CMA P1 Internal Controls: practice questions with answers

Question 1

Pellham Logistics' board has nine directors, seven of whom have no business or family ties to management. The board meets regularly without executives present to oversee the design and operation of the company's internal control system. Under the COSO Internal Control—Integrated Framework (2013), this practice most directly supports a principle within which component?

1. A Risk assessment
2. B Control environment
3. C Control activities
4. D Monitoring activities

Show the answer

Answer: B. COSO 2013 has five components and 17 principles. The control environment (Principles 1–5) covers commitment to integrity and ethical values, board independence and oversight (Principle 2), structures and reporting lines, commitment to competence, and accountability. An independent board that oversees internal control is therefore a control environment principle, even though the board also receives the results of monitoring.

Question 2

Harlan Electrical's order-entry system assigns each customer a six-digit account number whose final digit is calculated from the first five digits using a mathematical formula. When a clerk keys account 482173 instead of the correct 428173, the system immediately rejects the entry. Which input control has detected the error?

1. A Check digit verification
2. B Limit (reasonableness) check
3. C Field (format) check
4. D Sequence check

Show the answer

Answer: A. A check digit is an extra digit derived from the other digits of a code. When the code is entered, the system recalculates the digit; if it does not match, the entry is rejected. Check digits are designed to catch transcription and transposition errors such as keying 482173 for 428173. The number still has six numeric digits, so a field check would pass it.

Question 3

Lindell Payments copies its transaction database to an off-site location every six hours, at 02:00, 08:00, 14:00 and 20:00. Its business continuity plan sets a recovery point objective (RPO) of 4 hours and a recovery time objective (RTO) of 8 hours. The primary server fails at 13:20, and the database is restored from the off-site copy and back in service 5 hours later. Which statement is correct?

1. A The RPO was not met, because 5 hours 20 minutes of transactions were lost; the RTO was met, because the system was down for 5 hours.
2. B The RPO was met, because restoration took less than 8 hours; the RTO was not met, because the 6-hour copy interval exceeds 4 hours.
3. C Both were met, because a copy is made four times a day and the system was back in service within 5 hours of the failure.
4. D Neither was met, because the 5 hours 20 minutes of lost data plus the 5 hours of restoration total 10 hours 20 minutes, over 8 hours.

Show the answer

Answer: A. - Recovery point objective (RPO): the maximum acceptable amount of data loss, measured in time back from the failure.
- Recovery time objective (RTO): the maximum acceptable time to restore the system after the failure.

Data loss: the last off-site copy before the 13:20 failure was taken at 08:00, so 13:20 − 08:00 = 5 hours 20 minutes of transactions were lost. This exceeds the 4-hour RPO.

Downtime: 5 hours, within the 8-hour RTO.

With copies only every 6 hours, the RPO cannot be met reliably; Lindell needs copies at least every 4 hours or continuous replication to a standby site.

Question 4

Sales managers at Corliss Medical Supply earn a bonus only if quarterly revenue meets an aggressive target, and several of them are struggling to meet large personal debts. As part of its COSO risk assessment, the company considers how these factors could lead to fraudulent revenue reporting. In the fraud triangle, the bonus scheme and the managers' personal debts are examples of:

1. A attitudes and rationalizations
2. B opportunities
3. C incentives and pressures
4. D inherent limitations of internal control

Show the answer

Answer: C. COSO 2013 Principle 8 (in the risk assessment component) requires the organization to consider the potential for fraud when assessing risks. Its points of focus follow the fraud triangle:

- Incentives and pressures: motives such as bonus targets, market expectations or personal financial difficulty
- Opportunities: weak controls, poor segregation of duties, ability to override controls
- Attitudes and rationalizations: the justification the person gives themselves

Corliss's bonus scheme and the managers' debts are incentives and pressures.

Question 5

Hollis Pharmacies estimates a 12% annual probability that it will suffer an undetected inventory theft loss of $500,000. An automated dispensing-cabinet control would reduce that probability to 3% and would cost $28,000 a year to operate. What is the annual net expected benefit (cost) of the control?

1. A Net benefit of $32,000
2. B Net cost of $13,000
3. C Net benefit of $17,000
4. D Net benefit of $45,000

Show the answer

Answer: C. A control is worthwhile if the reduction in expected loss exceeds its cost.

Expected loss without the control = 12% × $500,000 = $60,000

Expected loss with the control = 3% × $500,000 = $15,000

Reduction in expected loss = $60,000 − $15,000 = $45,000

Net expected benefit = $45,000 − $28,000 = $17,000

Cost-benefit judgment is one reason internal control provides reasonable rather than absolute assurance.

Question 6

Database administrators (DBAs) at Ashcott Savings Bank have full privileges on the core banking database, including the ability to change data directly and to switch off or edit the database audit log. Management wants assurance that any direct data change made by a DBA will be detected. Which control is most effective?

1. A Keep the database audit log on the database server for seven years instead of one year, so that a longer history is available.
2. B Send audit-log entries in real time to a separate, write-protected log server run by IT security, for independent review.
3. C Require DBAs to change their passwords every 30 days and to use passwords of at least 14 characters, including symbols.
4. D Have each DBA keep a manual register of the direct data changes he or she makes, which the DBA team leader then signs each month.

Show the answer

Answer: B. Privileged users such as DBAs can bypass ordinary application controls, so the key detective control is a reliable audit trail reviewed independently:

1. Integrity of the log: entries are forwarded immediately to a separate log server (often a security information and event management, or SIEM, system) that DBAs cannot access or alter, ideally on write-once storage.
2. Independent review: IT security or another function outside the DBA team reviews privileged activity, especially direct data changes, and follows up exceptions against approved change tickets.
3. Alerts when logging is switched off.

This also supports segregation of duties: the people who administer the database are not the people who monitor what is done to it.