CPA Exam — AUDAssessing Risk and Developing a Planned ResponseMedium
An auditor is evaluating the control environment of a client, a manufacturing company. The auditor observes that management regularly overrides established internal controls for approving significant expenditures when faced with tight production deadlines. This observation most directly indicates a weakness in which of the following COSO components?
- ARisk Assessment.
- BMonitoring Activities.
- CInformation and Communication.
- DControl Activities.
Show answer & explanationAnswer & explanation
Correct answer: D. Control Activities.
Management regularly overriding established internal controls for approving significant expenditures directly indicates a breakdown in the effectiveness of the 'Control Activities' component, as the policies and procedures designed to mitigate risk are being circumvented.
Why the other options are wrong
- A. Risk assessment is about identifying and analyzing risks, not the execution or override of controls.
- B. Monitoring activities assess the effectiveness of controls over time. While this issue might be discovered through monitoring, the root cause of the weakness lies in the control activities being overridden.
- C. Information and communication relate to how information is shared and understood, not the direct execution or circumvention of specific control procedures.
COSO - Control Activities (Override)
Control activities are policies and procedures that help ensure management directives are carried out. Management override of these controls indicates a significant weakness in this component.
- Includes authorizations, reconciliations, segregation of duties.
- Overrides bypass the intended purpose of controls.
- Frequent overrides can suggest a weak control environment as well.
Memory trick: Override of 'CONTROLS' means 'ACTIVITIES' are failing.