Governance, Ethics, Assurance and Compliance

Introduction

International organizations operate across legal systems, cultures, capital markets and institutional environments. Their governance arrangements must therefore do more than satisfy a single national company law. They must allocate authority responsibly, protect investors and other stakeholders, produce reliable financial information, manage risk, prevent misconduct and demonstrate compliance across borders.

Governance failures are rarely caused by one isolated mistake. They commonly arise from a combination of weak board oversight, excessive managerial power, poor internal controls, inadequate challenge, conflicts of interest, cultural pressure to meet targets and ineffective regulatory monitoring. The consequences may include financial loss, litigation, sanctions, reputational damage and loss of public trust.

This chapter examines international governance models, board accountability, internal control, audit and assurance, fraud, anti-money-laundering requirements, professional ethics, whistleblowing and regulatory compliance. The emphasis is strategic: accounting and finance professionals are not merely recorders of transactions. They are participants in systems that determine whether organizations act lawfully, transparently and in the long-term interests of stakeholders.

Learning objectives

By the end of this chapter, students should be able to:

1. Compare major international corporate governance models and explain their institutional foundations.
2. Evaluate the accountability of boards, directors, senior executives and audit committees.
3. Explain the purpose and limitations of internal control frameworks.
4. Distinguish audit, review, other assurance and non-assurance engagements.
5. Analyze fraud risks and describe appropriate anti-fraud responses.
6. Explain the risk-based logic of anti-money-laundering and counter-terrorist-financing controls.
7. Apply professional ethical principles to international accounting and finance decisions.
8. Assess whistleblowing systems and regulatory compliance programs.
9. Integrate governance, assurance and compliance considerations in a multinational case.

1. The meaning and purpose of governance

Corporate governance is the system by which organizations are directed, controlled and held accountable. It includes structures, processes, rights, responsibilities, controls and relationships among shareholders, the board, management, employees, auditors, regulators and other stakeholders.

Governance addresses several central questions:

• Who has authority to make decisions?
• To whom are decision-makers accountable?
• How are conflicts of interest identified and managed?
• How are risks recognized, measured and controlled?
• How is reliable information communicated to users?
• What remedies exist when duties are breached?

Governance is distinct from management, although the two are connected. The board governs by setting direction, overseeing management and monitoring performance. Management executes strategy and operates the organization. In practice, the boundary varies by organization, but a board should not become so involved in routine operations that it loses its monitoring role or independence.

Agency theory and stakeholder theory

Agency theory focuses on the relationship between principals, such as shareholders, and agents, such as directors and executives. Because agents may possess more information and may have different interests, governance mechanisms are needed to reduce information asymmetry, opportunism and agency costs. Independent directors, executive remuneration controls, disclosure, audit and shareholder voting are examples of such mechanisms.

Stakeholder theory takes a broader view. It argues that organizations affect and depend on employees, customers, suppliers, creditors, communities, governments and the environment as well as shareholders. A governance system based only on short-term shareholder returns may overlook social, environmental and systemic risks. International organizations increasingly use stakeholder-oriented approaches in sustainability reporting, human-rights due diligence and responsible supply-chain management.

Neither theory alone completely explains governance. Shareholders provide capital and require accountability, but corporate decisions can impose material costs on other groups. Effective governance therefore combines financial accountability with lawful, ethical and sustainable conduct.

2. International governance models

Governance practices reflect ownership structures, legal traditions, securities regulation, labor institutions and cultural expectations. No model is universally superior; each presents characteristic strengths and risks.

A one-tier board combines executive and non-executive directors in a single board. A two-tier structure separates a management board, responsible for operations, from a supervisory board, responsible for oversight. In either structure, the quality of challenge, information and accountability matters more than the formal label.

Convergence and divergence

International standards have encouraged convergence in areas such as independent audit committees, director responsibilities, internal control reporting, beneficial ownership transparency and anti-bribery controls. Nevertheless, divergence remains because countries differ in company law, enforcement capacity, ownership patterns and social expectations. A multinational organization must therefore establish a global minimum standard while adapting procedures to local legal requirements.

The global minimum should never be interpreted as permission to ignore stricter local law. If a host country requires more protective controls than group policy, the stricter requirement should normally apply. Where local law conflicts with group policy, the issue should be escalated to legal and compliance functions rather than resolved informally by local managers.

3. Board accountability and oversight

The board is collectively responsible for the organization’s direction, oversight and accountability. Specific duties vary by jurisdiction, but commonly include:

• approving strategy, budgets and major transactions;
• overseeing risk appetite and risk management;
• ensuring the integrity of financial reporting;
• appointing, evaluating and, where necessary, removing senior executives;
• overseeing internal and external audit;
• monitoring legal, regulatory and ethical compliance;
• protecting organizational assets and confidential information;
• considering material effects on stakeholders; and
• communicating transparently with investors and other users.

Directors owe duties that may include care, skill, diligence, loyalty, good faith and avoidance of unauthorized conflicts. A director cannot avoid responsibility merely by claiming not to have read a report. Board members should receive information that is timely, relevant, sufficiently detailed and independently sourced.

Board composition and effectiveness

Board effectiveness depends on competence, independence, diversity of experience, time commitment and willingness to challenge management. Independence is not simply a formal status. A director may be legally independent but psychologically or economically dependent on a dominant executive or controlling shareholder.

Important board committees commonly include:

• Audit committee: financial reporting, internal control, internal audit and the external auditor.
• Risk committee: material financial and non-financial risks, risk appetite and resilience.
• Remuneration committee: executive pay, incentives and alignment with sustainable performance.
• Nomination or governance committee: board composition, succession and evaluation.
• Ethics or compliance committee: conduct, investigations and regulatory issues, where appropriate.

The audit committee should meet privately with the chief audit executive and external auditor, without management present, when necessary. It should understand significant accounting judgments, estimates, control deficiencies, audit findings and management’s response.

Accountability mechanisms

Accountability is strengthened by:

1. clear delegation of authority;
2. documented board and committee terms of reference;
3. performance evaluation of the board and individual directors;
4. transparent remuneration linked to balanced performance measures;
5. declarations and management of conflicts of interest;
6. accurate minutes showing challenge and decisions;
7. protected reporting channels; and
8. consequences for misconduct regardless of seniority.

A common governance failure is “paper compliance”: policies exist, but directors do not test whether they operate in practice. Effective boards ask how a control works, who owns it, what evidence exists and what happened when it failed.

4. Internal control and risk management

Internal control is a process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable—not absolute—assurance regarding achievement of objectives. These objectives commonly concern operations, reporting and compliance.

The widely used COSO framework describes five interconnected components:

1. Control environment: integrity, ethical values, competence, accountability and organizational structure.
2. Risk assessment: identifying and analyzing risks to objectives, including fraud and change-related risks.
3. Control activities: approvals, authorizations, reconciliations, segregation of duties, access controls and performance reviews.
4. Information and communication: obtaining and communicating reliable information internally and externally.
5. Monitoring activities: ongoing and separate evaluations, including remediation of deficiencies.

Internal control should be risk-based. A control is valuable when it reduces a relevant risk at acceptable cost without creating greater operational or compliance risk.

Preventive and detective controls

Preventive controls seek to stop an error or misconduct before it occurs. Examples include approval limits, segregation of duties, supplier due diligence and system access restrictions. Detective controls identify events after they occur. Examples include bank reconciliations, exception reports, inventory counts and internal audit reviews. Corrective controls address the underlying cause and prevent recurrence.

Segregation of duties is particularly important where one person could initiate, authorize, record and conceal a transaction. In a small subsidiary, complete segregation may be impractical. Compensating controls, such as independent owner review, surprise checks and automated audit trails, may reduce the risk.

Limitations of internal control

Internal control cannot eliminate all risk. Limitations include human error, collusion, management override, poor judgment, changing conditions, cost constraints and defective technology. A control that worked last year may be ineffective after a new enterprise resource-planning system, acquisition or regulatory change. Control evaluation must therefore consider both design and operating effectiveness.

A useful distinction is:

• Design effectiveness: whether the control, if operated as intended, could prevent or detect a material problem.
• Operating effectiveness: whether the control actually operated consistently, by competent people, with appropriate evidence, during the relevant period.

5. Audit and assurance

Assurance engagements are designed to increase the confidence of intended users in information. An independent practitioner evaluates subject matter against suitable criteria and expresses a conclusion. Financial statement audits provide reasonable assurance, but reasonable assurance is high—not absolute—assurance.

An audit is not a guarantee that financial statements are free from every error or fraud. Auditors obtain sufficient appropriate evidence and assess the risk of material misstatement. Because audits use sampling, professional judgment and risk assessment, some undetected misstatements may remain.

Types of engagements

The external auditor must maintain independence in mind and appearance. Threats include self-interest, self-review, advocacy, familiarity and intimidation. Safeguards may include removing conflicted personnel, independent review, rotating key partners where required, declining services or ending the engagement.

Internal audit is an independent and objective assurance and consulting activity designed to add value and improve operations. It evaluates governance, risk management and control. Internal audit should report functionally to the audit committee or equivalent oversight body, even if it has administrative reporting to management.

Three lines model

A practical governance arrangement often distinguishes:

1. First line: operational management owns and manages risks.
2. Second line: risk, compliance and control functions provide expertise, monitoring and challenge.
3. Third line: internal audit provides independent assurance to the board.

External audit is not simply a “fourth line”; it has a separate statutory or contractual mandate and serves external users. Confusing these roles can weaken accountability. Management remains responsible for controls and financial statements; auditors do not replace management.

6. Fraud risk and investigation

Fraud is an intentional act involving deception to obtain an unjust or illegal advantage. It may involve asset misappropriation, corruption, procurement manipulation, financial statement fraud, cyber-enabled theft or concealment of liabilities.

The fraud triangle identifies three common conditions:

• Pressure or incentive: financial difficulty, unrealistic targets or personal needs.
• Opportunity: weak controls, unrestricted access or ineffective oversight.
• Rationalization: belief that the conduct is justified, temporary or harmless.

A fourth dimension, capability, is sometimes added in the fraud diamond: the individual must possess the ability, authority or technical skill to exploit the opportunity.

Fraud risk assessment should consider country risk, industry risk, incentives, unusual transactions, related parties, third parties, override risk and prior incidents. Warning signs are not proof of fraud. They require proportionate investigation and preservation of evidence.

A sound anti-fraud program includes:

• tone from the top and explicit prohibition of retaliation;
• risk assessment and controls over high-risk transactions;
• due diligence on agents, distributors and suppliers;
• data analytics for unusual payments and journal entries;
• confidential reporting channels;
• investigation protocols and document preservation;
• disciplinary and remedial action; and
• reporting to regulators or law enforcement when required.

Investigations should be independent, properly scoped and respectful of privacy, employment and evidence laws. Management should not prejudge allegations or destroy potentially relevant records.

7. Anti-money-laundering and counter-terrorist-financing compliance

Money laundering is the process of disguising proceeds of crime so they appear legitimate. A simplified model describes placement, layering and integration, although actual schemes may not follow these stages neatly. Terrorist financing may involve legitimate or illicit funds and focuses on supporting terrorism rather than merely laundering criminal proceeds.

International organizations generally use a risk-based approach informed by standards associated with the Financial Action Task Force and implemented through national law. Core measures commonly include:

1. Customer or counterparty due diligence: identify and verify customers and beneficial owners.
2. Risk classification: consider customer, product, geography, delivery channel and transaction risk.
3. Enhanced due diligence: apply stronger measures to high-risk relationships, politically exposed persons and complex structures.
4. Transaction monitoring: identify unusual patterns and investigate alerts.
5. Record keeping: retain required identity, transaction and investigation records.
6. Suspicious transaction reporting: report suspicions to the appropriate financial intelligence authority where required.
7. Training and governance: assign responsibility, test controls and report significant issues to the board.

Beneficial ownership means identifying the natural person or persons who ultimately own or control a legal entity. A company should not treat a complex corporate structure as proof of legitimacy. It should understand ownership, purpose, source of funds and expected activity.

AML compliance has two important boundaries. First, a suspicious transaction is not necessarily a proven crime; reporting regimes generally require suspicion based on reasonable grounds, not certainty. Second, organizations must respect confidentiality and anti-tipping-off rules. Staff should not alert a customer that a suspicious transaction report has been filed when prohibited by law.

8. Professional ethics in international accounting and finance

Professional ethics provides a basis for decisions when rules do not give a complete answer. The International Ethics Standards Board for Accountants’ framework identifies fundamental principles commonly expressed as:

• integrity;
• objectivity;
• professional competence and due care;
• confidentiality; and
• professional behavior.

Accountants should identify, evaluate and address threats to compliance with these principles. Common threats include self-interest, self-review, advocacy, familiarity and intimidation. Safeguards may arise from professional standards, law, governance structures, independent review, rotation, disclosure and withdrawal from an engagement.

Ethical reasoning should proceed beyond “Is it technically permitted?” A stronger sequence is:

1. Identify the facts and affected stakeholders.
2. Identify applicable law, professional standards and organizational policies.
3. Identify conflicts and threats to ethical principles.
4. Evaluate possible consequences and the public-interest dimension.
5. Consult an appropriate senior, ethics or legal function.
6. Document the reasoning and decision.
7. Escalate or withdraw if the threat cannot be reduced to an acceptable level.

Cultural differences do not justify bribery, falsification or concealment. Local custom may influence how relationships are managed, but it does not remove professional duties or applicable law. Multinational firms should distinguish legitimate hospitality from improper inducements using thresholds, approval rules, transparency and purpose.

9. Whistleblowing and speak-up systems

Whistleblowing is the reporting of suspected wrongdoing through internal or external channels. Effective systems allow employees, contractors and other parties to raise concerns confidentially or anonymously where legally permitted.

A credible system requires:

• multiple reporting channels, including channels independent of local management;
• clear scope covering fraud, corruption, harassment, safety, financial reporting and regulatory breaches;
• confidentiality and controlled access to case information;
• prompt triage based on severity and risk;
• protection against retaliation;
• competent, independent investigation;
• feedback where legally possible; and
• board-level reporting of trends, substantiated cases and remediation.

An anonymous hotline is not sufficient by itself. If employees believe reports disappear, senior people are protected or retaliation is likely, the system will be underused. A healthy speak-up culture is demonstrated by fair investigation and consistent consequences, not by a low number of reported cases.

10. Regulatory compliance in multinational organizations

Compliance is the structured process of identifying obligations, implementing controls, monitoring behavior and responding to breaches. Obligations may arise from company law, securities regulation, tax law, labor law, data protection, sanctions, export controls, competition law, environmental regulation, AML legislation and anti-bribery statutes.

A compliance management cycle includes:

1. Obligation mapping: identify laws, licenses, contractual duties and standards.
2. Risk assessment: rank obligations by likelihood, impact and control maturity.
3. Policy and control design: translate requirements into operational procedures.
4. Communication and training: make responsibilities understandable and relevant.
5. Monitoring and testing: use audits, analytics, attestations and investigations.
6. Incident response: contain, investigate, disclose and remediate.
7. Continuous improvement: update controls after legal, technological or business change.

A multinational must manage extraterritorial risks. For example, anti-bribery, sanctions and data laws may apply because of a company’s listing, ownership, technology, employees, transactions or use of a particular currency. Legal analysis is fact-specific. A group compliance policy should identify jurisdictional triggers and escalation procedures rather than assume that conduct outside headquarters is outside the group’s responsibility.

Compliance metrics

Useful metrics include training completion, overdue investigations, control testing results, hotline reports, repeat incidents, third-party screening exceptions and remediation age. Metrics should not be used mechanically. A target of “zero complaints” may encourage suppression of reporting, while a high number of reports may reflect a healthy speak-up culture. Boards should examine trends, quality and root causes rather than celebrate superficial numbers.

11. Integrated illustrative case: Meridian Global Components

Background. Meridian Global Components, a fictional manufacturer headquartered in Country A, acquires a distributor in Country B. The subsidiary uses local sales agents, has concentrated ownership and reports unusually rapid revenue growth. The group’s finance team discovers large year-end commissions, incomplete beneficial-owner records for two agents and repeated manual journal entries posted by the sales director.

Problem. The board must determine whether the issues represent ordinary local practice, control deficiencies or possible corruption and financial statement fraud. The subsidiary argues that strict group procedures would damage commercial relationships. A whistleblower alleges that one agent is connected to a government purchasing official.

Analysis. The risks include:

• bribery and improper payments through intermediaries;
• related-party or politically exposed relationships;
• premature or fictitious revenue recognition;
• management override of controls;
• inadequate AML and third-party due diligence;
• retaliation against the whistleblower; and
• inaccurate group reporting.

The audit committee should not allow local management to investigate itself. It should preserve records, restrict access where appropriate, appoint an independent investigation team and obtain legal advice concerning reporting duties. The external auditor should reassess fraud and material misstatement risks, while internal audit evaluates the control environment and remediation.

Approach and solution. Meridian should suspend new payments to high-risk agents pending review, verify beneficial ownership, examine contracts and invoices, test sales cut-off, analyze journal entries, interview relevant personnel and review communications. It should apply a documented risk-based decision to retain, remediate or terminate agents. The whistleblower must be protected from retaliation. If evidence supports a violation, Meridian should make required disclosures to regulators and cooperate with lawful investigations.

The board should require a remediation plan with named owners, deadlines and evidence of completion. It should also review incentive structures: if bonuses depend almost entirely on reported sales, they may have created pressure that contributed to misconduct.

Outcome. In this illustrative case, the investigation confirms that some commissions were unsupported and that revenue was accelerated. Meridian restates affected results, terminates one agent, disciplines responsible employees, strengthens third-party due diligence and introduces independent review of high-risk sales. The board reports the incident transparently and monitors remediation for twelve months.

Learning points. The case demonstrates that governance, ethics, assurance and compliance are interconnected. A formal policy did not prevent the problem because local incentives, weak ownership verification and management override undermined it. The appropriate response combines investigation, reporting, accountability, control redesign and cultural change.

12. Technology, data and emerging developments

Technology can improve governance through continuous monitoring, automated approvals, access logs, anomaly detection and centralized compliance records. Data analytics can identify duplicate vendors, unusual payment timing, round-dollar transactions, dormant accounts and journal entries posted outside normal patterns.

Artificial intelligence may assist with document review, transaction classification, sanctions screening and risk prioritization. However, AI outputs require human governance. Risks include biased training data, false positives, false negatives, opaque models, privacy violations and overreliance on automated recommendations. Organizations should define accountability for model approval, data quality, validation, access, explainability and escalation.

Cybersecurity is also a governance issue. Boards should understand material cyber risks, incident response capability, third-party exposure and the effect of system compromise on financial reporting. Digital records can be altered, deleted or exfiltrated; therefore, access controls, segregation, backups and immutable audit trails are relevant to both compliance and assurance.

Contemporary developments also include climate and sustainability reporting, supply-chain human-rights risks, beneficial ownership transparency, digital assets and stronger expectations regarding corporate culture. These developments expand the information that boards and assurance providers may need to evaluate.

Challenges and limitations

International governance systems face persistent challenges:

• differing legal definitions and enforcement standards;
• conflicts between group policy and local practice;
• fragmented data and inconsistent control maturity;
• language and cultural barriers;
• powerful controlling shareholders or executives;
• excessive compliance that creates bureaucracy without reducing risk;
• privacy restrictions affecting investigations and monitoring;
• shortage of qualified compliance and internal audit personnel; and
• uncertainty about emerging technology and sustainability obligations.

No framework replaces judgment. A checklist can show that a policy exists, but not whether people understand it, whether incentives undermine it or whether the board receives truthful information. Effective governance is therefore both structural and behavioral.

Best-practice principles

An internationally active organization should:

1. Establish clear board accountability and independent challenge.
2. Align incentives with sustainable, lawful performance rather than volume alone.
3. Maintain a risk-based internal control and compliance framework.
4. Protect the independence and authority of internal and external assurance providers.
5. Conduct robust due diligence on customers, suppliers, agents and beneficial owners.
6. Maintain accessible and trusted speak-up channels.
7. Investigate allegations promptly, fairly and confidentially.
8. Use technology to support—not replace—professional judgment.
9. Report significant weaknesses and remediation progress to the board.
10. Treat ethics as a daily management responsibility rather than an annual training event.

Chapter Summary

International governance is the system through which organizations are directed, controlled and held accountable. Agency theory highlights the need to control conflicts between owners and managers, while stakeholder theory emphasizes broader social and institutional effects. Anglo-American, continental, relationship-oriented and family-controlled models differ in ownership, board structure and accountability risks.

Boards are responsible for strategy, risk oversight, financial reporting, executive accountability, ethical conduct and compliance. Audit, risk, remuneration and nomination committees support this work, but committees do not remove the board’s collective responsibility. Internal control frameworks organize control environment, risk assessment, control activities, information and monitoring. Controls provide reasonable rather than absolute assurance and can fail because of collusion, override, error or change.

Audit, review, agreed-upon procedures and internal audit have different purposes and assurance levels. Fraud risk is influenced by pressure, opportunity, rationalization and capability. AML programs use customer due diligence, beneficial-owner identification, risk classification, monitoring, record keeping and reporting. Professional ethics requires integrity, objectivity, competence, confidentiality and professional behavior. Whistleblowing systems must protect reporters and support independent investigation. Multinational compliance requires obligation mapping, risk assessment, training, monitoring, incident response and continuous improvement.

The strategic lesson is that governance, ethics, assurance and compliance are mutually reinforcing. Reliable financial reporting depends not only on accounting techniques but also on culture, incentives, oversight, controls and the willingness to challenge powerful decision-makers.

Key Terms

Corporate governance: The system by which an organization is directed, controlled and held accountable.

Agency theory: A theory focusing on conflicts and information asymmetry between principals and agents.

Stakeholder theory: A perspective that considers the interests of groups affected by and contributing to the organization.

Board independence: The capacity to exercise objective judgment without improper influence or conflicts.

Audit committee: A board committee overseeing financial reporting, internal control and audit relationships.

Internal control: A process providing reasonable assurance over operations, reporting and compliance objectives.

Control environment: The ethical, structural and accountability foundation of internal control.

Segregation of duties: Dividing incompatible transaction responsibilities among different people or systems.

Reasonable assurance: A high, but not absolute, level of assurance.

Internal audit: An independent activity evaluating governance, risk management and control.

Fraud triangle: Pressure, opportunity and rationalization as conditions associated with fraud.

Beneficial owner: The natural person who ultimately owns or controls an entity.

Customer due diligence: Procedures for identifying, verifying and understanding a customer or counterparty.

Money laundering: Disguising proceeds of crime to make them appear legitimate.

Politically exposed person: A person entrusted with a prominent public function, together with relevant associated risks.

Professional skepticism: An attitude that includes a questioning mind and critical assessment of evidence.

Whistleblowing: Reporting suspected wrongdoing through an internal or external channel.

Compliance: The process of identifying obligations, implementing controls and responding to breaches.

Management override: Deliberate circumvention of established controls by senior personnel.

Tone at the top: The ethical example and expectations established by senior leadership.

Review Questions

5 Short Answer Questions

1. What is the difference between governance and management?
2. Identify the five components of the COSO internal control framework.
3. Why is beneficial-owner identification important in AML compliance?
4. Name five fundamental professional ethical principles.
5. What is the purpose of an audit committee?

5 Long Answer Questions

1. Compare the Anglo-American and continental European governance models, including their principal strengths and risks.
2. Explain how board composition, information quality and committee structures affect board accountability.
3. Distinguish audit, review, agreed-upon procedures and internal audit engagements.
4. Discuss the fraud triangle and explain how an organization can reduce each component of fraud risk.
5. Explain why internal controls provide reasonable rather than absolute assurance.

3 Analytical / Application Questions

1. A multinational subsidiary has strong written policies but repeated unexplained payments to local agents. Analyze the governance, AML, fraud and assurance responses that should follow.
2. A finance director is asked to delay recording a major expense until after year-end to protect a bonus. Apply the ethical decision-making framework and identify appropriate escalation steps.
3. A company receives very few whistleblower reports and concludes that its culture is healthy. Critically evaluate this conclusion and propose better measures of speak-up effectiveness.

Multiple Choice Questions with Answers

Question 1

Which governance model commonly uses a separate management board and supervisory board?

A. Two-tier continental European model

B. Single-tier market model

C. Purely family-controlled model

D. Informal partnership model

Correct Answer: A. Two-tier continental European model

Question 2

Which COSO component includes approvals, reconciliations and segregation of duties?

A. Control environment

B. Risk assessment

C. Control activities

D. Monitoring activities

Correct Answer: C. Control activities

Question 3

Which statement best describes reasonable assurance in an audit?

A. It guarantees that no error or fraud exists

B. It provides a high but not absolute level of assurance

C. It is the same as management’s representation

D. It requires testing every transaction

Correct Answer: B. It provides a high but not absolute level of assurance

Question 4

Which is an example of a preventive control?

A. A post-year-end variance report

B. A bank reconciliation

C. An approval limit before payment

D. An investigation after a complaint

Correct Answer: C. An approval limit before payment

Question 5

Which item is not one of the classic fraud triangle elements?

A. Pressure

B. Opportunity

C. Rationalization

D. Independence

Correct Answer: D. Independence

Question 6

What is the primary purpose of identifying a beneficial owner?

A. To calculate depreciation

B. To identify the natural person ultimately owning or controlling an entity

C. To determine employee vacation rights

D. To set an audit sampling interval

Correct Answer: B. To identify the natural person ultimately owning or controlling an entity

Question 7

Which professional principle requires accountants to avoid bias and conflicts that impair judgment?

A. Objectivity

B. Confidentiality

C. Professional behavior

D. Competence

Correct Answer: A. Objectivity

Question 8

Which arrangement best supports internal audit independence?

A. Reporting only to the sales director

B. Functional reporting to the audit committee

C. Receiving findings from the external auditor only

D. Being managed by the department being audited

Correct Answer: B. Functional reporting to the audit committee

Question 9

Why is a low number of whistleblower reports not necessarily evidence of a healthy culture?

A. Reports are always legally required to be high

B. Employees may fear retaliation or distrust the reporting process

C. Whistleblowing systems create financial statements

D. All organizations must receive identical report volumes

Correct Answer: B. Employees may fear retaliation or distrust the reporting process

Question 10

Which response is most consistent with a risk-based AML program?

A. Apply identical procedures regardless of risk

B. Ignore beneficial ownership if a customer is profitable

C. Apply enhanced due diligence to higher-risk relationships

D. Report every transaction as a confirmed crime

Correct Answer: C. Apply enhanced due diligence to higher-risk relationships