AA: Internal control

Answer: C. Understanding internal controls serves the auditor's risk assessment and procedure design — option C. By understanding what controls exist, the auditor can: identify which areas are susceptible to misstatement; evaluate whether controls are adequately designed; decide whether to test controls (which may reduce substantive testing) or proceed to substantive procedures only. Option A is incorrect — redesigning controls is management's responsibility. Option B is incorrect — the auditor does not take over management's control responsibilities. Option D is incorrect — legislative compliance is not the primary reason for understanding controls in a financial statement audit.

Answer: A. ISA 315 identifies five components of internal control — option A: (1) the control environment (tone from the top, including governance and culture); (2) the entity's risk assessment process; (3) the information system and communication; (4) control activities (specific policies and procedures); and (5) monitoring of controls. Option B lists types of control activities rather than the five components. Options C and D are invented lists.

Answer: C. The control environment is the foundation of all other internal control components — option C. It encompasses: management's philosophy and operating style; integrity and ethical values; commitment to competence; the role of those charged with governance; and assignment of authority and responsibility. A weak control environment undermines all other controls regardless of how well designed they are. Option A describes individual authorisation controls (a control activity). Option B describes the information system (a separate component). Option D describes physical controls (a type of control activity).

Answer: C. Flowcharts are most appropriate for complex multi-department systems — option C. They visually represent the flow of transactions, documents and authorisations across departments, making it easy to identify controls and, crucially, where controls are absent. Narrative notes (option A) become unwieldy for complex systems and are harder to review for completeness. Questionnaires (option B) are useful for identifying whether controls exist but do not map the process flow. A simple list (option D) lacks the structural representation needed to evaluate a complex process.

Answer: C. The lack of segregation of duties is a significant deficiency — option C. Effective internal control requires that the person who initiates a transaction (raises the purchase order) should not be the same person who approves the resulting liability for payment (approves invoices). When one department does both, a corrupt or careless employee could raise fictitious purchase orders and approve fraudulent invoices for payment. Option A incorrectly values efficiency over control. Option B is a rationalisation for poor control design. Option D is incorrect — segregation of duties is a structural issue that applies regardless of monetary value.

Answer: C. This is a classic segregation of duties deficiency — option C. The credit controller who can approve credit AND write off debts has both the ability to misappropriate customer receipts and the mechanism to conceal the theft (by writing off the receivable as irrecoverable). Effective control requires that write-offs be approved by an independent manager. Option A incorrectly values expertise over independence. Option B incorrectly applies monetary materiality to a structural control issue. Option D is irrelevant — board authority does not remove the segregation problem.

Answer: C. Collusion is a classic inherent limitation of internal control — option C. Segregation of duties is a powerful control, but if two or more employees collude, they can circumvent it. Other inherent limitations include: management override; human error; controls becoming outdated; and the cost-benefit constraint. Option A is incorrect — controls are relevant at all sizes. Option B is incorrect — controls are not optional. Option D is incorrect — many effective controls are automated or procedural rather than documented.

Answer: C. The key control objectives for the sales system relate to authorisation, completeness, accuracy and safeguarding of receipts — option C. Controls should ensure: sales are made to authorised customers at authorised prices; all sales are recorded (completeness); recorded amounts are correct (accuracy); and cash received is promptly banked without being diverted. Option A (highest price) is a commercial objective. Option B (credit customers only) is not universal — many businesses have cash sales. Option D (annual reconciliation) is too infrequent for effective control.

Answer: C. Reconciling goods received to the purchase order at the point of receipt is the most effective control — option C. This three-way match (purchase order, goods received note, supplier invoice) ensures goods ordered were actually received, in the correct quantity and condition, before payment is approved. Option A (signing the delivery note) only confirms receipt — it does not verify the goods match the order. Option B (filing the order) is a documentation step, not a verification control. Option D (recording the invoice) occurs after receipt and does not confirm physical verification.

Answer: C. Segregation of duties between HR (authorising changes to the payroll master file) and payroll processing is the most effective control against ghost employees — option C. If the same person can add employees to the payroll and also process payments, they can invent fictitious employees and divert their wages. Option A (year-on-year comparison) is an analytical check that may detect unusual trends but not small, consistent frauds. Option B (payment method) does not address fictitious employees. Option D (self-service updates) actually increases risk.

Answer: C. An inventory count provides physical verification of existence and condition — option C. By counting physical inventory and comparing it to records, the company can identify: recording errors or theft (quantities differ from records); and items that are damaged, obsolete or slow-moving (may require write-down to NRV). This serves the financial reporting objectives of existence and valuation. Option A (calculating cost of sales) is achieved through accounting records. Option B relates to warehouse management efficiency. Option D relates to the purchases cycle.

Answer: C. A three-way segregation of duties over cash receipts is the most effective control — option C. Separating: (1) opening mail and listing receipts; (2) posting to ledgers; and (3) bank reconciliation ensures no single employee can misappropriate cash and conceal the theft through ledger manipulation or reconciliation falsification. Option A (management accounts) is too infrequent. Option B (cashier authorises payments) creates a self-approval risk. Option D (annual cash count) is far too infrequent.

Answer: C. A non-current asset register with physical tags and regular verification is the most effective control — option C. The register provides a record of each asset's existence and location; physical verification confirms assets are still held; unique tags deter theft and enable assets to be traced. Together these address the key assertions of existence and completeness. Option A (depreciation) is an accounting procedure, not a safeguarding control. Option B (historical cost recording) is an accounting policy choice. Option D describes an absence of control.

Answer: C. Significant deficiencies must be communicated in writing to management and those charged with governance — option C. ISA 265 requires auditors to communicate significant deficiencies in internal control to those charged with governance and to report other identified deficiencies to management. Written communication is required for significant deficiencies to ensure a formal record and allow management and governance to take appropriate remedial action. Option A is incorrect — the whole point of reporting is to enable management to address the issue. Option B does not meet ISA 265's written communication requirement. Option D is not required for internal control deficiencies.

Answer: C. An effective recommendation must describe specific actions, not just objectives — option C. The recommendation must: (1) perform credit checks on new customers before extending credit (preventive); (2) review existing limits periodically using objective data (detective/preventive). Option A ('ensure credit limits are appropriate') is phrased as an objective rather than an action — the examiner specifically warns that 'ensure that' phrasing is unlikely to score. Option B reduces business, not risk. Option D treats the symptom, not the cause.

Answer: C. Communication with those charged with governance serves multiple purposes — option C. The auditor should communicate: the planned scope and timing of the audit; significant findings including material weaknesses in internal control; auditor independence; and any matters required by ISAs (e.g. uncorrected misstatements, going concern matters). This two-way communication helps governance fulfil its oversight function and ensures the auditor has all relevant information. Option A is commercially relevant but not the professional reason. Option B overstates the requirement. Option D is incorrect — audit committee members do not draft management responses.

Answer: C. Size, complexity and geographic dispersion are the primary drivers for internal audit — option C. Large, complex organisations face greater risks and have more complex control environments. The external auditor provides annual assurance on financial statements but not continuous monitoring. An internal audit function can perform ongoing risk-based reviews that complement external audit. Option A (small, owner-managed) suggests internal audit is less necessary — the owner can directly oversee operations. Option B relates to external auditor quality, not need for internal audit. Option D (simple, stable) reduces the case for internal audit.

Answer: C. Dual reporting — functional to the audit committee, administrative to management — is best practice — option C. Functional reporting to the audit committee ensures independence: the committee approves the internal audit charter, evaluates the chief internal auditor's performance, and ensures adequate resources and scope. Administrative reporting to management handles day-to-day matters. Option A (reporting to CFO only) reduces independence since the CFO is one of the parties being audited. Option B defeats the purpose of internal audit. Option D ignores the broad scope of modern internal audit.

Answer: C. Option C correctly identifies the key distinctions. External auditors are appointed by and report to the shareholders, are independent of the organisation, and have the primary objective of expressing an opinion on the financial statements. Internal auditors are employed by, or contracted to, the organisation and report to management or the audit committee; their work is broader, covering risk management, internal controls, operational efficiency, compliance and fraud investigation. Option A is wrong because the two have different objectives and reporting lines. Option B reverses the employment relationship (it is internal auditors, not external, who work within the organisation). Option D is wrong because only external auditors give an audit opinion on the financial statements.

Answer: D. The potential lack of independence is the primary limitation of internal audit — option D. Internal auditors are employed by (or contracted to) the organisation, so their independence from management may be compromised: management controls their budget, terms of reference, and sometimes their career progression. To mitigate this, best practice requires internal audit to report functionally to the audit committee. Option A is a generalisation with no factual basis. Option C is incorrect — internal audit covers a very broad scope. Option B is incorrect — internal audit is not legally mandated in most jurisdictions.

Answer: D. A key disadvantage of outsourcing is the initial lack of company-specific knowledge — option D. An external provider brings generic expertise and fresh perspective, but in the early period they will not know the company's specific systems, risks, culture and people as well as an in-house team would. The examiner specifically noted in MJ25 that 'loss of in-house knowledge' is a genuine disadvantage. Option A is not always true. Option C is a potential advantage, not disadvantage. Option B is incorrect — outsourced providers often provide specialist skills as an advantage.

Answer: D. A VFM audit assesses the three Es: economy, efficiency and effectiveness — option D. Economy: are inputs acquired at the minimum cost consistent with required quality? Efficiency: are inputs used to achieve maximum output? Effectiveness: is the procurement function achieving its intended outcomes (right goods, right quality, right time, right price)? This is broader than mere policy compliance. Option A (salary value) is not the focus of a procurement VFM audit. Option C describes a compliance audit. Option B is one element of economy but not the entire VFM assessment.

Answer: D. Operational auditing assesses efficiency and effectiveness of business processes — option D. Unlike financial auditing (which focuses on financial statement accuracy) or compliance auditing (which checks rule adherence), operational auditing looks at whether business processes are achieving their objectives efficiently. For example, an operational audit of procurement might assess whether supplier selection, ordering and payment processes are optimal, and recommend process improvements. Option A describes external audit work. Option C — reviewing external audit papers — would have confidentiality implications. Option B describes a compliance audit of HR policies.

Answer: D. Reporting to the CFO compromises internal audit independence — option D. The CFO is a member of senior management — one of the parties whose work internal audit reviews. If internal audit reports to the CFO, the CFO has the ability to: restrict the scope of work; influence the framing of findings; delay or prevent adverse reports reaching the board; and manage the internal auditor's career and remuneration. Best practice requires the chief audit executive to have functional independence through reporting to the audit committee. Option A is incorrect — CFOs typically have the financial expertise to understand such reports. Option C is an administrative concern, not an independence concern. Option B is incorrect.

Answer: D. Service organisation considerations are addressed in ISA 402 — option D. When a client outsources significant functions, the auditor must understand the service organisation's controls to assess the risk of material misstatement. If the client does not have adequate information about the bureau's controls, the auditor can obtain an ISAE 3402 report from the bureau's own auditors. Option A is incorrect — the client remains responsible for its financial statements regardless of outsourcing. Option C — auditing the bureau directly — is not the standard approach. Option B is incorrect — outsourcing does not eliminate audit risk.