CIA Part 1, Unit 9: Controls: Application
Free study notes for Section C: Governance, Risk Management, and Control, which is 30% of the CIA Part 1 exam. Topics: Segregation of duties, Five accounting cycles, Management controls, Frameworks.
Practice 115 free questionsOpen CIA Drill
Segregation of duties
- Three functions: Authorization, recordkeeping, custody (ARC).
- Why: No one controls a transaction from start to finish.
- Weak spot: Collusion and management override.
- Small firms: Use compensating controls such as supervision.
Five accounting cycles
- Sales: Credit approves, the warehouse ships, billing invoices only goods shipped.
- Collections: Two people open mail, checks are endorsed, the bank slip is checked, lockbox helps.
- Purchases: Requisition, approved vendors, purchase order, blind receiving count.
- Disbursements: Three-way match of order, receiving report, and invoice, then cancel the documents.
- Payroll: HR authorizes, timekeeping records, payroll calculates, treasury distributes.
Management controls
- Policies and procedures: A policy guides action. Procedures carry it out.
- Personnel: Qualified staff and supervision, the best control over performance.
- Organization: Clear roles and responsibility, with follow-up on delegation.
- Budgets: Standards for inputs and outputs with prompt variance feedback.
- Reports: Timely, accurate, meaningful, and economical.
Frameworks
- COSO: A process by the board and management for reasonable assurance on operations, reporting, and compliance.
- COBIT 2019: The best-known IT governance framework.
- Purpose: Match controls to risks and goals.
Test yourself on this unit
Reading is only half of studying. CIA Drill has 115 free exam-style questions for this unit, each with an explanation, and spaced review that brings missed questions back. You can also take timed mock tests that follow the real exam weighting.