20) Which of the following is the best reason for management to emphasize fraud prevention and deterrence? A) The AICPA requires management to implement a fraud prevention program.

B) It is often more effective and economical for companies to focus on fraud prevention and deterrence rather than on fraud detection.

C) Collusion is impossible to detect.

D) All of the above are equally valid reasons.

21) Who is responsible for setting the "tone at the top"?

A) SEC B) PCAOB

C) management D) audit committee

22) With whom should the auditor communicate whenever he or she determines that senior management fraud may be present, even if the matter might be considered inconsequential? A) the internal auditors

B) an appropriate level of management that is at least one level above those involved

C) audit committee

D) PCAOB

23) Which of the following is most correct regarding the requirements under Section 404 of the Sarbanes-Oxley Act? A) The audit of financial statements provides absolute assurance of misstatement.

B) The audits of internal control and the financial statements provide absolute assurance as to misstatements.

C) The audits of internal control and the financial statements provide reasonable assurance as to misstatements.

D) The audit of internal control provides absolute assurance of misstatement.

24) Which of the following is a risk assessment principle?

A) use relevant, quality information to support the functioning of internal controls

B) consider the potential for fraud

C) develop general controls over technology

D) accountability

25) In an IT system, automated equipment controls or hardware controls are designed to

A) arrange data in a logical sequential manner for processing purposes.

B) monitor and detect errors in source documents.

C) detect and control errors arising from the use of equipment.

D) correct errors in the computer programs.