Senior management has decided to adopt the key principles approach of the ISO 31000 risk management framework. According to IIA guidance, which of the following principles is most appropriate when implementing the risk management process in a dynamic agency?

The risk management process should be regularly reviewed and respond to changes in the environment, to remain relevant.

Everyone in the agency has a primary responsibility for identifying and managing risks as part of the risk management process.

The risk management process, while evaluating risk, should develop a mechanism to rank the relative importance of each risk.

The risk management process should be regularly reviewed and respond to changes in the environment, to remain relevant.

The risk management process should use a formal technique to consider the consequence and likelihood of each risk.

A multinational organization has asked the internal audit activity to assist in setting up the organization's risk management system. The chief audit executive (CAE) agrees to take on the engagement as a consultant. Which of the following tasks is appropriate for the CAE to undertake?

Coordinate and facilitate risk workshops for management to attend.

Establish the degree of risk appetite for management to accept.

Set risk indicators and mitigation plans for management to implement

Determine the number of significant risks for management to report to the board.

Upon joining the internal audit activity, each new auditor receives a copy of the audit handbook.Which of the following handbook policies has the greatest risk of compromising audit objectivity?

Internal auditors should rotate to other areas of the organization for nonaudit assignments to gain an understanding of the organization's operations.

Internal auditors should obtain 80 hours of continuing professional education every two years, 20 of which should be audit-related, and the remainder may be operations-related.

Internal auditors should rotate to other areas of the organization for nonaudit assignments to gain an understanding of the organization's operations.

Internal auditors should have direct and unrestricted access to personnel and information throughout the organization and the governing board.

Internal auditors should undergo annual performance appraisals conducted by the chief audit executive, who reports administratively to the chief financial officer.

Which of the following resources would be most effective for an organization that would like to improve how it informs stakeholders of its social responsibility performance?

Open Compliance and Ethics Group.

COSO's enterprise risk management framework

According to NA guidance, which of the following corporate sociaf responsibility (CSR) evaluation activities may be performed by the internal audit activity?

Consult on CSR program design and implementation.

Serve as an advisor on CSR governance and risk management.

Review third parties for contractual compliance with CSR terms.

Identify and mitigate risks to help meet the CSR program objectives.

Which of the following is a true statement regarding whistleblowing?

Whistleblowing is one of several possible ethical structures an organization can undertake to encourage ethical behavior.

Whistleblowing programs help employees deal with ethical questions and instill ethical values into everyday behavior

Whistleblowers are current or former employees who are disgruntled and looking to retaliate.

Whistleblowers should inform the organization about actual criminal circumstances, not assumed allegations

Which of the following actions is a chief audit executive most likely to take in order to identify gaps in the internal audit activity's knowledge, skills, and competencies?

Develop a competency assessment tool for the internal audit activity based on The IIA Global Internal Audit Competency Framework.

Complete a skills assessment of the internal audit activity based on. The IIA Global Internal Audit Competency Framework.

Develop a competency assessment tool for the internal audit activity based on The IIA Global Internal Audit Competency Framework.

Incorporate the basic criteria for competency of the internal audit activity into the job descriptions of potential internal auditors,

Develop an internal audit activity plan for training internal auditors to perform required assurance and consulting activities.

In which of the following ways can a chief audit executive demonstrate to the board that the internal audit activity collectively possesses all of the skills needed to complete its annual goals?

Provide a competency assessment of the internal audit staff.

Involve board members in hiring activities and request advice.

Require all internal audit staff to complete the same training course on a general audit subject,

Require senior auditors to obtain a professional certification.

Provide a competency assessment of the internal audit staff.

An engagement supervisor obtains facilities maintenance reports from a contractor during an audit of third-party services. Which of the following is the source of authority for the engagement supervisor to make such contact outside the organization?

The provisions of the internal audit charter.

The policies and procedures of the internal audit activity.

The provisions of the internal audit charter.

Applying ISO 31000, which of the following is part of the external context for risk management?

The regulatory and competitive environment

Risk treatment method based on risk evaluation.

Organizational culture, objectives, and processes.

The regulatory and competitive environment

The method of determining the risk level.

The internal audit activity is asked to review the effectiveness of controls around the disposal of chemical waste. However, the internal auditors on staff lack the necessary skills to conduct this review. Which of the following would be the most appropriate approach?

A nonaudit employee from the chemical disposal area may share his expertise with the audit team, provided the internal audit manager conducts a detailed review of all engagement work performed.

An internal auditor who recently attended a three-day workshop on chemical waste disposal, and therefore has the most knowledge on the topic, should lead the engagement.

A team of available internal auditors should be assembled and should consult with an external nonaudit expert on chemical waste disposal to plan and conduct the engagement.

A team of the most knowledgeable auditors could be assembled and use the engagement work program from the previous year to gather additional insight regarding recommended audit procedures.

A nonaudit employee from the chemical disposal area may share his expertise with the audit team, provided the internal audit manager conducts a detailed review of all engagement work performed.

A newly appointed chief audit executive (CAE) started analyzing the organization's policies in an attempt to customize them to address internal audit specifics. Which of the following organizationwide practices is most likely to be acceptable to the CAE?

Hiring practices include requiring potential auditors to disclose any significant stock ownership in the organization.

Internal auditors1performance evaluation is primarily based on both client satisfaction surveys and cost savings identified from the audits.

Standard training for each employee, including internal auditors, is 10 hours per year.

To enhance efficiency, internal auditors should not be rotated regularly among engagements.

Hiring practices include requiring potential auditors to disclose any significant stock ownership in the organization.

If the skills and competencies are not present within the internal audit activity to complete an ad-hoc assurance engagement, which of the following is an acceptable resolution?

Consider using employees from other departments in the organization on the audit team.

Politely decline the engagement due to a lack of qualified staff available at the time.

Complete the engagement as requested, with the best of the current staffs abilities.

Consider using employees from other departments in the organization on the audit team.

Change the scope of the testing to ensure that only available staff proficiencies are used

Which of the following actions should the internal audit activity take during an audit engagement when examining the effectiveness of risk management processes?

Evaluate how the organization manages fraud risk.

Establish procedures for improving risk management processes.

Ensure risk responses are aligned with industry standards.

Verify that organizational objectives are aligned with each department's objectives.

A regional entertainment organization is in the process of developing a corporate social responsibility (CSR) policy. Management invites ideas from employees when developing the CSR policy. Which of the following is the most appropriate idea to include?

The board is responsible for ensuring that CSR objectives are established, risks are managed, performance is measured, and activities are appropriately monitored and reported.

Management has overall responsibility for the effectiveness of governance, risk management, and internal control processes associated with CSR.

The board is responsible for ensuring that CSR objectives are established, risks are managed, performance is measured, and activities are appropriately monitored and reported.

Management is responsible for ensuring that the organization's CSR principles are communicated, understood, and integrated into decision-making processes.

Generally, CSR activities are limited to the management of the organization; thus, employees do not have a responsibility for ensuring the success of CSR objectives.

In which scenario might it be considered problematic for the chief audit executive (CAE) to provide assurance services over the payroll function?

The CAE previously undertook a consulting assignment in that area to improve processes,

A couple of years ago, the CAE performed accounting functions for the payroll department.

Prior to becoming the CAE, the CAE was the payroll manager.

The assurance review was initiated following issues identified during a consulting assignment requested by management.

Which of the following would be the most effective fraud prevention control?

New hire training to explain fraud and employee misconduct.

Email alert sent to management for checks issued over $100,000.

Installation of a video surveillance system in a warehouse prone to inventory loss.

New hire training to explain fraud and employee misconduct.

Daily report that identifies unsuccessful system log-in attempts

At a conference, an interna! auditor presented a new computer-assisted audit technique developed by his organization. The presentation included sample data derived from performing audit engagements for the organization. Travel costs were paid by the conference organizers, and the trip was approved by the chief audit executive (CAE).However, neither management nor the CAE was aware that the internal auditor would be making a presentation based on work completed for the organization. According to IIA guidance, which of the following statements is most relevant regarding the actions of the auditor?

The auditor should have obtained permission before using the material, but did not violate the IIA Code of Ethics or Standards,

The auditor did not violate the standard of objectivity because the presentation had no impact on the organization.

The auditor violated the principle of confidentiality by disclosing information about the organization without approval.

The auditor should have obtained permission before using the material, but did not violate the IIA Code of Ethics or Standards,

The auditor breached the conflict of interest standard by accepting payment for travel costs

In an assurance engagement focused on the adequacy of organizationwide risk management practices, which of the following best describes a primary area of interest for the engagement?

The alignment of management decisions with the level of risk the organization is willing to accept.

The effectiveness of process-level and transaction-level controls.

Conflicts of interest within the organizational structure of the senior management.

The alignment of management decisions with the level of risk the organization is willing to accept.

The actions of upper management in response to the internal audit activity's reporting

Which of the following documents would promote objectivity within an organization's internal audit activity?

Human resources employee handbook.

According to NA guidance, which of the following provides the best evidence of conformance with the Standards with respect to the proficiency required of the internal audit activity?

A listing of employee profiles and certifications.

Discussions with the chief audit executive.

A listing of employee profiles and certifications.

An internal auditor believes that the internal audit activity's independence is impaired. Which of the following actions should the internal auditor take first?

Ascertain the best approach to disclose the impairment.

Report the impairment to senior management

Discuss the impairment with the audit manager

Ascertain the best approach to disclose the impairment.

Decide on the extent of impact of the impairment

In which of the following ways could stakeholders be engaged in corporate social responsibility efforts?

Communication of disclosures and external reporting,

Investigation of health and safety incidents.

Auditing of controls and management systems.

Communication of disclosures and external reporting,

Involvement in focus groups and complaint management

According to IIA guidance, which of the following statements is true regarding reporting the results of the quality assurance and improvement program?

Results of ongoing monitoring of the internal audit activity's performance must be reported to senior management and the board at least annually

Results of internal assessments need to be reported to the board at least once every five years.

The external assessor must present the findings from the external assessment to senior management and the board upon completion.

Deficiencies within the internal audit activity must be reported to the board as soon as they are noted.

Results of ongoing monitoring of the internal audit activity's performance must be reported to senior management and the board at least annually

Which of the following best describes the internal audit activity's responsibility within a risk and control framework?

The internal audit activity verifies that management has met its responsibility for implementing effective controls.

The internal audit activity constitutes the first line of defense in effective risk management.

The internal audit activity provides direction regarding internal controls implementation.

The internal audit activity verifies that management has met its responsibility for implementing effective controls.

The internal audit activity implements the internal control framework and advises management regarding best practices.

Which of the following best demonstrates that the internal audit activity is using due professional care?

Internal auditors consider the use of technology-based audit and other data analysts techniques

The internal audit activity reports directly to the board on the engagements it performs.

Internal auditors undertake the necessary training to complete their audit work.

The completion of engagements is based on the assumption that fraudulent activities may exist.

Internal auditors consider the use of technology-based audit and other data analysts techniques

Which of the following best demonstrates conformance with the Standards relating to continuing professional development of internal auditors?

Approval and signoff from the board of directors.

Regulatory approval from an accrediting agency.

Self-assessments against a competency framework.

Approval and signoff from the board of directors.

A review by external auditors on an annual basis

If an internal auditor suspects fraud during an engagement which of the following is expected of the auditor?

Evaluate the suspected activities to determine whether a forma! investigation is warranted,

Immediately inform senior management and the board of the suspected fraud.

Ascertain the level of resources needed to formally investigate the fraud, and proceed with the investigation if resources permit,

Include in the engagement documentation all possible effects and the potential impact of the fraud to the organization

Which of the following statements best describes the difference between risk appetite and risk tolerance?

Risk appetite refers to an organization's general level of acceptance, while risk tolerance is a more specific and subordinate concept.

Risk appetite applies to specific objectives, while risk tolerance refers to an organization's general attitude toward risk,

Risk appetite refers to the degree of risk acceptance for a particular objective, while risk tolerance is one approach to risk management.

Risk appetite refers to an organization's general level of acceptance, while risk tolerance is a more specific and subordinate concept.

There is no significant difference between the two terms.

An internal auditor discovered fraud while performing an audit of an organization's procurement process. Which of the following describes the greatest benefit of using forensic auditing techniques in this scenario?

Greater understanding of fraud through better evidence collection

Enhanced capability to prevent frauds from occurring.

Greater assurance that procurement frauds will be detected in a timely manner

Improved capability of evaluating fraud risks within the organization.

Greater understanding of fraud through better evidence collection

Which of the following is an example of a detective control?

Confirmation with suppliers and vendors.

Auto-correct software functionality.

Confirmation with suppliers and vendors.

Which of the following needs to be established prior to undertaking an assessment of the quality assurance and improvement program?

Department performance standards.

According to NA guidance, which of the following is true regarding typical fraud schemes?

A diversion occurs when an employee has an undisclosed personal economic interest in a transaction that adversely affects the organization.

Tax evasion is intentional reporting of false or misleading information on a tax return by an organization to reduce taxes owed.

Skimming involves stealing cash or assets from the organization and is normally concealed by adjusting the organization's records.4, Disbursement fraud occurs when a person causes the organization to issue a payment for fictitious goods or services.

IIA IIA-CIA-Part1 Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

According to IIA guidance, which of the following statements is true regarding due professional care?

Internal auditors must exercise due professional care to Insure that all significant risks will be identified,

Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor

Due professional care requires the internal auditor to conduct extensive examinations and verifications to ensure fraud does not exist,

Due professional care is displayed during a consulting engagement when the internal auditor focuses on potential benefits of the engagement rather than the cost.

Comment (0)

IIA IIA-CIA-Part1 Practice Test 2

Question

IIA IIA-CIA-Part1 Practice Tests

Practice Tests