Which of the following is a GAO standard for internal controls?

Which of the following is a GAO standard for internal controls?

• A. Control Environment
• B. Risk Assessment
• C. Control Activities
• D. Information and Communication

Answer: (A)

GAO internal control standards are built on five interrelated components that together form a complete system. Among these, the Control Environment acts as the foundation. It covers the tone at the top, integrity and ethical values, the organizational structure, clear assignment of authority and responsibility, and the human resource policies that support competent, ethical behavior. This base shapes how all other components function, guiding the design and operation of risk assessment, control activities, and information and communication. Because it sets the expectations and culture that enable effective controls, recognizing Control Environment as a GAO standard is essential. The other options—Risk Assessment, Control Activities, and Information and Communication—are also important components of the framework, contributing to identifying risks, implementing procedures, and ensuring information flows properly, but they rely on a strong control environment to be effective.

GAO internal control standards are built on five interrelated components that together form a complete system. Among these, the Control Environment acts as the foundation. It covers the tone at the top, integrity and ethical values, the organizational structure, clear assignment of authority and responsibility, and the human resource policies that support competent, ethical behavior. This base shapes how all other components function, guiding the design and operation of risk assessment, control activities, and information and communication. Because it sets the expectations and culture that enable effective controls, recognizing Control Environment as a GAO standard is essential. The other options—Risk Assessment, Control Activities, and Information and Communication—are also important components of the framework, contributing to identifying risks, implementing procedures, and ensuring information flows properly, but they rely on a strong control environment to be effective.