discovers that senior executives and finance personnel jointly entered undisclosed side agreements with customers, resulting in improper revenue recording. Which statement is most appropriate?

1. The satisfactory control environment proves that the reported revenue must be correct because ethical governance eliminates fraud risk.
2. The satisfactory control environment may reduce fraud risk, but it is not an absolute deterrent; collusion can circumvent established controls. (correct answer)
3. The fraud establishes that the company never possessed any meaningful internal control, regardless of its other control arrangements.
4. The fraud should be ignored if the audit committee had previously approved the company's overall internal control framework.

Answer: B — The satisfactory control environment may reduce fraud risk, but it is not an absolute deterrent; collusion can circumvent established controls.

Explanation. SA 315, Chapter 3, §§4.5(A) and 4.4(iv), establish that a satisfactory control environment can positively influence the auditor's assessment, but is not an absolute deterrent to fraud. Controls may be circumvented through collusion between two or more individuals. The study material specifically discusses side agreements with customers that alter standard contract terms and may result in improper revenue recognition. Accordingly, the auditor must maintain professional skepticism even where the governance structure appears satisfactory.

Where it goes wrong. Assuming that a strong control environment guarantees fraud prevention or makes collusion impossible.

Authority. SA 315