ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 312 - IIA-CIA-Part2 discussion

Report
Export

An internal auditor recommended that an organization implement computerized controls in its sales system in order to prevent sales representatives from executing contracts in excess of their delegated authority levels A follow-up review found that the sales system had not been modified, but a process had been implemented to obtain written approval by the vice president of sales for all contracts in excess of S1 million The chief audit executive (CAE) would be justified in reporting this situation to the organization's board under which of the tollowing circumstances'?

1. In the opinion of the CAE the level of residual risk assumed by senior management is too high

2. Testing of compliance with the new process finds that all new contracts in excess of $1 million have been approved by the vice president of sales

3. The cost of modifying the sales system to include a preventive control is less than S100.000

A.
1 only
Answers
A.
1 only
B.
3 only
Answers
B.
3 only
C.
1 and 3 only
Answers
C.
1 and 3 only
D.
1, 2, and3
Answers
D.
1, 2, and3
Suggested answer: A

Explanation:

The Chief Audit Executive (CAE) would be justified in reporting the situation to the organization's board if, in the opinion of the CAE, the level of residual risk assumed by senior management is too high (1). Even though the new process of obtaining written approval by the vice president of sales addresses the issue, if the CAE believes that the residual risk remains too high, it is their duty to report it to the board. The cost of implementing a preventive control or the compliance with the new process does not change the responsibility of the CAE to report significant residual risks to the board.

The Institute of Internal Auditors (IIA) Standard 2600 -- Communicating the Acceptance of Risks: 'When the chief audit executive believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the decision regarding residual risk is not resolved, the chief audit executive must report the matter to the board for resolution.'

IIA Practice Guide on 'Communicating Risk Acceptance to the Board'

asked 18/09/2024
TRONG KY
51 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first