Performance measures and incentives shape behavior by signaling what is valued and rewarding the actions that support reliable operations, accurate reporting, and adherence to policies. When rewards align with achieving objectives, management and staff are more likely to follow procedures, monitor risks, and promptly address issues, strengthening the control environment. That said, incentives won’t guarantee zero errors or complete legal compliance, since mistakes happen and laws are complex; they should complement, not replace, proper controls, training, and monitoring. They also don’t obviate the need for independent audits and ongoing assessments to verify that controls are functioning as intended and to catch weaknesses that incentives alone might miss.

Delegation of authority is the process of giving the right level of decision-making power to the people who are closest to the work, while management retains ultimate accountability. When authority is delegated, tasks can be performed promptly, responsibilities are matched with the people who understand the details, and clear limits and requirements are established. This alignment helps drive progress toward the entity’s objectives because decisions happen where the information and actions occur, reducing delays and bottlenecks. It also supports internal control by defining who can authorize actions, what limits apply, and how actions are reviewed and monitored. Increasing budgets by itself doesn’t guarantee effective execution if those budgets can’t be approved and acted upon at the appropriate level. Centralizing operations tends to slow decision-making and reduce responsiveness, which can impede achieving objectives. Outsourcing functions removes some control from internal processes and isn’t the same as empowering internal staff to act within defined authorities.

Professional skepticism centers on maintaining a questioning mindset and a careful, evidence-based approach. It means not taking explanations at face value, being alert to conditions that could indicate errors or fraud, and critically evaluating issues that don’t seem reasonable. A rigid adherence to procedures is not a trait of professional skepticism. Rigidly following procedures can lead to mechanical compliance and may cause an auditor to miss inconsistencies or fail to probe deeper when evidence doesn’t add up. Skepticism is about evaluating the quality and sufficiency of evidence, not just ticking checkboxes. The other traits fit well with professional skepticism: a questioning mind involves continually asking whether the evidence supports the conclusion; awareness of conditions that could result in errors or fraud means spotting red flags; and critical SAMPLEassessments of unusual or unreasonable issues means challenging explanations until they are satisfactorily supported.

Setting objectives is essential when establishing an internal control system. Objectives define what the organization expects to achieve in operations, reporting, and compliance, and they guide the design and implementation of controls. With clear objectives, risk assessment focuses on what could prevent those objectives from being achieved, and control activities are tailored to address those specific risks. They also provide a basis for evaluating control effectiveness and for auditors to judge whether controls align with management’s goals. Without explicit objectives, controls can be misaligned, either over- or under-designed, and performance criteria for testing controls become unreliable. In practice, objectives should be defined clearly and mapped to controls so the system remains relevant as conditions change. Hence, this statement is not correct; setting objectives is needed.

The main idea being tested is that controls should be cost-effective, meaning you weigh the cost of implementing and operating a control against the benefits it provides in reducing risk. This balance ensures resources aren’t wasted on controls that don’t provide enough protection. The best statement expresses this direct trade-off: the cost of a control should not exceed the benefit derived from it. When the cost outweighs the benefit, the control isn’t cost-effective and you’d seek a lighter or different approach. In contrast, simply adding more controls isn’t automatically better, costs shouldn’t be accepted regardless of benefits, and benefits should be considered during design, not only after audits.