AUD · Assessing Risk and Developing a Planned Response · 7 practice questions
COSO Control Environment: Tone at the Top and Board Oversight
Leadership behavior and independent board oversight define the COSO control environment, even when written controls exist. Below, sort alternative observations at Orion into control environment strengths, control environment weaknesses, control activities, or monitoring.
Try one first
Hint
Ask which COSO component sets the organization's 'tone at the top' and establishes integrity, governance, and HR practices.
Answer A. These practices primarily reflect the control environment, which is the foundation of internal control and encompasses the organization's ethical values, commitment to competence, and oversight by the board and management. A formal code of conduct, ethics training, and incorporating ethics into hiring and evaluation establish the tone at the top and personnel policies that define the control environment.
Why not B: This may seem plausible because the board oversees compliance, but monitoring activities are processes to assess whether controls are operating effectively (for example, internal audit or ongoing control assessments), not the establishment of ethical tone and HR policies.
Why not C: Ethics programs can reduce risk, but risk assessment specifically involves identifying and analyzing risks to achieving objectives. The described practices set organizational tone and values rather than performing risk identification or analysis.
Why not D: The code being communicated and training provided relate to information flows, but the core purpose described is to establish ethical standards and governance. Information and communication focuses on systems for capturing and sharing information relevant to control, not on setting the tone and HR policies.
Sort it
Does the observation support ethical values, independent board oversight, competence, or accountability?
Does leadership behavior or missing independent oversight undermine ethics, governance, or accountability?
Is this a specific procedure that prevents or detects transaction errors?
Does this evaluate whether existing controls work or whether identified deficiencies were corrected?
| Item | Goes to |
|---|---|
| Orion's independent audit committee challenges management's assumptions in significant accounting estimates. | Control environment strengthIndependent challenge of management demonstrates board oversight. |
| Orion requires controller approval before a purchase is processed. | Control activityThis authorizes a transaction; it does not establish leadership's ethical tone. |
| Orion's CEO routinely orders staff to bypass written approvals to meet targets. | Control environment weaknessLeadership deliberately undermines the procedures it claims to support. |
| Orion's internal audit team periodically tests whether purchase approvals operated. | MonitoringTesting existing controls evaluates their operation rather than establishing ethical expectations. |
| Orion considers integrity in hiring decisions and performance evaluations. | Control environment strengthPersonnel decisions reinforce ethical values and accountability. |
| Orion's CFO removes significant internal audit findings before reports reach the board. | Control environment weaknessManagement filtering undermines independent oversight, not merely the transmission of information. |
| Orion's controller reconciles the bank account each month. | Control activityA reconciliation detects account differences; it does not establish ethical leadership. |
| Orion requires accounting hires to have the skills needed for their assigned responsibilities. | Control environment strengthHiring qualified personnel demonstrates commitment to competence. |
| Orion has no independent board oversight, despite effective automated purchase matching. | Control environment weaknessAn effective transaction control cannot replace independent governance. |
| Orion's internal audit team checks whether previously reported control deficiencies were corrected. | MonitoringFollowing up on deficiencies evaluates whether corrective action restored effective controls. |
| Orion's CEO lowers the controller's performance evaluation for objecting to an unsupported entry. | Control environment weaknessPunishing ethical objections undermines integrity and accountability at the top. |
| Orion communicates its board-approved code of conduct through annual ethics training. | Control environment strengthThe code and training establish ethical expectations, but do not prove leaders follow them. |
Key points
- Remember: Judge leadership behavior and independent oversight, not the number of written procedures.
- Classify the cause of a breakdown, not just the procedure being bypassed.
- Positive ethics policies do not cancel evidence of management override.
How the exam traps you
- Picking control activities because the CEO bypasses an approval. Classify the cause: deliberate leadership pressure points to the control environment.
- Calling all board oversight monitoring. Independent challenge of management is control environment; testing whether approvals work is monitoring.
- Treating automated purchase matching as a cure for absent independent oversight. Transaction controls cannot replace independent governance.
Question 2
Hint
Focus on whether the problem is mainly about the existence of procedures, the review of procedures, or the attitude and oversight of leadership.
Answer D. The primary issue is the control environment because the facts point to tone at the top, weak board oversight, and management's willingness to override controls. COSO treats integrity, ethical values, and governance oversight as foundational elements of the control environment. Even though approval procedures exist, they are undermined when leadership does not support them.
Why not A: Monitoring might seem relevant because exception reports are generated monthly. Nevertheless, the stronger signal in the fact pattern is weak governance and management override. Monitoring concerns whether controls are evaluated over time, whereas these facts point to tone at the top and ethical values.
Why not B: This is tempting because candidates may associate poor decisions by management with weak risk management. However, the stem explicitly asks you to assume there is no separate issue about identifying business risks. The core problem described is leadership attitude and oversight, not the process for identifying or assessing risks.
Why not C: This distractor is plausible because specific approval rules are being overridden, which sounds like a failure of control activities. But the scenario states that approval procedures are documented and known; the deeper issue is that management regularly overrides them, reflecting a deficient control environment rather than the absence of control activities.
Question 3
Hint
Ask which COSO element sets the tone and governance that affect the reliability of all other components (i.e., the foundation of the system).
Answer A. The control environment is the foundational COSO component that sets the tone at the top and influences the effectiveness of all other components. Pervasive weaknesses, management override of controls, weak governance, and compromised independence of oversight functions, can undermine otherwise well-designed control activities. Therefore, the control environment is the primary governing factor when deciding whether to rely on controls and reduce substantive procedures.
Why not B: Tempting because control activities directly address revenue recognition and appear well designed. Wrong because control activities depend on a supportive control environment; evidence of management override or weak governance reduces their reliability for cutting substantive testing.
Why not C: Tempting because monitoring (internal audit and audit committee oversight) evaluates whether controls operate effectively, and the stem shows monitoring weaknesses. Wrong because monitoring itself is shaped by the control environment; weak tone at the top is the more fundamental issue for reliance decisions.
Why not D: Tempting because a poor risk assessment could lead to misaligned controls. Wrong because risk assessment helps identify and design controls but does not replace the control environment as the foundational determinant of whether controls can be trusted to reduce substantive procedures.
Question 4
Hint
Ask which fact is most pervasive and most capable of causing other controls to fail, even when those controls appear properly designed.
Answer C. Under COSO, the control environment sets the tone at the top and includes integrity and ethical values. A CEO's instruction to defer a potentially material accrual to avoid covenant violations, together with the controller's fear of challenging the CEO, indicates a pervasive tone-at-the-top problem and a risk of management override. That pervasive ethical weakness can undermine otherwise well-designed control activities, making the control environment the best-supported conclusion.
Why not A: This is tempting because management's failure to analyze the new subscription product is a real risk assessment lapse. However, the CEO's directive to manipulate reporting and the controller's compliance out of fear point to a broader tone-at-the-top and override problem that is more pervasive than a single risk-assessment omission.
Why not B: This distractor appeals because the controller's comment suggests employees feel unable to challenge senior management. But an anonymous hotline exists and summaries reach the audit committee, so the channels are present; the deeper problem is that senior management's behavior discourages their effective use, which is a control environment issue.
Why not D: Candidates may focus on monitoring cadence and view monthly reporting as inadequate. The facts, however, do not show monitoring failure as the root cause; the overriding ethical misconduct and risk of management override represent the more fundamental COSO concern.
Question 5
Hint
Which COSO component explicitly includes board/audit committee oversight and 'tone at the top'?
Answer C. The audit committee's oversight, challenge to management, and enforcement of corrective action reflect board governance and the organization's 'tone at the top,' which are core elements of the control environment. COSO explicitly includes board oversight, ethical tone, and assignment of authority and responsibility within the control environment. While the activity touches on communication and oversight, its primary COSO placement is the control environment.
Why not A: Information and communication relates to the systems and processes for capturing and conveying relevant information across the entity. The committee's communication of concerns is an action, but the underlying activity emphasizing board oversight and tone fits the control environment more directly.
Why not B: Monitoring involves ongoing or separate evaluations of how well controls operate over time. Although the audit committee oversees management, the committee's governance role and influence on tone and accountability are classified under the control environment rather than routine monitoring.
Why not D: Risk assessment is the entity's process for identifying and analyzing risks to achieving objectives. Reviewing significant estimates may involve considerations of risk, but the audit committee's oversight role that establishes governance and accountability is characteristic of the control environment, not the internal risk-assessment process.
Question 6
Hint
Focus on which COSO component deals with tone at the top, integrity, and how management's behavior influences the effectiveness of all other controls.
Answer C. The control environment is the foundation of internal control and includes tone at the top, integrity, ethical values, and management's operating style. The CFO's direction to record unsupported top-side entries and the employees' fear of speaking up indicate management override and a poor tone at the top, which directly weakens the control environment even if formal procedures exist.
Why not A: This distractor appeals because employees are reluctant to speak up, which involves communication, but the core problem is management integrity and tone at the top rather than a failure in the information flow itself.
Why not B: This is tempting because specific procedures (approvals, reconciliations) are being bypassed, but the root cause described is management override and pressure from senior management. Control activities may be affected, but the primary weakness is in the control environment.
Why not D: This is plausible if you focus on why the unsupported entries weren't caught, but the facts mainly describe management-driven override and pressure. That points most directly to a weakened control environment rather than a standalone monitoring failure.
Question 7
Hint
Focus on which COSO component sets the tone for whether employees and management will actually follow established controls.
Answer A. The control environment is the foundation of internal control, reflecting tone at the top, integrity, and oversight. Management pressure to "make the numbers," a passive board, and routine exceptions for executives indicate a weak control environment that can undermine the effectiveness of formally designed controls.
Why not B: This is tempting because risk assessment is part of COSO and auditors perform risk assessment during planning, but the facts emphasize management attitude and oversight rather than how the entity identifies and analyzes risks; those facts point to the control environment.
Why not C: Control activities (reconciliations, approvals, access restrictions) are present here, but frequent overrides and managerial pressure suggest the deeper problem is a weak control environment that may prevent those activities from operating effectively.
Why not D: Ineffective follow-up on exceptions could indicate weak monitoring, but the central issues described, tone at the top, board passivity, and executive overrides, are foundational control environment concerns and are the primary governance for overall control effectiveness.
Common questions
What is tone at the top in COSO?
It is the ethical standard set by leadership's behavior. A CEO who orders employees to bypass approvals weakens the control environment, even when approvals are documented.
Is audit committee oversight control environment or monitoring?
Independent board challenge of management reflects the control environment. Internal audit testing of purchase approvals is monitoring because it evaluates whether controls operate.
Can strong transaction controls offset a weak control environment?
They cannot cure a pervasive governance failure. Automated purchase matching cannot replace independent board oversight, and written approvals cannot cure leadership pressure to bypass them.
Practice AUD like the real exam
The free ChatCPA simulator: real exam layout, timed testlets, starting with a question on this topic. No account needed to start.
Open the free simulator →Questions from the ChatCPA bank of 17,658 CPA exam questions, each with a written reason for every wrong answer. ChatCPA is built by Nicholas Miller, CPA (Oregon #14907). How these pages are made. Spot an error? Tell us.