Question 1

An internal audit activity has made a preliminary determination that a division of the organization has employed improper accounting practices. Upon being informed, the head of the organization instructs the chief audit executive (CAE) to cease the investigation and to withhold the information from external auditors. Which course of action should the CAE follow?
A) Report the communication to the organization's general counsel.
B) Report the instruction to the chairperson of the audit committee.
C) Inform the head of the organization that the investigation will continue as planned.
D) Inform the external auditors of the findings and the mandate to stop investigating.

Accepted Answer

The CAE should report the instruction to the chairperson of the audit committee, as this ensures that the audit committee is aware of potential interference with the audit process and can take appropriate action to address the situation.

Question 2

What is audit risk?
A) Internal and external risk factors that exist when there are no controls implemented.
B) The amount of risk that is reduced through risk management operations.
C) An incorrect conclusion based on evidence uncovered during an audit.
D) The risk that remains after management has executed risk management activities.

Accepted Answer

Audit risk is the risk that an auditor may reach an incorrect conclusion based on the evidence gathered during an audit, leading to an inappropriate audit opinion.

Question 3

COBIT is primarily designed to:
A) Define auditing standards for information technology auditors.
B) Satisfy information technology regulatory requirements.
C) Provide guidance to govern information technology activities.
D) Assist technology professionals in interpreting technological specifications.

Accepted Answer

COBIT (Control Objectives for Information and Related Technologies) is a framework created by ISACA for the governance and management of enterprise IT. It provides guidance to help organizations effectively govern and manage their IT activities.

Question 4

An internal auditor is gathering evidence for an organization's internal audit engagement and requests a sample of vendor invoices from the organization. Which of the following is true regarding the reliability of this evidence?
A) The invoices have zero reliability.
B) The invoices have low reliability.
C) The invoices have medium reliability.
D) The invoices have high reliability.

Accepted Answer

Vendor invoices are considered to have medium reliability as they are internally generated documents that can be verified against external records, but they may still be subject to manipulation or error.

Question 5

An internal auditor is testing the controls of a large and complex food production process where quality assurance is critical. Management provides process charts and documentation, but the auditor quickly determines that this information is incomplete and out of date. Which of the following would be the most appropriate course of action for the auditor to follow?
A) Use the documentation but meet with the production supervisor to obtain updated information before proceeding.
B) Amend the engagement objectives recognizing that important information is not available to protect the engagement's integrity.
C) Defer the audit until management can provide updated charts and documentation as this is their responsibility.
D) Use the documentation but use observation during the engagement to provide missing information.

Accepted Answer

The auditor should use the existing documentation and meet with the production supervisor to obtain updated information, ensuring they have the most current and accurate data before proceeding with the audit.

Question 6

An internal auditor for a large computer company suspects that returned computer systems are being repackaged as new products and shipped to other customers before the defects have been repaired. Which of the following would be the most persuasive piece of evidence in support of the auditor's suspicions?
A) Credit memos issued after year end for goods shipped before year end.
B) Evidence of returned goods in the shipping and receiving area.
C) An unusual number of customer complaints.
D) The results of a complete physical inventory taken at year end.

Accepted Answer

An unusual number of customer complaints would be the most persuasive evidence, as it directly indicates that customers are receiving defective products, supporting the suspicion that returned systems are being repackaged and reshipped without repairs.

Question 7

Which of the following activities would be most likely to impair the objectivity of an internal auditor?
A) Performing reviews of procedures for a new information systems application before it is installed.
B) Benchmarking controls during the development of a new information systems application.
C) Assisting with the development and installation of a new information systems application.
D) Developing recommended controls for the use of a new information systems application.

Accepted Answer

Assisting with the development and installation of a new information systems application could impair an internal auditor's objectivity, as it involves taking part in the creation process, which may lead to a conflict of interest when later auditing the same system.

Question 8

An internal auditor is assessing the risk of employees falsifying reimbursement requests for business-related meals or travel. Which of the following procedures would the internal auditor most likely perform first?
A) Review the supplemental documentation provided for a sample of reimbursement requests.
B) Interview the payroll/accounting supervisor to determine what controls exist to prevent fraud.
C) Determine whether or not the payroll/accounting department has been subject to regular review.
D) Establish a flowchart of the payroll/accounting functions that include any controls currently in place.

Accepted Answer

The answer of An internal auditor is assessing the risk...

Question 9

A fast-food company is developing a computer simu-lation involving arrival time at a drive-through restaurant. The distribution for arrival times is: Time Single-Digit Random Between Arrivals Probability Number Assigned 2 minutes 0.1 0 3 minutes 0.2 1, 2 4 minutes 0.3 3, 4, 5 5 minutes 0.4 6, 7, 8, 9 Six random numbers are selected to represent the arrival of six cars: 1, 6, 9, 0, 5, 6. What is the mean time between arrivals in this run of the simu-lation model?
A) 2 minutes.
B) 3 minutes.
C) 4 minutes.
D) 5 minutes.

Accepted Answer

The random numbers 1, 6, 9, 0, 5, 6 correspond to arrival times of 3, 5, 4, 2, 4, 5 minutes, respectively. The mean time between arrivals is (3 + 5 + 4 + 2 + 4 + 5) / 5 = 4 minutes.

Question 10

For a bank handling large amounts of cash, which of the following types of control would be the most effective to use?
A) Detective controls.
B) Corrective controls.
C) Preventive controls.
D) Directive controls.

Accepted Answer

Preventive controls are designed to deter or stop an undesirable event from occurring, making them most effective for handling large amounts of cash by preventing theft or fraud.

Question 11

Line management of a manufacturing operation requests an operational audit. They are seeking recommendations for policies and procedures to enhance control over the operation. What should the internal audit activity do?
A) Review the effectiveness of current policies and procedures but avoid making control recommendations due to impaired objectivity.
B) Perform the engagement and make appropriate recommendations for policies and procedures.
C) Turn down the engagement because recommending controls would impair future objectivity regarding this client.
D) Turn down the engagement because an operational audit should not review policies and procedures.

Accepted Answer

The internal audit activity should perform the engagement and make appropriate recommendations for policies and procedures. Internal auditors can provide recommendations to improve controls while maintaining objectivity.

Question 12

While conducting an audit, an internal auditor notices an unusual increase in sales among a small number of units within the organization. The units also experienced persistent negative cash flows despite reported earnings and earnings growth. Which type of fraud do the auditor's findings most likely indicate?
A) Employee collusion with customer organizations.
B) Improper asset valuation.
C) Inventory theft.
D) Fictitious revenues.

Accepted Answer

The unusual increase in sales and persistent negative cash flows despite reported earnings suggest that the organization might be recording fictitious revenues to inflate earnings, which do not translate into actual cash flow.

Question 13

Which fraudulent act is designed primarily to benefit the organization?
A) Fictitious sale or assignment of assets.
B) Authorization of payment for hours not worked.
C) Theft or misappropriation of funds.
D) Acceptance of bribes or kickbacks.

Accepted Answer

Fictitious sale or assignment of assets is typically designed to inflate the organization's financial statements, benefiting the organization by making it appear more profitable or financially stable than it actually is.

Question 14

An internal auditor is testing whether payments to outside contractors have been charged to the proper account. Which of the following sampling methods would be most useful in completing this task?
A) Haphazard sampling.
B) Probability-proportional-to-size sampling.
C) Attribute sampling.
D) Judgmental sampling.

Accepted Answer

Attribute sampling is used to test whether transactions have certain characteristics, such as being charged to the proper account.

Question 15

Which of the following statements describes a control weakness?
A) Purchasing procedures are well designed and are followed even when the purchasing supervisor wishes to direct otherwise.
B) Pre-numbered blank purchase orders are secured within the purchasing department.
C) Normal operational purchases fall in the range from $500 to $1, 000, with a single signature required for purchases over $1, 000.
D) The purchasing agent in a personal capacity invests in a publicly-traded mutual fund that lists the stock of one of the company's suppliers in its portfolio.

Accepted Answer

A single signature for purchases over $1,000 may not provide sufficient oversight, indicating a control weakness.

Question 16

Which of the following is the responsibility of an internal auditor? 1. Assist operating management in implementing audit recommendations. 2. Provide management with value-added analysis to improve operations. 3. Become an advocate for changes to the internal audit activity charter. 4. Disclose non-financial risks that may be identified during the course of an engagement.
A) 1 and 3 only
B) 2 and 4 only
C) 1, 2, and 4 only
D) 1, 2, 3, and 4

Accepted Answer

The answer of Which of the following is the responsibility...

Question 17

Which of the following would be outside the scope of acquiring and developing human resources for an internal audit department?
A) Requiring audit staff to participate in continuing education activities.
B) Writing job descriptions for audit staff, audit managers, and other auditing positions.
C) Conducting individual counseling sessions regarding professional development and performance.
D) Evaluating auditors' compliance with standards and level of audit effectiveness.

Accepted Answer

Evaluating auditors' compliance with standards and level of audit effectiveness is related to assessing performance and quality assurance, not directly to acquiring and developing human resources.

Question 18

A product manager occasionally overrides established purchasing policies in order to expedite the introduction of new products in a competitive industry. The manager's overrides are:
A) Unacceptable as they are not consistent with the purchasing policy.
B) Only acceptable if the override is within the manager's spending limit.
C) Only acceptable if a policy governing such overrides is in place and they are reported.
D) Acceptable due to the highly competitive nature of the industry.

Accepted Answer

Overrides are acceptable if there is a policy in place that allows for such actions and they are properly reported, ensuring accountability and adherence to company guidelines.

Question 19

Management has decided to invest significant capital in a new and innovative large computer system. They understand that they are one of the first organizations to implement this system, but they believe the benefits outweigh the uncertainty over the performance and reliability of the software. This decision best describes which aspect of risk management?
A) Risk appetite.
B) Risk tolerance.
C) Residual risk.
D) Inherent risk.

Accepted Answer

Risk appetite refers to the level of risk an organization is willing to accept in pursuit of its objectives. In this scenario, management's decision to invest in a new system despite uncertainties indicates their willingness to accept a certain level of risk, reflecting their risk appetite.

Question 20

Which of the following is an example of a preventive control activity for risk related to pollution caused by waste disposal?
A) Offering an education program delivered by environmental experts.
B) Maintaining strict security around environmental department files.
C) Seeking legal consultation from a firm with experience in environmental law.
D) Taking periodic samples of the area at risk and logging the results.

Accepted Answer

Offering an education program delivered by environmental experts is a preventive control activity as it aims to prevent pollution by educating employees on proper waste disposal practices.

Exam 3: The Internal Audit Activity Role in Governance, Risk, and Control

What is audit risk?

COBIT is primarily designed to:

An internal auditor is gathering evidence for an organization's internal audit engagement and requests a sample of vendor invoices from the organization. Which of the following is true regarding the reliability of this evidence?

Which of the following activities would be most likely to impair the objectivity of an internal auditor?

An internal auditor is assessing the risk of employees falsifying reimbursement requests for business-related meals or travel. Which of the following procedures would the internal auditor most likely perform first?

For a bank handling large amounts of cash, which of the following types of control would be the most effective to use?

Line management of a manufacturing operation requests an operational audit. They are seeking recommendations for policies and procedures to enhance control over the operation. What should the internal audit activity do?

Which fraudulent act is designed primarily to benefit the organization?

An internal auditor is testing whether payments to outside contractors have been charged to the proper account. Which of the following sampling methods would be most useful in completing this task?

Which of the following statements describes a control weakness?

Which of the following would be outside the scope of acquiring and developing human resources for an internal audit department?

A product manager occasionally overrides established purchasing policies in order to expedite the introduction of new products in a competitive industry. The manager's overrides are:

Which of the following is an example of a preventive control activity for risk related to pollution caused by waste disposal?