Question 1

According to IIA guidance, which of the following best describes how risks are measured?

Accepted Answer

A)  Likelihood and probability. 
B)  Impact and relevance. 
C)  Velocity and rate of occurrence. 
D)  Likelihood and impact. 
A)  Likelihood and probability. 
B)  Impact and relevance. 
C)  Velocity and rate of occurrence. 
D)  Likelihood and impact.

Question 2

In selecting an instructional strategy for developing internal audit staff, a chief audit executive should first review the:

Accepted Answer

A)  Department's budget constraints. 
B)  Internal auditors' personal development needs. 
C)  Content of potential training courses. 
D)  Organization's objectives. 
A)  Department's budget constraints. 
B)  Internal auditors' personal development needs. 
C)  Content of potential training courses. 
D)  Organization's objectives.

Question 3

In a manufacturing organization, all sales prices are determined centrally and are electronically sent to the distribution centers to update their sales price tables. Any pricing deviations must be approved by central headquarters. To determine how this process is functioning, an internal auditor should:

Accepted Answer

A)  Document the flow of sales price information, and determine how the table is accessed and updated. 
B)  Develop a flowchart of the sales order process to determine how orders are taken and priced. 
C)  Identify who approves the shipment of goods and how the goods are priced. 
D)  Obtain a copy of the existing flowchart for the computer program to determine how price data are accessed. 
A)  Document the flow of sales price information, and determine how the table is accessed and updated. 
B)  Develop a flowchart of the sales order process to determine how orders are taken and priced. 
C)  Identify who approves the shipment of goods and how the goods are priced. 
D)  Obtain a copy of the existing flowchart for the computer program to determine how price data are accessed.

Question 4

Which of the following internal control weaknesses would an internal auditor most likely detect while reviewing a flowchart that depicts the purchasing function of an organization?

Accepted Answer

A)  Purchasing policies have not been updated. 
B)  The organization is not taking advantage of quantity discounts available from its suppliers. 
C)  Payments for goods received have not been authorized at the appropriate level. 
D)  Payments to suppliers are made before goods are received. 
A)  Purchasing policies have not been updated. 
B)  The organization is not taking advantage of quantity discounts available from its suppliers. 
C)  Payments for goods received have not been authorized at the appropriate level. 
D)  Payments to suppliers are made before goods are received.

Question 5

According to the IIA guidance, who is responsible for periodically assessing the internal audit activity?

Accepted Answer

A)  The board. 
B)  The chief audit executive. 
C)  Senior management. 
D)  The external auditors. 
A)  The board. 
B)  The chief audit executive. 
C)  Senior management. 
D)  The external auditors.

Question 6

Which of the following controls could an internal auditor reasonably conclude is effective by observing the physical controls of a large server room?

Accepted Answer

A)  Adequate signs are in place to assist in locating safety equipment. 
B)  Servers are secured individually to their racks by locks. 
C)  Foam fire extinguishers are operable to protect against electrical fires. 
D)  Swipe card access is required to gain access to the server room. 
A)  Adequate signs are in place to assist in locating safety equipment. 
B)  Servers are secured individually to their racks by locks. 
C)  Foam fire extinguishers are operable to protect against electrical fires. 
D)  Swipe card access is required to gain access to the server room.

Question 7

Feedback on engagements from audit clients, annual benchmarking of the internal audit activity's (IAA's) performance against best practice, and analyses of project budgets and audit plan completion are all tools that can best be used by the IAA for which purpose?

Accepted Answer

A)  Completing internal assessments. 
B)  Determining the level of residual risk. 
C)  Identifying conflicts of interest. 
D)  Developing control processes. 
A)  Completing internal assessments. 
B)  Determining the level of residual risk. 
C)  Identifying conflicts of interest. 
D)  Developing control processes.

Question 8

Which of the following statements is true regarding assurance services provided to clients outside of the organization?

Accepted Answer

A)  Assurance services for outside clients are not covered under the internal audit charter. 
B)  Assurance services for outside clients must be approved on a case-by-case basis by the board of directors. 
C)  The nature of assurance services for outside clients should be defined in the internal audit charter. 
D)  The nature of assurance services for outside clients is the same as for internal clients. 
A)  Assurance services for outside clients are not covered under the internal audit charter. 
B)  Assurance services for outside clients must be approved on a case-by-case basis by the board of directors. 
C)  The nature of assurance services for outside clients should be defined in the internal audit charter. 
D)  The nature of assurance services for outside clients is the same as for internal clients.

Question 9

A production division received 45 responses to a customer-service survey distributed to 100 purchasing departments randomly selected from all customers who made purchases in the prior 12 months. Which of the following is the most likely reason that the division manager would be concerned about nonresponse bias in this situation?

Accepted Answer

A)  The sample means and standard errors are more difficult to compute. 
B)  Those who did not respond may be systematically different from those who did. 
C)  The sample size is too small. 
D)  Confidence intervals are narrower. 
A)  The sample means and standard errors are more difficult to compute. 
B)  Those who did not respond may be systematically different from those who did. 
C)  The sample size is too small. 
D)  Confidence intervals are narrower.

Question 10

Which of the following decisions made during the testing phase of a compliance audit requires the most judgment by an internal auditor?

Accepted Answer

A)  Which sampling methodology to select for testing. 
B)  Which fields to examine on each invoice. 
C)  Whether an individual expenditure is allowable. 
D)  What level of noncompliance is acceptable. 
A)  Which sampling methodology to select for testing. 
B)  Which fields to examine on each invoice. 
C)  Whether an individual expenditure is allowable. 
D)  What level of noncompliance is acceptable.

Question 11

An auditor for a large wholesaler is evaluating the controls over the approval and oversight of credit sales. Which of the following procedures would be a control weakness?

Accepted Answer

A)  The credit department is responsible for approving shipments to all customers. 
B)  The finance committee of the board of directors periodically reviews credit standards. 
C)  Customers who fail to meet credit requirements must pay cash for shipments upon delivery. 
D)  The sales department is responsible for determining the credit ratings of customers. 
A)  The credit department is responsible for approving shipments to all customers. 
B)  The finance committee of the board of directors periodically reviews credit standards. 
C)  Customers who fail to meet credit requirements must pay cash for shipments upon delivery. 
D)  The sales department is responsible for determining the credit ratings of customers.

Question 12

According to IIA guidance, which of the following is the best example of a system application control?

Accepted Answer

A)  A physical security control over a data center. 
B)  A system development life cycle control. 
C)  A program change management control. 
D)  An input control over data integrity. 
A)  A physical security control over a data center. 
B)  A system development life cycle control. 
C)  A program change management control. 
D)  An input control over data integrity.

Question 13

Which of the following is a valid statement about the use of visual observations during an audit engagement? 1. Visual observations can be used to detect ineffective controls, idle resources, and safety hazards. 2. Visual observations can be used during both preliminary survey and fieldwork stages of the audit engagement. 3. Visual observations can provide unsubstantiated facts to management if the internal auditor believes the information is useful. 4. Visual observations can assist an auditor in determining if a material observation should be communicated through informal means to the organization's senior management.

Accepted Answer

A)  1 and 2 only 
B)  1 and 4 only 
C)  2 and 3 only 
D)  3 and 4 only 
A)  1 and 2 only 
B)  1 and 4 only 
C)  2 and 3 only 
D)  3 and 4 only

Question 14

Which of the following is a preventive control?

Accepted Answer

A)  Creating an audit trail. 
B)  Placing controls on physical access to inventory. 
C)  Reconciling purchase orders with approvals. 
D)  Reviewing expense accounts for irregularities. 
A)  Creating an audit trail. 
B)  Placing controls on physical access to inventory. 
C)  Reconciling purchase orders with approvals. 
D)  Reviewing expense accounts for irregularities.

Question 15

A small not-for-profit organization with limited resources is unable to adequately maintain appropriate segregation of duties. Considering the organization's resource constraints, which type of controls would best mitigate segregation of duty risks?

Accepted Answer

A)  Application controls. 
B)  Detective controls. 
C)  Preventive controls. 
D)  Compensating controls. 
A)  Application controls. 
B)  Detective controls. 
C)  Preventive controls. 
D)  Compensating controls.

Question 16

The director of purchasing, a certified internal auditor (CIA), signs a contract to procure a large order from a supplier whose products provide the best price, quality, and performance. A few days after signing the contract, the supplier presents the CIA with $1, 000 as a gift. Which statement regarding acceptance of the money is correct?

Accepted Answer

A)  Accepting the money would be prohibited only if it were non-customary. 
B)  Accepting the money would violate the IIA Code of Ethics. 
C)  Because the CIA is not acting as an internal auditor, accepting the money would be governed only by the organization's code of conduct. 
D)  Because the contract was signed before the money was offered, accepting the money would not violate the IIA Code of Ethics. 
A)  Accepting the money would be prohibited only if it were non-customary. 
B)  Accepting the money would violate the IIA Code of Ethics. 
C)  Because the CIA is not acting as an internal auditor, accepting the money would be governed only by the organization's code of conduct. 
D)  Because the contract was signed before the money was offered, accepting the money would not violate the IIA Code of Ethics.

Question 17

Which of the following is the primary advantage of using a computer assisted audit technique (CAAT) to provide a higher level of assurance?

Accepted Answer

A)  CAATs can select an appropriate sample size for testing and thus provide higher level of assurance. 
B)  CAATs are more objective than the traditional methods in interpreting the results. 
C)  CAATs can examine the whole of population of transactions, rather than a sample, in order to identify exceptions and trends. 
D)  CAATs can process the results faster and thus give a higher level of assurance. 
A)  CAATs can select an appropriate sample size for testing and thus provide higher level of assurance. 
B)  CAATs are more objective than the traditional methods in interpreting the results. 
C)  CAATs can examine the whole of population of transactions, rather than a sample, in order to identify exceptions and trends. 
D)  CAATs can process the results faster and thus give a higher level of assurance.

Question 18

Which of the following statements, if true, could justify an auditor's decision not to report governance-related control deficiencies to the audit committee?

Accepted Answer

A)  Management plans to initiate corrective action. 
B)  The board of directors has a separate corporate governance committee. 
C)  The amounts and the potential risks associated with the deficiencies are not material to the overall organization. 
D)  Governance issues are complex and the auditor should rely on management's analysis of the extent of the problem. 
A)  Management plans to initiate corrective action. 
B)  The board of directors has a separate corporate governance committee. 
C)  The amounts and the potential risks associated with the deficiencies are not material to the overall organization. 
D)  Governance issues are complex and the auditor should rely on management's analysis of the extent of the problem.

Question 19

Which of the following risk assessment tools would best facilitate the matching of controls to risks?

Accepted Answer

A)  Control matrix. 
B)  Internal control questionnaire. 
C)  Control flowchart. 
D)  Program evaluation and review technique (PERT) analysis. 
A)  Control matrix. 
B)  Internal control questionnaire. 
C)  Control flowchart. 
D)  Program evaluation and review technique (PERT) analysis.

Question 20

An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which of the following statements about a common risk language is true?

Accepted Answer

A)  Management will be able to reduce inherent risk because they will have a better understanding of risk. 
B)  Internal auditors will be able to reduce their sample sizes because controls will be more consistent. 
C)  Stakeholders will have more assurance that the risks are assessed consistently. 
D)  Decision makers will understand that the likelihood of missing or ineffective controls will be reduced. 
A)  Management will be able to reduce inherent risk because they will have a better understanding of risk. 
B)  Internal auditors will be able to reduce their sample sizes because controls will be more consistent. 
C)  Stakeholders will have more assurance that the risks are assessed consistently. 
D)  Decision makers will understand that the likelihood of missing or ineffective controls will be reduced.

According to IIA guidance, which of the following best describes how risks are measured?

In selecting an instructional strategy for developing internal audit staff, a chief audit executive should first review the:

Which of the following internal control weaknesses would an internal auditor most likely detect while reviewing a flowchart that depicts the purchasing function of an organization?

According to the IIA guidance, who is responsible for periodically assessing the internal audit activity?

Which of the following controls could an internal auditor reasonably conclude is effective by observing the physical controls of a large server room?

Feedback on engagements from audit clients, annual benchmarking of the internal audit activity's (IAA's) performance against best practice, and analyses of project budgets and audit plan completion are all tools that can best be used by the IAA for which purpose?

Which of the following statements is true regarding assurance services provided to clients outside of the organization?

Which of the following decisions made during the testing phase of a compliance audit requires the most judgment by an internal auditor?

An auditor for a large wholesaler is evaluating the controls over the approval and oversight of credit sales. Which of the following procedures would be a control weakness?

According to IIA guidance, which of the following is the best example of a system application control?

Which of the following is a preventive control?

A small not-for-profit organization with limited resources is unable to adequately maintain appropriate segregation of duties. Considering the organization's resource constraints, which type of controls would best mitigate segregation of duty risks?

Which of the following is the primary advantage of using a computer assisted audit technique (CAAT) to provide a higher level of assurance?

Which of the following statements, if true, could justify an auditor's decision not to report governance-related control deficiencies to the audit committee?

Which of the following risk assessment tools would best facilitate the matching of controls to risks?

An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which of the following statements about a common risk language is true?

Certified Financial Services Auditor

Certified Government Auditing Professional

Conducting the Internal Audit Engagement

Business Analysis and Information Technology

Filters

Exam 3: The Internal Audit Activity Role in Governance, Risk, and Control

According to IIA guidance, which of the following best describes how risks are measured?

In selecting an instructional strategy for developing internal audit staff, a chief audit executive should first review the:

Which of the following internal control weaknesses would an internal auditor most likely detect while reviewing a flowchart that depicts the purchasing function of an organization?

According to the IIA guidance, who is responsible for periodically assessing the internal audit activity?

Which of the following controls could an internal auditor reasonably conclude is effective by observing the physical controls of a large server room?

Feedback on engagements from audit clients, annual benchmarking of the internal audit activity's (IAA's) performance against best practice, and analyses of project budgets and audit plan completion are all tools that can best be used by the IAA for which purpose?

Which of the following statements is true regarding assurance services provided to clients outside of the organization?

Which of the following decisions made during the testing phase of a compliance audit requires the most judgment by an internal auditor?

An auditor for a large wholesaler is evaluating the controls over the approval and oversight of credit sales. Which of the following procedures would be a control weakness?

According to IIA guidance, which of the following is the best example of a system application control?

Which of the following is a preventive control?

A small not-for-profit organization with limited resources is unable to adequately maintain appropriate segregation of duties. Considering the organization's resource constraints, which type of controls would best mitigate segregation of duty risks?

Which of the following is the primary advantage of using a computer assisted audit technique (CAAT) to provide a higher level of assurance?

Which of the following statements, if true, could justify an auditor's decision not to report governance-related control deficiencies to the audit committee?

Which of the following risk assessment tools would best facilitate the matching of controls to risks?

An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which of the following statements about a common risk language is true?

Certified Financial Services Auditor

Certified Government Auditing Professional

Conducting the Internal Audit Engagement

Business Analysis and Information Technology

Filters