CGFM Practice Questions

Definition of Internal Control (According to GAO):

Internal control is a process implemented by management to provide reasonable assurance that the

organization will achieve its objectives in:

Operations (effectiveness and efficiency).

Reporting (reliable and accurate financial and non-financial reporting).

Compliance (adherence to laws and regulations).

Explanation of Answer Choices:

A . Help an entity achieve its objectives: Correct. This is the primary purpose of internal controls.

B . Design an ERM system: Incorrect. Enterprise Risk Management (ERM) is broader than internal

control and includes risk strategy and appetite.

C . Set the tone at the top: Incorrect. While the tone at the top is part of the control environment, it

is not the full scope of internal control.

D . Develop a strategic plan: Incorrect. Internal control supports strategic plans but is not directly

involved in developing them.

Reference:

GAO, Standards for Internal Control in the Federal Government (Green Book).

COSO, Internal Control - Integrated Framework.

• Materiality in Auditing:

Materiality refers to the significance of misstatements or omissions in financial statements that could

influence the decisions of users relying on those statements.

During the planning phase of a financial audit, the auditor determines the dollar threshold for

materiality based on professional judgment, considering the size and nature of the auditee’s

operations and the needs of financial statement users.

• Why the Auditor Determines Materiality:

The auditor has the responsibility to form an independent opinion on the financial statements and

must determine materiality thresholds to design audit procedures effectively.

Materiality thresholds guide the extent of testing and ensure the audit focuses on areas most likely

to impact decision-making.

• Why Other Options Are Incorrect:

B . Auditee: The auditee provides the information, but it does not decide the materiality threshold.

C . Auditor in consultation with the auditee: The auditor may consult with the auditee for context,

but the final determination is solely the auditor's responsibility.

D . Audit committee: While the audit committee oversees the audit, it does not set materiality

thresholds.

• Reference and Documents:

GAAS (Generally Accepted Auditing Standards): States that materiality is determined by the auditor’s

judgment.

AICPA AU-C Section 320: Provides guidance on materiality in planning and performing audits.

Importance of Prior Audit Findings:

When planning a local government financial statement audit, auditors should first review previous

audit findings to identify recurring issues, control weaknesses, or non-compliance areas. This helps

auditors focus on areas of higher risk and guides the development of an effective audit strategy.

Explanation of Answer Choices:

A . Government-wide financial statements: Important, but these are reviewed after identifying risk

areas from prior findings.

B . Fund financial statements: These are part of the audit process but not the starting point for

planning.

C . Reconciliations between fund financial statements: These are analyzed during the audit but come

later in the process.

D . Previous audit findings: Correct. Reviewing past findings ensures the auditor addresses previously

identified risks and compliance issues.

Reference:

GAO, Government Auditing Standards (Yellow Book).

AICPA, Audit Planning and Risk Assessment Best Practices.

• What Is Strategic Sourcing?

Strategic sourcing is a systematic process aimed at optimizing an organization’s purchasing activities

to maximize value and minimize costs. It involves analyzing spending, selecting suppliers, and

negotiating contracts strategically rather than reactively.

• Why Start with Spend Data?

Analyzing Spend Data: The first step is to understand the organization’s current spending patterns by

analyzing spend data by category and by business unit. This helps identify high-cost areas,

redundancies, and opportunities for cost savings.

Importance of Data-Driven Decisions: Without knowing where and how money is being spent, it’s

impossible to make informed strategic sourcing decisions.

• Why Other Options Are Incorrect:

A . Contacting Vendors: Vendors are contacted later in the process after the spend analysis is

complete and sourcing strategies are determined.

C . Contacting Business Units: While checking for existing contracts is part of the process, it happens

after analyzing spend data.

D . Developing Supplier Performance Measures: This step occurs much later, typically after supplier

selection and contract execution.

• Reference and Documents:

GAO Guide to Strategic Sourcing (2013): Recommends starting with a detailed spend analysis as the

foundation for effective sourcing decisions.

Definition of Computer-Assisted Audit Techniques (CAATs):

CAATs use software tools to perform audit tasks such as data analysis, testing transactions, and

evaluating internal controls.

Obtaining accurate and relevant data is a key first step, as it forms the basis of any analysis

performed using CAATs.

Explanation of Answer Choices:

A . Writing the system audit program: This is part of audit planning but not a specific feature of

CAATs.

B . Verifying internal controls: While CAATs can be used to test controls, obtaining data is

fundamental to this process.

C . Obtaining appropriate data: Correct. CAATs rely on accurate, relevant, and complete data for

meaningful analysis.

D . Purchasing data mining software: While software is a tool for CAATs, the focus is on using data,

not on acquiring the software itself.

Reference:

Information Systems Audit and Control Association (ISACA), Guide to Computer-Assisted Audit

Techniques.

Association of Government Accountants (AGA), Data Analytics and Auditing Best Practices.

• What Is Vertical Analysis?

Vertical Analysis evaluates a single year's financial statements by expressing each line item as a

percentage of a base amount. For example, in an income statement, each expense may be presented

as a percentage of total revenue.

This approach helps users understand the relative size of each financial statement item within the

context of the total.

• Why Is Vertical Analysis Used for a Single Year?

Vertical analysis focuses solely on relationships within a single set of financial statements, making it

the appropriate choice for single-year evaluations.

• Why Other Options Are Incorrect:

A . Comparative: Involves comparing financial data across entities or periods, not within a single year.

B . Horizontal: Focuses on changes in financial data over time (year-to-year comparisons).

C . Trend: Examines patterns over multiple periods to identify long-term trends, not a single year.

• Reference and Documents:

GAO Financial Audit Manual: Recommends vertical analysis for single-year financial statement

evaluations.

AICPA Financial Statement Analysis Guide: Provides detailed examples of vertical analysis

techniques.

• Definition of a Material Weakness:

According to auditing standards, a material weakness in internal control over financial reporting is a

deficiency or combination of deficiencies that creates a reasonable possibility of a material

misstatement in the financial statements that will not be prevented or detected on a timely basis.

• Key Characteristics of a Material Weakness:

Reasonable Possibility: The likelihood of a misstatement is more than remote but less than certain.

Material Misstatement: The error or omission could impact the decisions of users relying on the

financial statements.

Timely Detection: The deficiency allows errors to go undetected for an extended period, potentially

affecting financial statement reliability.

• Why Other Options Are Incorrect:

A . A misstatement in the basic financial statements may result from a material weakness, but the

definition focuses on the reasonable possibility, not the actual result.

B . A material weakness impacts the financial statements, not "other accompanying financial

information."

C . While timely detection is part of the issue, the definition focuses on the reasonable possibility of a

misstatement, not management’s inability to perform specific duties.

• Reference and Documents:

GAAS (AICPA SAS No. 115): Provides the formal definition of material weaknesses and guidance for

auditors in evaluating control deficiencies.

COSO Framework: Emphasizes the need for effective internal controls to mitigate material

misstatement risks.

• Why Should Management Consider the Cost of Internal Controls in Relation to Benefits?

The cost-benefit principle states that the cost of implementing and maintaining internal controls

should not exceed the benefits derived from those controls. Effective internal controls help mitigate

risks, improve efficiency, and ensure compliance, but their implementation comes with costs (e.g.,

time, resources, systems).

Management must evaluate whether the benefits of preventing or detecting potential issues (e.g.,

fraud, errors) justify the associated costs.

• Why Other Options Are Incorrect:

A . The available budget: While the budget is important, internal controls are not solely dictated by

budget constraints; their effectiveness and benefit-to-cost ratio are key considerations.

B . Inherent risks: While inherent risks are a factor in determining control needs, the relationship

between cost and benefit remains the primary consideration.

D . Risk of collusion: Controls address collusion risks, but management does not prioritize collusion

specifically when assessing cost versus benefit.

• Reference and Documents:

COSO Internal Control Framework: Highlights the cost-benefit principle when implementing controls.

GAO Standards for Internal Control (Green Book): Emphasizes balancing costs with benefits when

designing internal control systems.

• Why Hire Contractors for Management Control Evaluations?

Management may decide to bring in external contractors when there are gaps in the organization’s

capacity to perform evaluations internally. One key factor is the lack of management expertise—if

management lacks the necessary knowledge or experience to evaluate controls effectively, it may

outsource this task to qualified contractors.

• Why Other Options Are Incorrect:

B . Availability of Qualified Contractors: While availability is a factor, it’s not a variable that influences

the decision to outsource. Instead, it’s a logistical consideration once the decision has been made.

C . Suspicion of Internal Fraud: Suspicion of fraud may lead to investigations, but hiring contractors to

evaluate controls is driven by expertise gaps rather than fraud concerns.

D . Knowledge of Systemic Deficiencies: If management already has knowledge of systemic

deficiencies, they may focus on remediation rather than outsourcing evaluations.

• Reference and Documents:

GAO Standards for Internal Control in the Federal Government (Green Book): Emphasizes the need

for knowledgeable personnel to evaluate controls.

GAGAS (Yellow Book): Highlights the role of external expertise in cases where internal expertise is

insufficient.

Government Auditing Standards (GAS):

GAS, often referred to as the Yellow Book, outlines the responsibilities of auditors conducting

financial statement audits for government entities.

One core requirement is that auditors must consider compliance with applicable laws, regulations,

contracts, and grant agreements that could materially affect financial statements.

Explanation of Answer Choices:

A . Design tests to assess compliance with laws, regulations, contracts, and grant agreements:

Correct. This is a required component under GAS to ensure financial statements are materially

accurate and comply with legal and regulatory frameworks.

B . Identify violations of laws which could be punishable by monetary penalties: Incorrect. Auditors

are not required to investigate or pursue penalties but to focus on material misstatements or risks.

C . Identify expenditures that exceed the related obligations: Incorrect. While this could indicate an

issue, auditors are not required to specifically test for this unless it relates to material misstatements

or compliance issues.

D . Design tests to detect fraud, waste, and abuse: Incorrect. Auditors are not specifically required to

detect fraud, waste, and abuse, though they should be alert to indicators.

Reference:

Government Accountability Office (GAO), Government Auditing Standards (Yellow Book).

Uniform Guidance (2 CFR Part 200), Audit Requirements for Federal Programs.