Which of the following is a primary responsibility of senior management with respect to ethical violations?

Senior management assesses the effectiveness of the organization's ethical programs.

Senior management provides oversight for the organization's ethical climate.

Senior management promotes an ethical culture in the organization.

Senior management assesses the effectiveness of the organization's ethical programs.

Senior management reviews major ethical policies in the organization for compliance

With regard to IT governance, which of the following is the most effective and appropriate role for the internal audit activity?

Assess whether governance activities are aligned with the organization's risk appetite and take into consideration emerging risks

Independently evaluate the skills and experience of potential chief information officer candidates to assess the best fit based on the organization's risk appetite.

Evaluate the organization's governance standards and assess IT-related activities to identify gaps and develop policies, ensuring alignment with the organization's risk appetite.

Assist management in interpreting complex IT-related privacy and security risk exposures and evaluating potential mitigation strategies.

Assess whether governance activities are aligned with the organization's risk appetite and take into consideration emerging risks

Which of the following best describes organizational governance processes?

Processes employed by the board of directors to authorize and provide guidance and oversight to management to promote the achievement of organizational objectives.

Processes employed by internal and external assurance providers to authorize, direct, and provide oversight to management to better enable the meeting of organizational objectives

Processes employed by the board of directors to authorize and provide guidance and oversight to management to promote the achievement of organizational objectives.

Processes employed by the board of directors and senior management to mitigate risks to acceptable levels.

Processes employed by risk owners to mitigate risks to acceptable levels within the organization's risk appetite

Which of the following is true with regard to an organization's risk management practices?

Risks represent a single point estimate

Each organization faces the same types of risk.

Risks may relate to failing to achieve positive outcomes.

Mitigated risks are no longer considered to be inherent.

Which of the following is the best way for internal auditors to demonstrate their proficiency to effectively carry out their professional responsibilities?

Obtain appropriate professional certifications or other designations.

Volunteer for audit engagements in areas or industries in which the auditor is unfamiliar

Sign an annual attestation indicating that the auditor has all required competencies to perform her job effectively.

Obtain appropriate professional certifications or other designations.

Disclose potential impairments to independence or objectivity prior to performing an audit engagement.

Which of the following is the best example of a computer forensic audit activity?

An internal auditor recovered emails of an employee who was suspected of fraudulent activities

An internal auditor compared vendor addresses to employee home addresses.

An internal auditor used analytical software to trace all disbursements processed on weekends.

An internal auditor tried to circumvent the logical access controls of the purchasing system.

An internal auditor recovered emails of an employee who was suspected of fraudulent activities

An IT contractor applied for an internal audit position at a bank. The contractor worked for the bank's IT security manager two years ago. If the audit manager interviewed the contractor and wants to extend a job offer, which of the following actions should the chief audit executive pursue?

Allow the audit manager to hire the contractor and state that the individual is free to perform IT audits, including security.

Not allow the audit manager to hire the contractor, as it would be a conflict of interest

Allow the audit manager to hire the contractor, but state that the individual is not allowed to work on IT security audits for one year.

Not allow the audit manager to hire the contractor and ask the individual to apply again in one year.

Which of the following types of fraud tests would be most effective if an internal auditor was looking for possible fictitious vendors?

Checking for invoice amounts that do not match that of the purchase order.

Searching for identical invoice numbers and payment amounts.

Running checks to uncover post office box addresses matching employee addresses.

Comparing prices across vendors to see whether one vendor is unreasonably high.

According to IIA guidance, which of the following statements is true regarding proficiency?

Internal auditors are encouraged to obtain appropriate professional designations.

The globally accepted Certified Internal Auditor designation is mandatory at chief audit executive levels.

Internal auditors are encouraged to obtain appropriate professional designations.

Specialty designations are required for those who perform specialized audit and consulting work.

Studies for professional designations are the preferred source of continuing professional education

Which of the following statements about internal audit consulting engagements is true?

Internal auditors may provide consulting services relating to operations for which they had previous responsibilities.

The primary purpose of a consulting engagement is to assess evidence and provide conclusions.

The internal audit activity determines the nature and scope of work for the specific consulting engagement

Internal auditors may provide consulting services relating to operations for which they had previous responsibilities.

It is not appropriate to communicate control issues identified during consulting engagements to the board

Which of the following is true regarding the use of a formal risk management framework?

It defines and standardizes the terminology used in risk communication.

It facilitates a methodical approach to risk mitigation.

It defines and standardizes the terminology used in risk communication.

It establishes the risk tolerance levels to be accommodated in the strategy.

It facilitates the alignment of risk mitigation strategies with management priorities.

According to IIA guidance, which of the following is most critical to ensuring that an organization's risk management program remains effective over time?

Establishing a risk management function and appointing a chief risk officer.

Ensuring a fully executed assurance role for the internal audit activity.

Conducting risk evaluations that include ranking the relative importance of each risk.

Establishing a risk management function and appointing a chief risk officer.

Conducting a combination of ongoing risk reviews and individual evaluations.

Which of the following statements is true regarding consulting engagements?

The nature of consulting services to be performed by internal auditors must be defined in the internal audit charter

Internal auditors cannot provide consulting services related to operations for which they had previous responsibilities.

The nature of consulting services to be performed by internal auditors must be defined in the internal audit charter

If internal auditors have potential impairments to objectivity related to the proposed consulting engagement, the engagement must be declined.

If internal auditors lack the knowledge, skills, or other competencies needed to perform the consulting engagement, the engagement can proceed with proper disclosures.

Which of the following describes two duties that should not be performed by the same person?

Recording cash receipts and preparing bank reconciliations.

Posting cash receipts and cash payments to the general ledger.

Posting bad debt write-offs and reconciling the accounts payable subsidiary ledger.

Distributing payroll checks and approving sales returns for credit.

Recording cash receipts and preparing bank reconciliations.

Which of the following actions should the audit committee take to promote organizational independence for the internal audit activity?

Approve the annual budget and resource plan for the internal audit activity.

Delegate final approval of the risk-based internal audit plan to the chief audit executive (CAE).

Approve the annual budget and resource plan for the internal audit activity.

Assist the CAE with hiring objective and competent internal audit staff.

Encourage the CAE to communicate and coordinate with the external auditor.

An organization is testing a new IT system for digital data storage and security. The internal audit activity has been asked to evaluate the system in a consulting engagement. Although several internal auditors on staff are qualified to perform basic assessments of IT systems, none are familiar with the new system. Which of the following is a legitimate response to the prospective client?

Proceed with the engagement, performing only those parts of the engagement that the internal auditors are qualified to perform.

Accept the engagement and develop the additional competencies in-house prior to the engagement's starting date.

Make arrangements to obtain assistance from a competent IT auditing expert.

According to IIA guidance, which of the following actions best demonstrates due professional care by an internal auditor when she discovers a number of fraud-related red flags during an audit engagement?

Perform further testing to verify the existence of fraud.

Conclude the engagement and inform management that fraud has occurred

Perform further testing to verify the existence of fraud.

Suspend the engagement and undertake a formal fraud investigation.

Notify the board of the possible fraud immediately

In which of the following scenarios would the internal auditor's objectivity be best protected?

An internal auditor conducts an effectiveness review of an organization's business continuity plan in which his son is a minority stockholder.

A former human resources manager conducts an effectiveness review of the appointment and termination process six months after transferring to the internal audit activity.

An accounts payable clerk assists the internal auditors during an effectiveness review of the physical access controls to the server room.

An internal auditor writes the system manual for a newly acquired payroll software application prior to conducting an effectiveness review of the system.

An internal auditor conducts an effectiveness review of an organization's business continuity plan in which his son is a minority stockholder.

An organization's board recommends revising the internal audit charter by adding requirements regarding the hiring and compensation of the chief audit executive as well as information on approving the internal audit budget. Which of the following is the board most likely defining in the charter?

Independence and objectivity of internal audit activity.

Functional and administrative responsibilities of internal audit activity.

Authority and objectivity of internal audit activity.

Independence and objectivity of internal audit activity.

Assurance and improvement of internal audit activity.

According to IIA guidance, which of the following actions by a new chief audit executive would be most appropriate to gain an understanding of the current level of knowledge, skills, and competencies required by an internal audit activity to fulfill its responsibilities?

Identify gaps in the activity's proficiency, based on criteria defined by a widely accepted competency framework.

Have a quality assessment review performed by an expert external entity.

Identify a mature internal audit activity to serve as a benchmark for measuring the internal audit activity's competence.

Assess whether members of the internal audit activity understand and apply the 11As mandatory guidance.

Which of the following is the best example of a risk appetite statement concerning an investment portfolio?

We have a moderate tolerance for investment earnings volatility with a target value at risk of S50 million.

We will request CEO approval for investments greater than S20 million and board approval for investments greater than $50 million.

We will hedge 95 percent of our U S. currency exposure and 100 percent of our European currency exposure.

We have a moderate tolerance for investment earnings volatility with a target value at risk of S50 million.

We will report to the risk committee all credit losses greater than S10 million and all market value losses greater than S20 million.

According to IIA guidance, which of the following would be included in an internal audit charter to help establish the authority of the internal audit activity?

Document the chief audit executive's (CAE's) reporting line

Outline expectations for communicating the results of all aspects of the internal audit activity.

Declare the internal audit activity's accountability for safeguarding assets and confidentiality.

Document the chief audit executive's (CAE's) reporting line

Document agreement between the CAE and the individual to whom the CAE reports

Why is it imperative for the chief audit executive to track and develop the educational qualifications of internal audit staff?

To ensure that the resources needed to complete the audit plan are available.

To accurately conduct performance appraisals

To ensure that staff complete required continuing professional education credits annually.

To ensure that the resources needed to complete the audit plan are available.

To satisfy the audit committee requirements.

Which of the following would be the best choice for a continuing professional development requirement for a newly created internal audit activity?

Require all internal auditors to create a training plan based on a competency self-assessment.

Require internal auditors to complete all of their training through webinars, to increase efficiency and avoid traveling

Require all internal auditors to become a member of The Institute of Internal Auditors.

Require internal auditors to create a training plan based on their areas of interest

Which of the following is considered to be a threat to the internal auditor's objectivity?

The auditor drafted the operational procedures of the area that she is currently auditing.

The auditor received a bonus that was approved by the board of directors.

The assigned auditor recommended operational procedures for the organization.

The assigned auditor rotated out of the same business activity three years ago

Which of the following indicates an appropriate disclosure of a potential nonconformance with the Standards?

An external assessment of the internal audit activity was last performed six years ago.

The internal audit activity has been in existence for four years but has not performed an external assessment.

An internal assessment is not performed every year.

The internal audit activity has been in existence for two years and has documented only an internal assessment.

Which of the following best describes the differences between internal auditors and external auditors?

External auditors are not employees of the organization, while internal auditors are employees who have in-depth knowledge of the business, making their opinion more reliable to the board and senior management.

External auditors are concerned about misstatements in the organization's financial statements, while internal auditors are concerned about fraudulent activities that could impact the organization's financial statements

External auditors are required to hold an accounting designation and are responsible for continuing their education, while internal auditors are required to hold an internal audit designation.

External auditors focus on the accuracy and understandability of financial statements, while internal auditors help the organization accomplish its objectives by evaluating and improving the effectiveness of the control process.

External auditors are not employees of the organization, while internal auditors are employees who have in-depth knowledge of the business, making their opinion more reliable to the board and senior management.

A fraud investigation was completed by management, and a proven fraud was communicated to relevant authorities. According to IIA guidance, which of the following roles would be most appropriate for the internal audit activity to undertake after the investigation?

Conduct lessons learned sessions to ascertain how the fraud occurred and which controls failed.

Plan employee sessions and team building strategies for the organization to improve awareness of fraud among employees

Review the investigation and implement any improvements to the process.

Conduct lessons learned sessions to ascertain how the fraud occurred and which controls failed.

Determine why the fraud was not detected earlier and design controls to strengthen early detection.

Which of the following would be the most appropriate first step for the board to take when developing an effective system of governance?

Establish a governance committee.

Determine the organization's overall risk appetite.

Establish a governance committee.

Delegate authority to members of senior management.

Identify key stakeholders and their expectations

According to MA guidance, which of the following gives the internal audit activity the authority to request supporting documentation for the invoices of a third-party service provider?

The internal audit policy manual.

The quality assurance and improvement program.

Which of the following is a responsibility of the internal audit activity as it relates to risk and risk management?

Ensuring an adequate risk management system is in place.

Evaluating and suggesting improvements to the risk management process.

Establishing the organization's risk appetite.

Determining whether the risk attitude is aligned with shareholder interests.

Ensuring an adequate risk management system is in place.

IIA IIA-CIA-Part1 Practice Test 8 - Free Online Exam Prep & Questions

Question 1 / 40

Which of the following scenarios best illustrates a rationalization as the root cause of potential fraud?

Managers who have been with the organization for several decades become aware that newly hired, younger managers are being moved more quickly into senior positions.

The controller at a nationwide manufacturing company recently opted to no longer require twoweek mandatory vacations for accounting staff.

Security cameras that monitor cash handling at the register are not functioning.

The organization is slowly phasing out three mature products that produce the highest commissions for the sales staff

Comment (0)

IIA IIA-CIA-Part1 Practice Test 8

Question

IIA IIA-CIA-Part1 Practice Tests

Practice Tests