According to IIA guidance, which of the following would not be a consideration for the internal audit activity (IAA) when determining the need to follow-up on recommendations?

Amount of resources required to conduct the follow-up activities.

Degree of effort and cost needed to correct the reported condition.

Complexity of the corrective action.

Impact that may result should the corrective action fail.

Amount of resources required to conduct the follow-up activities.

Which of the following is an appropriate responsibility for the internal audit activity with regard to the organization's risk management program?

Ensuring that a proper and effective risk management process exists.

Identifying and managing risks in line with the entity's risk appetite.

Ensuring that a proper and effective risk management process exists.

Attaining an adequate understanding of the entity's key mitigation strategies.

Identifying and ensuring that appropriate controls exist to mitigate risks.

Which of the following is a detective control for managing the risk of fraud?

Receipts for employee expenses.

Awareness of prior incidents of fraud.

Contractor non-disclosure agreements.

Verification of currency exchange rates.

Receipts for employee expenses.

Which of the following is a justifiable reason for omitting advance client notice when planning an audit engagement?

The engagement includes audit assurance procedures such as sensitive or restricted asset verifications.

Advance notice may result in management making corrections to reduce the number of potential deficiencies.

Previous management action plans addressing prior internal audit recommendations remain incomplete.

The engagement includes audit assurance procedures such as sensitive or restricted asset verifications.

The audit engagement has already been communicated and approved through the annual audit plan.

The external auditor has identified a number of production process control deficiencies involving several departments. As a result, senior management has asked the internal audit activity to complete internal control training for all related staff. According to IIA guidance, which of the following would be the most appropriate course of action for the chief audit executive to follow?

Accept the engagement but hire an external training specialist to provide the necessary expertise.

Refuse to accept the consulting engagement because it would be a violation of independence.

Collaborate with the external auditor to ensure the most efficient use of resources.

Accept the engagement but hire an external training specialist to provide the necessary expertise.

Accept the engagement even if the audit engagement staff was previously responsible for operational areas being trained.

Which of the following is not a primary reason for outsourcing a portion of the internal audit activity?

To provide the organization with appropriate contingency planning for the internal audit function.

To gain access to a wider variety of skills, competencies and best practices.

To complement existing expertise with a required skill and competency for a particular audit engagement.

To focus on and strengthen core audit competencies.

To provide the organization with appropriate contingency planning for the internal audit function.

Which of the following statements about internal audit's follow-up process is true?

Internal auditors have responsibility for determining if management and the board have implemented the recommended action or otherwise accepted the risk.

The nature, timing, and extent of follow-up for assurance engagements is standardized to ensure quality performance.

The actions of external auditors and other external assurance providers is not encompassed by internal audit's follow-up process.

Internal auditors have responsibility for determining if management and the board have implemented the recommended action or otherwise accepted the risk.

The follow-up process must be complete and documented in the working papers in order to conclude the engagement.

A manufacturer is under contract to produce and deliver a number of aircraft to a major airline. As part of the contract, the manufacturer is also providing training to the airline's pilots. At the time of the audit, the delivery of the aircraft had fallen substantially behind schedule while the training had already been completed. If half of the aircraft under contract have been delivered, which of the following should the internal auditor expect to be accounted for in the general ledger?

All completed training costs, and the cost of actual production hours completed to date.

Training costs allocated to the number of aircraft delivered, and the cost of actual production hours completed to date.

All completed training costs, and the cost of actual production hours completed to date.

Training costs allocated to the number of aircraft delivered, and 50% of contracted production costs.

All completed training costs, and 50% of the contracted production costs.

An internal auditor determines that certain information from the engagement results is not appropriate for disclosure to all report recipients because it is privileged. In this situation, which of the following actions would be most appropriate?

Disclose the information in a separate report.

Distribute the information in a confidential report to the board only

Distribute the reports through the use of blind copies.

Exclude the results from the report and verbally report the conditions to senior management and the board.

For which of the following fraud engagement activities would it be most appropriate to involve a forensic auditor?

Preparing evidentiary documentation.

Independently evaluating conflicts of interests.

Assessing contracts for relevant terms and conditions.

Performing statistical analysis for data anomalies.

Preparing evidentiary documentation.

According to IIA guidance, which of the following are appropriate actions for the chief audit executive regarding management's response to audit recommendations?

Evaluate and verify management's response, and determine the need and scope for additional work.

Evaluate and verify management's response, and establish timelines for corrective action by management.

Oversee the corrective actions undertaken by management, and determine the need and scope for additional work.

Oversee the corrective actions undertaken by management, and establish timelines for corrective action by management.

The newly appointed chief audit executive (CAE) of a large multinational corporation, with seasoned internal audit departments located around the world, is reviewing responsibilities for engagement reports. According to IIA guidance, which of the following statements is true?

The CAE may delegate responsibility for reviewing, approving and signing engagement reports, but should review the reports after they are issued.

The CAE is required to review, approve, and sign every engagement report.

The CAE is required to review, approve, and sign all regulatory compliance engagement reports only

The CAE may delegate responsibility for reviewing, approving and signing engagement reports, but should review the reports after they are issued.

The internal audit charter must identify authorized signers of engagement reports.

The internal audit activity (IAA) wants to measure its performance related to the quality of audit recommendations. Which of the following client survey questions would best help the IAA meet this objective?

Were audit findings relevant and useful to management?

Does the audit report format present issues clearly and concisely?

Does the IAA work with a high degree of professionalism and objectivity?

Were the findings reported in a timely manner?

An internal auditor and engagement client are deadlocked over the auditor's differing opinion with management on the adequacy of access controls for a major system. Which of the following strategies would be the most helpful in resolving this dispute?

Escalate the issue to senior management for a decision.

Conduct a joint brainstorming session with management.

Ask the chief audit executive to mediate.

Disclose the client's differing opinion in the final report.

Escalate the issue to senior management for a decision.

When setting the scope for the identification and assessment of key risks and controls in a process, which of the following would be the least appropriate approach?

Develop the scope of the audit based on a bottom-up perspective to ensure that all business objectives are considered.

Develop the scope of the audit to include controls that are necessary to manage risk associated with a critical business objective.

Specify that the auditors need to assess only key controls, but may include an assessment of non-key controls if there is value to the business in providing such assurance.

Ensure the audit includes an assessment of manual and automated controls to determine whether business risks are effectively managed.

According to IIA guidance, which of the following is true when the internal audit activity is asked to investigate potential ethics violations in a foreign subsidiary?

Communication of any internal ethics violations to external parties may occur with appropriate safeguards.

Cultural impacts are less critical where the organization practices uniform polices around the globe.

Cross-cultural differences should always be handled by the staff of the same cultural background.

Local law enforcement should be involved as they are more familiar with the applicable local laws.

It is close to the fiscal year end for a government agency, and the chief audit executive (CAE) has the following items to submit to either the board or the chief executive officer (CEO) for approval. According to IIA guidance, which of the following items should be submitted only to the CEO?

A request for an increase of the CAE's salary for the next fiscal year.

The internal audit risk assessment and audit plan for the next fiscal year.

The internal audit budget and resource plan for the coming fiscal year.

A request for an increase of the CAE's salary for the next fiscal year.

The evaluation and compensation of the internal audit team.

An internal control questionnaire would be most appropriate in which of the following situations?

Testing controls in decentralized offices.

Testing controls where operating procedures vary.

Testing controls in decentralized offices.

Testing controls in high risk areas.

Testing controls in areas with high control failure rates.

According to IIA guidance, which of the following statements is true regarding the authority of the chief audit executive (CAE) to release previous audit reports to outside parties?

The CAE can release prior internal audit reports with the approval of the board and senior management.

The CAE can employ judgment and release prior audit results as they deem appropriate and necessary.

The CAE can only release prior information outside the organization when mandated by legal or statutory requirements.

The CAE can release prior information provided it is as originally published and distributed within the organization.

An internal auditor has been assigned to facilitate a risk and control self-assessment for the finance group. Which of the following is the most appropriate role that she should assume when facilitating the workshop?

Provide appropriate techniques and guidelines on how the exercise should be undertaken.

Express an opinion on the participants' inputs and conclusions as the assessment progresses.

Provide appropriate techniques and guidelines on how the exercise should be undertaken.

Evaluate and report on all issues that may be uncovered during the exercise.

Screen and vet participants so that the most appropriate candidates are selected to participate in the exercise.

An audit identified a number of weaknesses in the configuration of a critical client/server system. Although some of the weaknesses were corrected prior to the issuance of the audit report, correction of the rest will require between 6 and 18 months for completion. Consequently, management has developed a detailed action plan, with anticipated completion dates, for addressing the weaknesses. What is the most appropriate course of action for the chief audit executive to take?

Evaluate the ability of the action plan to correct the weaknesses and monitor key dates and deliverables.

Assess the status of corrective action during a follow-up audit engagement after the action plan has been completed.

Assess the effectiveness of corrections by reviewing statistics related to unplanned system outages, and denials of service.

Reassign information systems auditors to assist in implementing management's action plan.

Evaluate the ability of the action plan to correct the weaknesses and monitor key dates and deliverables.

Which of the following is not an outcome of control self-assessment?

Informal, soft controls are omitted, and greater focus is placed on hard controls.

The entire objectives-risks-controls infrastructure of an organization is subject to greater monitoring and continuous improvement.

Internal auditors become involved in and knowledgeable about the self-assessment process.

Nonaudit employees become experienced in assessing controls and associating control processes with managing risks.

New environmental regulations require the board to certify that the organization's reported pollutant emissions data is accurate. The chief audit executive (CAE) is planning an audit to provide assurance over the organization's compliance with the environmental regulations. Which of the following groups or individuals is most important for the CAE to consult to determine the scope of the audit?

The environmental, health, and safety manager.

The audit committee of the board.

The environmental, health, and safety manager.

The organization's external environmental lawyers.

The organization's insurance department.

The board has asked the internal audit activity (IAA) to be involved in the organization's enterprise risk management process. Which of the following activities is appropriate for IAA to perform without safeguards?

Evaluate risk management processes.

Coach management in responding to risks.

Develop risk management strategies for board approval.

Facilitate identification and evaluation of risks.

Evaluate risk management processes.

Which of the following statements is false regarding roles and responsibilities pertaining to risk management and control?

Senior management is charged with overseeing the establishment risk management and control processes.

The chief audit executive is responsible for overseeing the evaluation risk management and control processes.

Operating managers are responsible for assessing risks and controls in their departments.

Internal auditors provide assurance about risk management and control process effectiveness.

Which of the following statements describes an engagement planning best practice?

Engagement planning activities include setting engagement objectives that align with audit client's business objectives.

It is best to determine planning activities on a case-by-case basis because they can vary widely from engagement to engagement.

If the engagement subject matter is not unique, it is not necessary to outline specific testing procedures during the planning phase.

The engagement plan includes the expected distribution of the audit results, which should be kept confidential until the audit report is final.

Engagement planning activities include setting engagement objectives that align with audit client's business objectives.

Which of the following is not a primary purpose for conducting a walk-through during the initial stages of an assurance engagement?

To test the adequacy of controls.

To determine segregation of duties.

To test the adequacy of controls.

IIA IIA-CIA-Part2 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

According to IIA guidance, which of the following actions might place the independence of the internal audit function in jeopardy?

Having no active role or involvement in the risk management process.

Auditing the risk management process for reasonableness.

Coordinating and managing the risk management process.

Participating with management in identifying and evaluating risks.

Comment (0)

IIA IIA-CIA-Part2 Practice Test 1

Question

IIA IIA-CIA-Part2 Practice Tests

Practice Tests