answers: US CMA Part 1 – Internal Control, SOX, FCPA, COSO & COBIT
answers:
US CMA Part 1 – Internal Control, SOX, FCPA, COSO & COBIT
50 MCQs (Exam-Oriented)
1. Which of the following is NOT an objective of an effective internal control system?
A. Safeguarding assets
B. Ensuring reliable financial reporting
C. Guaranteeing that fraud will never occur
D. Promoting operational efficiency
Answer: C
2. Internal control does NOT provide reasonable assurance regarding:
A. Achievement of objectives
B. Reliability of financial reporting
C. Absolute prevention of all errors
D. Compliance with laws and regulations
Answer: C
3. Which of the following is NOT one of the five components of the COSO Internal Control Framework?
A. Control environment
B. Risk assessment
C. Risk transfer
D. Monitoring activities
Answer: C
4. Which is NOT considered a limitation of internal control?
A. Collusion among employees
B. Management override
C. Human error
D. Absolute guarantee of achieving objectives
Answer: D
5. Which of the following is NOT primarily the responsibility of management?
A. Establishing internal controls
B. Maintaining internal controls
C. Designing appropriate controls
D. Providing an external audit opinion
Answer: D
6. Which activity would NOT normally be considered a preventive control?
A. Segregation of duties
B. Password authorization
C. Bank reconciliation
D. Physical access restrictions
Answer: C
7. Which of the following is NOT a detective control?
A. Bank reconciliation
B. Physical inventory count
C. Exception reports
D. Employee authorization limits
Answer: D
8. Segregation of duties is designed primarily to reduce the risk of all of the following EXCEPT:
A. Fraud
B. Errors
C. Unauthorized transactions
D. Natural disasters
Answer: D
9. Which of the following duties should NOT normally be performed by the same employee?
A. Authorization and custody of assets
B. Recording and reconciliation
C. Authorization and recording
D. Custody and authorization
Answer: A
10. A properly designed internal control system does NOT necessarily:
A. Reduce the risk of fraud
B. Improve reliability of information
C. Eliminate all business risks
D. Support achievement of objectives
Answer: C
COSO FRAMEWORK
11. Which of the following is NOT a COSO component?
A. Control environment
B. Information and communication
C. Monitoring activities
D. Strategic planning
Answer: D
12. The COSO control environment does NOT primarily include:
A. Integrity and ethical values
B. Organizational structure
C. Management's philosophy
D. Detailed transaction processing
Answer: D
13. Which is NOT normally included in the COSO risk assessment component?
A. Identification of risks
B. Analysis of risks
C. Consideration of fraud risk
D. Preparation of journal entries
Answer: D
14. Control activities do NOT generally include:
A. Authorizations
B. Verifications
C. Reconciliations
D. Establishing corporate objectives only
Answer: D
15. Which of the following is NOT an example of information and communication?
A. Reporting control deficiencies
B. Communicating policies
C. Sharing relevant information
D. Performing physical inventory counts
Answer: D
16. Monitoring activities do NOT primarily involve:
A. Ongoing evaluations
B. Separate evaluations
C. Identification of deficiencies
D. Daily authorization of every transaction
Answer: D
17. Which COSO component is most directly concerned with identifying and analyzing threats to objectives?
A. Control environment
B. Risk assessment
C. Monitoring
D. Information and communication
Answer: B
18. Which of the following is NOT a principle associated with the COSO control environment?
A. Demonstrates commitment to integrity
B. Exercises board oversight
C. Establishes appropriate structure and authority
D. Guarantees profitability
Answer: D
GOVERNANCE
19. Corporate governance does NOT primarily focus on:
A. Accountability
B. Oversight
C. Ethical conduct
D. Guaranteeing business success
Answer: D
20. The board of directors should NOT:
A. Provide oversight
B. Monitor management
C. Establish governance direction
D. Perform all day-to-day management functions
Answer: D
21. Which is NOT generally a responsibility of the audit committee?
A. Overseeing financial reporting
B. Monitoring internal controls
C. Overseeing external auditors
D. Preparing daily accounting entries
Answer: D
22. An independent board member is generally expected to NOT:
A. Exercise objective judgment
B. Provide oversight
C. Have excessive conflicts of interest
D. Challenge management decisions
Answer: C
23. Which of the following is NOT a major objective of corporate governance?
A. Accountability
B. Transparency
C. Ethical behavior
D. Elimination of all financial risks
Answer: D
24. The audit committee should NOT compromise its independence by:
A. Meeting external auditors
B. Reviewing financial reporting
C. Excessively depending on management without independent evaluation
D. Monitoring internal control
Answer: C
SARBANES-OXLEY ACT (SOX)
25. The Sarbanes-Oxley Act (SOX) does NOT primarily apply to:
A. Publicly traded companies in the United States
B. Companies subject to SEC reporting requirements
C. Management of covered companies
D. Every private business worldwide
Answer: D
26. Section 302 of SOX does NOT require CEOs and CFOs to certify:
A. Accuracy of financial reports
B. Responsibility for disclosure controls
C. Knowledge of material weaknesses
D. Guaranteed future profitability
Answer: D
27. SOX Section 404 primarily deals with:
A. Executive compensation
B. Internal control over financial reporting
C. Foreign bribery
D. Income tax calculation
Answer: B
28. Section 404 does NOT require management to:
A. Assess internal controls
B. Report on internal control effectiveness
C. Maintain adequate internal control over financial reporting
D. Guarantee that no accounting error exists
Answer: D
29. SOX Section 302 certification is primarily made by:
A. Internal auditor and external auditor
B. CEO and CFO
C. Audit committee chairperson only
D. All accounting employees
Answer: B
30. SOX was enacted primarily in response to concerns about:
A. Corporate financial reporting and governance failures
B. Weather-related business risks
C. International trade restrictions
D. Employee productivity only
Answer: A
31. Which of the following is NOT a purpose of SOX?
A. Improving corporate governance
B. Enhancing financial reporting reliability
C. Strengthening internal controls
D. Eliminating the need for external auditors
Answer: D
32. Under SOX, management is NOT relieved from responsibility for internal control because:
A. External auditors conduct an audit
B. Internal audit performs testing
C. An audit committee exists
D. All of the above
Answer: D
SECTION 302 & SECTION 404
33. Which statement about SOX Section 302 is INCORRECT?
A. CEO and CFO certifications are required
B. Officers accept responsibility for financial reports
C. The section requires management to guarantee future results
D. Disclosure controls are relevant
Answer: C
34. SOX Section 404 focuses primarily on:
A. Internal control over financial reporting
B. Foreign political contributions
C. Personal income taxes
D. Product quality management
Answer: A
35. Which is NOT required for effective internal control assessment under Section 404?
A. Identification of relevant controls
B. Evaluation of control effectiveness
C. Documentation of significant deficiencies
D. Guarantee of zero fraud
Answer: D
36. A material weakness in internal control does NOT mean:
A. There is a reasonable possibility of material misstatement
B. Internal controls have a serious deficiency
C. Management should evaluate the issue
D. Every financial statement amount is incorrect
Answer: D
FCPA – FOREIGN CORRUPT PRACTICES ACT
37. The FCPA does NOT permit:
A. Accurate books and records
B. Adequate internal accounting controls
C. Bribery of foreign officials to obtain business
D. Compliance monitoring
Answer: C
38. The anti-bribery provisions of the FCPA primarily prohibit:
A. Accurate accounting
B. Improper payments to foreign officials for business advantage
C. Internal control testing
D. Employee training
Answer: B
39. Which of the following is NOT a major requirement associated with the FCPA?
A. Maintaining accurate books and records
B. Maintaining adequate internal accounting controls
C. Preventing improper foreign bribery
D. Guaranteeing that every foreign transaction is profitable
Answer: D
40. Under the FCPA, a company should NOT:
A. Maintain accurate records
B. Establish internal accounting controls
C. Conceal improper payments
D. Monitor foreign operations
Answer: C
41. The books and records provisions of the FCPA do NOT encourage:
A. Accurate transaction recording
B. Proper accounting records
C. Concealment of transactions
D. Reasonable internal accounting controls
Answer: C
COBIT
42. COBIT is primarily associated with governance and management of:
A. Information and technology
B. Human resource recruitment only
C. Manufacturing machinery only
D. Personal taxation
Answer: A
43. COBIT does NOT primarily focus on:
A. IT governance
B. Information management
C. Alignment of IT with business objectives
D. Preparing individual tax returns
Answer: D
44. Which of the following is NOT a primary objective of IT governance?
A. Value delivery
B. Risk management
C. Resource optimization
D. Guaranteeing that all IT projects succeed
Answer: D
45. COBIT helps an organization EXCEPT:
A. Align IT with business objectives
B. Manage IT-related risks
C. Establish IT governance frameworks
D. Eliminate all cybersecurity threats permanently
Answer: D
46. Which statement is NOT correct regarding COBIT?
A. It supports IT governance
B. It can help manage IT risks
C. It provides a framework for information and technology governance
D. It guarantees that IT systems will never fail
Answer: D
INTEGRATED INTERNAL CONTROL QUESTIONS
47. Which of the following is NOT an effective response to a significant control deficiency?
A. Investigating the root cause
B. Communicating the deficiency to appropriate parties
C. Taking corrective action
D. Ignoring the deficiency because controls cannot be perfect
Answer: D
48. An effective internal control system should NOT be designed solely to:
A. Prevent fraud
B. Support reliable reporting
C. Help achieve organizational objectives
D. Provide reasonable assurance
Answer: A
49. Which of the following is NOT an appropriate control over cash disbursements?
A. Segregating authorization and custody duties
B. Requiring supporting documentation
C. Performing independent bank reconciliations
D. Allowing one employee to authorize, record, and reconcile all payments
Answer: D
50. Which statement about internal control is INCORRECT?
A. Internal control is a process
B. Internal control provides reasonable assurance
C. Internal control is affected by people at all organizational levels
D. Internal control guarantees achievement of all organizational objectives
Answer: D
