When developing the scope of an audit engagement, which of the following would the internal auditor typically not need to consider?

The need and availability of automated support.

The potential impact of key risks.

The expected outcomes and deliverables.

The operational and geographic boundaries.

Which of the following situations would justify the removal of a finding from the final audit report?

Management has provided additional information that contradicts the findings.

Management disagrees with the report findings and conclusions in their responses.

Management has already satisfactorily completed the recommended corrective action.

Management has provided additional information that contradicts the findings.

Management believes that the finding is insignificant and unfairly included in the report.

According to IIA guidance, which of the following procedures would be least effective in managing the risk of payroll fraud?

Payroll time sheets are reviewed and approved by the timekeeper before processing.

The employee's name listed on organization's payroll is compared to the personnel records.

Payroll time sheets are reviewed and approved by the timekeeper before processing.

Employee access to the payroll database is deactivated immediately upon termination.

Changes to payroll are validated by the personnel department before being processed.

During an assurance engagement, an internal auditor discovered that a sales manager approved numerous sales contracts for values exceeding his authorization limit. The auditor reported the finding to the audit supervisor, noting that the sales manager had additional new contracts under negotiation. According to IIA guidance, which of the following would be the most appropriate next step?

The audit supervisor should communicate the finding to the supervisor of the sales manager through an interim report.

The audit supervisor should include the new contracts in the finding for the final audit report.

The audit supervisor should communicate the finding to the supervisor of the sales manager through an interim report.

The audit supervisor should remind the sales manager of his authority limit for the contracts under negotiation.

The auditor should not reference the new contracts, because they are not yet signed and therefore cannot be included in the final report.

An internal auditor wants to determine whether employees are complying with the information security policy, which prohibits leaving sensitive information on employee desks overnight. The auditor checked a sample of 90 desks and found eight that contained sensitive information. How should this observation be reported, if the organization tolerates 4 percent noncompliance?

The incidents of noncompliance exceed the tolerance level and should be included in the final engagement report.

The matter does not need to be reported, because the noncompliant findings fall within the acceptable tolerance limit.

The deviations are within the acceptable tolerance limit, so the matter only needs to be reported to the information security manager.

The incidents of noncompliance fall outside the acceptable tolerance limit and require immediate corrective action, as opposed to reporting.

The incidents of noncompliance exceed the tolerance level and should be included in the final engagement report.

Which of the following is the primary reason the chief audit executive should consider the organization's strategic plans when developing the annual audit plan?

Strategic plans reflect the organization's business objectives and overall attitude toward risk.

Strategic plans are helpful to identify major areas of activity, which may direct the allocation of internal audit activity resources.

Strategic plans are likely to show areas of weak financial controls.

The strategic plan is a relatively stable document on which to base audit planning.

An organization has a health and safety division that conducts audits to meet regulatory requirements. The chief health and safety officer reports directly to the CEO. Which of the following describes an appropriate role for the chief audit executive (CAE) with regard to the organization's health and safety program?

The CAE should coordinate with, and review the work of, the chief health and safety officer to gain an understanding of whether risks related to health and safety are managed properly.

The CAE has no role to play, because the chief health and safety officer reports to a senior executive.

The CAE should coordinate with, and review the work of, the chief health and safety officer to gain an understanding of whether risks related to health and safety are managed properly.

The CAE should give periodic reports directly to the regulator regarding health and safety issues, as it is the appropriate regulatory oversight body.

The CAE should hire an independent external specialist to conduct an annual assessment and provide assurance over the effectiveness of the health and safety program and the reliability of its reports.

Which of the following evaluation criteria would be the most useful to help the chief audit executive determine whether an external service provider possesses the knowledge, skills, and other competencies needed to perform a review?

The service provider's experience in the type of work being considered.

The financial interest the service provider may have in the organization.

The relationship the service provider may have had with the organization or the activities being reviewed.

Compensation or other incentives that may be applicable to the service provider.

The service provider's experience in the type of work being considered.

Which of the following best describes the four components of a balanced scorecard?

Financial measures, learning and growth, customers, and internal processes.

Customers, innovation, growth, and internal processes.

Business objectives, critical success factors, innovation, and growth.

Customers, support, critical success factors, and learning.

Financial measures, learning and growth, customers, and internal processes.

Which of the following is not a direct benefit of control self-assessment (CSA)?

CSA allows management to have input into the audit plan.

CSA allows process owners to identify, evaluate, and recommend improving control deficiencies.

CSA can improve the control environment.

CSA increases control consciousness.

According to IIA guidance, which of the following statements is false regarding a review of the controls in place to prevent fraud?

The review should focus on the efficiency of the controls in place to prevent fraud.

The scope of the review does not need to include all operating areas of the organization.

The cost of the control should be compared to the benefit of mitigating the related risk.

The review should assess whether the internal controls can be circumvented.

According to IIA guidance, which of the following factors should the auditor in charge consider when determining the resource requirements for an audit engagement?

The number, experience, and availability of audit staff as well as the nature, complexity, and time constraints of the engagement.

The appropriateness and sufficiency of resources and the ability to coordinate with external auditors.

The number, proficiency, experience, and availability of audit staff as well as the ability to coordinate with external auditors.

The appropriateness and sufficiency of resources as well as the nature, complexity, and time constraints of the engagement.

According to IIA guidance, which of the following is least likely to be a key financial control in an organization's accounts payable process?

Monitor customer quality complaints compared to the prior period to identify vendor issues.

Require the approval of additions and changes to the vendor master listing, where the inherent risk of false vendors is high.

Monitor amounts paid each period and compare them to the budget to identify potential issues.

Compare employee addresses to vendor addresses to identify potential employee fraud.

Monitor customer quality complaints compared to the prior period to identify vendor issues.

Which of the following is an appropriate role for the internal audit activity with regard to the organization's risk management program?

Attain an adequate understanding of the organization's key risk mitigation strategies.

Identify and manage risks in line with the organization's risk appetite.

Ensure that a proper and effective risk management process exists.

Attain an adequate understanding of the organization's key risk mitigation strategies.

Identify and ensure that appropriate controls exist to mitigate risks.

Which of the following would not be a typical activity for the chief audit executive to perform following an audit engagement?

Determine the costs of implementing the recommendations.

Report follow-up activities to senior management.

Implement follow-up procedures to evaluate residual risk.

Determine the costs of implementing the recommendations.

Evaluate the extent of improvements.

During an audit of the accounts receivable (AR) process, an internal auditor noted that reconciliations are still not performed regularly by the AR staff, a recommendation that was made following a previous audit. Monitoring by the financial reporting function has failed to detect the shortcoming. Both the financial reporting function and AR report to the controller, who is responsible for implementing action plans. Which of the following supports the internal auditor's decision to combine both observations into one reported finding?

The observation was made during the same audit, and the action plan has a common owner.

The observation relates to the same control activity within a common process.

The observation has a common control, and it was noted in a prior audit.

The observation has a common process, and the action plan for the observation has a common owner.

A chief audit executive (CAE) received a detailed internal report of senior management's internal control assessment. Which of the following subsequent actions by the CAE would provide the greatest assurance over management's assertions?

Evaluate the completeness of the report and management's responses to identified deficiencies.

Assert whether the described and reported control processes and systems exist.

Assess whether senior management adequately supports and promotes the internal control culture described in the report.

Evaluate the completeness of the report and management's responses to identified deficiencies.

Determine whether management's operating style and the philosophy described in the report reflect the effective functioning of internal controls.

Which of the followings statements describes a best practice regarding assurance engagement communication activities?

During the 'communicate' phase of an assurance engagement, it is best to define the methods and timing of engagement communications.

All assurance engagement observations should be communicated to the audit committee.

All assurance engagement observations should be included in the main section of the engagement communication.

During the 'communicate' phase of an assurance engagement, it is best to define the methods and timing of engagement communications.

A detailed escalation process should be developed during the planning stage of an assurance engagement.

An engagement team is being assembled to audit of one of the organization's vendors Which of the following statements best applies to this scenario?

The engagement team should include internal auditors who have expertise in investigating vendor fraud

The engagement team should be composed of certified accountants who are proficient In financial statement analysis and local accounting principles

To preserve independence and objectivity, an auditor who worked for the vendor two years prior may not participate on the engagement team

The engagement team may include an auditor who lacks knowledge of the industry in which the vendor operates

When me internal audit activity does not have sufficient time to complete its usual root cause analysis which c4 the following is most appropriate?

The chief audit executive may recommend that management conduct further work to identify the root cause and address the issue

Internal auditors should finish the engagement without conducting the root cause analysis and draft the audit report, though the report would not be considered complete until the analysis is concluded

internal auditors must adjust their future engagement schedule to ensure that the root cause analysis is always performed before the engagement is concluded

Internal auditors should Instead perform a Pareto rule analysis

To effectively communicate the acceptance of risk in an organization a chief audit executive must first consider which of the following?

The organization's view on risk tolerance

The organization's principal risk events.

The organization's risk response strategies

The organization's major control activities

In which of the following situations would an internal auditor consider the need to outsource competencies and skills9

During the inspection of a wind turbine. an internal auditor notices that some replaced parts took used According to purchase documents, the parts still have a long lifespan.

The auditor believes that the audit client's actions contradict the organization's code of conduct The audit client disagrees and says his actions are for the organization's benefit

An audit team member is allocated to conduct an assurance engagement m the sales unit. However, the same auditor performed an assurance engagement in that area just one year prior

During an inventory count, the auditor ascertained that some goods were missing. The audit client argues that the auditor does not understand how inventory should be counted

Which of the following is the most important determinant of the objectives and scope of assurance engagements?

The preliminary risk assessment performed by internal auditors planning the engagement

The organizational chart, business objectives and policies and procedures of the area to be reviewed.

The most recent risk assessment conducted by management of the area to be reviewed.

The requests of operational and senior management throughout the organization.

The preliminary risk assessment performed by internal auditors planning the engagement

Which of The following best describes a risk that is deemed 'unacceptable' to the organization?

A risk where residual risk exceeds the tolerance level

A risk where likelihood and impact are high

A risk where inherent risk exceeds its residual risk

A risk where inherent risk exceeds the tolerance level

A risk where residual risk exceeds the tolerance level

An organization has a mature control environment but limited internal audit resources Given this scenario, on which of the following should the internal auditors focus their testing?

Detective compensating controls

Preventive compensating controls

What is the primary purpose of creating a preliminary draft audit report?

To use as a tool for communicating with management of the area under review.

To save time during final report writing

To meet the Standards requirement for developing a draft report prior to issuing a final report

To use as a tool for communicating with management of the area under review.

To require that management implements solutions to issues identified during the engagement

A newly appointed chief audit executive (CAE) of a small organization is developing a resource management plan Which of the following approaches would be most beneficial to help the CAE obtain details of the Internal audit activity's collective knowledge skills, and other competencies?

Review or establish a documented skills assessment of the internal audit staff and gather information from post-audit surveys

Obtain from the human resources department the job descriptions and position requirements for all internal audit staff

Conduct an objective written test of the internal audit staff to assess their knowledge and skills related to core internal audit competencies

Request the internal audit staff to submit a document that summarizes their most recent performance appraisals and post audit reviews

The engagement supervisor would like lo change the audit program's scope poor to beginning fieldwork According to IIA guidance before any change is implemented what is the most important action that should be undertaken?

Seek approval from the chief audit executive for the proposed scope change

Document in the engagement workpapers the rationale for changing the scope.

Confirm that the scope change would align to the organization's objectives and goals

Confirm that the internal audit activity continues to have the necessary knowledge and skills

Seek approval from the chief audit executive for the proposed scope change

Which of The following best justifies an internal auditor's decision to issue a preliminary audit report?

The internal audit team expects management to address certain issues immediately due to their severe impact

The internal audit team and audit client have a serious dispute over the scope and objective of the engagement

The internal audit team expects management to address certain issues immediately due to their severe impact

The internal audit team anticipates that the formal final audit report would be undesirable for management due to the significance of outlined risks

The internal audit team would like to issue a clean final audit report without any material observations or risks

IIA IIA-CIA-Part2 Practice Test 3 - Free Online Exam Questions 81-120

When constructing a staffing schedule for the internal audit activity (IAA), which of the following criteria are most important for the chief audit executive to consider for the effective use of audit resources?

1. The competency and qualifications of the audit staff for specific assignments.

2. The effectiveness of IAA staff performance measures.

3. The number of training hours received by staff auditors compared to the budget.

4. The geographical dispersion of audit staff across the organization.

1 and 3

1 and 4

2 and 3

2 and 4

Comment (0)

IIA IIA-CIA-Part2 Practice Test 3

Question

IIA IIA-CIA-Part2 Practice Tests

Practice Tests