ICAEW ACA (Associate Chartered Accountant), Next Generation syllabus · Assurance and Risk Fundamentals
ICAEW ARF Risk, internal controls and information flows: practice questions with answers
6 free exam-style questions on Risk, internal controls and information flows for ICAEW ARF Assurance and Risk Fundamentals. Try each one, then open the answer to read the explanation. Fincora has 39 original questions on this syllabus area.
Question 1
Assurance engagement risk is the risk that a practitioner gives an inappropriate conclusion when the subject matter information is materially misstated. In an audit of financial statements it is called audit risk. Which statement about the components of audit risk is correct?
- A Control risk can be reduced to nil if the auditor's tests of controls find no deviations in the sample.
- B Detection risk forms part of the risk of material misstatement, together with inherent and control risk.
- C Inherent and control risk belong to the entity; the auditor manages detection risk through its procedures.
- D Inherent risk is assessed only at the financial statement level, never for individual assertions.
Show the answer
Answer: C. Audit risk = inherent risk x control risk x detection risk (ISA (UK) 200).
- Inherent risk is how susceptible an assertion is to misstatement before considering controls.
- Control risk is the risk that the entity's controls fail to prevent, or detect and correct, a material misstatement.
- Together these form the risk of material misstatement (RoMM), which belongs to the entity and exists whether or not an audit takes place. ISA (UK) 315 (Revised July 2020) requires inherent risk and control risk to be assessed separately, at both the financial statement and assertion levels.
- Detection risk is the only component the auditor controls, by changing the nature, timing and extent of further audit procedures. It can be reduced but never removed, because audit testing is selective and evidence is persuasive rather than conclusive.
Question 2
Harrowgate Care Homes Ltd introduces a rule that every fire-safety check must be logged on the day it is done, and the log is reviewed each month by the compliance manager. Missed checks can lead to fines and enforcement action by the fire authority. Which objective of internal control does this control mainly serve?
- A Safeguarding the company's physical assets against theft
- B Producing reliable information for the financial statements
- C Making efficient use of the care staff's working time
- D Complying with the laws and regulations that apply to it
Show the answer
Answer: D. Internal control serves several objectives: safeguarding assets, reliable financial reporting, compliance with laws and regulations, efficient operations and deterring fraud and error.
This control is designed to make sure required fire-safety checks happen and are evidenced, so the company meets its legal obligations. Its main objective is therefore compliance with laws and regulations. Avoiding fines also protects the company financially, but that is a consequence of compliance rather than the control's main purpose.
Question 3
Which sequence shows the usual flow of documents in a purchases and payables process for goods bought on credit?
- A Purchase order, purchase requisition, supplier invoice, goods received note, payment
- B Purchase requisition, supplier invoice, purchase order, goods received note, payment
- C Purchase requisition, goods received note, purchase order, supplier invoice, payment
- D Purchase requisition, purchase order, goods received note, supplier invoice, payment
Show the answer
Answer: D. A typical purchases and payables process runs:
1. Purchase requisition: a department asks for goods.
2. Purchase order: an authorised order is sent to an approved supplier.
3. Goods received note (GRN): goods are checked on arrival.
4. Supplier invoice: matched to the order and GRN before it is recorded as a liability.
5. Payment: authorised and made, with the payables ledger updated.
Each document controls the next step, for example only invoices matched to an order and a GRN should be approved for payment.
Question 4
Which of the following is a general IT control rather than an information processing control?
- A An edit check in the sales application that rejects an order if the quantity field contains letters
- B A batch total of invoice values that the purchases application agrees before it posts the batch
- C A procedure requiring program changes to be tested and approved by users before release to live
- D An exception report from the payroll application listing anyone paid more than £8,000 in a month
Show the answer
Answer: C. ISA (UK) 315 (Revised July 2020) separates general IT controls (GITCs), which support the IT environment as a whole, from information processing controls, which work on the processing of information within individual applications.
- GITCs cover access security, program change, program development and acquisition, and IT operations (for example back-up and recovery).
- Information processing controls cover input (edit and validation checks), processing (control totals, sequence checks) and output (exception reports and their review).
A requirement that program changes are tested and approved before going live is a program change control, so it is a GITC. If it fails, unauthorised or faulty changes could stop any application control from working as designed.
Question 5
Halden Medical Supplies Ltd requires multi-factor authentication (MFA) for all remote logins, and it installs software security patches within 14 days of their release. Which of the following statements about these controls is correct?
- A MFA is an information processing control, because it operates inside the finance application
- B With MFA in place, phishing awareness training for staff adds no further protection
- C Patching is a detective control, because it identifies cyber attacks after they have happened
- D A weakness can still be exploited before a patch is released or while it awaits installation
Show the answer
Answer: D. Both are preventive cyber security controls, and both are general IT controls (access security and IT operations). Each has limitations:
- Patching only fixes weaknesses that the software supplier knows about and has fixed. A weakness with no patch yet (a 'zero-day' weakness) and the 14-day window before installation both leave the systems exposed.
- MFA stops a stolen password alone from being enough to log in, but staff can still be deceived, for example into approving a sign-in request they did not start or into paying a fake invoice. That is why phishing awareness training is still needed alongside it.
Layering several controls reduces cyber risk, but no combination removes it entirely.
Question 6
Hollins Bus Services Ltd pays its drivers monthly. Its payroll process includes the following features. Which of them is a control deficiency?
- A Overtime is paid only after the depot manager has signed each driver's timesheet for the month
- B Each month the payroll totals are reconciled to the payroll control account in the general ledger
- C The finance director approves the BACS payment list after agreeing its total to the payroll report
- D Depot managers send the payroll team a list of drivers who have left once a quarter, at its end
Show the answer
Answer: D. Leavers must be removed from the payroll promptly, so the notice of each leaver should reach payroll, authorised, before the next pay run. Hollins pays monthly but hears about leavers only quarterly, so a driver who leaves in the first month of a quarter could be paid for the next two months as well.
The result is overpayments that may be hard to recover. It is also an opportunity for fraud: a payroll clerk could divert the pay of a driver who has left (a 'ghost' employee) to their own account. A suitable control is a leaver form sent to payroll as soon as notice is given, plus a monthly review by depot managers of the list of employees paid at their depot. The other three features are controls: authorisation of overtime, reconciliation to the general ledger, and approval of the payment.
Keep practising Risk, internal controls and information flows
Sign up free to practise this syllabus area in full, sit timed ICAEW ARF mocks and see your score by area. Every question on Fincora is written by us; none are past exam papers.
More ICAEW ARF syllabus areas
Practice questions are for study only and are not official exam questions. Back to ICAEW ARF mock exams and practice.