Skip to content

CS Professional · Internal and Forensic Audit · Internal Controls

An internal auditor of Narmada Steels Ltd documents a payroll control with several individually minor weaknesses: no review of the master file changes, shared system passwords and no independent check of overtime. Management argues each lapse is immaterial. What is the soundest approach in evaluating and reporting?

The auditor should assess the combined effect of the deficiencies and report them together with the aggregate exposure. Individually minor weaknesses can compound, for example allowing ghost employee payments, so evaluating each in isolation understates the real payroll risk.

  1. AIgnore all three as each is immaterial alone
  2. BAssess the combined effect of the deficiencies on the payroll risk and report them together with the aggregate exposureCorrect
  3. CReport only the one with the lowest cost to fix
  4. DWait for an actual fraud before reporting

Explanation

Deficiencies can compound: unauthorised master file changes, shared passwords and unchecked overtime together could allow ghost payments to pass undetected. Evaluation therefore considers their aggregate effect on risk, not each in isolation. Waiting for a loss defeats the preventive purpose of internal audit.

Did you get it right without looking?

One question tells you little. A timed set on Internal Controls shows your real accuracy, how long you take and where you lose marks.

Practise Internal ControlsFree diagnostic mock

More Internal Controls questions