Exam 3: The Internal Audit Activity Role in Governance, Risk, and Control

Question 1

An organization's accounts payable function improved its internal controls significantly after it received an unsatisfactory audit report. When planning a follow-up audit of the function, what level of detection risk should be expected if the audit and sampling procedures used are unchanged from the prior audit?

A) Detection risk is lower because control risk is lower.
B) Detection risk is lower because control risk is higher.
C) Detection risk is higher because control risk is lower.
D) Detection risk is unchanged although control risk is lower.

Answer 1

Detection risk is unchanged although control risk is lower.

Question 2

According to the Standards, the organizational status of the internal audit activity:

A) Must be sufficient to permit the accomplishment of its audit responsibilities.
B) Is best when the reporting relationship is direct to the board of directors.
C) Requires the board's annual approval of the audit schedules, plans, and budgets.
D) Is guaranteed when the charter specifically defines its independence.

Answer 2

Must be sufficient to permit the accomplishment of its audit responsibilities.

Question 3

Which of the following is an appropriate consideration by the auditor when preparing an engagement program for a human resource audit?

A) State the work steps in the form of questions.
B) Use standard audit program for HR from previous years.
C) Include in the audit program certain audit tests requested by audit client.
D) Defer preparation of the audit program after the field work.

Answer 3

Include in the audit program certain audit tests requested by audit client.

Question 4

Which of the following activities most significantly increases the risk that a bank will make poor-quality loans to its customers?

A) Borrowers may not sign all required mortgage loan documentation.
B) Fees paid by the borrower at the time of the loan may not be deposited in a timely manner.
C) The bank's loan documentation may not meet the government's disclosure requirements.
D) Loan officers may override the lending criteria established by senior management.

Question 5

Which of the following would not be a factor for senior management to consider when determining the internal audit activity's role in an organization's risk management process?

A) The extent to which the internal audit activity is outsourced.
B) The maturity level of risk management practices in the organization.
C) The competency of the internal auditors in risk management.
D) The nature of the business and the environment in which the organization operates.

Question 6

An auditor plans to analyze customer satisfaction, including. (1) customer complaints recorded by the customer service department during the last three months; (2) merchandise returned in the last three months; and (3) responses to a survey of customers who made purchases in the last three months. Which of the following statements regarding this audit approach is correct?

A) Although useful, such an analysis does not address any risk factors.
B) The survey would not consider customers who did not make purchases in the last three months.
C) Steps 1 and 2 of the analysis are not necessary or cost-effective if the customer survey is comprehensive.
D) Analysis of three months' activity would not evaluate customer satisfaction.

Question 7

When internal auditors perform consulting services that add value and improve an organization's operations, these services:

A) Impair the internal auditors' objectivity with respect to an assurance service involving the same engagement client.
B) Would preclude the achievement of assurance from the consulting engagement.
C) Should be consistent with the internal audit activity's empowerment reflected in the charter.
D) Impose no responsibility to communicate information other than to the engagement client.

Question 8

Which of the following components influences the risk consciousness of an organization's people and is the basis for all other components of enterprise risk management?

A) Objective setting.
B) Information and Communication.
C) Risk Assessment.
D) Internal Environment.

Question 9

According to the International Professional Practices Framework, which of the following is the appropriate division of responsibilities for the coordination of internal and external audit efforts?

A) Oversight of Work Coordination of Activities Chief audit executive Senior management II. Board III. Chief financial officer IV. Board Chief financial officer
B) I
C) II.
D) III.
E) IV.

Question 10

Which of the following risk assessment tools would best facilitate the matching of controls to risks?

A) Control matrix.
B) Internal control questionnaire.
C) Control flowchart.
D) Program evaluation and review technique (PERT) analysis.

Question 11

A manufacturing firm uses hazardous materials in the production of its products. An audit of the firm's processes related to hazardous materials should include.

A) Recommending an environmental management system as part of policies and procedures. II. Verifying the existence of tracking records for these materials from creation to destruction. III. Using consultants to avoid self-incrimination of the firm in the event illegalities were detected in an environmental audit. IV. Evaluating the cost provided for in an environmental liability accrual account.
B) II only
C) III and IV only
D) I, II, and IV only
E) I, III, and IV only

Question 12

An organization that outsources much of its internal audit work to an external service provider is planning for an external quality assessment. Which of the following options would accomplish this task and be in conformance with the Standards?

A) External industry associate that performed a similar review for a supplier of the organization.
B) A team from an independent entity that previously employed the chief audit executive of the organization.
C) A team under the direction of the organization's chief audit executive with validation by a former manager of the internal audit activity.
D) The same external service provider because of its competency and experience with the organization.

Question 13

An organization has a policy requiring two signatures on all checks written for amounts in excess of $10, 000. When evaluating controls over disbursements, an auditor would conclude that a greater risk exists if.

A) The auditor located two checks for $9, 000 each that contained one authorized signature.
B) The $10, 000 was an immaterial amount to the organization and very few cash disbursements required an amount in excess of $10, 000.
C) The director of accounting was not one of the authorized signers.
D) There were several instances in which successively numbered checks for amounts between $5, 000 and $10, 000 were made payable to the same vendor.

Question 14

An internal auditor is assigned to conduct an audit of security for a local area network (LAN) in the finance department of the organization. Investment decisions, including the use of hedging strategies and financial derivatives, use data and financial models which run on the LAN. The LAN is also used to download data from the mainframe to assist in decisions. Which of the following should be considered outside the scope of this security audit engagement?

A) Investigation of the physical security over access to the components of the LAN.
B) The ability of the LAN application to identify data items at the field or record level and implement user access security at that level.
C) Interviews with users to determine their assessment of the level of security in the system and the vulnerability of the system to compromise.
D) The level of security of other LANs in the company which also utilize sensitive data.

Question 15

Which of the following best describes the underlying premise of the COSO enterprise risk management framework?

A) Management should set objectives before assessing risk.
B) Every entity exists to provide value for its stakeholders.
C) Policies are established to ensure that risk responses are performed effectively.
D) Enterprise risk management can minimize the impact and likelihood of unanticipated events.

Question 16

Which of the following factors affects the control risk of a company?

A) Potential problems like technological obsolescence.
B) Unusual pressures on management.
C) Complex accounts that require expert valuations.
D) Segregation of duties.

Question 17

During the planning phase of an audit of suspected overbilling on contracts for security services, an auditor should perform all of the following except:

A) Interviewing an official of the security services company to determine the cause of recent increases in billings for services.
B) Interviewing the manager who requested the audit engagement.
C) Obtaining a copy of the contract between the two organizations.
D) Preparing an engagement program.

Question 18

Which of the following is an appropriate role for the board in governance?

A) Preparing written organizational policies that relate to compliance with laws, regulations, ethics, and conflicts of interest.
B) Ensuring that financial statements are understandable, transparent, and reliable.
C) Assisting the internal audit activity in performing annual reviews of governance.
D) Working with the organization's attorneys to develop a strategy regarding current litigation, pending litigation, or regulatory proceedings governance.

Question 19

The top three sales representatives for a company consistently include non-allowable charges on their expense reports. Line management is reluctant to deny reimbursement of the charges for fear of losing the sales representatives. This situation has the greatest negative impact on which of the following internal control components?

A) Monitoring.
B) Control environment.
C) Information and communication.
D) Control activities.

Question 20

According to the International Professional Practices Framework, internal auditors should possess which of the following competencies?

A) Proficiency in applying internal auditing standards, procedures, and techniques. II. Proficiency in accounting principles and techniques. III. An understanding of management principles. IV. An understanding of the fundamentals of economics, commercial law, taxation, finance, and quantitative methods.
B) I only
C) II only
D) I and III only
E) I, III, and IV only

Question 21

In advance of a preliminary survey, a chief audit executive sends a memorandum and questionnaire to the supervisors of the department to be audited. What is the most likely result of that procedure?

A) It creates apprehension about the audit engagement.
B) It involves the engagement client's supervisory personnel in the audit.
C) It is an uneconomical approach to obtaining information.
D) It is only useful for audits of distant locations.

Question 22

Which of the following measurements could an auditor use in an audit of the efficiency of a motor vehicle inspection facility?

A) The total number of cars approved.
B) The ratio of cars rejected to total cars inspected.
C) The number of cars inspected per inspection agent.
D) The average amount of fees collected per cashier.

Question 23

A charitable organization provides substantial grants for important medical research. Assuming marginal controls are in place, which of the following possible frauds or misuses of organization assets should be considered the area of greatest risk?

A) Senior executives are using company travel and entertainment funds for activities that might be considered questionable.
B) Purchases of office supplies are made from fictitious vendors.
C) Grants are made to organizations associated with senior executives.
D) A payroll clerk has added a fictitious employee.

Question 24

An audit to test the system of controls over the purchase, distribution, and use of radioactive material is being conducted at a company's plants. The process is well documented, and employees in the safety department are very familiar with the department's procedures. Since the purchasing and facilities departments are involved in the process, the auditor is considering reviewing their radioactive material-handling procedures as well. The auditor should:

A) Have confidence in the rigorous and detailed safety department procedures, since that department has the main responsibility for radiation safety, and should not use audit time to review other departments.
B) Adjust the engagement schedule and budget, if needed, and interview the appropriate individuals in the purchasing and facilities departments to ascertain whether additional controls exist that complement those identified within the safety department.
C) Test the controls identified within the safety department; if results are unfavorable, the auditor should consider whether to involve the other departments.
D) Defer questions regarding purchasing, facilities, and other departments until audit projects can be scheduled for those departments.

Question 25

The chief audit executive should periodically report the internal audit activity's purpose, authority, responsibility, and performance, as well as significant risk exposures and control issues, to which of the following?

A) Board of directors. II. Senior management. III. Shareholders. IV. External auditors.
B) II only
C) I and II only
D) I, II, and III only
E) I, III, and IV only

Question 26

Senior management at a financial institution has received allegations of fraud at its derivatives trading desk and has asked the internal audit activity to investigate and issue a report concerning the allegations. The internal audit activity has not yet developed sufficient proficiency regarding derivatives trading to conduct a thorough fraud investigation in this area. Which of the following courses of action should the chief audit executive (CAE) take to comply with the Standards?

A) Engage the former head of the institution's derivatives trading desk to perform the investigation and submit a report with supporting documentation to the CAE.
B) Request that senior management allow a delay of the fraud investigation until the internal audit activity's on-staff certified fraud examiner is able to obtain the appropriate training regarding the analysis of derivatives trading.
C) Request that senior management exclude the internal audit activity from the investigation completely and instead contract with an external certified fraud examiner with derivatives experience to perform all aspects of the investigation and subsequent reporting.
D) Contract with an external certified fraud examiner with derivatives experience to perform the investigation and subsequent reporting, with the chief audit executive approving the scope of the investigation and evaluating the adequacy of the work performed.

Question 27

In a manufacturing organization, all sales prices are determined centrally and are electronically sent to the distribution centers to update their sales price tables. Any pricing deviations must be approved by central headquarters. To determine how this process is functioning, an internal auditor should:

A) Document the flow of sales price information, and determine how the table is accessed and updated.
B) Develop a flowchart of the sales order process to determine how orders are taken and priced.
C) Identify who approves the shipment of goods and how the goods are priced.
D) Obtain a copy of the existing flowchart for the computer program to determine how price data are accessed.

Question 28

Which of the following describes a control weakness?

A) Purchasing procedures are well designed and are followed unless otherwise directed by the purchasing supervisor.
B) Pre-numbered blank purchase orders are secured within the purchasing department.
C) Normal operational purchases fall in the range from $500 to $1, 000 with two signatures required for purchases over $1, 000.
D) The purchasing agent invests in a publicly traded mutual fund that lists the stock of one of the company's suppliers in its portfolio.

Question 29

Which of the following best describes the most important criteria when assigning responsibility for specific tasks required in an audit engagement?

A) Auditors must be given assignments based primarily upon their years of experience.
B) All auditors assigned an audit task must have the knowledge and skills necessary to complete the task satisfactorily.
C) Tasks must be assigned to the audit team member who is most qualified to perform them.
D) All audit team members must have the skills necessary to satisfactorily complete any task that will be required in the audit engagement.

Question 30

An audit of the quality control department is being planned. Which of the following would least likely be used in the preparation of a preliminary survey questionnaire?

A) An analysis of quality control documents.
B) The permanent audit file.
C) The prior audit report.
D) Management's charter for the quality control department.

Question 31

If an engagement client's operating standards are vague and thus subject to interpretation, the auditor should:

A) Seek agreement with the client as to the standards to be used to measure operating performance.
B) Determine best practices in the area and use them as the standard.
C) Interpret the standards in their strictest sense because standards are otherwise only minimum measures of acceptance.
D) Omit any comments on standards and the client's performance in relationship to those standards, because such an analysis would be meaningless.

Question 32

To assure that the technical proficiency of internal auditors is appropriate for the audit engagements to be performed, a chief audit executive should:

A) Consider the scope of work and level of responsibility when establishing criteria for education and experience in filling internal auditing positions.
B) Ensure that each newly hired auditor is qualified in all of the disciplines needed to accomplish the department's audit mission.
C) Oversee a training program that matches the actual training provided with the interests of individual auditors.
D) Require all of the audit staff to pursue a minimum number of continuing professional education hours each year.

Question 33

An objective for an audit of a medical research corporation is to evaluate management's controls to ensure that timely reports are submitted to sponsors of contracted research projects. In planning the audit to achieve this objective, the auditor should begin by:

A) Reviewing policies and procedures.
B) Interviewing a group of research managers.
C) Observing report preparation in a number of laboratories.
D) Sending a questionnaire to a sample of research sponsors.

Question 34

Which of the following would be most effective in determining if the percentage of medication orders containing errors improved after a hospital installed a computerized medication-tracking system?

A) Compare the proportion of erroneous medication orders before and after system installation for similar periods.
B) Compare the number of errors before and after system installation for similar periods.
C) Compare, after adjusting for the number of patients, the proportion of erroneous medication orders before and after system installation.
D) Compare, after adjusting for the number of patients, the number of errors before and after system installation for similar periods.

Question 35

An internal auditor plans to use an analytical review to verify the correctness of various operating expenses in a division. The use of an analytical review as a verification technique would not be a preferred approach if.

A) The auditor notes strong indicators of a specific fraud involving this account.
B) The company has relatively stable operations which have not changed much over the past year.
C) The auditor would like to identify large, unusual, or non-recurring transactions during the year.
D) The operating expenses vary in relation to other operating expenses, but not in relation to revenue.

Question 36

After several years in the engineering department, an engineer was transferred to the internal audit department. One month later, the new auditor was assigned to an assurance engagement for the engineering department. When the auditor's former engineering supervisor suggested a change in the sample selection method, the auditor consulted with the audit supervisor. They determined that the suggested method would not be as representative and that the original selection method should be used. In this situation, the auditor:

A) Maintained an independent mental attitude and is therefore objective.
B) Has subordinated professional judgment, and objectivity is therefore impaired.
C) Does not have objectivity since the auditor recently transferred from the engineering department.
D) Does not have independent organizational status since the auditor recently transferred from the engineering department.

Question 37

An auditor for a large wholesaler is evaluating the controls over the approval and oversight of credit sales. Which of the following procedures would be a control weakness?

A) The credit department is responsible for approving shipments to all customers.
B) The finance committee of the board of directors periodically reviews credit standards.
C) Customers who fail to meet credit requirements must pay cash for shipments upon delivery.
D) The sales department is responsible for determining the credit ratings of customers.

Question 38

Which of the following would be the best source of information for a chief audit executive to use in planning future audit staff requirements?

A) Discussions of audit needs with executive management and the audit committee.
B) Review of audit staff education and training records.
C) Review of audit staff size and composition of similar-sized companies in the same industry.
D) Interviews with existing audit staff.

Question 39

Two individuals are being considered for an audit team that is to perform a highly technical review. Which of the following situations would preclude selection of the individual for the audit due to an objectivity concern?

A) Person A is a member of the internal audit staff and has the required technical skills. Person A participated in a controls review of the system to be audited when it was being developed. II. Person B is a technical specialist who understands the audit area but is not a member of the internal audit staff. Although person B has personal credibility in the information systems department to be audited, person B works for another department in the organization.
B) I only
C) II only
D) Both I and II.
E) Neither I nor II.

Question 40

Management has requested that an internal auditor serve as member of a task force that will review current receivables practices and make recommendations to improve processes. Which of the following is the most appropriate response by the internal auditor?

A) Accept the assignment provided that such consulting services are defined in the charter.
B) Decline the assignment because participation on task forces will impair the auditor's objectivity in future audit engagements.
C) Accept the assignment if the auditor believes that it will not impair objectivity in future audit engagements.
D) Do not accept the assignment because the assignment is not part of an approved audit plan.

Question 41

Which of the following is not true with regard to the internal audit charter?

A) It defines the authorities and responsibilities of the internal audit activity.
B) It specifies the minimum resources needed for the internal audit activity.
C) It provides a basis for evaluating the internal audit activity.
D) It should be approved by senior management and the board.

Question 42

To identify those components of a telecommunications system that present the greatest risk, an internal auditor should first:

A) Review the open systems interconnect network model.
B) Identify the network operating costs.
C) Determine the business purpose of the network.
D) Map the network software and hardware products into their respective layers.

Question 43

Which of the following actions would be considered a violation of the Standards?

A) Drafts of engagement communications were reviewed with the audit client to obtain input. The client's comments were considered when developing the engagement final communication. II. An auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development. III. Given limited resources, the chief audit executive performed a risk analysis to determine which functions to audit.
B) II only
C) I and III only
D) I, II, and III.
E) None of the above.

Question 44

Which of the following represents the most effective governance structure?

A) Operating Executive Internal Management Auditing Responsibility for risk Oversight role Advisory role II. III. IV.
B) I Only
C) II
D) III
E) IV

Question 45

Which of the following would provide the most reliable information on the risk associated with an auditable activity?

A) Event scenarios with regression analysis.
B) Past audit findings and instances of management failures.
C) Consequences and economic predictability of loss.
D) Management assessment and corroboration by the internal audit activity.

Question 46

The primary reason that a bank would maintain a separate compliance function is to:

A) Better manage perceived high risks.
B) Strengthen controls over the bank's investments.
C) Ensure the independence of line and senior management.
D) Better respond to shareholder expectations.

Question 47

To promote a positive image within an organization, a chief audit executive (CAE) adjusted the audit plan to focus on assurance engagements that highlighted potential costs to be saved. Negative observations were to be omitted from engagement final communications. Which action taken by the CAE would be considered a violation of the Standards?

A) The focus of the audit function was changed without modifying the audit charter or notifying the audit committee. II. Negative observations were omitted from the engagement final communications. III. Cost savings and recommendations were highlighted in the engagement final communications.
B) II only
C) I and II only
D) I and III only
E) I, II, and III.

Question 48

Which of the following would be the most useful in developing an annual audit plan?

A) General purpose audit software.
B) Voting software and hardware.
C) Flowcharting and data capture software.
D) Risk assessment software.

Question 49

The primary objective of risk-based auditing is to assess the:

A) Economy of controls.
B) Compliance with controls.
C) Adequacy of controls.
D) Efficiency of controls.

Question 50

The chief audit executive's responsibility regarding control processes includes:

A) Assisting senior management and the audit committee in the development of an annual assessment about internal control.
B) Overseeing the establishment of internal control processes.
C) Maintaining the organization's governance processes.
D) Ensuring that the internal audit activity assesses all control processes annually.

Question 51

Which is the least effective form of risk management?

A) Systems-based preventive control.
B) People-based preventive control.
C) Systems-based detective control.
D) People-based detective control.

Question 52

During a review of data center physical security and environmental controls, an auditor should ensure that:

A) Visitors are accompanied by authorized personnel at all times. II. Only developers and operators have access to the data center. III. Fire suppression equipment is tested periodically. IV. Fire and water detectors have been installed.
B) I and III only
C) II and IV only
D) I, III, and IV only
E) II, III, and IV only

Question 53

Inadequate risk assessment would have the strongest negative impact in which of the following phases of an audit engagement?

A) Determining the scope.
B) Reviewing internal controls.
C) Testing.
D) Evaluating findings.

Question 54

Regarding an organization's decision to retain an external audit firm, the chief audit executive (CAE) should:

A) Work with the organization's chief financial officer to evaluate the external auditor's performance and together make the decision.
B) Not be involved in this decision process as it would compromise the CAE's objectivity.
C) Evaluate the external auditor's performance and retain the external auditor if quality and cost criteria are met.
D) Assist the audit committee by facilitating the development of an appropriate evaluation process.

Question 55

At the beginning of fieldwork in an audit of investments, an internal auditor noted that the interest rate had declined significantly since the engagement work program was created. The auditor should:

A) Proceed with the existing program since this was the original scope of work that was approved.
B) Modify the audit program and proceed with the engagement.
C) Consult with management to verify the interest rate change and proceed with the engagement.
D) Determine the effect of the interest rate change and whether the program should be modified.

Question 56

Overall audit efficiency is enhanced between the internal and external audit functions when:

A) Internal audit coverage is reduced to avoid potential conflicts of interest.
B) Audits of the same department are conducted at different times.
C) The internal audit department reviews functions or departments prior to the external audit.
D) External audit scope is reduced based on the internal audit department's activities.

Question 57

In order to provide the most useful information for an organization's risk management decisions, which of the following should be assessed?

A) Risk levels for future events based on the degree of uncertainty of those events and their cost of mitigation.
B) Inherent and control risks and their impact on the extent of financial misstatements.
C) Risk levels of current and future events, their effect on the achievement of the organization's objectives, and their underlying causes.
D) Risk levels of current and future events, their impact on the organization's mission, and the potential for the elimination of existing risk factors.

Question 58

Which of the following would be the least desirable criteria against which to judge current operations of a company's treasury function?

A) The operations of the treasury function as documented during the last audit engagement.
B) Company policies and procedures delegating authority and assigning responsibilities.
C) Finance textbook illustrations of generally accepted good treasury function practices.
D) Codification of best practices of the treasury function in relevant industries.

Question 59

Which of the following is a role of the board of directors in the governance process?

A) Conduct periodic assessments of the organization's governance systems.
B) Obtain assurance concerning the effectiveness of the organization's governance systems.
C) Implement an effective system of internal controls to support the organization's governance systems.
D) Review and approve operational goals and objectives.

Question 60

Which of the following represents the correct order of the risk management process?

A) Resource allocation, risk management metrics, risk assessment, post-mortem analysis, effective communication.
B) Risk management metrics, resource allocation, risk assessment, effective communication, post-mortem analysis.
C) Risk assessment, resource allocation, risk governance and reporting, post-mortem analysis, feedback.
D) Resource allocation, risk monitoring, risk assessment, feedback, post-mortem analysis.

Question 61

The chairperson of an organization's audit committee has obtained a risk management report that identifies significant industry concerns that impact the organization. The chairperson has asked the chief audit executive (CAE) to review these concerns and advise if they are relevant to the organization. How should the CAE respond?

A) Accept the engagement but communicate only with the audit committee to protect the confidentiality of the request.
B) Decline the engagement because it is outside of the scope of the internal audit charter.
C) Decline the engagement because it impairs the internal audit activity's independence.
D) Accept the engagement but inform senior management of the request.

Question 62

Internal auditors can benefit from a strong relationship with the external auditors because external auditors can:

A) Provide internal auditors with an independent and knowledgeable viewpoint.
B) Concur with the internal auditors' reports and thus improve the quality of assurance provided to management.
C) Increase the effectiveness of internal control sampling techniques.
D) Assist the internal auditor by providing information obtained from similar audits with other clients.

Question 63

The chief audit executive for an organization has just completed a risk assessment process, identified the areas with the highest risk, and assigned an audit priority to each. Which of the following statements is true and consistent with the International Professional Practices Framework?

A) Items should be ranked in the order of quantifiable dollar exposure to the organization. II. The audit priorities should be in order of major control deficiencies. III. The risk assessment, though quantified, is the result of professional judgments about both exposures and probability of occurrences.
B) I only
C) III only
D) II and III only
E) I, II, and III.

Question 64

The audit process used by the internal audit activity of a large wholesale clothing company does not include an engagement letter or project approval document. The most serious consequence of this deficiency in the process is that the:

A) Audit schedule may not be optimal from the engagement client's perspective.
B) Audit objectives may not be understood by management of the area being audited.
C) Audit resources may not be sufficient.
D) Audit plan priority may have changed.

Question 65

During an audit of financial contracts, an auditor learns that a relative has a substantial loan with the organization. The auditor should:

A) Exclude the relative's information from the audited work and proceed with the audit engagement.
B) Proceed with the audit engagement but disclose in the engagement final communication that the relative is a customer.
C) Immediately withdraw from the audit engagement.
D) Notify management and the chief audit executive (CAE) and have the CAE determine whether the auditor should continue with the audit engagement.

Question 66

When reviewing operational risk for a department whose manager adopts a laissez-faire style of leadership, it is most important for the internal auditor to verify that:

A) Employee decisions follow department and company guidelines.
B) The manager considers employees' input when designing new procedures.
C) Employees are empowered to deal with unusual or emergency situations.
D) Management has adopted an open-door policy to assist with communication.

Question 67

In selecting an instructional strategy for developing internal audit staff, a chief audit executive should first review the:

A) Department's budget constraints.
B) Internal auditors' personal development needs.
C) Content of potential training courses.
D) Organization's objectives.

Question 68

An organization receives the most value from an internal audit activity's enterprise-wide risk assessment when the auditor:

A) Focuses primarily on enterprise-level risks.
B) Considers activities at all levels of the organization.
C) Reviews special projects and new initiatives.
D) Validates supporting financial and operational data.

Question 69

Internal auditors who are concerned with potential risks due to the mishandling of records or transactions should take into consideration:

A) The type and nature of the activities to be examined.
B) Whether employees in key positions of trust are bonded.
C) The history of losses suffered by the company.
D) The results of prior risk assessments.

Question 70

A quantitative risk assessment model has all of the following advantages except:

A) Accommodating a large number of risk factors in the assessment.
B) Providing documentation for the chief audit executive, who must defend the long-range audit plan.
C) Providing a systematic method of applying weightings to risks and priorities.
D) Removing the need for judgment on the part of the chief audit executive.

Question 71

Using the internal audit department to coordinate regulatory examiners' efforts is beneficial to the organization because internal auditors can:

A) Influence regulatory interpretation of law to better match corporate practice.
B) Recommend changes to the scope of the regulatory examiners' review.
C) Perform fieldwork for the regulatory examiners and thus shorten the regulatory examiners' review.
D) Supply evidence of adequate compliance testing through internal audit workpapers and reports.

Question 72

Noncompliance with which of the following would cause a control deficiency related to privacy protection practices?

A) An organization's internal privacy policies. II. Financial accounting standards. III. Privacy laws and regulations. IV. The Standards.
B) I and III only
C) II and IV only
D) II, III, and IV only
E) I, II, III, and IV.

Question 73

Which of the following situations allows for the most objectivity on the part of an internal auditor?

A) Assessing testing procedures in a new computer system.
B) Performing a risk assessment of a new financial instrument.
C) Drawing conclusions from a sample of financial transactions.
D) Comparing current environmental activities against legislation.

Question 74

A chief audit executive would most likely use risk assessment for audit planning because it provides:

A) A systematic process for assessing and integrating professional judgment about probable adverse conditions.
B) A listing of potentially adverse effects on the organization.
C) A list of auditable activities in the organization.
D) The probability that an event or action may adversely affect the organization.

Question 75

A company has entered into a $20, 000, 000 fixed-price contract with a general contractor for the construction of a new retail outlet. For this contract, which of the following would represent the greatest risk?

A) Excessive labor charged to the project.
B) Poor physical protection of materials and equipment.
C) Failure to complete the project within budget.
D) Substitution of inferior materials.

Question 76

Risk assessments are valuable to the internal audit activity's planning process because they assist in:

A) Eliminating all areas with low risk from the audit plan.
B) Educating management on the importance of keeping the internal audit activity informed of organizational changes.
C) Identifying the audit universe or auditable activities that need to be reviewed.
D) Identifying risks that management and the internal auditors have overlooked.

Question 77

Which of the following actions by a chief audit executive would be most effective in preventing fraud?

A) Ensure that the board is aware of all fraud that has been identified or reported.
B) Train the internal audit staff in identifying fraud indicators.
C) Review the adequacy of all policies that describe prohibited activities.
D) Submit an annual report to the board on all fraud that has been detected.

Question 78

Which of the following is not an appropriate role of the internal audit activity in governance activities?

A) Support the board in enterprise-wide risk assessment.
B) Ensure the timely implementation of audit recommendations.
C) Monitor compliance with the organization's ethics policies.
D) Discuss areas of significant risk.

Question 79

Risk assessments can vary in format, but generally include.

A) A description of identified risks. II. Tests of audit controls. III. A system of rating risks. IV. Sample size identification.
B) I and II only
C) I and III only
D) I, III, and IV only
E) II, III, and IV only

Question 80

Which of the following statements is correct regarding risk analysis?

A) The extent to which management judgments are required in an area could serve as a risk factor in assisting the auditor in making a comparative risk analysis.
B) The highest risk assessment should always be assigned to the area with the largest potential loss.
C) The highest risk assessment should always be assigned to the area with the highest probability of occurrence.
D) Risk analysis must be reduced to quantitative terms in order to provide meaningful comparisons across an organization.