22 Internal Controls & Fraud Prevention Practice Questions & Answers

1. 1. A company's owner asks the bookkeeper why the firm should invest time in a system of internal control. Which statement best describes the purposes an internal control system is designed to serve?

   • A.Safeguarding assets against loss or theft, producing reliable accounting records, and promoting compliance with laws and management's policies✓ Answer
   • B.Guaranteeing that the financial statements contain no errors of any kind
   • C.Eliminating the need for an annual audit by an outside accountant
   • D.Ensuring that the company reports the lowest possible taxable income each year

   Internal control exists to protect assets, to make the accounting records reliable, and to promote compliance with laws and with management's own policies. Because control depends on people and on a cost-benefit judgment, it gives reasonable rather than absolute assurance, so it cannot guarantee error-free statements, replace an audit, or serve as a tax-reduction device.

   Source: AIPB Certified Bookkeeper internal control subject area; COSO objectives of internal control (safeguarding of assets, reliable records, compliance)Report a problem with this question

2. 2. A controller requires a supervisor's written approval before any purchase order is issued, has an employee who handles no cash perform a surprise count of the petty cash fund each month, and has the bookkeeper prepare correcting journal entries for the errors the count turns up. How are these three measures classified?

   • A.The approval requirement is preventive, the surprise count is detective, and the correcting entries are corrective✓ Answer
   • B.All three are preventive controls because they belong to the same control system
   • C.The approval requirement is detective, the surprise count is preventive, and the correcting entries are corrective
   • D.The approval requirement and the surprise count are both corrective, and the correcting entries are preventive

   Controls are classified by when they act: a preventive control stops an error or theft before it happens (approval before the order is placed), a detective control finds a problem that has already occurred (a surprise count compared with the recorded balance), and a corrective control repairs what detection uncovered (the correcting entry and follow-up).

   Source: Internal control classification: preventive, detective and corrective controlsReport a problem with this question

3. 3. In a four-person office, one employee opens the mail and lists incoming customer checks, posts those payments to the accounts receivable subsidiary ledger, prepares the bank deposit, and reconciles the monthly bank statement. Which feature of this arrangement is the most serious internal control weakness?

   • A.One person holds custody of cash receipts, the recordkeeping for those receipts, and the independent reconciliation, so the same person who takes cash can conceal the theft in the records✓ Answer
   • B.Mail should be opened by two people so that customers receive credit for their payments faster
   • C.The employee is handling too many transactions in one day to post them accurately
   • D.Bank deposits should be prepared only on the last business day of each month

   The dangerous combination is custody of an asset together with the recordkeeping for it and the reconciliation that would otherwise detect a difference. When one person controls all three, a diverted check can be hidden by a false posting and the reconciliation that should reveal the gap is prepared by the same person.

   Source: Segregation of duties: separation of custody, recordkeeping and independent reconciliationReport a problem with this question

4. 4. Under the segregation-of-duties principle, which set of functions should be placed in different hands?

   • A.Filing source documents, photocopying source documents, and storing source documents
   • B.Preparing the trial balance, preparing the income statement, and preparing the balance sheet
   • C.Authorization of a transaction, custody of the related asset, recordkeeping for the transaction, and reconciliation of the resulting balances✓ Answer
   • D.Answering the telephone, greeting visitors, and distributing incoming mail

   The four incompatible functions are authorization, custody, recordkeeping and reconciliation. Keeping them apart means that no single employee can both take or commit an asset and adjust the records to hide it, so a theft requires collusion rather than one person's decision.

   Source: Segregation of duties: incompatible functions of authorization, custody, recordkeeping and reconciliationReport a problem with this question

5. 5. A three-person company cannot fully separate incompatible duties because it does not have enough staff. Which set of compensating controls best offsets that limitation?

   • A.The company buys accounting software so that all journal entries post automatically
   • B.The owner receives the bank statement unopened and reviews the cancelled items, signs every check while inspecting the supporting invoice, and periodically reviews the vendor list and the payroll register✓ Answer
   • C.The bookkeeper writes a signed memo each month stating that no irregularities occurred during the period
   • D.The company waits until year-end and relies on the outside tax preparer to notice any problem

   When headcount makes full segregation impossible, active owner oversight is the standard compensating control: independent receipt of the bank statement, check signing against original supporting documents, and periodic review of the vendor and payroll lists reinsert an independent person into the cycle. A self-certification, automated posting, or a once-a-year outside look supplies no independent review of the transactions as they occur.

   Source: Compensating controls in small entities: owner oversight substituting for segregation of dutiesReport a problem with this question

6. 6. A company's policy states that any check above a dollar limit set by the board requires two authorized signatures, and that no signer may ever sign a blank check. What is the control purpose of these two rules?

   • A.They satisfy a federal requirement that all business checks carry two signatures
   • B.They allow the company to delay recording the disbursement until the second signature is obtained
   • C.They shift responsibility for any resulting loss to the bank that pays the check
   • D.They force a second independent person to examine the supporting documentation before larger amounts leave the company, and they prevent the payee or amount from being filled in after approval was given✓ Answer

   An approval limit routes larger disbursements to a second authorized reviewer who must see the invoice or other support, and the ban on signing blank checks preserves the link between what was approved and what the check actually says. There is no federal rule requiring two signatures on business checks, and signature policy does not shift loss to the bank or change when the disbursement is recorded.

   Source: Cash disbursement controls: authorization limits, dual signatures and the prohibition on signing blank checksReport a problem with this question

7. 7. Why should the monthly bank statement be delivered unopened to an owner or manager who neither handles cash nor posts to the cash records?

   • A.Because a person who both handles cash and reconciles the account can suppress or alter the statement's evidence and hide a shortage, so the reconciliation must be performed by someone independent of custody and recordkeeping✓ Answer
   • B.Because opening the statement begins the period during which the bank guarantees the reported balance
   • C.Because the bank will not honor a reconciliation that was prepared by a bookkeeper
   • D.Because bank statements are confidential and may legally be opened only by a corporate officer

   The bank statement is independent, externally generated evidence of the cash balance. If it passes first through the hands of the person with custody of cash or responsibility for the cash records, that person can remove cancelled items or alter the reconciliation, so the control depends on the statement reaching an independent reviewer intact.

   Source: Cash controls: independent receipt and reconciliation of the bank statementReport a problem with this question

8. 8. A bookkeeper who covers a cash shortage by applying a later customer's payment to an earlier customer's account must keep making new entries continuously to stay ahead of the shortage. Which personnel control is most likely to expose this scheme?

   • A.Requiring the bookkeeper to take an uninterrupted vacation of at least one full period while another employee performs the duties✓ Answer
   • B.Asking the bookkeeper to prepare a written description of the collection procedures
   • C.Paying the bookkeeper a year-end bonus tied to collections on accounts receivable
   • D.Having the bookkeeper sign an annual confidentiality agreement

   Lapping only survives while the perpetrator keeps posting each new receipt to the previously robbed account. A mandatory uninterrupted vacation, with duties performed by someone else, interrupts that cycle and lets the unposted or misposted balances surface; job rotation works the same way.

   Source: Personnel controls: mandatory vacations and job rotation as detective controls over lappingReport a problem with this question

9. 9. Each month a manager charts gross margin as a percentage of sales and investigates any month whose percentage departs from the established trend. Into which of the five internal control categories that prevent theft of assets does this practice fall?

   • A.Analytical review✓ Answer
   • B.Physical safeguards
   • C.Segregation of duties
   • D.Proper documentation that is monitored

   Analytical review compares recorded results with an expected relationship or trend and investigates the variance. A falling gross-margin percentage is a classic symptom of merchandise leaving without a corresponding sale, which is why tracking the ratio over time is itself a control rather than merely a reporting exercise.

   Source: Five internal control categories that prevent theft of assets: analytical reviewReport a problem with this question

10. 10. A restaurant's kitchen will not begin preparing any dish until a prenumbered order ticket produced by the point-of-sale system reaches the cook's station, and at the end of each shift a manager compares the ticket sequence with recorded sales. Which internal control category does this arrangement illustrate?

    • A.Physical safeguards
    • B.An established system for storing and counting assets
    • C.Proper documentation that is monitored✓ Answer
    • D.Analytical review

    Requiring a document before an asset can be released is documentation control, and comparing the numbered sequence to recorded sales is the monitoring half that makes the document meaningful. Without the monitoring step the ticket is only paperwork; the control is the combination of a required document and someone who checks it.

    Source: Five internal control categories that prevent theft of assets: proper documentation monitored properlyReport a problem with this question

11. 11. A distributor's storage area has no locks on its bay doors, no badge reader, and no restriction on who may walk in, although its paperwork requirements, periodic counting procedures and separation of duties are all sound. Merchandise nevertheless disappears overnight. Which control category is missing?

    • A.Segregation of duties
    • B.Physical safeguards✓ Answer
    • C.Proper documentation that is monitored
    • D.Analytical review

    Documents, counts and separated duties govern recorded transactions, but none of them stops a person from physically walking off with goods outside the transaction cycle. Locks, restricted access, fencing, alarms and surveillance are the physical safeguard category, and it is the one absent here.

    Source: Five internal control categories that prevent theft of assets: physical safeguardsReport a problem with this question

12. 12. A clerk spoils a prenumbered company check while printing it. Why should the voided check be defaced, marked void and filed rather than thrown away?

    • A.Because the voided check must be recorded as a disbursement to keep the cash account in balance
    • B.Because the bank requires all voided checks to be physically returned with the next deposit
    • C.Because a voided check may still be reissued to a vendor if the amount is later approved
    • D.Retaining it keeps the prenumbered sequence complete, so that a number missing from the file signals a check that may have been written and concealed✓ Answer

    Prenumbered documents work as a control only if every number can be accounted for. Keeping the defaced void preserves the audit trail; destroying it would leave a gap that could equally be explained by a fraudulent check, and the void is never re-entered in the accounts because no cash moved.

    Source: Documentation and the audit trail: control over prenumbered documents and retention of voided formsReport a problem with this question

13. 13. Why should a company apply a restrictive endorsement reading "for deposit only" to incoming customer checks as soon as the mail is opened, and deposit each day's receipts intact rather than using part of the cash to pay small bills?

    • A.Federal banking rules forbid a business from holding customer checks overnight
    • B.The restrictive endorsement keeps a stolen check from being cashed or diverted, and depositing intact makes the daily deposit equal the receipts recorded that day so the two can be compared✓ Answer
    • C.Paying small bills out of receipts is acceptable as long as the bookkeeper notes the amount on the deposit slip
    • D.Endorsing checks immediately lets the company recognize the related revenue earlier than it otherwise could

    A restrictive endorsement limits the check to the company's own account the moment it is received, removing the chance to cash or negotiate it elsewhere. Depositing receipts intact preserves a one-to-one match between the day's recorded collections and the validated deposit slip, which is what makes an independent comparison possible; disbursing from receipts destroys that link, which is why small payments go through an imprest petty cash fund or a lockbox arrangement is used instead.

    Source: Cash receipts controls: restrictive endorsement and daily intact depositReport a problem with this question

14. 14. Customer A's payment never reaches A's account; when Customer B pays, that money is posted to A, and when Customer C pays, it is posted to B. Which control is most effective at detecting this pattern?

    • A.Requiring the accounts receivable clerk to prepare an aging of receivables every month
    • B.Asking customers to pay by check rather than by electronic transfer
    • C.Increasing the allowance for doubtful accounts at the end of each year
    • D.Having someone independent of cash receipts compare the detail of each day's deposit with the postings to individual customer accounts, and mailing statements to customers directly✓ Answer

    This is lapping, and it depends on the same person controlling both the incoming cash and the customer postings. Comparing deposit detail to individual account credits by an independent person breaks the concealment, and statements mailed by someone outside receivables let the customer report a payment that was never credited.

    Source: Lapping of accounts receivable; independent comparison of deposits to customer postings and direct mailing of statementsReport a problem with this question

15. 15. A company established a $500 imprest petty cash fund. At replenishment the custodian presents paid vouchers totaling $412 for postage, delivery and office supplies, and $88 of currency remains in the box. What is the correct entry to replenish the fund?

    • A.Debit the expense accounts $500 and credit Cash $500
    • B.Debit Petty Cash $412 and credit Cash $412
    • C.Debit the expense accounts $412 and credit Petty Cash $412
    • D.Debit the individual expense accounts for a total of $412 and credit Cash for $412, leaving the Petty Cash account balance unchanged✓ Answer

    Under an imprest system the Petty Cash account is debited only when the fund is first established or when its authorized size is later increased or decreased. Expenses are recognized at replenishment, and the credit is to the general Cash account for the amount needed to restore the fund to its fixed balance, which here is the $412 supported by vouchers.

    Source: Imprest petty cash fund: expenses recognized at replenishment; Petty Cash account adjusted only when fund size changesReport a problem with this question

16. 16. A $300 imprest petty cash fund contains paid vouchers totaling $268 and currency of $27 on the day it is replenished. How is the difference recorded?

    • A.Debit Petty Cash $5, debit the expense accounts $268, and credit Cash $273
    • B.Debit the expense accounts $268, debit Cash Short and Over $5, and credit Cash $273✓ Answer
    • C.Debit the expense accounts $273 and credit Cash $273, with no separate account for the difference
    • D.Debit the expense accounts $268, credit Cash Short and Over $5, and credit Cash $263

    The fund must be restored to its fixed $300 balance, so the check written is $300 minus the $27 on hand, or $273. Vouchers account for only $268 of that, so the unexplained $5 shortage is debited to Cash Short and Over; an overage would be credited to the same account, and the Petty Cash account itself is not touched.

    Source: Imprest petty cash fund: Cash Short and Over account for unexplained shortages and overagesReport a problem with this question

17. 17. The fraud triangle describes three conditions usually present when an employee commits fraud: pressure, opportunity and rationalization. Which one does an employer's system of internal control act on most directly?

    • A.Opportunity✓ Answer
    • B.Pressure
    • C.None of them; internal control acts equally on all three
    • D.Rationalization

    An employer cannot remove an employee's personal financial pressure or change the attitude that lets the person justify a theft, but it can remove the chance to take an asset and conceal the taking. Segregating duties, requiring documentation, safeguarding assets physically and reviewing results independently all attack opportunity.

    Source: Fraud triangle: pressure, opportunity and rationalization; internal control addresses opportunityReport a problem with this question

18. 18. A payroll clerk who also has authority to add names to the personnel file creates a nonexistent worker and routes the pay to an account he controls. Which combination of controls best prevents and detects this scheme?

    • A.Requiring the payroll clerk to recompute gross-to-net pay for every employee each period
    • B.Paying all employees by direct deposit so that no paper paychecks exist
    • C.Having the payroll clerk review the payroll register before it is posted to the general ledger
    • D.Requiring hiring, pay-rate changes and terminations to be authorized by human resources independently of payroll processing, having pay distributed by someone outside payroll, and periodically reconciling the payroll register to an independent headcount✓ Answer

    A ghost employee exists only because one person can both create the employee record and process the pay. Separating personnel authorization from payroll processing removes that ability, distribution by an independent person and investigation of unclaimed pay surfaces names no one recognizes, and reconciling the register to an actual headcount detects a payee who does not exist. Direct deposit alone does not help, since a ghost can be paid electronically as easily as by check.

    Source: Payroll fraud controls: ghost employees; separation of personnel authorization from payroll processing and independent distributionReport a problem with this question

19. 19. While reviewing the vendor master file, a bookkeeper notices that three vendors with different names share a single mailing address, that their invoices in the file are photocopies rather than originals, and that no purchase order or receiving report supports any of their billings. What does this pattern most likely indicate, and which control addresses it?

    • A.A fictitious-vendor scheme; the authority to add or change vendors in the master file must be separated from invoice approval and payment, and payment should require a matching purchase order and receiving report✓ Answer
    • B.A routine consolidation of vendors under a single billing agent, so no change in controls is needed
    • C.A check-kiting scheme; the company should open a second bank account to isolate the activity
    • D.An inventory obsolescence problem; the company should write the affected items down

    Multiple payees sharing one address, photocopied rather than original invoices, and billings with no purchase order or receiving report are classic indicators that an employee has set up shell vendors and is approving payments to himself. The control is to keep vendor-file maintenance away from invoice approval and payment and to require the purchase order, the receiving report and the invoice to agree before a check is issued.

    Source: Vendor fraud controls: fictitious/shell vendor red flags and separation of vendor master file maintenance from approval and paymentReport a problem with this question

20. 20. Even a well-designed internal control system provides only reasonable, not absolute, assurance. Which set of factors explains that inherent limitation?

    • A.Generally accepted accounting principles are revised from time to time
    • B.Auditors are not permitted to test the same control more than once in a year
    • C.Accounting software occasionally computes column totals incorrectly
    • D.Management can override established procedures, two or more employees can collude to defeat separated duties, and a control is adopted only when its benefit is judged to exceed its cost✓ Answer

    Segregation of duties assumes that the separated employees act independently, so collusion defeats it; controls are designed and enforced by management, so management can set them aside; and no organization installs a control that costs more than the loss it prevents. Human error and changing conditions add to the limitation, which is why control yields reasonable rather than absolute assurance.

    Source: Inherent limitations of internal control: management override, collusion, cost-benefit constraint and human errorReport a problem with this question

21. 21. An employer directs a Certified Bookkeeper to record entries that the bookkeeper knows are not in accordance with professional standards. Under the bookkeeper's code of professional conduct, what is the required course of action?

    • A.Record the entries as directed, because the employer bears legal responsibility for the company's records
    • B.Record the entries but place an unsigned memo in the file noting the bookkeeper's disagreement
    • C.Immediately report the employer to a government agency or to the press
    • D.First attempt to resolve the matter within the employer's own organizational structure, and if it cannot be resolved, resign and seek other employment, reporting the matter outside the organization only if the law requires it✓ Answer

    The code's escalation rule is internal first: raise the issue through the levels of the employer's organization. If the matter cannot be resolved there, the bookkeeper resigns and seeks employment elsewhere, and at no time reports the situation to an outside group or agency unless required to do so by law. Recording the entries anyway would breach the duty to provide high-quality professional service and to act with integrity.

    Source: Certified Bookkeeper Code of Ethics: obligations to the employer and the resolve-internally-then-resign ruleReport a problem with this question

22. 22. A bookkeeper discovers that a disbursement was posted to a customer's account in a way that appears to conceal a deposit that never reached the bank. What is the appropriate professional response?

    • A.Discuss the discovery with coworkers and with the company's customers in order to gather more information
    • B.Preserve the supporting documents and report the suspected irregularity to the appropriate level of management or to the owner, without quietly adjusting the entry and without discussing the matter with people outside the organization✓ Answer
    • C.Make a correcting entry to bring the account into agreement and say nothing until year-end
    • D.Destroy the supporting documents so that the questionable entry cannot be repeated

    A bookkeeper owes the employer accurate records, loyalty and confidentiality. Unilaterally correcting the entry destroys the evidence and effectively conceals a possible theft, discussing it with outsiders breaches confidentiality, and destroying documents obstructs any investigation. The obligation is to preserve the audit trail and escalate the matter inside the organization.

    Source: Certified Bookkeeper Code of Ethics: integrity, confidentiality and the duty to report suspected irregularities internallyReport a problem with this question

Practice questions based on the subject areas of the AIPB Certified Bookkeeper designation, US GAAP, and federal payroll practice. Tax rates, wage bases, contribution limits and withholding tables are reset annually and unemployment and wage-and-hour rules differ by state, so no such figure is used as an answer here — where a calculation needs one, the question supplies it. Confirm the rates in effect for your payroll period and your state's requirements before applying anything here to real books. AIPB and Certified Bookkeeper are marks of the American Institute of Professional Bookkeepers; this site is not affiliated with or endorsed by the AIPB. About the Certified Bookkeeper exam →