GAO internal control standards include which components?

GAO internal control standards include which components?

• A. A positive environment for control objectives; Control activities; Risk assessment; Information communicated; Monitor by assessing the quality of performance over time
• B. Planning; Budgeting; Auditing; Reporting
• C. Access controls; Segregation of duties; Change management; Incident response
• D. Compliance with laws and regulations; Ethical standards; Documentation; Oversight

Answer: (A)

GAO internal control standards are built around five interrelated components that together provide reasonable assurance for achieving objectives. A positive environment for control objectives corresponds to the control environment, which sets the tone at the top and establishes integrity, ethical values, and organizational structure that influence all other controls. Control activities are the actual policies and procedures—like approvals, authorizations, reconciliations, and reviews—that prevent or detect errors and fraud. Risk assessment involves identifying and analyzing risks to the achievement of objectives so that appropriate controls can be designed and applied. Information and communication ensures the right information is identified, captured, and shared in a timely manner to support decision making. Monitoring is the ongoing evaluation of the effectiveness of controls, including assessing performance over time and making improvements as needed. Together, these five components form a complete framework for establishing, operating, and maintaining internal control. The other options describe governance or security practices that aren’t the five GAO internal control components. Planning, budgeting, auditing, and reporting reflect broader management cycles rather than the internal control framework itself. IT-focused controls like access controls and change management are important but represent specific control activities within a domain, not the full set of GAO’s internal control components. Finally, compliance, ethics, documentation, and oversight are essential governance elements but don’t comprise the five integrated components GAO defines for internal control.

GAO internal control standards are built around five interrelated components that together provide reasonable assurance for achieving objectives. A positive environment for control objectives corresponds to the control environment, which sets the tone at the top and establishes integrity, ethical values, and organizational structure that influence all other controls. Control activities are the actual policies and procedures—like approvals, authorizations, reconciliations, and reviews—that prevent or detect errors and fraud. Risk assessment involves identifying and analyzing risks to the achievement of objectives so that appropriate controls can be designed and applied. Information and communication ensures the right information is identified, captured, and shared in a timely manner to support decision making. Monitoring is the ongoing evaluation of the effectiveness of controls, including assessing performance over time and making improvements as needed. Together, these five components form a complete framework for establishing, operating, and maintaining internal control.

The other options describe governance or security practices that aren’t the five GAO internal control components. Planning, budgeting, auditing, and reporting reflect broader management cycles rather than the internal control framework itself. IT-focused controls like access controls and change management are important but represent specific control activities within a domain, not the full set of GAO’s internal control components. Finally, compliance, ethics, documentation, and oversight are essential governance elements but don’t comprise the five integrated components GAO defines for internal control.