9.1  Which of the following is not an aim of internal controls?

• A.  To enable the organisation to respond appropriately to business, operational and financial risks

• B.  To eliminate the possibility of impacts from poor judgement and human error

• C.  To help ensure the quality of internal and external reporting

• D.  To help ensure compliance with applicable laws and regulations  (2 marks)

9.2  Some controls are provided automatically by the system and cannot be by-passed, ignored or overridden: for example, having to input a password to enter a computer system. These are classified as ........................................ controls.

Which term correctly completes this statement?

• A. Detect

• B. Mandated

• C. Non-discretionary

• D. Administrative

9.3  The mnemonic SPAMSOAP is often used to remember the range of financial control procedures. What  does the 'O' stand for in this mnemonic?

• A. Operations

• B. Organisation

• C. Oversight 

9.4  Which of the following is not an internal check?

• A.  Separation of duties for authorising, custody and recording

• B.  Pre-lists, post-lists and control totals

• C. Bank reconciliations

• D.  Systems for authorising transactions within specified spending limits 

9.5  Which of the following statements about internal audit is true?

• A.  Internal audit is an independent appraisal activity 

• B.  Internal audit is separate from the organisation's internal control system

• C.  Internal audit is carried out solely for the benefit of the organisation's stakeholders

• D.  The internal audit function reports to the finance director 

9.6  The use of uninterruptible (protected) power supplies is a method of protecting data and IT systems from what sort of security threat?

• A. Accidental damage

• B. Weather

• C. Hacking 

9.7  Which of the following would be classed as a contingency control in an information system?

• A.  Password-only access to the system

• B.  System recovery procedures

• C. Audit trails

9.8  All of the following, with one exception, are inherent limitations of internal control systems. Which is the exception?

• A.  The costs of control

• B.  Potential for human error and deliberate override

• C.  The types of transactions controls are designed to cope with

• D.  The independence of controls from the method of data processing

9.9  Which of the following statements about external auditors is not correct?

• A.  External auditors are appointed by the shareholders of a company

• B.  The primary responsibility of external auditors is to investigate financial irregularities and report them to shareholders

• C.  External auditors may rely on the work of internal auditors, if they first assess its worth

• D.  External auditors are concerned with the financial records and statements of the organisation

9.10 In the context of audit, what are 'substantive tests' designed to accomplish?

• A.  To establish whether internal controls are being applied as prescribed

• B.  To identify errors and omissions in financial records

• C.  To establish the causes of errors or omissions in financial records

• D.  To establish an audit trail