Skip to content

ACCA Applied Knowledge · Business and Technology · Internal controls

A company has weak preventive controls over supplier master file changes, but its management is considering relying instead on a monthly exception report of changed bank details reviewed by an independent manager. Which statement about this proposal is most accurate?

The exception report is a detective control that finds unauthorised changes only after they have been made. Money may already have been paid to a fraudulent account before the review, so it cannot fully replace preventive controls.

  1. AThe report fully replaces preventive controls because any fraud will be detected so no loss can occur
  2. BThe report would detect unauthorised changes only after they have been made, so loss may already have occurred before action is takenCorrect
  3. CThe report is a corrective control because it reverses unauthorised changes automatically

Explanation

An exception report reviewed monthly is a detective control and works after the changes are made. Payments could be made to a fraudulent account in the meantime, so detection does not guarantee that loss is avoided. It does not reverse changes automatically, so it is not corrective by itself.

Did you get it right without looking?

One question tells you little. A timed set on Internal controls shows your real accuracy, how long you take and where you lose marks.

Practise Internal controlsFree diagnostic mock

More Internal controls questions