Best IIA IIA-CIA-Part2 Dumps [2023] With Real Exam Questions

Jonnie Karnath2023-04-14T09:48:56+00:00

Do you want to ensure your success and pass the IIA-CIA-Part2 exam on your first attempt? One of the biggest advantages of using the IIA IIA-CIA-Part2 dumps is that it is updated regularly to ensure that it reflects the latest exam trends and requirements. This means that you can be sure that the IIA IIA-CIA-Part2 dumps you are studying are up-to-date and relevant to the exam you are preparing for. In addition to providing you with real exam questions and answers, the IIA IIA-CIA-Part2 dumps also include practice tests and quizzes that are designed to simulate the actual exam experience. This will help you get a feel for the exam format, as well as identify areas where you may need to focus your study efforts.

Page 1 of 11

1. A corporate merger decision prompts the cruel audit executive (CAE) to propose interim changes lo the existing annual audit plan to account for emerging risks.

When of the following is the most appropriate action for the CAE to take regarding the changes made to the audit plan?

Present the revised audit plan directly to the board for approval

Communicate with the chief financial officer and present the revised audit plan to the CEO for approval

Present the revised audit plan directly to the CEO for approval

Communicate with the CCO and present the revised audit plan to the board for approval

2. When creating the internal audit plan, the chief audit executive should prioritize engagements based primarily on which of the following?

The last available risk assessment.

Requests from senior management and the board.

The longest interval since the last examination of each audit universe item.

The auditable areas required by regulatory agencies.

3. The chief audit executive (CAF) determined that the residual risk identified in an assurance engagement is acceptable.

When should this be communicated to senior management?

When the CAE reports the audit outcome to senior management.

When the residual risk is identified before the engagement is complete.

Immediately, as residual risk should be communicated as soon as possible

When management of the area under review has resolved and mitigated the residual risk

4. Provide the auditor with instructions and directions to complete the audit.

1, 2, and 3

1, 2, and 4

1, 3, and 4

2, 3, and 4

5. According to the Standards, which of the following is least important in determining the adequacy of an annual audit plan?

Sufficiency.

Appropriateness.

Effective deployment.

Cost effectiveness.

6. Which of the following is an appropriate documentation of proper engagement supervision?

A completed engagement workpaper review checklist.

The supervisor's review notes on engagement workpapers.

The email exchanges between the audit team and the supervisor.

A supervisor's approval of resources allocated to the engagement

7. Negotiating a settlement of an employee claim for personal damages.

1 and 2

1 and 4

2 and 3

3 and 4

8. According to IIA guidance, which of the following is true when the internal audit activity is asked to investigate potential ethics violations in a foreign subsidiary?

Communication of any internal ethics violations to external parties may occur with appropriate safeguards.

Cultural impacts are less critical where the organization practices uniform polices around the globe.

Cross-cultural differences should always be handled by the staff of the same cultural background.

Local law enforcement should be involved as they are more familiar with the applicable local laws.

9. Ensure engagement objectives are reviewed for satisfactory achievement and are documented properly.

1, 2, and 3

1, 2, and 4

1, 3, and 4

2, 3, and 4

10. Which of the following is the most appropriate approach for the internal audit activity to follow up on management action plans?

Create a tracking system for follow up

Ensure that follow-up activities are performed at least weekly.

Delegate follow-up activities to qualified administrative staff within the business unit

Ensure that follow-up activities are performed by the most senior auditor on staff

Page 2 of 11

11. Which of the following statements about internal audit's follow-up process is true?

The nature, timing, and extent of follow-up for assurance engagements is standardized to ensure quality performance.

The actions of external auditors and other external assurance providers is not encompassed by internal audit's follow-up process.

Internal auditors have responsibility for determining if management and the board have implemented the recommended action or otherwise accepted the risk.

The follow-up process must be complete and documented in the working papers in order to conclude the engagement.

12. The following is a list of major findings in the executive summary report for an audit of the contract management process

- Noncompliance with contract provisions requiring vendors to obtain insurance policies with indemnity value of not less than $1 million

- Compliance with contract obligations and deliverables is not monitored

- No contract agreement with five vendors providing core services

Which of the following is an appropriate conclusion that can be drawn from these findings?

These are weaknesses resulting from a lack of a documented contracting policy

Substandard service delivery by vendors may not be detected

Management should expedite actions to rectify the observations identified

The internal controls guiding contract management are not operating effectively

13. Which of the following best describes the manual audit procedure known as vouching?

Testing the validity of information by following it backward to a previously prepared record

Testing the accuracy of the control by reperforming the task or process required

Soliciting and obtaining written verification of the accuracy from an independent third party

Testing the completeness of information forward from a record to a subsequently prepared document

14. The same individuals who receive the final report.

1 only

1 and 2 only

1, 2, and 3

1, 2, and 4

15. An internal auditor was assigned to review controls in the accounts payable function. Most of tie accounts payable processes are performed by a third-party service provider. The auditor included in the audit report a number of control deficiencies involving processes performed by the service provider. The service provider requested a copy of the report.

Which of Vie following would be the most appropriate response from the chief audit executive (CAE)?

The CAE would automatically sand a copy of the report to the service provider as many of the findings relate to Via area managed by the service provider

The CAE may distribute the report to tie service provider at no cost, after consulting with legal counsel and tie chief compliance officer

The CAE may provide a copy of the audit report to the service provider If an agreement & signed and the service provider agrees to reimburse the cost of the audit D, The CAE should benchmark with other organization in the industry by consorting with colleagues and distribute the report only I it is an acceptable practice m the industry

16. If observed during fieldwork by an internal auditor, which of the following activities is least important to communicate formally to the chief audit executive?

Acts that may endanger the health or safety of individuals.

Acts that favor one party to the detriment of another.

Acts that damage or have an adverse effect on the environment.

Acts that conceal inappropriate activities in the organization.

17. According to the MA guidance, which of the following does the engagement work program test in a review of an organizational process?

Process objectives.

Process risks

Process controls.

Process scope

18. Which of the following is the primary purpose of implementing a program whereby employees are rotated from other parts of the organization into the internal audit activity?

It provides the internal audit activity with more resourcing options to meet the audit plan

It offers internal auditors the opportunity to learn more about other work areas.

It gives nonauditors a better understanding of the control environment.

It provides an opportunity for the recruitment of employees as permanent internal auditors

19. In a health care organization the internal audit activity provides overall assurance on governance, risk and control. The chief audit executive advises and influences senior management, and the audit strategy leverages the organization's management of risk According to HA guidance which of the following stages of internal audit maturity best describes this organization?

Infrastructure.

Emerging.

Managed.

Initial.

20. The audit plan is aligned with the organization's goals.

1 and 2 only

3 and 4 only

1, 2, and 4

1, 3, and 4

Page 3 of 11

21. Which of the following is not a direct benefit of control self-assessment (CSA)?

CSA allows management to have input into the audit plan.

CSA allows process owners to identify, evaluate, and recommend improving control deficiencies.

CSA can improve the control environment.

CSA increases control consciousness.

22. During an audit of the accounts receivable (AR) process, an internal auditor noted that reconciliations are still not performed regularly by the AR staff, a recommendation that was made following a previous audit. Monitoring by the financial reporting function has failed to detect the shortcoming. Both the financial reporting function and AR report to the controller, who is responsible for implementing action plans.

Which of the following supports the internal auditor's decision to combine both observations into one reported finding?

The observation was made during the same audit, and the action plan has a common owner.

The observation relates to the same control activity within a common process.

The observation has a common control, and it was noted in a prior audit.

The observation has a common process, and the action plan for the observation has a common owner.

23. Due to a recent system upgrade, an audit is planned to test the payroll process.

Which of the following audit objectives would be most important to prevent fraud?

Verify that amounts are correct.

Verify that payments are on time.

Verify that recipients are valid employees.

Verify that benefits deductions are accurate.

24. Which of the blowing is an example of a compliance assurance engagement?

Proving in-house training to senior management regarding applicable laws and regulations

Proving an assessment of the design adequacy of controls related to consumer privacy and confidentially.

Providing an assessment of customer satisfaction with customer service provided by the organization

Providing testing on the operating effectiveness of controls ever the reliability of financial reporting

25. Which of the following is not an outcome of control self-assessment?

Informal, soft controls are omitted, and greater focus is placed on hard controls.

The entire objectives-risks-controls infrastructure of an organization is subject to greater monitoring and continuous improvement.

Internal auditors become involved in and knowledgeable about the self-assessment process.

Nonaudit employees become experienced in assessing controls and associating control processes with managing risks.

26. Which of the following best describes the four components of a balanced scorecard?

Customers, innovation, growth, and internal processes.

Business objectives, critical success factors, innovation, and growth.

Customers, support, critical success factors, and learning.

Financial measures, learning and growth, customers, and internal processes.

27. Which of The following best justifies an internal auditor's decision to issue a preliminary audit report?

The internal audit team and audit client have a serious dispute over the scope and objective of the engagement

The internal audit team expects management to address certain issues immediately due to their severe impact

The internal audit team anticipates that the formal final audit report would be undesirable for management due to the significance of outlined risks

The internal audit team would like to issue a clean final audit report without any material observations or risks

28. Which of the following statements is true regarding internal control questionnaires?

Internal control questionnaires are useful m evaluating the effectiveness of standard operating procedures

internal control questionnaires provide reliable documents allowing internal auditors to cover many control procedures in little time

Internal control questionnaires can be used by internal auditors as an interview guide

Internal control questionnaires provide direct audit evidence which may need corroboration

29. Considering the five-attribute approach to documenting deficiencies in an area under review which of the following answers the question. "What should be in place?’’

Action plan

Recommendation

Condition

Criteria

30. Which of the followings statements describes a best practice regarding assurance engagement communication activities?

All assurance engagement observations should be communicated to the audit committee.

All assurance engagement observations should be included in the main section of the engagement communication.

During the "communicate" phase of an assurance engagement, it is best to define the methods and timing of engagement communications.

A detailed escalation process should be developed during the planning stage of an assurance engagement.

Page 4 of 11

31. An internal auditor submitted a report containing recommendations for management to enhance internal controls related to investments.

To follow up, which of the following is the most appropriate action for the internal auditor to take?

Observe corrective measures.

Seek a management assurance declaration.

Follow up during the next scheduled audit.

Conduct appropriate testing to verify management responses.

32. An internal auditor receives a document displaying all the steps of a process and the path taken as transactions flow between each step of the process.

How is the internal auditor most likely to use This document during the engagement?

To perform an assessment of the adequacy of process controls.

To perform an assessment of the effectiveness of process controls

To perform a detailed assessment of process risks

To perform an assessment of the sufficiency of residual process risks.

33. Which of the following audit steps would an internal auditor perform when reviewing cash disbursements to satisfy IIA guidance on due professional care?

The calculated statistical sample size is 50 however the internal auditor believes errors exist so he decides to increase the sample size to 80

The internal auditor traces serial numbers of computer equipment listed on an invoice to the fixed asset inventory

The internal auditor reviews the accounts payable manager's petty cash fund and vouchers

The internal auditor reviews the related invoice purchase order and receiving report for each sample selection

34. After concluding a preliminary assessment, the engagement supervisor prepared a draft work program According to HA guidance which of the following would be tested by this program?

The process objectives.

The process risks

The process controls

The process scope

35. An internal auditor is analyzing sates records and is concerned whether a transaction is recorded in the coned period. The accounting manager explains that the external auditor approved the records and produces an email from the external audit team leader.

How should tie internal auditor respond?

Ask the external auditor to review the same transaction again as an independent third party

Consult account accounting principles, standards, and relevant guidelines in regard to timing of the entry

Interview the chief financial officer and obtain her opinion on how the transactions should be recorded

Compare the recording of this transaction to now similar ones were executed last year

36. The amount of fuel purchased.

1 and 2

1 and 4

2 and 3

3 and 4

37. Which of the following should be the focus of the effect section of the preliminary observations document?

Residual risk

Inherent risk

Compensating controls

Control activities

38. An internal auditor is testing the success of the IT support department in meeting the service levels guaranteed to small, medium and large customers. The customer's size classification is based on its annual expenditures with the organization and the nature and extent of services it receives.

Which of the following sampling techniques would be the most suitable to select customers for this test?

Interval sampling

Cluster sampling

Stop-and-go sampling

Stratified sampling

39. According to HA guidance, which of the following statements regarding audit workpapers is true?

Audit reports should include the workpapers as a reference for the audit conclusions.

The internal auditor's workpapers are the primary reference for reported control deficiencies.

Ad-hoc communications with management of the area under review should be excluded from the workpapers.

Both draft and final versions of workpapers should be saved at the end of the engagement

40. An audit client responded to recommendations from a recent consulting engagement. The client indicated that several recommended process improvements would not be implemented.

Which of the following actions should the internal audit activity take in response?

Escalate the unresolved issues to the board, because they could pose significant risk exposures to the organization.

Confirm the decision with management and document this decision in the audit file.

Document the issue in the audit file and follow up until the issues are resolved.

Initiate an assurance engagement on the unresolved issues.

Page 5 of 11

41. Which of the following would most likely cause an internal auditor to consider adding fraud work steps to the audit program?

Improper segregation of duties.

Incentives and bonus programs.

An employee's reported concerns.

Lack of an ethics policy.

42. Which of the following statements is true regarding the chief audit executive's (CAT$) responsibilities after completing an assurance or consulting engagement?

The CAE must establish a follow-up process tor both assurance and consulting engagements to monitor that management actions have been effectively implemented to address observations

The CAE must communicate the results of assurance and consulting engagements lo whoever can ensure that the results are given due consideration.

The CAE must acknowledge satisfactory performance when communicating the results of assurance and consulting engagements

The CAE may delegate the responsibility for communicating the results of consulting engagements although this responsibility cannot be delegated for assurance engagements

43. In which of the following situations would an internal auditor consider the need to outsource competencies and skills9

During the inspection of a wind turbine. an internal auditor notices that some replaced parts took used According to purchase documents, the parts still have a long lifespan.

The auditor believes that the audit client's actions contradict the organization's code of conduct The audit client disagrees and says his actions are for the organization's benefit

An audit team member is allocated to conduct an assurance engagement m the sales unit. However, the same auditor performed an assurance engagement in that area just one year prior

During an inventory count, the auditor ascertained that some goods were missing. The audit client argues that the auditor does not understand how inventory should be counted

44. An internal audit activity is planning its first audit of IT shared services.

Which of the following controls would typically be evaluated first?

Entity-level controls

Application controls

General controls.

Transaction controls

45. Which of the following sources of testimonial evidence would be considered the most reliable regarding whether a process is effectively performed according to its design?

The person responsible for performing the task

Two or more people that work in the area

The supervisor in charge of the process

The manager that wrote the steps to be followed

46. An internal auditor is planning a consuming engagement and the objective is to identify opportunities to improve the efficiency of the organization’s procurement process. The auditor is preparing to conduct a preliminary survey of the area.

Which of the following approaches would be most useful to obtain relevant information to support the engagement objective?

Complete a transaction walkthrough fiat focuses on the design and operation of financial reporting controls

Conduct interviews with senior management to obtain their input and insights regarding operational controls.

Perform a comprehensive review of the organization s existing policies and standard operating procedures.

Review the procurement process map w*h employees who carry out key activities to obtain their input and insights.

47. Which of the following has the greatest effect on the efficiency of an audit?

The complexity of deficiency findings.

The adequacy of preliminary survey information.

The organization and content of workpapers.

The method and amount of supporting detail used for the audit report.

48. Which of the following information is most appropriate for the chief audit executive to share when coordinating audit plans with other internal and external assurance providers?

Objectives scope and timing at a high level to support coordination while adhering to confidentiality requirements

The area and timing of the audit engagement to ensure confidentially and avoid conflict of interest.

All plan information, including risk assessments, planned tests and past results to maximize the opportunity for coordination with internal and external providers.

No information should be shared with internal and external provider as it could introduce bias into the engagement results.

49. For which of the following fraud engagement activities would it be most appropriate to involve a forensic auditor?

Independently evaluating conflicts of interests.

Assessing contracts for relevant terms and conditions.

Performing statistical analysis for data anomalies.

Preparing evidentiary documentation.

50. An organization's board would like to establish a formal risk management function and has asked the chief audit executive (CAE) to be involved in the process.

According to IIA guidance, which of the following roles should the CAE not undertake?

Manage and coordinate risk management processes.

Audit risk management processes.

Become involved in risk oversight committees, monitoring activities, and status reporting.

Accept management's responsibility for risk management without board approval.

Page 6 of 11

51. According to IIA guidance, which of the following is true about the supervising internal auditor's review notes?

• They are discussed with management prior to finalizing the audit.

• They may be discarded after working papers are amended as appropriate.

• They are created by the auditor to support her fieldwork in case of questions.

• They are not required to support observations issued in the audit report.

1 and 3 only

1 and 4 only

2 and 3 only

2 and 4 only

52. A newly appointed chief audit executive (CAE) of a small organization is developing a resource management plan.

Which of the following approaches would be most beneficial to help the CAE obtain details of the Internal audit activity's collective knowledge skills, and other competencies?

Review or establish a documented skills assessment of the internal audit staff and gather information from post-audit surveys

Obtain from the human resources department the job descriptions and position requirements for all internal audit staff

Conduct an objective written test of the internal audit staff to assess their knowledge and skills related to core internal audit competencies

Request the internal audit staff to submit a document that summarizes their most recent performance appraisals and post audit reviews

53. The chief audit executive (CAE) for a manufacturing company included in this year s audit plan a review of the company's laboratory, using an experienced external service provider. The audit plan was approved by the audit committee without any changes At the time of engaging the external service provider, the CAE also secured the approval from the CEO.

Who is responsible for ensuring that the conclusions reached for this exercise are adequately supported?

Audit committee

CEO

External service provider

54. The newly appointed chief audit executive (CAE) of a large multinational corporation, with seasoned internal audit departments located around the world, is reviewing responsibilities for engagement reports.

According to IIA guidance, which of the following statements is true?

The CAE is required to review, approve, and sign every engagement report.

The CAE is required to review, approve, and sign all regulatory compliance engagement reports only

The CAE may delegate responsibility for reviewing, approving and signing engagement reports, but should review the reports after they are issued.

The internal audit charter must identify authorized signers of engagement reports.

55. Which of the following statements accurately describes the Standards requirement for ret internal audit records?

Retention requirements for internal audit records should be compliant with ones set for external audit records

Retention requirements should take into account the medium in which internal audit records are stored

Retention requirements should be set by the chief audit executive and aligned will the organization s process and procedures

Retention requirements should set a minimum period of the for records storage and the process of archiving documents

56. According to IIA guidance, which of the following procedures would be least effective in managing the risk of payroll fraud?

The employee’s name listed on organization’s payroll is compared to the personnel records.

Payroll time sheets are reviewed and approved by the timekeeper before processing.

Employee access to the payroll database is deactivated immediately upon termination.

Changes to payroll are validated by the personnel department before being processed.

57. An internal auditor observes a double payment transaction on a supplier invoice during an accounts payable engagement.

Which of the following steps would be the most effective in helping the auditor determine whether fraud exists?

Switch the existing assurance engagement into a fraud investigation engagement

Extend the audit scope and perform additional testing of controls on other related areas

Review the poor year's transaction volume and amounts paid compared to the poor year's budget

Perform data analytics on the supplier's information, invoiced amounts, and payments performed

58. Which of the following actives is an internal auditor most likely to perform when establishing the objectives of an assurance engagement?

Discuss the internal audit risk assessment including applicable risks and objectives with internal audit management

Perform a walk-through of the process under review to determine whether control wore operating, effectively

Identify when controls will be tested and the sampling method to be used based on control risk

Meet with operational management to team about any areas of concern and to agree on the engagement objectives

59. An internal auditor has been assigned to facilitate a risk and control self-assessment for the finance group.

Which of the following is the most appropriate role that she should assume when facilitating the workshop?

Express an opinion on the participants' inputs and conclusions as the assessment progresses.

Provide appropriate techniques and guidelines on how the exercise should be undertaken.

Evaluate and report on all issues that may be uncovered during the exercise.

Screen and vet participants so that the most appropriate candidates are selected to participate in the exercise.

60. The external auditor has identified a number of production process control deficiencies involving several departments. As a result, senior management has asked the internal audit activity to complete internal control training for all related staff.

According to IIA guidance, which of the following would be the most appropriate course of action for the chief audit executive to follow?

Refuse to accept the consulting engagement because it would be a violation of independence.

Collaborate with the external auditor to ensure the most efficient use of resources.

Accept the engagement but hire an external training specialist to provide the necessary expertise.

Accept the engagement even if the audit engagement staff was previously responsible for operational areas being trained.

Page 7 of 11

61. Which of the following is an appropriate role for the internal audit activity with regard to the organization's risk management program?

Identify and manage risks in line with the organization's risk appetite.

Ensure that a proper and effective risk management process exists.

Attain an adequate understanding of the organization's key risk mitigation strategies.

Identify and ensure that appropriate controls exist to mitigate risks.

62. What type of audit engagement would be the most appropriate to determine how an organization could be more profitable in the long term?

Operational audit

Compliance and financial audit

Performance audit

Quality audit

63. When auditing an organization's cash-handling activates which of the following is the most reliable form of testimonial evidence an internal auditor can obtain?

Testimony from the cashier who performs the processes being reviewed

Testimony from me cashier's supervisor who knows how processes should be performed

Testimony from a knowledgeable person who is independent of the cashiering duty

Testimony from a manager who oversees all cashiering activities being reviewed

64. The factual evidence that the internal auditor found in the course of the examination.

1 and 2

1 and 3 only

2 and 4

1, 3, and 4

65. Which of the following attribute sampling methods would be most appropriate to use to measure the total misstatement posted to an accounts payable ledger?

Stop-or-go sampling

Probability to proportional size sampling

Classical variable sampling

Discovery sampling

66. According to IIA guidance, when would an interim report typically be produced?

During a standard audit engagement when management wants to address an issue before the final report is drafted.

Following each workshop conducted during a consulting engagement.

During lengthy audit engagements involving several organizational units.

Following management's update tor actions taken on outstanding recommendations.

67. Which of the following is a detective control for managing the risk of fraud?

Awareness of prior incidents of fraud.

Contractor non-disclosure agreements.

Verification of currency exchange rates.

Receipts for employee expenses.

68. Prior to performing testing an internal auditor has determined that a primary process control failed due to design weakness.

Which of the following actions should the auditor perform next?

Determine whether there are any compensating controls in place to reduce the nsk to an acceptable level, and discuss this matter with management of the business area to determine which corrective action is needed

Test the control anyway to determine the likelihood that the control was not performed property, and discuss this matter with management of the business area to determine which corrective action is needed

Conclude that the process control environment is weak, issue a finding on this conclusion and report this finding to management of the business area

Confer with a second internal auditor to determine whether the control failure is legitimate issue a finding on this conclusion and report this finding to management of the business area

69. Which of the following statements is true regarding internal controls?

For assurance engagements internal auditors should plan to assess the effectiveness of all entity-level controls

Poorly designed or deficient entity-level controls can prevent well-designed process controls from working as intended.

During engagement planning, internal auditors should not discuss the identified key risks and controls with management of the area under review to prevent tipping off probable audit lasts

Reviewing process maps and flowcharts is an appropriate method for the internal a auditor to identify all key risks and controls during engagement planning

70. Which of the following is one of the five attributes that internal auditors include when documenting a deficiency?

The criteria used to make the evaluation

The methodology used to analyze data

The proposed follow-up engagement work to be performed

The scope of work performed during the engagement

Page 8 of 11

71. An organization recently acquired a subsidiary in a new industry, and management asked the chief audit executive (CAE) to perform a comprehensive audit of the subsidiary prior to recommencing operations. The CAE is unsure her team has the necessary skills and knowledge to accept the engagement According to IIAguidance, which of the following responses by the CAE would be most appropriate?

The CAE should accept the engagement and ensure that an explanation of the expertise limitations is included in the final audit report.

The CAE should ask management to hire an external expert who is familiar with the industry to perform an independent audit for management

The CAE should accept the engagement and hire an external expert to assist the audit team with the audit of the subsidiary

The CAE should recommend postponing the engagement until the internal audit team is able to develop sufficient knowledge of the new industry

72. In which of the following situations would an internal control questionnaire best suit the internal auditor's purpose?

The auditor wants to receive mid-level management insight on how to improve hiring practices

The auditor wants to obtain information on whether adherence to approval matrices is actually taking place in different maintenance units.

The auditor wants to gain assurance that inventory counts are conducted in accordance with established procedures.

The auditor wants to assess whether different subsidiaries apply centrally established procurement rules in the same manner

73. An internal auditor wants to compare performance information from one quarter to another.

Which analytics procedure would the auditor use?

Ratio analysis

Trend analysis

Vertical analysis

Benchmarking analysis

74. New environmental regulations require the board to certify that the organization's reported pollutant emissions data is accurate. The chief audit executive (CAE) is planning an audit to provide assurance over the organization's compliance with the environmental regulations.

Which of the following groups or individuals is most important for the CAE to consult to determine the scope of the audit?

The audit committee of the board.

The environmental, health, and safety manager.

The organization's external environmental lawyers.

The organization's insurance department.

75. Which of The following best describes a risk that is deemed "unacceptable" to the organization?

A risk where likelihood and impact are high

A risk where inherent risk exceeds its residual risk

A risk where inherent risk exceeds the tolerance level

A risk where residual risk exceeds the tolerance level

76. CORRECT TEXT

Which of the following is one of the five basic tnanoal statement assertions when an internal auditor evaluates controls over financial reporting?

Reliability or appropriateness

Reasonableness

Existence or occurrence

Relevance

77. An organization has a mature control environment but limited internal audit resources Given this scenario, on which of the following should the internal auditors focus their testing?

Detective compensating controls

Preventive compensating controls

Detective Key controls

Preventive key controls

78. An internal auditor was reviewing the procurement department's tender documentation for completeness He documented all discrepancies but the procurement manager disagreed with his findings Upon further review, the internal auditor noted that all discrepancies had been corrected in the tender database.

Which of the following courses of action would have prevented this situation?

The auditor should have ensured the preservation of audit evidence by taking screenshots or extracting tender documents

The auditor should have extracted a list of logs and identified any actions that were executed in the database during the audit

The auditor should have instructed procurement workers that changes to the database during the course of the audit were strictly forbidden

The internal auditor should have created a more thorough work program, which would address audit criteria and potential causes in more detail

79. An internal auditor for a regional bank suspects that the head of commercial lending has been granting loans without the required collateral.

Which of the following sampling techniques will be most effective for investigating the auditor's suspicion?

Variables sampling

Dollar-unit sampling

Judgmental sampling

Discovery sampling

80. An internal auditor using the five-attribute approach to document deficiencies in a warehouse shipping process.

Which of the following attributes will be included in the workpapers?

Risk, impact likelihood existing control, recommendation

Condition, cause, effect, recommendation

Condition, cause effect test result

Risk, impact test result recommendation

Page 9 of 11

81. During an assurance engagement, an internal auditor noted that the time staff spent accessing customer information in large Excel spreadsheets could be reduced significantly through the use of macros. The auditor would like to train staff on how to use the macros.

Which of the following is the most appropriate course of action for the internal auditor to take?

The auditor must not perform the training, because any task to improve the business process could impact audit independence.

The auditor must create a new, separate consulting engagement with the business process owner prior to performing the improvement task.

The auditor should get permission to extend the current engagement, and with the process owner's approval, perform the improvement task.

The auditor may proceed with the improvement task without obtaining formal approval, because the task is voluntary and not time-intensive.

82. Which of the following factors would the auditor in charge be least likely to consider when assigning tasks to audit team members for an engagement?

The amount of experience the auditors have conducting audits in the specific area of the organization.

The availability of the auditors in relation to the availability of key client staff.

Whether the budgeted hours are sufficient to complete the audit within the current scope.

Whether outside resources will be needed, and their availability.

83. An engagement team is being assembled to audit of one of the organization's vendors.

Which of the following statements best applies to this scenario?

The engagement team should include internal auditors who have expertise in investigating vendor fraud

The engagement team should be composed of certified accountants who are proficient In financial statement analysis and local accounting principles

To preserve independence and objectivity, an auditor who worked for the vendor two years prior may not participate on the engagement team

The engagement team may include an auditor who lacks knowledge of the industry in which the vendor operates

84. According to IIA guidance, which of the following individuals should receive the final audit report on a compliance engagement for the organization's cash disbursements process?

The accounts payable supervisor, accounts payable manager, and controller.

The accounts payable manager, purchasing manager, and receiving manager.

The accounts payable supervisor, controller, and treasurer.

The accounts payable manager, chief financial officer, and audit committee.

85. According to the IIA guidance, which of the following foes the engagement work test in a review in a review of an organization al process?

Process objectives

Process risks

Process controls

Process scope

86. Which of the following manual audit approaches describes testing the validity of a document by following it backward to a previously prepared record?

Tracing

Reperformance

Vouching

Walkthrough

87. The internal auditor and her supervisor are in dispute about a risk that was not tested during an audit of the procurement function.

Which of the following tools would best support the auditor's decision not to test the risk?

A spaghetti map

A heat map.

A process map

An assurance map

88. Which of the following is a significant governance issue that should be reported by the chief audit executive to the board?

There is no risk management and control process and risk management is solely tie responsibility of operational managers

The organisation’s code of conduct is distributed to employees each year however employees are not required to attest that they will operate In compliance with the code.

Reconciliation of planned board meeting agendas to meeting minutes finds that one meeting was canceled, and the agenda topics were covered at the following meeting.

The review of the five-year strategic plan shows that the details of the plan have not been dearly communicated to employees throughout the organization

89. To compete in the global market, an organization is restructuring and consolidating many of its divisions. Prior to the consolidation, senior management requested assistance from tie internal audit activity.

Which of the following consulting services would be most appropriate in this situation?

Assess controls for potential compliance issues that may affect me consolidation

Brief vendors on the potential risks that will occur without continued business

Advise division managers on how to streamline operations for better efficiency

Determine whether the organization’s controls are effective in meeting business objectives

90. Management has taken immediate action to address an observation received during an audit of the organization's manufacturing process.

Which of the following is true regarding the validity of the observation closure?

Valid closure requires evidence that ensures the corrected process will function as expected in the future

Valid closure requires the client lo address not only the condition, but also the cause of the condition

Valid closure of an observation ensures it will be included in the final engagement report

Valid closure requires assurance from management that the original problem will not recur in the future

Page 10 of 11

91. Which of the following is the best option for the chief audit executive to consider for effective coordination of assurance coverage?

Create an assurance map to illustrate each provider's level of assurance and planned activities for each area of the organization

Rely on the risk and control and management testing information maintained for compliance with the regulatory framework

Prepare a risk likelihood and impact heal map to prioritize assurance coverage coordination.

92. Flowcharts highlight the control points to help internal auditors evaluate control design

1 and 3 only

2 and 4 only.

1.2. and 3 only

2. 3 and 4 only

93. During the filework phase of an assurance engagement the internal auditor decides that she wants to adjust the audit work program.

Which of the following is the most appropriate next step for the auditor to take9

Request additional information needed from management of the area under review.

Obtain approval from the engagement supervisor

Obtain the required resources, including I

to complete the work

Discuss the change in scope with management of the area under review.

94. An internal auditor has suspicions that the management of a department splits me number of planned purchases to avoid the approval process required for larger purchases.

Which of the following would be the most efficient technique to help the auditor identify the seventy of this malpractice?

Examining the entire population

Asking management about the malpractice

Testing a sample of random transactions.

Using data analytics

95. An internal auditor has been asked to join a project team to help design controls in a software application to address specific risks that have been identified by the team.

Which of the following actions is most appropriate for the internal auditor to perform?

Facilitate a control assessment to ensure all application risks were appropriately identified

Advise the project team on how to develop effective controls

Direct the project team to implement the appropriate controls within the software application

Provide assurance that the design of the controls will mitigate the identified application risks

96. A large investment organization hired a chief risk officer (CRO) to be responsible for the organization's risk management processes.

Which of the following people should prioritize risks to be used for the audit plan?

Operational management, because they are responsible for the day-to-day management of the operational risks.

The CRO, because he is responsible for coordinating and project managing risk activities based on his specialized skills and knowledge.

The chief audit executive, although he is not accountable for risk management in the organization.

The CEO, because he has ultimate responsibility for ensuring that risks are managed within the agreed tolerance limits set by the board.

97. The AIC should finalize the scope of the engagement before communicating with HR management.

1 and 3

1 and 4

2 and 3

2 and 4

98. An internal auditor wants to determine whether employees are complying with the information security policy, which prohibits leaving sensitive information on employee desks overnight. The auditor checked a sample of 90 desks and found eight that contained sensitive information.

How should this observation be reported, if the organization tolerates 4 percent noncompliance?

The matter does not need to be reported, because the noncompliant findings fall within the acceptable tolerance limit.

The deviations are within the acceptable tolerance limit, so the matter only needs to be reported to the information security manager.

The incidents of noncompliance fall outside the acceptable tolerance limit and require immediate corrective action, as opposed to reporting.

The incidents of noncompliance exceed the tolerance level and should be included in the final engagement report.

99. The engagement supervisor would like lo change the audit program's scope poor to beginning fieldwork According to IIA guidance before any change is implemented what is the most important action that should be undertaken?

Document in the engagement workpapers the rationale for changing the scope.

Confirm that the scope change would align to the organization's objectives and goals

Confirm that the internal audit activity continues to have the necessary knowledge and skills

Seek approval from the chief audit executive for the proposed scope change

100. During a consulting engagement an internal auditor wants to determine whether all principal stakeholders are involved in a project.

Which tool should the auditor use?

RACI (responsible, accountable, consult and inform) chart

Flowchart

SWOT {strengths. weaknesses opportunities, and threats) analysis

Workflow analysis

Page 11 of 11

101. In which of the following situations has an internal audit of obtained physical evidence?

An internal auditor made purchases from several of the organization's retail outlets to evaluate customer service

An internal auditor interviewed various employees regarding health and safety issues and recorded their answers

An internal auditor obtained the current quarterly financial report and computed changes in deb-to-equity ratio

An internal auditor received a signed confirmation regarding the terms of a transaction from an independent attorney

102. A preliminary observation document contains more detail than tie observation description in the engagement workpapers

1 and 2

1 and 4

2 and3

3 and 4

103. During a fraud interview, it was discovered that unquestioned authority enabled a vice president to steal funds from the organization.

Which of the following best describes this condition?

Scheme.

Opportunity.

Rationalization.

Pressure.

104. What is the primary objective of an engagement supervisor's review of key activities performed during the engagement?

To ensure that the engagement is completed on time and within budget

To ensure that all work performed meets acceptable quality standards

To ensure that management has provided suitable responses to all observations

To ensure that management is satisfied with the progress of the engagement

105. An engagement supervisor reviewed a staff internal auditor's documentation and noted that several edits should be made. The internal audit activity uses an electronic workpaper database and does not maintain paper files for its system of record. A system error prevents the engagement supervisor from adding her electronic signature to any workpaper in the database.

Given this situation which is the most appropriate response to provide evidence of supervisory review?

The engagement supervisor should print sign and date each workpaper after the review is complete and scan the document into the database as evidence of review

Because the engagement supervisor called the help desk to correct the IT problem, he should upload the support-request ticket from the help desk to serve as evidence of the review

The engagement supervisor should ask another manager-level internal auditor not associated with the project to sign the workpaper on his behalf

The engagement supervisor should instruct the staff internal auditor to add a note in the workpaper on his behalf indicating that the workpaper was reviewed and feedback was provided

Facebook Twitter LinkedIn Google + Email