According to The IIA's Code of Ethics, which of the following statements is true?

When an internal auditor disagrees with the treatment received by workers in the organization's foreign subsidiary and alters the audit program to highlight the issue, the fails to demonstrate objectivity.

When an internal auditor releases required information to a regulator, resulting in a significant loss through fines and penalties for the organization, he fails to add value.

When an internal auditor limits the scope of the audit engagement after learning that management is hiding relevant information, he demonstrates integrity.

When an internal auditor disagrees with the treatment received by workers in the organization's foreign subsidiary and alters the audit program to highlight the issue, the fails to demonstrate objectivity.

When an internal auditor continues with an audit engagement, despite the audit client's claims that the work performed is unnecessary and redundant, he fails to demonstrate competency.

According to The IIA's Code of Ethics, which of the following scenarios offers the best example of violating the principle of integrity?

An internal audit manager provides sample audit reports and workpapers to a friend without obtaining prior approval

An internal audit manager collaborates with senior management to provide misleading information to government authorities.

An internal audit manager provides sample audit reports and workpapers to a friend without obtaining prior approval

An internal audit manager carries out a technical audit request without seeking expert opinion, despite a lack of the requisite skills.

An internal audit manager assigned to audit a sales process failed to reveal that the process owner is a relative

Which of the following statements is most likely to be true regarding a consulting engagement involving an organization's new payroll system?

The internal auditor and engagement client established an understanding that the scope would include the new payroll system project.

The payroll system engagement was scheduled as a result of internal audit's risk-based annual planning process.

The internal auditor concluded that the engagement objectives would include assessing the effectiveness of the payroll process controls.

The internal auditor acknowledged the engagement client's satisfactory performance in the final engagement results that were communicated to senior management and the board.

A large commercial bank was fined by regulators for fraudulent practices when employees, over a period of time, opened thousands of new accounts for existing clients without the clients' consent. It was later found that employees were given unrealistic new account targets and were aggressively monitored by management on a daily basis.Which of the following controls would have most likely reduced the likelihood of the fraudulent practice from occurring?

An evaluation of the current performance and compensation program.

The performance of background investigations on all existing employees.

The availability of fraud training to all employees.

The availability of an employee whistleblower hotline

Which of the following best demonstrates that an internal auditor is applying due professional care when planning an assurance engagement?

Conducting the engagement on the presupposition that fraud exists.

Assessing the risk of noncompliance with laws and regulations

Following the policies as prescribed by the internal audit manual.

Advising management of the area under review on how to mitigate internal control risks.

Conducting the engagement on the presupposition that fraud exists.

An internal audit team analyzed the organization's value-at-risk model during an assurance engagement and suggested several useful improvements. Management was impressed by the internal audit team's work and requested additional actions. Which of the following requested actions would impact internal audit independence most severely if fulfilled?

Assess the effectiveness of the model at least semi-annually.

Modify model inputs and suggest courses of action based on outcomes.

Employ acquired experience to test other models used by the company.

Validate whether model outputs serve the purpose stated by the model.

Which of the following actions taken during an audit engagement is the best demonstration of an internal auditor's due professional care?

Consider the possibility of noncompliance or irregularities at all times during an engagement.

Ensure that all financial information related to the engagement is included in the audit plan and examined for irregularities.

Document all audit tests completely.

Consider the possibility of noncompliance or irregularities at all times during an engagement.

Notify the audit committee of any noncompliance or irregularity discovered during an engagement

Which of the following statements would typically be included in the responsibility section of the internal audit charter?

The internal audit activity shall develop a flexible audit plan, based on a risk assessment conducted at least annually and taking into consideration the risks or control concerns identified by management, and shall submit the plan to the board for approval.

The internal audit activity will have free and unrestricted access to the chief executive officer, audit committee, and chairman of the board of directors.

The internal audit activity shall develop a flexible audit plan, based on a risk assessment conducted at least annually and taking into consideration the risks or control concerns identified by management, and shall submit the plan to the board for approval.

The chief audit executive shall obtain the necessary assistance of personnel in areas where audits are performed, as well as specialized services within or outside of the organization.

The internal audit activity will not implement controls, develop procedures, install systems, prepare records, or engage in activities that may impair internal auditors' judgments.

According to IIA guidance, which of the following is necessary for internal auditors to comply with the requirements for proficiency?

Ability to provide relevant advice and recommendations to management and the board.

Sufficient consideration of current activities, trends, and emerging issues to effectively carry out their professional responsibilities.

Ability to provide relevant advice and recommendations to management and the board.

Understanding of key IT risks and controls and the ability to identify fraud using technology-based audit techniques.

Knowledge, skills, and other competencies necessary to perform individual responsibilities during the engagement.

Which of the following scenarios best demonstrates the application of internal audit proficiency?

Management requests that the internal audit activity review and provide feedback on its strategic plans for a merger, but the chief audit executive (CAE) declines the engagement due to the team's lack of experience with mergers.

A CAE reassigns auditors from other audits to perform testing on all of the fixed asset additions for a period, including amounts below the materiality level stated by external auditors.

Due to the routine and recurring nature of bank branch audits, an audit manager often excludes detailed planning at the beginning of the audit and immediately performs fieldwork.

During fieldwork, an auditor observed a lack of segregation of duties over cash management. The auditor reported this observation to his supervisor, who decided that the area should be examined in a subsequent audit.

According to IIA guidance, which of the following should be formally documented in the internal audit charter?

The nature of consulting services provided by the internal audit activity.

The internal audit activity's responsibility for imposing risk management processes.

The internal audit activity's responsibility for the organization's governance framework.

The nature of consulting services provided by the internal audit activity.

The budgeting process for the internal audit activity.

Which of the following is an example of a risk avoidance strategy?

Selling a nonstrategic business unit.

Hedging against exchange rate variations.

Limiting access to an organization's data center.

Selling a nonstrategic business unit.

Outsourcing a high-risk activity

An accounts payable clerk who has access to the vendor master file replaced the payment details of a legitimate vendor with those of a friend before processing the payment through the organization's cashier. Immediately afterward, he restored the original vendor information. Which of the following controls could have prevented this fraud?

Approval of master file change requests by the accounts payable supervisor

Comparison of the check register to original invoices.

Segregation of duties between accounts payable and the cashier.

Frequent issuance of account statements sent to the vendors.

The internal auditor obtained large volumes of transaction history data for accounts on which he suspected that some fraudulent transactions occurred. Which of the following actions best demonstrates due professional care by the internal auditor?

The internal auditor employed the use of data analytics tools to sort, analyze, and detect anomalies in the data

The internal auditor carefully scrutinized the data by manually reviewing each transaction to ensure that all irregularities were identified.

The internal auditor employed the use of data analytics tools to sort, analyze, and detect anomalies in the data

The internal auditor started the data analysis process by selecting a random sample of transactions on which to perform further tests.

The internal auditor requested that the branch supervisor assist in identifying fraudulent transactions, as he was most familiar with the accounts being audited.

Which of the following would provide the best support for internal auditors to meet their continuing professional development requirements?

Performance reviews comparing internal auditors' achievements against specified goals.

Access to online internal audit and business skills courses.

Records of self-assessment reports completed by the internal audit staff.

Cosourcing arrangements with external providers on specific engagements.

Performance reviews comparing internal auditors' achievements against specified goals.

In which of the following scenarios would the chief audit executive (CAE) be required to decline the assignment?

There is no available expertise on the internal audit team to perform a consulting engagement

The CAE would need to procure external services to deliver the internal audit assurance program.

There is no expertise within the internal audit team for detecting and investigating fraud.

There is no expertise within the internal audit team for auditing an IT engagement.

There is no available expertise on the internal audit team to perform a consulting engagement

According to IIA guidance, which of the following statements is true regarding ISO 31000?

The end point for improving an organization s approach to risk management should be a gap analysis that evaluates any changes.

The key principles approach checks whether each element of the risk management process is in place.

The framework is effective in addressing the organization's structure, size, and risk profile but not its culture objectives.

The end point for improving an organization s approach to risk management should be a gap analysis that evaluates any changes.

A combination of the three primary approaches to the framework generally yields the most information despite the complexity

What should the chief audit executive do when the internal audit activity is found to be in nonconformance with the Code of Ethics or the Standards?

Determine how the deviation impacted the overall scope of the internal audit activity.

Assign competent staff to the area under audit to remediate the nonconformance.

Determine how the deviation impacted the overall scope of the internal audit activity.

Meet with the board to gam an understanding of the board's expectations.

Communicate the matter to the board at the time of the next external assessment.

The internal audit activity audited an organization's risk management function multiple times, and the recommendations that were made remain unaddressed by the head of risk management. Which of the following would be the next step for the internal audit activity?

The CAE should determine which recommendations to implement based on the severity of the associated risks.

The internal audit activity should add value by implementing the recommendations on management's behalf.

The chief audit executive (CAE) must discuss this matter with senior management and the board

The CAE should determine which recommendations to implement based on the severity of the associated risks.

The internal audit activity, led by the CAE. should assume responsibility for risk management function.

Which of the following conditions classifies an engagement as a consulting service provided by the internal audit activity?

he internal audit engagement involves only two parties: the internal auditor and the engagement client.

The internal auditor assigned to the engagement previously worked in the area under review and lacks objectivity.

The internal audit engagement will involve providing an opinion on the effectiveness of controls.

The internal auditor assigned to the engagement was specifically requested by management of the area under review.

he internal audit engagement involves only two parties: the internal auditor and the engagement client.

A whistleblower reveals to the chief audit executive (CAE) detailed allegations of potential fraud at the senior management level. Although the CAE has some experience in the area, she chooses to retain an external fraud expert to conduct the investigation. When asked by the director of finance to defend the expenditure, which of the following statements represents the CAE's best response?

The CAE refers to the Standards and explains that the internal audit activity must obtain competent assistance if needed.

The CAE refers to the Standards and explains that to protect her independence, she needs to remain isolated from the investigation.

The CAE refers to the Standards and explains that the internal audit activity must obtain competent assistance if needed.

The CAE refers to the Standards and explains that to protect her objectivity, she needs to remain isolated from the investigation.

The CAE describes the specifics of the allegation to underscore the importance of the situation and the need for expert investigation

Guidelines need to be set for various levels of suspected fraud within an organization and when it would be reported to the audit committee. Which of the following would be reported at the next meeting?

Theft using collusion for more than $10,000. but not involving senior management.

Minor theft of less than $10,000, not involving senior management.

Theft using collusion for more than $10,000. but not involving senior management.

Denial of access to requested employees during an audit.

Discussion of replacement of the chief audit executive.

To assure that the technical proficiency of internal auditors is appropriate for the audit engagements to be performed, a chief audit executive should:

Consider the scope of work and level of responsibility when establishing criteria for education and experience in filling internal audit positions.

Ensure that each newly hired auditor is qualified in all of the disciplines needed to accomplish the department's audit mission.

Oversee a training program that matches the actual training provided with the interests of individual auditors.

Require all of the audit staff to pursue a minimum number of continuing professional education hours each year

Which of the following is a detective control strategy against fraud?

Requiring employees to attend ethics training.

Performing background checks on employees.

Implementing a control self-assessment.

Which of the following statements is true regarding the disclosure of results of the quality assurance and improvement program?

If nonconformance affects its ability to fulfill its professional responsibilities or stakeholder expectations, the internal audit activity should disclose nonconformance as well as its impact.

If the results of both internal and external assessments support conformance with the Standards, the internal audit activity must communicate this to the board and senior management in writing.

If it has been in existence fewer than five years and has no documented external assessment, the internal audit activity may not indicate that it is operating in conformance with the Standards.

If nonconformance affects its ability to fulfill its professional responsibilities or stakeholder expectations, the internal audit activity should disclose nonconformance as well as its impact.

If an external assessment reflects an overall conclusion of nonconformance, the internal audit activity may continue to communicate that it conforms with the Standards if it discloses a remediation plan, including timeline with subsequent validation.

Following a quality assurance review of a small internal audit activity, the external reviewer and the chief audit executive (CAE) cannot agree on the importance of several deficiencies noted during the review. Which of the following would be the most appropriate next step for the reviewer to take?

Request arbitration from the audit committee to resolve discrepancies prior to issuing the final report

Remove the areas of disagreement from the scope of the engagement and seek informal compromises with the CAE.

Issue the report to senior management, noting the deficiencies for immediate resolution.

Issue the report, noting the deficiencies with comments that address the areas of disagreement.

Request arbitration from the audit committee to resolve discrepancies prior to issuing the final report

Which of the following activities should the chief audit executive perform to ensure compliance with an organization's code of conduct?

Act as an advisor to the committee responsible for reviewing violations of the code.

Review and adjudicate all violations of the code of conduct.

Lead the committee responsible for the oversight of the code.

Implement a system of procedures to inform all employees of the code.

Which of the following best demonstrates the authority of the internal audit activity?

Determining the scope of internal audit services

Suggesting alternatives to decision makers.

Improving the integrity of information.

Determining the scope of internal audit services

Achieving engagement objectives.

Which of the following would the chief audit executive be required to disclose in the communication of quality assessment results to senior management and the board?

A potential conflict of interest of the assessment team.

The cost and frequency of both internal and external assessments.

Any assumptions made by the assessment team

A potential conflict of interest of the assessment team.

The assessment team's execution plan of relevant procedures.

An internal auditor performed a risk assessment and concluded that the controls over access privileges to a bank account were appropriate. Later, the auditor learned that a contractor was using a shared password provided by an authorized user of the account. Which of the following statements best describes the auditor's application of due professional care?

Due professional care was not exercised because the residual risk from the possibility of authorized users sharing their passwords was not considered.

Due professional care was exercised, despite the auditor's failure to identify the significant risk.

Due professional care was not exercised because the auditor failed to identify all the significant risks during the risk assessment.

Due professional care was not exercised because the residual risk from the possibility of authorized users sharing their passwords was not considered.

Due professional care was not exercised because the auditor failed to conduct interviews to obtain testimonial evidence of possible password sharing

Which competency is required of all staff internal auditors prior to the commencement of an IT audit?

The ability to assess IT governance.

The ability to provide an on the risk profile of the organization to the board and senior management.

The ability to ensure that proposals for improvements to internal controls are balanced with organizational objectives and capabilities.

The ability to assess the potential for fraud risk and identifying common types of fraud associated with the engagement.

According to IIA guidance, which of the following is the primary reason the chief audit executive discusses the internal audit charter with senior management and the board?

To provide information on existing internal audit planning, changes to the internal audit plan, and the rationale for the changes

To provide guidance and solicit feedback on managing the internal audit activity as expected by various stakeholders.

To provide an understanding of the Mission of Internal Audit and The IIA's mandatory guidance elements.

To provide an update on the internal audit activity's quality of engagement supervision.

To provide information on existing internal audit planning, changes to the internal audit plan, and the rationale for the changes

A significant number of employees expressed concerns of a hostile work environment within a large manufacturing plant, which is in contrast to the organization's stated culture of tolerance and open communication. Which of the following approaches would be most effective for an internal auditor to assess whether the organization supports a culture of tolerance and open communication?

Evaluate organization policies and procedures for references related to encouraging tolerance and open communication.

Assess plant employees' social media activity for specific messages related to tolerance and open communication

Compare plant employees' compensation and benefits with those at similar sized organizations that have a stated culture of tolerance and open communication.

Evaluate organization policies and procedures for references related to encouraging tolerance and open communication.

Conduct a meeting with all plant employees and management to discuss tolerance and open communication

IIA IIA-CIA-Part1 Practice Test 7 - Free Online Exam Prep & Questions

In which of the following scenarios would it be appropriate for the chief audit executive (CAE) to report that the internal audit activity conforms with the Standards?

Become a Premium Member for full access

Unlock Premium Member

IIA IIA-CIA-Part1 Practice Test 7

Question

IIA IIA-CIA-Part1 Practice Tests

Practice Tests