Group 4: Risk Assessment & Internal Control

Correct answer B: Inherent susceptibility can concern misstatement material individually or when aggregated, before related controls.

The component definition includes individual or aggregate materiality. Related controls are excluded when considering inherent susceptibility.

Correct answer C: Assertion level for disclosures.

Assertion-level assessment covers transactions, balances and disclosures and informs further procedures. Not every disclosure concern is pervasive.

Correct answer A: Obtain stronger appropriate audit evidence through responses that lower detection risk.

Responses manage detection risk in relation to assessed material-misstatement risks; auditor effort does not directly rewrite client inherent/control risk.

Correct answer B: Investigate the unusual relationships as possible risk indicators, not established misstatement amounts.

Analytics can identify unusual relationships relevant to risk. Explanations need evaluation and further evidence; the trend alone is not a quantified finding.

Correct answer A: Relevant personnel beyond management can provide useful perspectives on risks and changes.

Inquiries include management and others with useful information. Role-specific perspectives can reveal processing or product-related reporting risks.

Correct answer A: Other external factors, including general economic conditions, interest rates and financing availability.

The module includes general economic conditions, interest rates and financing availability among external factors affecting the entity.

Correct answer C: Investment activities and entity structure, to understand expected transactions, balances and disclosures.

Nature-of-entity understanding includes investment types, structure, operations and financing; complexity may introduce reporting issues.

Correct answer B: Business-risk understanding helps identify possible reporting consequences but does not guarantee discovery of all business risks.

Business risks can have financial consequences; the auditor understands relevant risks without taking responsibility for every commercial risk.

Correct answer C: Use updated entity understanding to develop appropriate expectations and evaluate the evidence.

The continuous understanding supplies a frame of reference for analytical expectations and sufficiency/appropriateness evaluation throughout the audit.

Correct answer D: The entity's governance, management and personnel design, implement and maintain controls; audit evaluation does not transfer that role.

The definition places design, implementation and maintenance with entity governance, management and other personnel, not the external auditor.

Correct answer B: Human error and misunderstanding can cause control breakdown despite a designed control.

Human judgement/error are inherent limitations. Distinguish the cause actually supplied from collusion or override not established by the case.

Correct answer D: No; it provides a foundation and affects other controls, but is not itself every specific prevention/detection control.

A satisfactory environment can be a positive foundation, not an absolute deterrent or substitute for all specific controls.

Correct answer D: Assignment of authority and responsibility, including reporting relationships and authorisation hierarchy.

Assignment of authority/responsibility is an environment element. The issue is not merely whether a specific payment was arithmetically accurate.

Correct answer C: Assessing likelihood of occurrence.

Entity risk assessment separates identification, significance, likelihood and decisions on actions. Impact evaluation does not automatically assess likelihood.

Correct answer B: An information system includes people, procedures and data as well as infrastructure and software.

System understanding extends beyond machines/software to people, procedures and data, whose quality affects reliable reporting.

Correct answer D: Segregation of duties between authorisation, recording and custody.

Separating authorisation, recording and custody is a control activity. Evaluate actual incompatible duties rather than assume a loss.

Correct answer C: Monitoring of controls with remedial action for changed conditions.

Monitoring considers intended performance, effectiveness over time and appropriate modification/correction, including external communications.

Correct answer D: Accuracy of prices and completeness/accuracy of volume data, including relevant information controls.

Controls over entity information may be relevant if that information is used for further procedures. Operational/compliance controls can have a reporting-evidence link.

Correct answer D: The additional statutory requirement may broaden the review beyond ordinary financial-reporting relevance.

Operational-only controls ordinarily may be irrelevant to financial-statement risk assessment, but statutes/regulations can require broader, more detailed review.

Correct answer D: Whether the control design is capable of addressing the relevant quantity misstatement risk.

Design capability is considered before implementation. Performing a control incapable of addressing the relevant risk does not cure its design deficiency.

Correct answer A: The character, scope and relevant procedures of the control system laid down, followed by actual evaluation.

Initial study establishes the system and prescribed controls. Actual use/operation needs evidence; manuals and charts alone are not full-period proof.

Correct answer B: Incorporating changes and comprehending or spotting gaps can be difficult in narrative records.

The module identifies these practical disadvantages of narrative records; they call for accurate updates, not prohibition or blind reuse.

Correct answer A: Not Applicable, with the relevance basis clarified where needed.

Irrelevant questions receive Not Applicable. A forced Yes/No would confuse irrelevance with satisfactory/deficient operation.

Correct answer C: Is follow-up action taken to investigate differences between supplier statements and ledger accounts?

Creditor-control questionnaires separately address comparison and follow-up. The latter is absent on these facts and requires investigation, not an invented amount.

Correct answer C: Is written approval obtained from a responsible official for adjustments to stock and financial records?

The inventory questionnaire considers investigation, adjustments in records/accounts and approval. Count completion alone does not establish authorised correction.

Correct answer D: Its graphic format may be useful, but omitted actual pathways limit the completeness of the recorded system.

A flow chart presents actual system links/flow concisely. The form does not cure missing routes or supply full operation evidence.

Correct answer C: Use the relevant evidence appropriately and obtain additional evidence needed for the intended assessment.

Understanding procedures can serve a control-testing purpose when evidence is sufficient. Neither their original label nor one success settles sufficiency.

Correct answer A: Investigate causes and timing, cover the affected period and evaluate all relevant control evidence.

Deviations require specific inquiries and appropriate coverage. Evaluate support for the assessment, including other evidence, without all-or-nothing shortcuts.

Correct answer B: Consider whether the assessment remains supported and revise it and planned substantive work if required.

Before conclusion, substantive and other evidence can confirm or challenge assessment. Unsupported assumptions need revision and appropriate procedure changes.

Correct answer A: Tailor appropriate procedures and coverage to the actual system rather than apply uniformly heavy checking everywhere.

Understanding/evaluation shapes programme nature/extent and highlights weak/excessive controls. It is not an automatic exemption or universal guarantee.