CGFM AGA CGFM Certified Government Financial Manager Free Practice Exam Questions (2025 Updated)

Definition of a Material Weakness:According to auditing standards, a material weakness in internal control over financial reporting is a deficiency or combination of deficiencies that creates a reasonable possibility of a material misstatement in the financial statements that will not be prevented or detected on a timely basis.

Key Characteristics of a Material Weakness:

Reasonable Possibility:The likelihood of a misstatement is more than remote but less than certain.

Material Misstatement:The error or omission could impact the decisions of users relying on the financial statements.

Timely Detection:The deficiency allows errors to go undetected for an extended period, potentially affecting financial statement reliability.

Why Other Options Are Incorrect:

A.A misstatement in the basic financial statements may result from a material weakness, but the definition focuses on the reasonable possibility, not the actual result.

B.A material weakness impacts the financial statements, not "other accompanying financial information."

C.While timely detection is part of the issue, the definition focuses on the reasonable possibility of a misstatement, not management’s inability to perform specific duties.

References and Documents:

GAAS (AICPA SAS No. 115):Provides the formal definition of material weaknesses and guidance for auditors in evaluating control deficiencies.

COSO Framework:Emphasizes the need for effective internal controls to mitigate material misstatement risks.

Selection Criteria for Contract Awards:

When awarding contracts, federal, state, and local governments typically evaluate contractors based on objective criteria like staff expertise, past performance, and financial position to ensure the contractor can successfully fulfill the contract requirements.

Union affiliationis irrelevant to the contractor’s ability to meet the contractual obligations and is not a valid selection criterion.

Explanation of Answer Choices:

A. Staff expertise: Correctly used to ensure the contractor has qualified personnel.

B. Past performance records: Correctly used to evaluate the contractor’s historical success in fulfilling similar contracts.

C. Union affiliations: Correct. This is not considered a valid selection criterion for contract awards.

D. Financial position: Correctly used to assess the contractor's financial stability.

References:

Federal Acquisition Regulation (FAR) Part 15,Contracting by Negotiation.

Office of Management and Budget (OMB) Circular A-102,Grant and Contract Management Requirements.

Federal Credit Reform Act of 1990:This Act established a new accounting framework for federal credit programs, such as direct loans and loan guarantees. It requires using thenet present value (NPV)method to measure the costs of loans and guarantees by discounting future cash flows (e.g., loan repayments, defaults) to their present value.

Explanation of Financial Analytical Technique:

Net Present Value (NPV): Accounts for the time value of money by discounting future cash flows to the present. It provides an accurate measure of the economic cost to the government.

Other options:

A. Future value: Focuses on future cash flows, not their present cost.

C. Current value: Not a recognized technique for analyzing long-term cash flows.

D. Regression analysis: A statistical method, unrelated to calculating loan program costs.

References:

Federal Credit Reform Act of 1990, Section 502.

Congressional Budget Office (CBO),Federal Credit Program Cost Analysis.

Office of Management and Budget (OMB),Circular A-11: Credit Reform Accounting.

Responsibilities in Resolving Single Audit Findings:

Single audits assess compliance with federal program requirements.

Findings often highlight deficiencies or noncompliance issues that must be resolved by the entity receiving the federal funds.

Explanation of Answer Choices:

A. Awarding agency: The agency provides oversight and guidance but does not directly resolve findings.

B. Recipient agency: Correct. The entity receiving the funds is responsible for addressing and resolving findings to comply with federal regulations.

C. Audit committee: May oversee the process but doesn’t take direct responsibility for resolving findings.

D. External auditors: Identify the findings but do not resolve them.

References:

Uniform Guidance (2 CFR Part 200),Single Audit Requirements.

Association of Government Accountants (AGA),Government Auditing Standards.

What Is Internal Control Evaluation?Internal control evaluation is the process of assessing an organization’s internal controls to ensure they are adequate and effective in mitigating risks, ensuring compliance, and achieving objectives.

Why Is Identifying Potential Risks the First Step?

The entire purpose of internal controls is to mitigate risks. Therefore, before evaluating the controls, you need to identify the risks they are meant to address.

Once risks are identified, the organization can evaluate whether the existing controls are adequate and effective in mitigating those risks.

This approach aligns with risk-based frameworks like theCOSO Internal Control Framework, which emphasizes risk identification as the foundation for effective controls.

Why Other Options Are Incorrect:

A. Identifying the effectiveness of management activities:This is part of control evaluation but occurs after risks and controls are identified.

B. Assessing the adequacy of controls:Controls cannot be assessed until the risks they address are identified.

C. Documenting how transactions or events are processed:While this step is important, it comes later in the process, after risks and controls are identified.

References and Documents:

COSO Internal Control Framework:Identifies risk assessment as the foundation for designing and evaluating controls.

GAO Standards for Internal Control (Green Book):Highlights risk identification as the first step in the control process.

What Is an Internal Control Deficiency?

Aninternal control deficiencyoccurs when an organization fails to implement controls to prevent or detect risks effectively.

In this case, responding only to maintenance needs when complaints are received demonstrates a lack of proactive controls, increasing the risk of issues going unnoticed or escalating over time.

Why Is Option C Correct?

Proactive maintenance schedules and inspections are essential for ensuring the safety and functionality of critical infrastructure like dams. Relying solely on complaints or employee reports is a reactive approach and represents a deficiency in internal controls.

Why Other Options Are Incorrect:

A. Inspecting completed work:This is a proper control to ensure compliance with contract specifications.

B. Releasing the bond after work completion:This ensures contractual obligations are met and is a good control practice.

D. Checking bidder references:This is part of the procurement process and a valid internal control.

References and Documents:

GAO Standards for Internal Control (Green Book):Emphasizes proactive controls and monitoring for critical operations.

Federal Infrastructure Maintenance Best Practices:Highlights proactive inspections and maintenance as essential controls.

Role of Management in Internal Control Evaluation:

Responsibility for Risk Identification:Management has the primary responsibility for designing, implementing, and maintaining an effective system of internal controls. As part of this process, management identifies the risks related to fraud, waste, and abuse that could impact financial reporting or operational efficiency.

Mitigating Risks:Once risks are identified, management is responsible for mitigating them by developing appropriate policies, procedures, and controls.

Role of the Auditor in Internal Control Evaluation:

Assessing Control Effectiveness:Auditors are not responsible for designing or implementing controls; rather, their role is to evaluate whether the controls put in place by management are effective. They do this through testing, observation, and other audit procedures.

Fraud Risk Assessment:As part of their duties under Generally Accepted Government Auditing Standards (GAGAS), auditors must assess the risk of material misstatement due to fraud and evaluate how management’s controls address those risks.

Why Other Options Are Incorrect:

B.Auditors do not identify risks—this is management's job. Auditors evaluate and assess the controls already in place.

C.Determining risk tolerance is a governance and management responsibility, not the joint responsibility of auditors and management.

D.Management mitigates risks, but auditors don’t monitor compliance with controls—they test and evaluate the controls as part of their audit procedures.

References and Documents:

GAGAS (Yellow Book) by GAO:Emphasizes management’s responsibility for risk identification and the auditor’s responsibility for assessing control effectiveness.

COSO Internal Control Framework (2013):Highlights management’s responsibility for risk assessment and control design, while auditors provide independent assurance.

What Is Control Risk?

Control riskrefers to the risk that an organization’s internal controls will fail to prevent or detect material misstatements in a timely manner.

The effectiveness of internal controls directly influences control risk. If controls are weak or poorly designed, the risk increases.

Why Is Option B Correct?

The primary focus of control risk is the adequacy and effectiveness of an entity’s internal controls. Effective controls reduce the likelihood of material misstatements, while deficiencies increase control risk.

Why Other Options Are Incorrect:

A. Inherent Risk:This is the risk of material misstatements due to the nature of the business or transactions, independent of controls.

C. Detection Risk:This refers to the risk that auditors will fail to detect material misstatements. It is influenced by the nature and extent of audit procedures, not internal controls.

D. Audit Risk:This is the overall risk that an auditor will issue an incorrect opinion. It combines inherent, control, and detection risks.

References and Documents:

AICPA Standards on Audit Risk (AU-C 315):Explains control risk and its relationship to the effectiveness of internal controls.

GAO Yellow Book:Emphasizes assessing control risk when evaluating internal controls in audits.

Risk Assessment Under COSO Framework:

The first step in a COSO-based risk assessment is defining internal control objectives. This establishes what the organization aims to achieve, providing a framework for identifying risks and ensuring controls align with objectives.

Risk assessment focuses on evaluating the likelihood and impact of risks that could hinder these objectives.

Explanation of Answer Choices:

A. Identification of risks: Identifying risks follows the definition of internal control objectives.

B. Defining internal control objectives: Correct. Objectives must be defined first to provide a basis for identifying and assessing risks.

C. Review of prior audit findings: Important, but it’s not the starting point for a risk assessment under COSO.

D. Setting risk tolerance levels: This occurs later, after risks have been identified and evaluated.

References:

COSO,Internal Control - Integrated Framework.

GAO,Standards for Internal Control in the Federal Government (Green Book).

Why Hire Contractors for Management Control Evaluations?Management may decide to bring in external contractors when there are gaps in the organization’s capacity to perform evaluations internally. One key factor is thelack of management expertise—if management lacks the necessary knowledge or experience to evaluate controls effectively, it may outsource this task to qualified contractors.

Why Other Options Are Incorrect:

B. Availability of Qualified Contractors:While availability is a factor, it’s not a variable that influences the decision to outsource. Instead, it’s a logistical consideration once the decision has been made.

C. Suspicion of Internal Fraud:Suspicion of fraud may lead to investigations, but hiring contractors to evaluate controls is driven by expertise gaps rather than fraud concerns.

D. Knowledge of Systemic Deficiencies:If management already has knowledge of systemic deficiencies, they may focus on remediation rather than outsourcing evaluations.

References and Documents:

GAO Standards for Internal Control in the Federal Government (Green Book):Emphasizes the need for knowledgeable personnel to evaluate controls.

GAGAS (Yellow Book):Highlights the role of external expertise in cases where internal expertise is insufficient.

Assumptions in Disaster Planning:

Financial continuity planning for natural disasters must account for scenarios where the event occurs suddenly and without warning.

This assumption ensures that governments are prepared to quickly resume critical financial operations even under challenging and unpredictable circumstances.

Explanation of Answer Choices:

A. Leadership and staff will reconvene at an alternate location: While this is part of disaster planning, it is not the primary assumption.

B. A fully redundant infrastructure will be available to staff at an alternate location: This may not always be realistic or feasible.

C. There may be no warning of the potential emergency: Correct. Disaster planning assumes that emergencies can occur without prior notice.

D. Government agencies will need to operate as standalone organizations: This is not a standard assumption in disaster planning.

References:

FEMA,Continuity Guidance Circular.

GAO,Disaster Resilience and Continuity Planning.

Single Audit Report Requirements:

A single audit evaluates the financial statements and compliance with federal award requirements.

Thefinancial statement opinionmust state whether the financial statements arefairly presented in accordance with Generally Accepted Accounting Principles (GAAP).

Explanation of Answer Choices:

A. Free from fraud: Incorrect. Auditors do not provide an opinion on fraud; they assess for material misstatements.

B. Fairly presented in accordance with GAAP: Correct. The financial statement opinion is issued based on compliance with GAAP.

C. Fairly presented in accordance with GASB: Incorrect. GASB (Governmental Accounting Standards Board) provides guidance for state and local governments, but financial statements must comply with GAAP as the overarching standard.

D. Fairly presented in accordance with GAO: Incorrect. The GAO (Government Accountability Office) issues auditing standards, not financial reporting standards.

References:

OMB Uniform Guidance (2 CFR Part 200),Subpart F - Audit Requirements.

GAO,Government Auditing Standards (Yellow Book).

Government Auditing Standards (GAS):

GAS, often referred to as theYellow Book, outlines the responsibilities of auditors conducting financial statement audits for government entities.

One core requirement is that auditors must consider compliance with applicable laws, regulations, contracts, and grant agreements that could materially affect financial statements.

Explanation of Answer Choices:

A. Design tests to assess compliance with laws, regulations, contracts, and grant agreements: Correct. This is a required component under GAS to ensure financial statements are materially accurate and comply with legal and regulatory frameworks.

B. Identify violations of laws which could be punishable by monetary penalties: Incorrect. Auditors are not required to investigate or pursue penalties but to focus on material misstatements or risks.

C. Identify expenditures that exceed the related obligations: Incorrect. While this could indicate an issue, auditors are not required to specifically test for this unless it relates to material misstatements or compliance issues.

D. Design tests to detect fraud, waste, and abuse: Incorrect. Auditors are not specifically required to detect fraud, waste, and abuse, though they should be alert to indicators.

References:

Government Accountability Office (GAO),Government Auditing Standards (Yellow Book).

Uniform Guidance (2 CFR Part 200),Audit Requirements for Federal Programs.