Question 1

While performing an internal audit engagement, an auditor reviews a flowchart of the organization's purchasing function. Which of the following internal control weaknesses would the auditor be able to identify in the chart?

Accepted Answer

A)   That purchasing policies have not been updated.
B)   That supplier invoices are processed and paid before the goods are received.
C)   That the organization is not taking advantage of quantity discounts available from its suppliers.
D)   That authorization for payment of goods received has not been granted at the appropriate level. B

Question 2

Which of the following best describes an appropriate form of working paper standardization?

Accepted Answer

A)   Uniform cross referencing system.
B)   Customized layouts for each specific audit area.
C)   Comprehensive data lists from information databases.
D)   Audit client review and approval. A

Question 3

To promote a positive image within an organization, a chief audit executive (CAE) adjusted the audit plan to focus on assurance engagements that highlighted potential costs to be saved. Negative observations were to be omitted from engagement final communications. Which action taken by the CAE would be considered a violation of the Standards?

Accepted Answer

A)   The focus of the audit function was changed without modifying the audit charter or notifying the audit committee. II. Negative observations were omitted from the engagement final communications. III. Cost savings and recommendations were highlighted in the engagement final communications.
B)   II only
C)   I and II only
D)   I and III only
E)   I, II, and III. B

Question 4

To assure that the technical proficiency of internal auditors is appropriate for the audit engagements to be performed, a chief audit executive should:

Accepted Answer

A)   Consider the scope of work and level of responsibility when establishing criteria for education and experience in filling internal auditing positions.
B)   Ensure that each newly hired auditor is qualified in all of the disciplines needed to accomplish the department's audit mission.
C)   Oversee a training program that matches the actual training provided with the interests of individual auditors.
D)   Require all of the audit staff to pursue a minimum number of continuing professional education hours each year.

Question 5

An internal auditor obtains spreadsheets created by the finance department of an organization. The internal auditor contacts a third party about the source data that was utilized to create the spreadsheets before going on to perform a ratio analysis and a comparison of budget versus actual data. What is the most likely reason that the internal auditor involved a third party before performing further analysis?

Accepted Answer

A)   To determine if a later re-performance for testing mechanical accuracy would be possible.
B)   To confirm that the spreadsheets could be used as a source of analytic data.
C)   To determine what future usage limitations the spreadsheets might have.
D)   To obtain a reliable verification about the accuracy of the source data.

Question 6

A company has entered into a $20, 000, 000 fixed-price contract with a general contractor for the construction of a new retail outlet. For this contract, which of the following would represent the greatest risk?

Accepted Answer

A)   Excessive labor charged to the project.
B)   Poor physical protection of materials and equipment.
C)   Failure to complete the project within budget.
D)   Substitution of inferior materials.

Question 7

Which of the following would be considered a preventive control?

Accepted Answer

A)   A library control log.
B)   A review of exception reports.
C)   A password lock on a server.
D)   A software scan of financial records for irregularities.

Question 8

A manufacturing organization discovers that the waste water released has failed to meet permitted limits. Which control function will be least effective in correcting the issue?

Accepted Answer

A)   Performing a chemical analysis of the water, prior to discharge, for components specified in the permit.
B)   Posting signs that tell employees which substances may be disposed of via sinks and floor drains within the facility.
C)   Diluting pollutants by flushing sinks and floor drains daily with large volumes of clean water.
D)   Establishing a preventive maintenance program for the pretreatment system.

Question 9

Which of the following would be most effective in determining if the percentage of medication orders containing errors improved after a hospital installed a computerized medication-tracking system?

Accepted Answer

A)   Compare the proportion of erroneous medication orders before and after system installation for similar periods.
B)   Compare the number of errors before and after system installation for similar periods.
C)   Compare, after adjusting for the number of patients, the proportion of erroneous medication orders before and after system installation.
D)   Compare, after adjusting for the number of patients, the number of errors before and after system installation for similar periods.

Question 10

An internal auditor for a large computer company suspects that returned computer systems are being repackaged as new products and shipped to other customers before the defects have been repaired. Which of the following would be the most persuasive piece of evidence in support of the auditor's suspicions?

Accepted Answer

A)   Credit memos issued after year end for goods shipped before year end.
B)   Evidence of returned goods in the shipping and receiving area.
C)   An unusual number of customer complaints.
D)   The results of a complete physical inventory taken at year end.

Question 11

What conclusion can be reached by comparing a random sample of vendor invoices to purchase orders?

Accepted Answer

A)   No duplicate invoices were received.
B)   No duplicate payments were made.
C)   Invoices were for authorized purchases.
D)   Authorized invoices were paid.

Question 12

Which of the following would not be considered part of preliminary survey of an engagement area?

Accepted Answer

A)   Interviews with individuals affected by the entity.
B)   Functional walk through test.
C)   Analytical reviews.
D)   Sampling scope.

Question 13

When comparing an organization's current performance to that of the prior year, an internal auditor found that: Total labor costs had increased. More overtime costs had been incurred. The total number of workers had increased. Net income was 10 percent lower. Based solely on this information, which of the following is a valid conclusion?

Accepted Answer

A)   Net income per worker decreased.
B)   Wage rates increased.
C)   Worker efficiency decreased.
D)   Total labor hours increased.

Question 14

When developing the annual audit plan and reviewing risk assessment priorities, a chief audit executive should always identify the:

Accepted Answer

A)   Potential recommendations for each auditable activity.
B)   Persons to whom engagement reports will be communicated.
C)   Engagement procedures to be used during the engagements.
D)   Internal audit resources required to achieve the audit plan.

Question 15

An internal auditor is testing the controls of a large and complex food production process where quality assurance is critical. Management provides process charts and documentation, but the auditor quickly determines that this information is incomplete and out of date. Which of the following would be the most appropriate course of action for the auditor to follow?

Accepted Answer

A)   Use the documentation but meet with the production supervisor to obtain updated information before proceeding.
B)   Amend the engagement objectives recognizing that important information is not available to protect the engagement's integrity.
C)   Defer the audit until management can provide updated charts and documentation as this is their responsibility.
D)   Use the documentation but use observation during the engagement to provide missing information.

Question 16

Which of the following factors is not likely to affect the level of inherent risk associated with an application system?

Accepted Answer

A)   The system is strategic.
B)   Controls over the system appear reliable.
C)   The system is not a critical operating system.
D)   The system uses complex technology.

Question 17

Allegations have been made that an organization's share price has been manipulated. Which of the following would provide an internal auditor with the most objective evidence in this case?

Accepted Answer

A)   Major shareholders of the organization.
B)   Large customers of the organization.
C)   Former members of management.
D)   Former financial consultants.

Question 18

A large trucking organization wants to reduce traffic accidents by improving its system of internal controls. Which of the following controls is correctly classified? 1. Review of speeding violations to identify repetitive locations and drivers is an example of a preventive control. 2. Defensive driver training is an example of a directive control. 3. The installation of tracking devices in delivery vehicles is an example of a corrective control. 4. Providing a vehicle driver handbook is an example of a detective control.

Accepted Answer

A)   1 and 2.
B)   1 and 4.
C)   2 and 3.
D)   3 and 4.

Question 19

Which of the following is least likely to enhance the independence of an internal audit activity?

Accepted Answer

A)   The existence of a formal written charter for the internal audit activity.
B)   Submission of an annual internal audit work plan to the audit committee.
C)   A direct reporting relationship to the audit committee.
D)   Adherence to the organization's position classification structure.

Question 20

According to IIA guidance, which of the following statements is true?

Accepted Answer

A)   Risks in IT processes are best mitigated by individual controls.
B)   The overall focus of the framework is on significant controls in all critical IT applications.
C)   IT risks and related controls are operational and best identified using a bottom-up approach.
D)   Control process risks are found at multiple layers of the IT environment.

Exam 3: The Internal Audit Activity Role in Governance, Risk, and Control