Which of the following should the chief audit executive do when evaluating the possibility of relying on external auditors' work?

Examine objectivity and any perceived or actual conflicts of interest.

Perform comprehensive background checks on all independent auditors on the engagement.

Recalculate all financial calculations to confirm competency.

Examine objectivity and any perceived or actual conflicts of interest.

Review audit tests employed in all previous audits.

An internal auditor discovered that equipment used to monitor air quality was not maintained according to the established maintenance schedule. If the issue is not addressed, the equipment may not provide accurate information on pollutant levels, which could result in regulatory sanctions and reputational damage. The auditor discussed the issue with both the manager in charge and the CEO, who explained that they understand the risk, but it has become too expensive to maintain the equipment as scheduled. In this situation, what should the chief audit executive do?

Communicate to the board the current situation, including the risk exposure to the organization.

Add value to the organization by taking initiative and implementing corrective actions to mitigate the identified risks.

Communicate to the board the current situation, including the risk exposure to the organization.

Discuss the matter with external auditors and request that they persuade management to address the issue.

Contact the regulatory agency and inform them of the risk exposure.

The chief audit executive (CAE) is developing a workpaper preparation policy for a new internal audit activity. The CAE wants to ensure that all workpapers relate directly to the engagement objectives. Which of the following statements should be included in the policy specifically to address this concern?

The workpapers should be relevant.

The workpapers should be understandable.

The workpapers should be relevant.

The workpapers should be economical.

The workpapers should be complete.

Following an audit, management developed an action plan to improve controls over the handling of scrap metal. Which of the following would be the most appropriate course of action for the auditor to follow up?

Perform retesting to confirm that new procedures address the previously identified deficient control activities.

Conduct another audit engagement to ensure all risks related to the sales of scrap metal have been mitigated.

Ensure new procedures have been documented, approved, and distributed to the employees responsible.

Perform retesting to confirm that new procedures address the previously identified deficient control activities.

Analyze the new procedures, then report to senior management whether the associated risks have been managed.

What is the primary reason that audit supervision includes approval of the engagement report?

To ensure report findings are substantiated.

To ensure the objectives of the area under review are met.

To ensure senior management supports the report's conclusions.

To ensure report style and grammar are appropriate.

To ensure report findings are substantiated.

What information would be most useful to an internal auditor who is attempting to identify specific processes to include in the scope of an assurance engagement?

Recent area performance indicators against productivity metrics.

Recent organizationwide recognition awards given to employees within the area.

The timing of the most recent audit of the area.

Management's presentation to the board regarding recent area achievements.

Recent area performance indicators against productivity metrics.

Senior management is challenging regulatory fines that were assessed to the organization due to questionable business practices. Their actions and the fines could have an adverse effect on the organization's ability to continue business. How would the chief audit executive respond?

Assess the level of financial risks that may affect the organization's stability.

Assume responsibility for quantifying and minimizing the residual risks to the organization.

Assess the level of financial risks that may affect the organization's stability.

Inform the regulatory agency about senior management's action and seek guidance.

Proceed with a consulting engagement to benchmark similar organizations' business practices in the region.

According to IIA guidance, which of the following is a limitation of a heat map?

Impact and likelihood at times cannot be differentiated as to which is more important.

Impact cannot be represented on a heat map unless it is quantified in financial terms.

Impact and likelihood at times cannot be differentiated as to which is more important.

A heat map cannot be used unless a risk and control matrix has been developed.

Qualitative factors cannot be incorporated into a heat map.

During audit engagement planning, an internal auditor is determining the best approach for leveraging computer-assisted audit techniques (CAATs). Which of the following approaches maximizes the use of CAATs and why?

Reperformance, because it enables the auditor to verify that the application performed the calculation correctly.

Tracing, because it would enable the auditor to verify quickly that the record counts were properly included in the compilation.

Inspection, because it would enable the auditor to verify how management enters the data into the application for processing.

Testing data, because it would enable the auditor to ensure that the application processes the transaction as described by management.

Reperformance, because it enables the auditor to verify that the application performed the calculation correctly.

Which of the following statements is true regarding risk assessments, including the evaluation and prioritization of risk and control factors?

A risk-by-process matrix enables the user to determine associations between any of the processes and the risks.

The risk-factor approach for linking business processes and risks is more direct than the use of a risk-by-process matrix.

Internal risk factors are built into the environment and the nature of the process itself.

A risk map is used primarily to depict which risks will be reduced and which will be shared.

Which of the following statements is true regarding engagement planning?

The planning phase of the engagement should be completed and approved before the fieldwork of the engagement begins.

The scope of the engagement should be planned according to the internal audit activity's budget and then aligned to the risk universe.

The audit engagement objectives should be based on operational management's view of risk objectives.

The planning phase of the engagement should be completed and approved before the fieldwork of the engagement begins.

The main purpose of the engagement work program is to determine the nature and timing of procedures required to gather audit evidence.

Which of the following actions should the chief audit executive take when senior management decides to accept risks by choosing to do business with a questionable vendor?

Discuss the issue with the board for them to take appropriate action.

Persuade senior management to take appropriate action.

Cancel issuing the engagement report due to the assumed risks.

Accept senior management's assumption of the risks.

Discuss the issue with the board for them to take appropriate action.

The internal audit activity needs to review the information security function but does not have the IT expertise needed for the engagement. Which of the following actions should the chief audit executive take to ensure the internal audit activity conforms with the Standards?

Contract an external service provider auditor with the experience necessary to perform the audit.

Assign the engagement to a staff auditor and closely review his work and report.

Assign the engagement to a senior auditor, who carefully researches and studies the company's IT infrastructure.

Contract an external service provider auditor with the experience necessary to perform the audit.

Perform the audit herself and work closely with the information security function to obtain expertise in the area.

Which of the following is an advantage of nonstatistical sampling over statistical sampling?

Nonstatistical sampling provides for the use of subjective judgment in determining the sample size.

Nonstatistical sampling provides more objective recommendations for management.

Nonstatistical sampling provides an opportunity to select the minimum sample size required to satisfy the objectives of the audit tests.

Nonstatistical sampling provides for the use of subjective judgment in determining the sample size.

Nonstatistical sampling permits the auditor to specify a level of reliability and the desired degree of precision.

Which of the following is most appropriate for internal auditors to do during the internal audit recommendations monitoring process?

Determine the frequency and approach to monitoring.

Report the monitoring status to senior management when requested.

Assist management with implementing corrective actions.

Determine the frequency and approach to monitoring.

Include all types of observations in the monitoring process.

Which of the following is an advantage of utilizing an external fraud specialist in a suspected fraud investigation?

Increased ability to preserve evidence and the chain of command.

Increased access to the organization's employees.

Increased ability to preserve evidence and the chain of command.

Increased ability to scrutinize the organization's key business processes.

Increased access to the organization's software and proprietary data.

Which of the following is an advantage of an internal audit activity coordinating with a management-defined risk universe?

Increased completeness, including risk categories like political, supplier, and social media.

Business managers can identify and assess risks that occur within each category.

The internal audit activity can rely on management's risk assessment.

Organizationwide audits are required since risk events within categories occur in many different ways.

Which of the following is the primary reason a chief audit executive should network with an organization's executives?

To make executives aware of the benefits that the internal audit activity can provide.

To better understand and influence executives' planning.

To make executives aware of the benefits that the internal audit activity can provide.

To assist executives in setting the organization's risk appetite.

To have a better understanding of the training needed to strengthen the audit team.

An internal auditor is using attributes sampling to test internal controls. Under which of the following circumstances would the auditor increase the original sample size to estimate error occurrence at a given precision and confidence level?

The sample rate of occurrence plus the precision exceeds the acceptable error rate.

The sample rate of occurrence is less than the acceptable error rate.

The acceptable rate of occurrence less the precision exceeds the sample rate of occurrence.

The sample rate of occurrence plus the precision equals the acceptable error rate.

Which of the following is the most appropriate objective for establishing a professional development plan for the internal audit activity?

A plan that focuses on filling gaps in the current skills needed to complete audit objectives.

A plan that focuses on furthering the independence of the internal audit activity.

A plan that ensures internal auditors collectively possess expertise in various fields to avoid outsourcing.

A plan based on individual preferences and proposals, which helps internal auditors achieve greater success.

A plan that focuses on filling gaps in the current skills needed to complete audit objectives.

When auditing an organization's purchasing function, which of the following appropriately matches an engagement objective and the resulting audit procedure?

Determine whether the purchasing department complies with policy by examining a random selection of purchase orders.

Evaluate whether purchasing requests are properly approved by authorized staff by obtaining independent verification from the vendors.

Ascertain whether material receipts are recorded on a timely basis by reviewing physical inventory stock counts.

Determine whether prices charged for goods received are correct by reviewing the appropriate accounts payable record by vendor.

A team of internal auditors is assigned to audit the employee relations process in an organization, which includes employee conduct and disciplinary hearings. Which of the following audit approaches would provide the auditors with the best evidence to determine the degree to which disciplinary decisions are complying with documented policy?

Review a random sample of concluded disciplinary reports to assess how the policy was applied in each case.

Interview a sample of impacted employees for their opinions on the clarity and fairness of the policy.

Observe several disciplinary hearings to determine whether they are in compliance with the policy.

Conduct an interview to assess the disciplinary hearing chairman's understanding of the policy and its appropriate use.

Which of the following represents the best method for confirming that vendor invoices were for authorized purchases?

Comparing a random sample of vendor invoices to purchase orders.

Vouching vendor invoices to payments made.

Sorting invoices by purchase orders and comparing for successive duplicate invoices.

Comparing a random sample of vendor invoices to purchase orders.

Sorting payments by invoice to detect successive duplicate invoices.

Which of the following is the primary reason an internal auditor would issue an interim report during an engagement?

To provide those responsible for the area under review with the opportunity to act on certain observations immediately.

To provide a status update on a short engagement to management of the area under review and to the audit supervisor.

To confirm agreement with preliminary observations and conclusions identified during the engagement.

To provide those responsible for the area under review with the opportunity to act on certain observations immediately.

To verify that the corrective actions required by senior management are completed as agreed.

Which of the following statements is true regarding internal control questionnaires (ICQs)?

An ICQ can be used effectively either by sending it in advance for management of the area under review to complete or by testing each procedure and recording the results.

ICQs are most useful in more organic, decentralized organizations with specialized departmental or regional characteristics.

An ICQ can be used effectively either by sending it in advance for management of the area under review to complete or by testing each procedure and recording the results.

An ICQ is not an efficient tool, as it can only inquire about controls and it does not test them.

ICQs are also known as checklist audits and encourage management of the area under review to answer 'no' or 'yes' more accurately.

Which of the following analytical procedures should an internal auditor use to determine whether monthly expenses for the accounting department are reasonable?

Review year-over-year trending of total dollars spent in each period.

Review changes to the vendor master file for suspicious activity.

Review the percentage of on-time payments against prior periods.

Review total expenses for accounting against other department expenses in the organization.

During an internal audit engagement, which of the following is true regarding the decision to use statistical sampling or nonstatistical sampling?

The decision affects the test procedures performed.

The auditor's response to errors detected will be influenced.

The competence of the evidence obtained is greater with statistical sampling.

Nonstatistical sampling may be more cost effective.

According to IIA guidance, which of the following is most likely to become part of the engagement work program?

Resource deployment plans and sampling methodologies.

Information obtained from historic audits and memos.

Risk and control registers or matrices.

Resource deployment plans and sampling methodologies.

Prior findings and management responses.

An internal auditor discovered a control weakness that needs to be communicated to management. Which of the following is the best method for first communicating the weakness?

Verbal communication during the engagement, followed by the final report issuance.

Draft report, to be reviewed by management just prior to final report issuance.

Preliminary observation document, discussed during the engagement.

Final report, after review by audit management.

Verbal communication during the engagement, followed by the final report issuance.

Which of the following would be most useful for an internal auditor to obtain during the preliminary survey of an engagement on internal controls over user access management?

The policy for granting, modifying, and deleting user access to ensure processing requirements are clearly articulated.

A sample of change request forms to verify whether the forms bear the required approval for the user access change.

User access reports that were reviewed by management to ensure that access rights are appropriate for employee roles.

A current listing of system users and an employee listing to determine whether system users are active employees of the organization.

Which of the following is an example of internal benchmarking?

Utilities expense of the sales unit is higher than that of the customer service unit.

Book value per common share ratio is lower than that of the prior year.

Staff turnover ratio is higher than the comparable organization in the same industry.

Utilities expense of the sales unit is higher than that of the customer service unit.

Sales are significantly higher than the industry's average for five years.

While conducting an information security audit, an internal auditor learns that the existing disaster recovery plan is four years old and untested. The auditor also learns that in the four years since the recovery plan was implemented, the information systems have undergone extensive changes. Which of the following actions is most appropriate for the auditor to take?

Recommend that management and users update and test the recovery plan.

Inform management and request that the plan be tested immediately.

Update the recovery plan for management, as part of the review.

Evaluate the recovery plan and report weaknesses to management.

Recommend that management and users update and test the recovery plan.

The chief audit executive (CAE) of an organization has completed this year's risk-based audit plan and realized that current staff resources are insufficient to meet the needs of the plan. What course of action should the CAE take?

Inform the board and senior management of the resources needed, as well as the associated risks.

Amend the audit plan so that available audit resources are adequate to meet the plan's requirements.

Inform the board and senior management of the resources needed, as well as the associated risks.

Communicate early to those unit managers whose areas would most likely not be able to get reviewed.

Get approval from human resources regarding overtime payment to be made in an effort to complete the audit plan.

IIA IIA-CIA-Part2 Practice Test 12 - Free Online Exam Prep & Questions

An internal auditor plans to conduct a walk-through to evaluate the control design of a process. Which of the following techniques is the auditor most likely to use?

Become a Premium Member for full access

Unlock Premium Member

IIA IIA-CIA-Part2 Practice Test 12

Question

IIA IIA-CIA-Part2 Practice Tests

Practice Tests