AUD · Assessing Risk and Developing a Planned Response · 6 practice questions
COSO Control Activities vs Monitoring vs Information/Communication
Control activities address risks; monitoring checks whether controls work; information and communication supplies needed information. Below, sort alternative observations about Elm Co.'s vendor bank-account change controls by purpose.
Try one first
Hint
Decide whether the described work is implementing/performing controls or evaluating and reporting on their effectiveness over time.
Answer B. Monitoring Activities includes ongoing and separate evaluations of internal control performance and the reporting of deficiencies to those charged with governance. An independent internal audit function that periodically tests controls, documents deficiencies, and reports to the audit committee is a prototypical monitoring activity.
Why not A: Tempting because candidates often conflate testing with the controls themselves, but Control Activities are the policies and procedures (e.g., approvals, reconciliations) that prevent or detect misstatements, not the separate evaluation and reporting performed by internal audit.
Why not C: Tempting because governance and oversight are mentioned, yet the Control Environment is the organization's foundation (tone at the top, integrity, board oversight) rather than the periodic evaluation and reporting of control effectiveness described here.
Why not D: Tempting because the activity involves communication of results, but Information and Communication refers to the systems and processes for capturing and sharing information needed to perform controls, not the ongoing evaluation and follow-up that constitute monitoring.
Sort it
Does it authorize changes, separate incompatible duties, or detect and correct unauthorized changes?
Does it evaluate whether controls work or follow up on identified control deficiencies?
Does it supply relevant, quality information to the people responsible for controls?
| Item | Goes to |
|---|---|
| A weekly exception-report review identifies unauthorized vendor bank-account changes and requires corrections. | Control activitiesThe review directly detects and corrects unauthorized changes rather than evaluating whether controls work. |
| The controller reviews recurring weekly exceptions to determine whether approval controls are failing and recommends fixes. | MonitoringThe controller evaluates approval-control performance rather than merely correcting individual changes. |
| The exception report omits old and new bank-account details, with no other source available to the reviewer. | Information and communicationThe supplied information cannot support the review. This is a report design problem. |
| Vendor bank-account changes require an authorized supervisor's approval before they take effect. | Control activitiesAuthorization is the control itself, not an evaluation of that control. |
| Internal audit tests whether vendor bank-account changes received required approvals and reports control deficiencies. | MonitoringInternal audit evaluates whether the approval control operates. |
| A complete exception report reaches the reviewer only after the scheduled review. | Information and communicationRelevant information arrives too late to support the scheduled control. |
| The employee who changes vendor bank details also approves those changes, without independent review. | Control activitiesIncompatible duties are not separated. The weakness is in the control's design. |
| Management does not evaluate whether vendor-change approval controls remain effective after system implementation. | MonitoringThe missing step is evaluation of continuing control effectiveness. |
| The system routes vendor bank-account change exceptions to the employee responsible for reviewing them. | Information and communicationRouting delivers relevant information to the person who must act on it. |
| The system lets unauthorized employees approve bank-account changes despite the communicated approval policy. | Control activitiesActual permissions do not enforce the policy. Communicating the policy does not implement the approval control. |
| Management tracks identified vendor-change approval-control deficiencies until corrective actions are complete. | MonitoringFollow-up addresses identified failures in controls. |
| Management sends the revised vendor-change approval policy to employees who process those changes. | Information and communicationSending the policy communicates control responsibilities. It does not itself approve changes. |
Key points
- Remember: Ask whether the action performs a control, evaluates that control, or supplies information for that control.
- Weekly work can be monitoring when it evaluates whether approval controls function.
- A communicated approval policy does not fix a system that permits unauthorized approvals.
How the exam traps you
- Calling every recurring review monitoring. Ask whether Elm is detecting unauthorized changes or evaluating whether its approval controls work.
- Calling missing report fields a failure to perform the review. When needed details have no other source, classify the report design weakness as information and communication.
- Treating a communicated policy as an effective approval control. Inspect the system's actual permissions; unauthorized approval access is a control activities weakness.
Question 2
Hint
Focus on which COSO component is failing: the issue is not detecting damaged goods, but getting that information to the right people in time.
Answer B. This is primarily an information and communication deficiency under COSO: warehouse staff identify damaged or obsolete items but do not communicate that information to accounting in time. Requiring timely exception reports establishes a formal channel to deliver operational information so accounting can record write-downs promptly. Other choices address different components or detect problems after the fact rather than fixing the communications breakdown.
Why not A: Segregation of duties relates to control activities and can reduce misappropriation risk, but the fact pattern indicates safeguards and approval controls already exist. The core problem is missing timely communication, not who records adjustments.
Why not C: Internal audit monitoring might detect delayed write-downs after the fact, but it doesn't create a process to communicate issues in real time. Monitoring detects problems; the immediate need is to establish timely reporting so accounting can act when items are identified.
Why not D: A stronger tone at the top affects the control environment and expectations, but employees are already identifying damaged inventory. The weakness is the lack of a reporting mechanism, not unethical behavior, so updating the code of conduct is not the most direct fix.
Question 3
Hint
Ask whether the procedure is a specific control being performed or an evaluation of whether controls in general are working.
Answer B. The monthly budget-to-actual comparison with investigation of significant variances is a specific procedure performed to prevent or detect errors and ensure transactions are properly recorded. Under COSO, such procedures are classified as control activities. Monitoring, by contrast, is the process of evaluating whether the system of controls is operating effectively over time.
Why not A: This is tempting because the review is performed regularly, but monitoring refers to evaluations (ongoing or separate) of whether controls are functioning effectively. The monthly variance review described is the underlying control procedure itself, not an evaluation of the control system.
Why not C: Variance analysis can highlight areas of risk, yet risk assessment is the process of identifying and analyzing risks to achieving objectives. Performing the review to detect and respond to discrepancies is an operating control activity rather than the risk-assessment process.
Why not D: Information and communication relates to systems that produce and share the information needed for controls. Although the review uses financial reports and documentation, the primary nature of the procedure is performing a control (a review), not the broader information/communication component.
Question 4
Hint
Focus on which COSO response most directly addresses the specific risk created by one employee performing incompatible duties.
Answer B. Separating vendor setup from payment approval eliminates the incompatible duties that allow a single employee to create a fictitious vendor and pay it, directly reducing the risk of unauthorized payments. An independent review of vendor master changes provides a detective control to catch improper vendor additions. Together these are transaction-level control activities under COSO and therefore the most effective corrective action for the identified weakness.
Why not A: An annual code-of-conduct signing supports the control environment by promoting ethics, but it does not prevent or detect the specific operational risk of one person creating and paying a fictitious vendor. This is a high-level measure rather than a transaction-level segregation of duties control.
Why not C: Monthly budget-to-actual comparisons are useful monitoring procedures but are indirect and not timely enough to prevent or promptly detect a single employee creating and paying a fake vendor. They are detective/monitoring controls rather than immediate preventive controls at the transaction level.
Why not D: Quarterly internal audit reporting supports governance and monitoring but is oversight-level and infrequent; it would not prevent or promptly detect the accounts payable supervisor executing incompatible duties. This is not the most effective immediate control to address the identified transaction risk.
Question 5
Hint
Focus on whether the facts describe designing/perfoming a control, identifying risks, communicating information, or evaluating whether controls continue to work.
Answer B. Monitoring activities are ongoing or separate evaluations to determine whether controls are present and functioning effectively. The controller's review of exception reports, investigation of recurring errors, and recommendations for corrective action are actions that evaluate control performance and address failures, which illustrate monitoring.
Why not A: Control activities are the policies and procedures that execute control objectives (for example, reconciliations or authorizations). The controller's actions here are evaluating and correcting controls rather than performing those routine control procedures themselves.
Why not C: Risk assessment is about identifying and analyzing risks to achieving objectives. While recurring errors may signal risks, the controller's described actions focus on testing and fixing controls after implementation, which is monitoring rather than risk identification.
Why not D: Information and communication concern the systems and processes that support the capture and exchange of information (for example, producing exception reports). Although reports are used, the key activity is evaluating control effectiveness and initiating corrective action, which is monitoring.
Question 6
Hint
Separate the step of identifying and analyzing a risk from the step of designing and implementing the control response to that risk.
Answer A. Control activities address how management responds to identified risks through policies, procedures, and system configurations such as authorization controls. Here, management appears to have identified and analyzed the risk, communicated the revised approval matrix, and established monitoring through exception reports. The breakdown is that the actual authorization control was not implemented in line with approved policy, making control activities the best classification.
Why not B: This is tempting because the facts involve a new platform, changed incentives, and fraud risk from a significant change. But the stem says management documented objectives, identified the override risk, considered fraud incentives, and evaluated the changed risk profile. That means the risk assessment process occurred; the failure was in translating that assessment into an effective control.
Why not C: This distractor targets the common assumption that any implementation failure must be a communication problem. However, the stem expressly states that the revised approval matrix was formally communicated to sales operations and IT before go-live. The issue is not that the policy was unknown, but that the system authorization settings were not aligned with it.
Why not D: This is plausible because detective reviews do not stop bad transactions before they occur, and candidates often focus on that weakness. Still, the existence of weekly exception review and follow-up indicates monitoring is present. The more direct deficiency is the missing preventive authorization control within the system, which belongs to control activities.
Common questions
What is the difference between COSO control activities and monitoring?
A review that detects and corrects unauthorized vendor bank-account changes is a control activity. A review that evaluates whether approval controls work is monitoring.
Which COSO component covers missing information in an exception report?
Information and communication. Elm's report omits needed bank details and offers no alternative source, so its design does not support the review.
Does a weekly control review count as COSO monitoring?
Frequency does not decide the classification. Elm's weekly review is monitoring when its purpose is to identify failing approval controls, not simply to detect unauthorized changes.
Practice AUD like the real exam
The free ChatCPA simulator: real exam layout, timed testlets, starting with a question on this topic. No account needed to start.
Open the free simulator →More on COSO
Questions from the ChatCPA bank of 17,658 CPA exam questions, each with a written reason for every wrong answer. ChatCPA is built by Nicholas Miller, CPA (Oregon #14907). How these pages are made. Spot an error? Tell us.