Which of the following is an appropriate activity when supervising engagements?

During engagement planning, the audit work program should be discussed between auditors and the engagement supervisor with the supervisor approving the work program.

During fieldwork, scope changes made to the work program are at the auditor's discretion and should be supported adequately in the workpapers.

Engagement supervision is most critical to the fieldwork and reporting phases of the audit, as this is where the majority of the work takes place.

A degree of high supervision to no supervision may be provided to an auditor depending on his level of competence and the complexity of the engagement.

During an engagement in one of the subsidiaries of an organization, an internal auditor noted the following in the workpapers:'As a subsidiary of a multinational organization in this particular country, the entity is required to register annually with the respective ministry. However, the subsidiary did not submit the required documentation for registration during the prior year. Failure to comply with internal and external regulations could lead to penalties or fines from the respective authorities. It is recommended that the management of the subsidiary ensures compliance with the relevant legislation. As a recoverable action, management should register the subsidiary in the current year as soon as possible.'What part of this narrative represents a condition of the observation made by auditors in the final report?

' ... the subsidiary did not submit required documentation for registration in the prior year.'

' ... the entity is required to register annually with the respective ministry.'

' ... failure to comply with internal and external regulations might lead to penalties or fines from the respective authorities.'

' ... management should register the subsidiary in the current year as soon as possible

How should an internal auditor approach preparing a detailed risk assessment during engagement planning?

Work with management of the function being reviewed, as management would be most familiar with the business objectives and related risks.

Complete the risk assessment independently to prevent conflicts of interest with the function being reviewed.

Work with external auditors to ensure that the risk assessment includes items reflected on the independent auditor's report.

Work with management of the function being reviewed, as management would be most familiar with the business objectives and related risks.

Consult with the compliance department, which typically has a more comprehensive view of the organization.

An organization owns vehicles that are kept off-site by employees to pick up and deliver orders. An internal auditor selects a specific vehicle from the fixed asset register for testing. Which of the following would best provide sufficient, indirect evidence for the auditor to confirm the existence of the vehicle?

Compare the registered details of the vehicle in the fixed asset register to a date-stamped photograph of the vehicle.

Review logs of the vehicles assigned to employees for the delivery of goods during the engagement period.

Visit the home address of the specific employee to see the selected vehicle.

Compare the registered details of the vehicle in the fixed asset register to a date-stamped photograph of the vehicle.

Seek independent confirmation of the vehicle's details from one of the delivery employees.

An internal audit report includes a recommendation to remove inappropriate user access to an IT application. Which of the following does the recommendation represent?

A cause-based recommendation to prevent inappropriate access being granted again.

An agreed action adopted by management.

A condition-based recommendation as an interim solution to correct a current condition.

A cause-based recommendation to prevent inappropriate access being granted again.

An internal auditor used a risk and control matrix to prepare a work program for testing a software release. During the engagement planning stage, he tested the design of the release procedure as a key control and concluded that the control was not designed well. During the performance stage, he tested the operation of this control and concluded that it was implemented as designed. Which of the following statements is true regarding this scenario?

The test of the operating effectiveness of the control was not necessary.

The test of the control design should have occurred at the performance stage.

The test of the operating effectiveness of the control was not necessary.

A risk and control matrix is not appropriate for this type of engagement.

The test of the operating effectiveness of the control should have occurred at the planning stage.

According to the Standards, which of the following is true regarding the auditor's inclusion of management's satisfactory performance in the final audit report?

Acknowledgement of satisfactory performance is encouraged but not required.

There are no standards to address the inclusion of satisfactory performance.

Satisfactory performance should only be acknowledged with the advice of corporate counsel.

Auditors must include satisfactory performance with the approval of the board.

After completing an assurance engagement, the chief audit executive (CAE) concludes that management has accepted a level of risk that may be unacceptable to the organization. What is the most appropriate first step for the CAE to take?

Discuss the issue with senior management.

Discuss the issue only with the CEO.

Discuss the issue with the members of management responsible for the risk area.

During an entity-level controls assessment, internal auditors deploy an internal control questionnaire to test the controls. Which of the following is a major drawback of this testing method?

Information obtained by this method can be repudiated.

Information obtained by this method is difficult to quantify.

It is an inefficient method of gathering evidence.

Limited information can be gathered with this method.

During the preliminary survey of the procurement department, an internal auditor noted a major control weakness in the organization's ordering and receiving process. According to IIA guidance, which of the following is the most appropriate action the internal auditor should take?

Bring the control weakness to the attention of the process owner for resolution.

Issue a final report on the control weakness to senior management.

Bring the control weakness to the attention of the process owner for resolution.

Note the control weakness for discussion during the exit meeting.

Carry out an investigation of the control weakness for disciplinary action.

An internal auditor completed a test of 30 randomly selected accounts. For five of the accounts selected, the auditor was unable to find supporting documentation in the normal place of storage. Which of the following next steps would be most appropriate for the internal auditor to take?

Contact management to determine whether the supporting documentation can be located elsewhere.

Conclude that the test failed because at least 17 percent of the sample items were not supported.

Select five new accounts to replace the ones that were missing supporting documentation.

Expand the sample size to 60 to determine whether the error rate remains the same.

Contact management to determine whether the supporting documentation can be located elsewhere.

Which of the following internal audit activities is performed in the design evaluation phase?

The internal auditor identifies the controls over segregation of duties.

The internal auditor reviews prior audits and workpapers.

The internal auditor identifies the controls over segregation of duties.

The internal auditor checks a process for completeness.

The internal auditor communicates the audit results to management.

If there is a significant error or omission in the final audit report that was communicated to management, which of the following is the key action for the internal audit activity?

The corrected communication should be redistributed to the original recipients.

Communicate the corrected information to the manager of the audited department.

There should be a follow-up audit to address the error or omission.

The auditor should update the scope of the audit to include the omission.

The corrected communication should be redistributed to the original recipients.

Which of the following is the primary weakness of internal control questionnaires (ICQs)?

ICQ respondents have incentives to answer that there are internal controls in place.

ICQs do not allow for open-ended questions.

ICQs do not allow for evaluating multiple locations.

ICQs require significant auditor follow-up, as different managers may give different responses.

ICQ respondents have incentives to answer that there are internal controls in place.

Following an IT systems audit, management agreed to implement a specific control in one of the IT systems. After a period, the internal auditor followed up and learned that management had not implemented the agreed management action due to the decision to move to another IT system that has built-in controls, which may address the risks highlighted by the internal audit. Which of the following is the most appropriate action to address the outstanding audit recommendation?

The auditor examines the system documentation of the new system to verify that the risk has been addressed in the new system, then reports to senior management the closure of the issue.

The auditor accepts management's explanation that the previously identified issue is adequately addressed by the new IT system, as management understands the concern and is most knowledgeable about the new system, and closes the outstanding issue.

The auditor advises management that replacing the IT system does not dismiss the prior obligation to implement the agreed action plan, and escalates the issue to senior management and the board.

The auditor requires management to provide details regarding the process for selecting the new IT system and whether other systems were evaluated, and closure of the issue would depend on the new information provided.

When reviewing workpapers, engagement supervisors may ask for additional evidence or clarification via review notes. According to IIA guidance, which of the following statements is true regarding the engagement supervisor's review notes?

The review notes may be cleared from the final documentation once the engagement supervisor's concerns have been addressed.

Management of the area under review must address the engagement supervisor's review notes before the audit report can be finalized.

The chief audit executive must initial or sign the engagement supervisor's review notes to provide evidence of appropriate engagement supervision.

Review notes provide documented proof that the engagement is supervised properly and must be retained for the quality assurance and improvement program.

Flowcharts are useful during audit planning because they contain information that may help internal auditors with which of the following?

Understanding business processes.

Understanding management's risk tolerance.

Understanding business processes.

Determining the size of the audit team needed to perform the review.

Understanding organizational objectives.

Which of the following activities demonstrates an example of the chief audit executive performing residual risk assessment?

Cost-benefit analysis of management not implementing a recommendation to address an observation.

Inquiry of corrective action to be completed within a certain period.

Reporting the status of every observation for every engagement in a detailed manner.

Soliciting management's feedback after completion of the audit engagement.

When determining the level of staff and resources to be dedicated to an assurance engagement, which of the following would be the most relevant to the chief audit executive?

The available resources with the specific skill set required.

The overall adequacy of the internal audit activity's resources.

The availability of guest auditors for the engagement.

The number of internal auditors used for the previous review of the same area.

The available resources with the specific skill set required.

An internal audit activity plans its engagements based on an organization-wide risk assessment. According to IIA guidance, which of the following statements is true regarding the required frequency of the risk assessment?

There is no specific requirement; a risk assessment should be performed as needed to account for changes in the business environment.

The risk assessment must be performed at least quarterly.

The risk assessment must be performed at least annually.

The risk assessment must be performed at least once every five years, in alignment with the internal audit activity's quality assurance and improvement program.

There is no specific requirement; a risk assessment should be performed as needed to account for changes in the business environment.

According to IIA guidance, which of the following describes the primary reason the chief audit executive (CAE) should actively network and build relationships with senior management and the board?

To fulfill the CAE's responsibility to keep the board appropriately informed.

To expand the CAE's understanding of management issues.

To help maintain the objectivity of the internal audit activity.

To increase opportunities to demonstrate the internal audit activity performance.

According to IIA guidance, which of the following statements is true regarding engagement planning?

Internal auditors may not need to complete a preliminary risk assessment for a consulting engagement as they would when planning an assurance engagement.

For both assurance and consulting engagements, planning typically occurs after the engagement objectives and scope have already been determined.

The expectations and objectives of an assurance engagement are usually determined by, or in conjunction with, the engagement client.

Internal auditors may not need to complete a preliminary risk assessment for a consulting engagement as they would when planning an assurance engagement.

For both consulting and assurance engagements, internal auditors usually form the engagement objectives prior to completing the preliminary risk assessment.

An organization's healthcare insurance costs have been rising approximately 10 percent per year for several years. Which of the following analytical review procedures would best evaluate the reasonableness of the increase in healthcare costs?

Obtain the government index of healthcare costs for the comparable period of time and compare the rate of increase with that of the cost per employee incurred by the organization.

Develop a comparison of the costs incurred with similar costs incurred by other organizations.

Obtain the government index of healthcare costs for the comparable period of time and compare the rate of increase with that of the cost per employee incurred by the organization.

Obtain a bid from another healthcare administrator to provide the same administrative services as the current healthcare administrator.

Review all claims and compare with appropriate procedures to ensure that overpayments have not occurred.

The internal audit activity plans to assess the effectiveness of management's self-assessment activities regarding the risk management process. Which of the following procedures would be most appropriate to accomplish this objective?

Observe and test control and monitoring procedures and related reporting.

Review corporate policies and board minutes for examples of risk discussions.

Conduct interviews with line and senior management on current practices.

Research and review relevant industry information concerning key risks.

Observe and test control and monitoring procedures and related reporting.

According to IIA guidance, which of the following objectives was most likely formulated for a non-assurance engagement?

The internal audit activity will inform management on the possible risks of moving the data warehouse to a cloud server maintained by a third party.

The internal audit activity will assess the effects of changes in maintenance strategy on the availability of production equipment.

The internal audit activity will inform management on the possible risks of moving the data warehouse to a cloud server maintained by a third party.

The internal audit activity will ascertain whether the data center security arrangements are compliant with agreed terms.

The internal audit activity will ensure equipment downtime risks have been managed in accordance with internal policy.

An audit reveals that a manager's spouse is receiving paychecks, but is not employed by the organization. According to IIA guidance, which of the following actions should the internal auditor take?

Report the finding to senior management in a timely manner, following the normal chain of command.

Contact the external auditor and provide all relevant documentation.

Report the finding to senior management in a timely manner, following the normal chain of command.

Meet with the local manager to obtain more information on the finding before taking further action.

Bypass the normal chain of command and contact the board directly to report the finding.

Senior IT management requests the internal audit activity to perform an audit of a complex IT are a. The chief audit executive (CAE) knows that the internal audit activity lacks the expertise to perform the engagement. Which of the following is the most appropriate action for the CAE to take?

Outsource the audit engagement to a reputable IT audit consulting firm.

Decline the audit engagement, because the Standards prohibit internal auditors from performing engagements where they lack the necessary competencies.

Accept the audit engagement and use the engagement as an opportunity to develop the audit team's IT expertise while performing the audit work.

Temporarily hire an experienced and knowledgeable IT analyst from the organization's IT department to lead the audit.

Outsource the audit engagement to a reputable IT audit consulting firm.

Which of the following is the advantage of using internal control questionnaires (ICQs) as part of a preliminary survey for an engagement?

ICQs provide testimonial evidence.

ICQs provide tangible evidence to be quantified.

ICQs put observations into perspective.

Which of the following would help the internal audit activity assess compliance with the organization's standard operating procedures for bank deposits during a preliminary survey?

Issue an internal control questionnaire to select branch managers.

Issue an internal control questionnaire to select branch customers.

Issue an internal control questionnaire to the president of the organization.

Issue an internal control questionnaire to the director of bank operations.

Issue an internal control questionnaire to select branch managers.

According to IIA guidance, which of the following best describes the purpose of a planning memorandum for an audit engagement?

It documents preliminary information useful to the audit team.

It documents the audit steps and procedures to be performed.

It documents preliminary information useful to the audit team.

It documents events that could hinder the achievement of process objectives.

It documents existing measures that manage risks in the area under review.

The internal audit activity is planning an assurance engagement for a foreign subsidiary. According to IIA guidance, which of the following would be included in the preliminary communication to management of the area under review?

The scope of the engagement, the estimated time frame, and the names of the auditors.

The estimated time frame, the names of the auditors, and the resources and travel budget.

The names of the auditors, the resources and travel budget, and the scope of the engagement.

The resources and travel budget, the scope of the engagement, and the estimated time frame.

Which of the following best describes why an internal audit activity would consider sending written preliminary observations to the audit client?

Written observations help the internal auditors express the significance.

Written observations allow for more interpretation.

Written observations help the internal auditors express the significance.

Written and verbal observations are equally effective.

Written observations limit premature agreement.

An internal auditor completed a consulting engagement covering a recent advertising campaign. The audit client asked the auditor to forward a copy of the report to one of the three advertising agencies used by the organization. According to IIA guidance, which of the following statements is true regarding this request?

The internal auditor may communicate the results to the advertising agency as instructed by the audit client, with approval from the chief audit executive.

The internal auditor may not communicate the results to this external party regardless of the engagement client's instruction.

The internal auditor may send the report and is required to include instructions for the advertising agency to limit further distribution and the use of results.

The internal auditor may only communicate the results verbally to the advertising agency and should not provide a hard copy.

The internal audit activity is currently working on several engagements, including a consulting engagement on the management process in the human resources department. Which of the following actions should the chief audit executive take to most efficiently and effectively ensure the quality of the engagement?

Employ fieldwork peer review to enhance the work quality.

Assign an experienced manager to monitor the whole engagement process.

Employ fieldwork peer review to enhance the work quality.

Require internal auditors to follow a standardized work program.

Personally supervise the engagement.

An internal auditor performed a test of controls and found that a statistically selected representative sample of recorded transactions within the account receivables ledger had an error rate that was within management expectations. The associated revenue account was outside the scope of the audit engagement. How should the conclusion to this engagement be reported?

Positive assurance could be provided for the effectiveness of the accounts receivable controls.

The auditor should state that the error rate was within the selected confidence level.

Negative assurance should be provided, as the associated revenue account was not examined.

The auditor should state that controls over the recording of transactions in the revenue account are operating effectively.

Positive assurance could be provided for the effectiveness of the accounts receivable controls.

According to IIA guidance, how should an internal auditor apply any relevant information obtained from an internal consulting engagement during a related internal audit engagement?

Use the knowledge obtained to evaluate the effectiveness of internal control processes.

Document any facts obtained and include them as part of the audit engagement workpapers.

Rely upon the information to draw conclusions about the effectiveness of controls.

Use the knowledge obtained to evaluate the effectiveness of internal control processes.

Objectivity requires that this information should not be used in any part of the audit engagement.

Which of the following best describes the guideline for preparing audit engagement workpapers?

Workpapers should be understandable to another internal auditor who was not involved in the engagement.

Workpapers should be understandable to the auditor in charge and the chief audit executive.

Workpapers should be understandable to the audit client and the board.

Workpapers should be understandable to another internal auditor who was not involved in the engagement.

Workpapers should be understandable to external auditors and regulatory agencies.

IIA IIA-CIA-Part2 Practice Test 10 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

IIA IIA-CIA-Part2 Practice Test 10

Question

IIA IIA-CIA-Part2 Practice Tests

Practice Tests