Internal Controls and Audit Practices Worksheet

Which of the following BEST defines the purpose of internal controls in a banking institution?

• To detect and report fraud after it occurs

• To ensure operational efficiency, compliance with regulations, and safeguard assets

• To monitor and improve customer satisfaction levels

• To eliminate all risks associated with financial transactions

Which of the following is considered a preventive control in a banking environment?

• Segregation of duties to ensure no single employee has end-to-end control of a process

• Performing periodic reconciliations of bank accounts

• Conducting internal audits to identify control weaknesses

• Reviewing transaction logs for anomalies

During an audit, you identify that a specific control has been bypassed multiple times by the same business unit. What is the MOST appropriate course of action for the 3 LoD?

• Document the issue, escalate it to senior management, and recommend disciplinary action

• Escalate the issue directly to the regulator to prevent reputational risks

• Review the control design and implementation to identify potential weaknesses leading to bypasses

• Recommend immediate suspension of the business unit's operations

Which of the following best describes the "control environment" in the context of internal controls?

• A set of activities used to detect errors in financial reporting

• The overall culture, values, and attitudes that influence control awareness within an organisation

• Policies and procedures established to monitor operational efficiency

• Automated systems designed to prevent unauthorised transactions

You are tasked with reviewing the effectiveness of internal controls within your organisation. During your review, you identify that a critical operational process consistently fails to meet established policies and procedures, leading to regulatory non-compliance and potential reputational risks. What is the MOST appropriate action to take in alignment with effective internal control principles?

• Inform the process owner about the issue and suggest they address it internally without involving higher management to avoid unnecessary attention

• Focus on completing the review within the deadline and note the issue for future follow-up without escalating it immediately

• Recommend amending the organisation’s policies to align with the observed practices, ensuring easier compliance in the future

• Conduct a thorough root cause analysis, document the findings in a detailed report, escalate the issue to relevant stakeholders, and recommend corrective actions to ensure compliance and process improvement

When reviewing the results of an internal audit, what is the MOST critical factor for the 3 LoD to consider when prioritising audit findings?

• The financial impact of the identified issue on the bank’s operations

• The regulatory consequences of failing to address the identified issue

• The likelihood and impact of the issue resulting in systemic risks

• The ease with which the issue can be remediated by the 1 LoD and 2 LoD

An internal audit report identifies recurring gaps in the documentation of key control processes across multiple departments. As the 3 LoD, you are tasked with identifying the potential root causes contributing to these gaps. Which of the following could be contributing factors? i. Lack of consistent documentation standards across the organisation ii. High employee turnover in key operational roles responsible for control implementation iii. Failure to prioritise documentation during risk assessment exercises conducted by the 1 LoD iv. Inadequate training provided to staff on control documentation requirements

• i and iv

• i, ii and iv

• ii, iii and iv

• All of the above

Which of the following is the key critical factor to consider when prioritising audit findings for internal controls?

• The potential reputational damage to the organization if the issue is not resolved

• The regulatory requirements associated with the identified control gaps

• The likelihood and impact of the issue leading to financial or operational risks

• The availability of resources within the 1 LoD and 2 LoD to address the findings

The internal audit team identifies a pattern of control overrides by senior executives in high-value transactions, raising potential governance concerns. What should be the MOST effective next steps? i. Escalate the issue to the board of directors, emphasising the potential governance risks ii. Recommend stricter policies prohibiting control overrides in all transactions iii. Conduct a forensic audit to determine whether the overrides were justified or indicate misconduct iv. Collaborate with the compliance team to increase monitoring of high-value transactions

• i and iii only

• i and iv only

• iii and iv only

• All of the above

The board requests an audit of the bank's digital transformation initiatives, particularly the integration of AI-driven controls. Initial findings reveal that key stakeholders in the 1 LoD and 2 LoD lack understanding of how AI models determine risk scores. What recommendations would you provide? i. Advocate for mandatory training for all stakeholders on AI risk assessment methodologies ii. Recommend pausing the deployment of AI-driven controls until stakeholder concerns are resolved iii. Suggest periodic validation of AI models by external AI subject matter experts to ensure transparency and accuracy iv. Advise the board to allocate additional resources for improving AI model explainability

• i and ii only

• i and iii only

• i, ii and iii only

• All of the above