IIA IIA-CIA-Part2 Practice Test - Questions Answers, Page 32

The Chief Audit Executive (CAE) would be justified in reporting the situation to the organization's board if, in the opinion of the CAE, the level of residual risk assumed by senior management is too high (1). Even though the new process of obtaining written approval by the vice president of sales addresses the issue, if the CAE believes that the residual risk remains too high, it is their duty to report it to the board. The cost of implementing a preventive control or the compliance with the new process does not change the responsibility of the CAE to report significant residual risks to the board.

The Institute of Internal Auditors (IIA) Standard 2600 -- Communicating the Acceptance of Risks: 'When the chief audit executive believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the decision regarding residual risk is not resolved, the chief audit executive must report the matter to the board for resolution.'

IIA Practice Guide on 'Communicating Risk Acceptance to the Board'

In the risk control map, Risk C is positioned in the upper left quadrant, indicating it is critical (high risk significance) but with a low level of control. This suggests that the current controls are insufficient to mitigate the high level of risk associated with Risk C. For critical risks, a higher level of control is necessary to ensure that the risk is properly managed and mitigated.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'Risk Management Framework' (COSO)

Physical evidence in internal auditing refers to tangible, observable, and verifiable information obtained directly through auditors' activities. Making purchases from retail outlets to evaluate customer service involves direct interaction and observation, which constitutes obtaining physical evidence. This differs from documents, interviews, or confirmations, which are considered documentary or testimonial evidence.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'Audit Evidence' (International Standards on Auditing)

Proper engagement supervision is documented through formal records that show a systematic review and oversight process. A completed engagement workpaper review checklist provides evidence that the supervisor has reviewed and approved the work done by the audit team. This formal checklist ensures all critical aspects of the engagement are reviewed systematically, meeting the standards for proper supervision documentation.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'International Standards for the Professional Practice of Internal Auditing' (IIA)

The most effective management action to prevent similar issues in the future involves both corrective and preventive measures. Coaching the IT specialist addresses the immediate knowledge gap and mistake that occurred. Introducing a secondary control, such as a review or verification step, ensures that future access requests are granted correctly, thereby preventing similar errors. This combination addresses the root cause and adds a layer of assurance.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'IT Control Objectives for Sarbanes-Oxley' (IT Governance Institute)

When several irregularities are found in the financial information, it is critical to perform an analytical review that provides a broader perspective on the firm's financial health. Comparing the firm's financial performance with organizations in the same industry helps identify anomalies and trends that may indicate irregularities. This benchmarking approach can highlight unusual deviations from industry norms, which may signal errors or potential fraud.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'Auditing and Assurance Services' (Messier, Glover, Prawitt)

When significant control issues are identified during a consulting engagement, it is the responsibility of the chief audit executive to ensure that these issues are communicated to senior management and the board. This ensures that the organization is aware of the risks and can take corrective action. Consulting engagements should not overshadow the priority of addressing critical control issues that may affect the organization's risk profile.

Reference:

'International Standards for the Professional Practice of Internal Auditing' (IIA Standards)

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

An assurance map is a tool that provides a visual representation of the coverage of risks by various assurance providers. It supports the auditor's decision by showing which risks are being addressed by internal audit and other functions, and which risks are not being tested. This can help justify the auditor's decision not to test a particular risk, by demonstrating that it has already been covered or deemed low priority.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'Creating an Assurance Map' (IIA Practice Guide)

The most critical factor in determining which engagements should be included in the annual internal audit plan is the organization's annual risk management strategy. This strategy identifies the key risks facing the organization and ensures that the internal audit plan aligns with the areas of highest risk. This prioritization helps ensure that internal audit resources are focused on areas that could have the most significant impact on the organization.

Reference:

'Internal Auditing: Assurance & Advisory Services' (The Institute of Internal Auditors)

'Risk-Based Internal Auditing' (IIA Practice Guide)