Question 1

Which two of the following considerations must an internal auditor take into account while planning an audit of an accounting system/application that has been in use for the last five years? • The level and manner of linkages between the business' mission, objectives, and structure and the accounting system/application. • Presence or absence of computerized and manual controls that address risks. • Identification of risks at the application level, e.g. availability and security of the system. • Testing of the system/application for bugs and errors.

Accepted Answer

The internal auditor must consider the presence or absence of controls that address risks and identify risks at the application level, such as availability and security.

Question 2

Which of the following would be an appropriate role of the internal audit function?

Accepted Answer

The internal audit function is typically responsible for evaluating and improving the effectiveness of risk management, control, and governance processes, which includes assessing the effectiveness of ethics-related activities.

Question 3

Which of the following statements is not true about the oversight and review of working papers by the chief audit executive (CAE)?

Accepted Answer

The CAE does not need to personally review all working papers; they can delegate this task to experienced staff, as long as they ensure the quality and achievement of objectives.

Question 4

An internal auditor is reviewing purchases made through the organization's corporate credit card program. Which of the following statements best describes a root cause of a deficiency?

Accepted Answer

A root cause of a deficiency is the underlying reason for the issue. In this case, the lack of activation of a control to detect split purchases is a fundamental issue that allows non-compliance to occur.

Question 5

Which of the following controls in a computerized consumer loan system of a major bank would be the least effective in detecting a fraudulent loan?

Accepted Answer

The answer of Which of the following controls in a...

Question 6

If the chief audit executive believes that senior management has accepted a level of residual risk that is unacceptable to the organization, they should:

Accepted Answer

The chief audit executive should first discuss the concern with management. If the issue is not resolved, it should be escalated to the board, as they have the ultimate oversight responsibility for risk management.

Question 7

According to the Standards, which of the following should be the basis for scheduling follow-up of engagement recommendations?

Accepted Answer

The Standards suggest that follow-up of engagement recommendations should be based on the risks and exposures involved, ensuring that significant issues are addressed in a timely manner.

Question 8

Which of the following is a preventive control strategy against fraud?

Accepted Answer

Performing background checks on employees is a preventive control strategy as it helps to identify potential risks before hiring, thereby preventing fraud.

Question 9

The chief audit executive (CAE) decided that based on management's oral response, the action taken on an audit observation for a minor improvement in the client's process is sufficient and no further follow-up is necessary. Which of the following would be the best statement regarding the action of the CAE?

Accepted Answer

The CAE's action is acceptable if the follow-up is deemed sufficient relative to the importance of the recommendation, especially for minor improvements.

Question 10

The following audit observation was included in the final audit report: "Our review concluded that bank reconciliation statements for March and April did not show evidence of supervisory review. We recommend strict compliance with the controller's manual, which requires the department head to place their initials on the reconciliation statements to document their review." Which of the following attributes are missing from the above audit observation? 1. Criteria. 2. Condition. 3. Cause. 4. Effect.

Accepted Answer

The observation includes the criteria (controller's manual requirement) and the condition (lack of supervisory review evidence). However, it lacks the cause (reason for the missing review) and the effect (potential impact of not having the review).

Question 11

Which of the following should be included in the scope of an audit of a third-party contractor? 1. Budgets and financial forecasts for the project. 2. Contractor's information and control systems. 3. Contractor's financial position. 4. Progress of the project and costs incurred.

Accepted Answer

The scope of an audit of a third-party contractor should include all aspects of the contractor's performance that are relevant to the project, including budgets and financial forecasts, the contractor's information and control systems, the contractor's financial position, and the progress of the project and costs incurred.

Question 12

According to the International Professional Practices Framework, which of the following should be excluded from a final communication for a performance audit engagement?

Accepted Answer

Legal opinions related to illegal acts should be excluded from the final communication as they may require confidentiality and could be outside the scope of the auditor's expertise.

Question 13

Controls are implemented to:

Accepted Answer

Controls are designed to mitigate risk and reduce the potential for loss, not to eliminate risk entirely, as some level of risk is always present.

Question 14

The chief audit executive (CAE) notes that management has adopted the option of not taking action on an audit issue involving a sizeable risk which has been accepted in the past. Which would be an appropriate action by the CAE?

Accepted Answer

The CAE should discuss the matter with management to determine a resolution.

Question 15

Due to the expanded role of internal audit in the organization, the chief audit executive (CAE) of a construction company decides to employ the services of an outsourced audit service provider to augment the internal audit staff. What does the CAE need to consider in determining whether the outsourced audit service provider possesses the necessary knowledge, skills and other competencies to perform an audit engagement?

Accepted Answer

The CAE should consider the reputation of the external service provider as it reflects their credibility, reliability, and the quality of their work, which are crucial for ensuring they possess the necessary competencies for the audit engagement.

Question 16

In response to an audit finding, senior management informed the auditor that the issue would be investigated and resolved when time permitted. According to the International Professional Practices Framework, this action was not acceptable because:

Accepted Answer

Responses should provide enough detail to assess whether the corrective action is adequate and timely, which was not the case here.

Question 17

According to the International Professional Practices Framework, the responsibility for establishing and maintaining a system to monitor the disposition of results communicated to management falls upon:

Accepted Answer

The Chief Audit Executive (CAE) is responsible for establishing and maintaining a system to monitor the disposition of audit results communicated to management, as per the International Professional Practices Framework.

Question 18

Which of the following tasks is typically performed in the analysis phase of a benchmarking consulting engagement?

Accepted Answer

In the analysis phase of benchmarking, determining benchmarked process attributes is crucial to understand what specific aspects of the process will be compared against industry standards or best practices.

Question 19

Which of the following is a preventive control for fraud?

Accepted Answer

Verifying that new vendors appear on the vendor pre-approved list is a preventive control as it helps ensure that only authorized vendors are used, reducing the risk of fraudulent transactions.

Question 20

Which of the following would be a legitimate action for the internal auditor to take when monitoring audit engagement results? 1. Disregard a certain risk because management and the board accepted the risk in the past. 2. Abdicate the responsibility for a particular risk because it is not part of the audit plan. 3. Obtain agreement from senior management that unresolved audit issues will be reported to the board. Request corrective action from management in writing.

Accepted Answer

The internal auditor should ensure unresolved issues are reported to the board and request corrective action in writing. Disregarding or abdicating responsibility for risks is not appropriate.

Exam 4: Conducting the Internal Audit Engagement