Question 1

What type of risk management strategy is being employed when an organization installs two firewalls to provide protection from unauthorized access to the network?

Accepted Answer

The answer of What type of risk management strategy is...

Question 2

Which of the following techniques would best assist an internal auditor in evaluating the efficiency of a wholesale grocery distributor`s process to fill and package orders for shipping?

Accepted Answer

Queuing theory is used to analyze the flow of processes and can help identify bottlenecks, making it suitable for evaluating the efficiency of order filling and packaging processes.

Question 3

According to the IIA guidance, who is responsible for periodically assessing the internal audit activity?

Accepted Answer

The chief audit executive is responsible for periodically assessing the internal audit activity to ensure it is operating effectively and efficiently, as per the IIA guidance.

Question 4

A chief audit executive (CAE) of an international charity reports functionally to the audit committee of the board of directors and administratively to the charity's chief financial officer (CFO). Which of the following would impair the internal audit function's independence?

Accepted Answer

The CFO determining the scope of internal audit work impairs independence because it allows management to influence the audit process, potentially limiting the audit's objectivity and impartiality.

Question 5

Which of the following would be considered a preventive control?

Accepted Answer

A password lock on a server is a preventive control because it is designed to prevent unauthorized access before it occurs.

Question 6

If an engagement client disputes that a specific action or process is within the scope of the internal audit activity, what would be the most appropriate way for the internal audit activity (IAA) to respond?

Accepted Answer

The IAA should refer the client to the IAA's charter and the approved yearly audit plan, which outline the scope and areas designated for audit, ensuring clarity and alignment with agreed-upon objectives.

Question 7

Which of the following audit techniques is used to evaluate control design while also embodying auditing's analytical process?

Accepted Answer

A risk and control matrix is used to evaluate control design by identifying the risks that are present in a process and the controls that are in place to mitigate those risks. The matrix also allows auditors to assess the effectiveness of the controls and to identify any areas where the controls could be improved.

Question 8

During the course of an audit, an internal auditor discovers that a valuable employee in the research department has been patenting new developments in the employee's name that are unrelated to the basic business of the organization. The organization does not have a policy addressing this specific issue, but does have a general policy that all important new discoveries by employees are the property of the organization. Division management views the employee's actions as extra incentive to retain the employee. A decision to include the employee's action in the engagement final communication would be: 1. A violation of the IIA Code of Ethics. 2. A violation of the reporting requirements in the Standards. 3. Justified and necessary, according to the IIA Code of Ethics and Standards.

Accepted Answer

The internal auditor is justified in reporting the employee's actions as it aligns with the IIA Code of Ethics and Standards, which require auditors to report significant findings and ensure transparency and accountability.

Question 9

Which of the following activities best reflects the scope and status of the internal audit activity as defined in the internal audit policy statement?

Accepted Answer

The answer of Which of the following activities best reflects...

Question 10

According to IIA guidance, which of the following individuals would best be considered independent for the purpose of participating in an external assessment of the quality assurance and improvement program for an internal audit activity (IAA)?

Accepted Answer

A former employee who resigned three years earlier is likely to be considered independent as they are no longer affiliated with the organization and have had sufficient time away to avoid conflicts of interest.

Question 11

Which of the following is a preventive control?

Accepted Answer

Placing controls on physical access to inventory is a preventive control because it aims to prevent unauthorized access or theft before it occurs.

Question 12

A new chief audit executive (CAE) of a large internal audit activity (IAA) is dissatisfied with the current amount and quality of training being provided to the staff and wishes to implement improvements. According to IIA guidance, which of the following actions would best help the CAE reach this objective?

Accepted Answer

Performing a gap analysis of the IAA's existing knowledge, skills, and competencies will help identify specific areas where training is needed, allowing the CAE to tailor improvements effectively.

Question 13

A staff auditor, nearly finished with an audit engagement, discovers that the director of marketing has a gambling habit. The gambling issue is not directly related to the existing engagement, and there is pressure to complete the current engagement. The auditor notes the problem and forwards the information to the chief audit executive, but performs no further follow-up. Which of the following statements is true about the auditor's actions?

Accepted Answer

The auditor appropriately forwarded the information to the chief audit executive, which is a reasonable action given the situation. The gambling habit was not directly related to the audit engagement, and the auditor took steps to ensure the information was passed on for further consideration.

Question 14

According to IIA guidance, which of the following statements is false regarding continuing professional education for the internal audit activity (IAA)?

Accepted Answer

The answer of According to IIA guidance, which of the...

Question 15

According to the Standards, which of the following best describes why initial audit test results should be reported to the auditor-in-charge prior to advising management?

Accepted Answer

Reporting initial audit test results to the auditor-in-charge helps ensure that appropriate professional judgments and conclusions are made, as it allows for review and guidance before communicating with management.

Question 16

Why is it important for the chief audit executive to periodically review the audit charter and present the results to senior management and the board?

Accepted Answer

Periodic review of the audit charter is important to ensure that it remains aligned with the organization's objectives and any changes in the organization that might affect the internal audit activity's ability to meet its objectives.

Question 17

Which of the following is not a standard technique that the chief audit executive (CAE) would use to provide evidence of supervisory review of working papers?

Accepted Answer

Utilizing an external third party for recommendations is not a standard technique for supervisory review of working papers by the CAE.

Question 18

Which segregation of duties would best reduce the risk of payroll fraud?

Accepted Answer

The answer of Which segregation of duties would best reduce...

Question 19

Suspecting fraud, the chief financial officer (CFO) asked the internal audit activity to investigate a significant increase in travel related expenditures. Work was performed by a qualified internal auditor. Following the completion of the engagement, the chief audit executive (CAE) reported to the CFO that no violations were found and no fraud had occurred. According to the Standards, which of the following principles did the CAE violate?

Accepted Answer

The CAE violated the principle of due professional care by concluding that no fraud had occurred, as it is not possible to prove a negative. The CAE should have reported that no evidence of fraud was found instead.

Question 20

The audit committee is concerned that the small size of the internal audit activity (IAA) makes it impractical to achieve full conformance with the Standards. To address this concern, which of the following actions is most appropriate for the CAE to take?

Accepted Answer

Conformance with the Standards is essential for all internal audit activities, regardless of size. The CAE should explain this to the audit committee, emphasizing that the Standards are designed to be applicable to all internal audit functions.

Exam 3: The Internal Audit Activity Role in Governance, Risk, and Control