MCQ Flash cards

Which of the following best demonstrates how internal auditors can coordinate with fraud investigators to enhance fraud risk management?

A. Option A.	Avoiding involvement in fraud investigations to maintain their assurance role
B. Option B.	Conducting disciplinary actions against employees involved in fraudulent activities.
C. Option C.	Leading all fraud investigations to ensure independence and objectivity
D. Option D.	Reviewing whistleblower complaints and prior investigations to identify trends and lessons learned

Answer: D

What should an internal auditor do before proceeding with a fraud investigation initiated by an ethics hotline complaint?

A. Option A.	Identify loopholes for further investigation.
B. Option B.	Take a statement from the suspect.
C. Option C.	Determine if litigation has commenced or is anticipated.
D. Option D.	Gather related anti-fraud intelligence.

Answer:C

An internal auditor is performing the following procedures to detect fraudulent financial reporting: examining journal entries for each financial statement element; analyzing disaggregated transaction data for revenues; and having a specialist review all accounting estimates. Which of the following fraudulent activities would be most likely to escape detection even after these procedures?

A. Option A.	Management doubles a customer's regular parts order to inflate sales.
B. Option B.	Management uses specific identification to deliberately reduce the value of remaining inventory.
C. Option C.	Management deliberately omits recording an account receivable.
D. Option D.	Management reduces the value of several less important accounts directly on the financial statements.

Answer:D

A production manager orders excessive raw materials, diverts them to a personal business, falsifies receiving documents, and approves invoices. Which audit procedure would be most likely to detect this fraud?

A. Option A.	Verifying the legitimacy of materials received by cross-checking purchase records against inventory records.
B. Option B.	Reviewing purchase orders, invoices, and receiving reports to verify accuracy and consistency.
C. Option C.	Performing analytical tests that compare production, material purchased, and raw material inventory levels, followed by an investigation of the differences.
D. Option D.	Observing the receiving dock and counting materials received; comparing the counts to receiving reports completed by receiving personnel.

Answer C

An internal auditor, during a fraud investigation interview, uses presumptive questions, some of which may be untrue, to assess the interviewee's truthfulness and elicit a confession. Which of the following is the most significant risk associated with this interviewing technique?

A. Option A.	It could result in legal action if the person feels coerced.
B. Option B.	It could damage the auditor's credibility and rapport with the interviewee.
C. Option C.	It prevents digressions and keeps the discussion focused.
D. Option D.	It facilitates unobtrusive note-taking for documentation purposes.

Answer A

An organization's board has received complaints alleging suspicious business dealings across multiple departments and has requested the internal audit function to conduct an investigation. Which of the following best describes the primary knowledge, skills, and abilities required for the internal audit function to effectively carry out this investigation?

	A. Option A.	Proficiency in forensic auditing techniques and procedures.
	B. Option B.	Comprehensive understanding of internal control design and evaluation.
	C. Option C.	In-depth knowledge of corporate governance structures and regulatory compliance.
	D. Option D.	Expertise in risk management frameworks and methodologies.

Answer A

An internal auditor, suspecting fraud after a partial internal control review of accounts payable, needs to select a sample of vouchers for further investigation. Which sampling technique would be most appropriate to ascertain whether fraud is present?

A. Option A.	Discovery sampling to select a sample of vouchers processed by the department during the past year.
B. Option B.	Judgmental sampling to select a sample of vouchers processed by clerks identified by the department manager as acting suspiciously.
C. Option C.	Probability-proportionate-to-size (PPS) sampling to select a sample of vouchers processed by the department during the past year.
D. Option D.	Simple random sampling to select a sample of vouchers processed by the department during the past year.

Anwer A

Which of the following is a best practice for an effective fraud hotline?

A. Option A.	Be managed by the internal audit function.
B. Option B.	Respond to reports only after a preliminary investigation has been made.
C. Option C.	Employ an automated message service to increase confidentiality and lower costs.
D. Option D.	Be paired with other methods of reporting fraud, such as email.

D

Which of the following controls would most effectively mitigate the risk that a maintenance manager colludes with a vendor to repair used spare parts and sell them back to the organization as new?

A. Option A.	Physical and documentary control over entrance and exit of facilities.
B. Option B.	Application of invoice authorization routines without exceptions.
C. Option C.	Adequate segregation of duties in the organizational vendor master file.
D. Option D.	Adherence to procurement practices and fair competition.

A

During an assurance engagement, an internal auditor discovered that a developer of the organization's enterprise resource planning (ERP) system intentionally modified production code to commit a fraudulent transaction. Which control activity would be most effective in preventing such issues in the future?

	A. Option A.	Restrict developers' access to the ERP system's test environment.
	B. Option B.	Penalize the developer who committed the fraud by terminating employment.
	C. Option C.	Segregate duties between code development and migrating changes into production.
	D. Option D.	Conduct fraud training for the IT team responsible for the ERP system.

C

A manager has the authority to approve expenses up to $50,000 without additional review. Over time, the manager begins splitting large expenses into smaller amounts to avoid triggering a review. What control weakness does this scenario highlight?

	A. Option A.	Lack of fraud awareness training
	B. Option B.	Absence of a whistleblower hotline
	C. Option C.	Inadequate segregation of duties
	D. Option D.	Insufficient monitoring of authority levels

D

An organization's human resources (HR) department allows employees to take leave time prior to it being fully accrued, with employees tracking their leave in a spreadsheet they provide to HR. Which of the following controls implemented by HR would best mitigate the risk of employees inaccurately reporting the amount of leave they have taken, leading to the taking of more unaccrued leave than allowed?

	A. Option A.	Annually require ethics training for all employees that includes information on proper reporting of time attendance and leave.
	B. Option B.	Periodically review the spreadsheet data and reconcile leave taken and accrued with the organization's timekeeping system.
	C. Option C.	Frequently publish links to the organization's fraud reporting hotline.
	D. Option D.	Randomly select employees and require them to attest to the accuracy of the leave time they report in their spreadsheets.

B

A foreign currency trader concealed trading losses by altering the system's source code. Which control deficiency is most directly illustrated by this scenario?

A. Option A.	Inadequate segregation of duties, allowing the trader to both execute trades and modify system configurations.
B. Option B.	Insufficient version control documentation for program changes.
C. Option C.	End-user access to source code.
D. Option D.	Inadequate authorization controls for code modification.

c

An organization lacks a fraud risk management process. Which task order is the chief audit executive most likely to recommend for developing such a process?

	A. Option A.	Perform a comprehensive fraud risk assessment; select, develop, and deploy preventative and detective fraud control activities; establish a fraud risk management policy; establish a fraud reporting process and coordinated approach to investigative action; monitor the fraud risk management process, report results; and improve the process.
	B. Option B.	Perform a comprehensive fraud risk assessment; establish a fraud risk management policy; select, develop, and deploy preventative and detective fraud control activities; establish a fraud reporting process and coordinated approach to investigative action; monitor the fraud risk management process, report results; and improve the process.
	C. Option C.	Establish a fraud risk management policy; perform a comprehensive fraud risk assessment; select, develop, and deploy preventative and detective fraud control activities; establish a fraud reporting process and coordinated approach to investigative action; monitor the fraud risk management process, report results; and improve the process.
	D. Option D.	Establish a fraud risk management policy; select, develop, and deploy preventative and detective fraud control activities; perform a comprehensive fraud risk assessment; establish a fraud reporting process and coordinated approach to investigative action; monitor the fraud risk management process, report results; and improve the process

C

Which of the following scenarios in a marketing department presents the strongest red flag for potential fraud?

	A. Option A.	A marketing manager's lifestyle appears significantly below what is expected for the manager’s salary.
	B. Option B.	There is complex documentation for some fairly large expenditures made to a new vendor, but no unexplained journal entries.
	C. Option C.	The marketing manager expresses trust in key employees managing large ad buys but consistently double-checks their work.
	D. Option D.	Management justifies a very loose control environment as necessary for fostering creativity.

D

During an audit engagement of a company's sales order processing, the internal auditor observes that a significant number of customer credit memos are being issued after the end of each quarter. Further investigation reveals that sales personnel receive bonuses based on quarterly sales figures. Which of the following is the most significant red flag in this scenario?

	A. Option A.	The issuance of customer credit memos.
	B. Option B.	The timing of the credit memo issuance after quarter-end.
	C. Option C.	The sales personnel's bonus structure based on quarterly sales figures.
	D. Option D.	The company's sales order processing procedures.

B

While conducting a payroll audit, an internal auditor in a large government organization found inadequate segregation in the duties assigned to the assistant director of personnel. When the auditor explained the risk of fraud, the assistant director became upset, terminated the interview, and threatened to sue the organization for defamation of character if the audit engagement was not curtailed. The internal auditor discussed the situation with the chief audit executive (CAE). Which of the following is the most appropriate course of action for the CAE to take?

	A. Option A.	Continue the original engagement program as planned, but include a comment about the assistant director's reaction in the engagement final communication.
	B. Option B.	Curtail the audit engagement to avoid potential legal action.
	C. Option C.	Add additional testing to determine whether other indicators of fraud exist.
	D. Option D.	Provide a report to senior management recommending a fraud investigation.

C

While gathering information for a fraud risk assessment, an internal auditor on the engagement team becomes aware of potential fraud through a discussion with an operations-level employee. What is the most appropriate action for the auditor to take?

	A. Option A.	Ensure that this area is included within the audit scope and design procedures to investigate the potential fraud.
	B. Option B.	Schedule a meeting between the operations-level employee and her manager to discuss the potential fraud.
	C. Option C.	Communicate discreetly with the engagement supervisor to express concern.
	D. Option D.	Tactfully express the auditor's suspicion while interviewing coworkers of the suspected employee to obtain as much detail as possible.

C

A nonprofit is concerned about unusually high vendor payments. Purchases are made through three buyers who place orders, receive copies of receiving reports, and approve invoices. Three bids are required for purchases over $10,000. Which of the following suggests potential fraud?

	A. Option A.	The cost of goods procured seems to be excessive in comparison with that of previous years.
	B. Option B.	A purchase for $9,000 receives three bids.
	C. Option C.	Management, at the purchasing agents' request, has adopted a policy of paying vendors on a timelier basis to avoid incurring penalty charges.
	D. Option D.	Accounts payable has announced plans to have receiving reports sent directly to their department rather than first to purchasing agents.

A

During a bank reconciliation, an analyst finds out-of-sequence checks and missing check stock, indicating unauthorized payments. Which type of fraud is most likely occurring?

	A. Option A.	Expense reimbursement fraud.
	B. Option B.	Disbursement fraud.
	C. Option C.	Inventory theft.
	D. Option D.	Skimming.

B

An employee responsible for processing vendor payments creates a fictitious ve

	A. Option A.	Corruption.
	B. Option B.	Disbursement fraud.
	C. Option C.	Asset skimming.
	D. Option D.	Financial statement fraud.

B

Which of the following fraudulent accounting entries, if discovered during an audit engagement, would indicate a process with a significant exposure to fraud risk, specifically in relation to the concealment of asset theft?

	A. Option A.	Debit revenue and credit the asset account.
	B. Option B.	Debit another asset account and credit the stolen asset account.
	C. Option C.	Debit expenses and credit the asset account.
	D. Option D.	Debit a liability account and credit the asset account.

C

A recently-formed internet service provider wishes to develop a comprehensive corporate governance practice code to guide all employees and has asked for input from the chief audit executive (CAE). According to IIA guidance, which of the following is most important for the CAE to verify initially?

A. OPTION A.	Management has an adequate familiarity with key IT governance policies and practices.
B. OPTION B.	Management understands the organization's stakeholders and their interrelationships.
C. OPTION C.	Management has considered all relevant legal and regulatory requirements.
D. OPTION D.	Management has researched international corporate governance codes and best practices.

B

Which of the following is an example of engagement risk?

A. OPTION A.	A regulatory change requires the organization to update its compliance processes.
B. OPTION B.	A material weakness is not identified during an internal audit procedure where one does exist.
C. OPTION C.	A natural disaster negatively impacts the organization’s primary production facilities.
D. OPTION D.	A competitor launches an update to its product and causes a market disruption.

b

A manufacturing company is facing increasing pressure to reduce production costs. The leadership team decides to streamline the procurement process by eliminating several layers of review and approval, aiming for faster turnaround times. Shortly after implementation, the internal audit function identifies a significant rise in unauthorized vendor payments. Which of the following decision-making approaches most likely contributed to this control failure?

	A. OPTION A.	Balanced decision-making.
	B. OPTION B.	Efficiency-focused decision-making.
	C. OPTION C.	Exclusive decision-making.
	D. OPTION D.	Reactive decision-making.

b

How does an organization's decision-making process impact its control environment?

A. OPTION A.	It defines the organization's strategic objectives.
B. OPTION B.	It determines the organization's risk appetite and tolerance.
C. OPTION C.	It influences the tone at the top and the ethical culture of the organization.
D. OPTION D.	It establishes the reporting lines and authority structures.

b

A. OPTION A.	It defines the organization's strategic objectives.
B. OPTION B.	It determines the organization's risk appetite and tolerance.
C. OPTION C.	It influences the tone at the top and the ethical culture of the organization.
D. OPTION D.	It establishes the reporting lines and authority structures.

b

Which of the following best describes the purpose of a code of conduct in addressing ethical, legal, and compliance-related requirements?

	A. OPTION A.	To communicate the organization's values and expected behaviors
	B. OPTION B.	To replace the need for internal controls
	C. OPTION C.	To provide a detailed list of all potential ethical violations
	D. OPTION D.	To ensure compliance with all applicable laws and regulations

a

Which of the following stakeholders is primarily responsible for an organization's ethics and compliance programs?

	A. OPTION A.	The board.
	B. OPTION B.	The regulatory body.
	C. OPTION C.	The internal audit function.
	D. OPTION D.	Senior management.

d

Which of the following is a key element of an effective ethics and compliance program?

A.

OPTION A.

A focus on financial performance over ethical behavior

B.

OPTION B.

A code of conduct that is not regularly updated

C.

OPTION C.

A whistleblower hotline that is rarely used

D.

OPTION D.

Oversight by senior management or a chief compliance officer

d

What is the most critical role of senior management in promoting ethical leadership?

	A. OPTION A.	Setting the tone at the top by modeling ethical behavior
	B. OPTION B.	Establishing a whistleblower hotline
	C. OPTION C.	Conducting annual ethics training for employees
	D. OPTION D.	Delegating responsibility for ethical leadership to the compliance officer

a

Which of the following actions by the internal audit function best supports the organization's compliance with its ethics requirements?

	A. OPTION A.	The internal audit function examines the implementation of the organization's ethics program.
	B. OPTION B.	Internal auditors consider potential fraud risks during their audit engagements.
	C. OPTION C.	The chief audit executive leads a series of workshops across the organization to promote values and ethics.
	D. OPTION D.	Internal auditors attest annually to their compliance with the organization's code of ethics.

a

When auditing ethics and compliance, which of the following is most relevant?

A.

OPTION A.

Assessing programs for communicating values, strategies, and objectives.

B.

OPTION B.

Assessing the root causes for areas with culture deficiencies.

C.

OPTION C.

Assessing whether escalation and resolution processes are effective.

D.

OPTION D.

Assessing whether ethical values are consistent among policy statements.

c

When performing procedures to evaluate an organization’s ethics and compliance program, which of the following should the internal auditor assess first?

A.

OPTION A.

The results of employee ethics surveys

B.

OPTION B.

The effectiveness of the whistleblower hotline

C.

OPTION C.

The design of the code of conduct and related policies

D.

OPTION D.

The number of ethics violations reported in the past year

c

What is the primary purpose of communicating ethics and compliance engagement results?

A.

OPTION A.

To ensure all employees are aware of the findings

B.

OPTION B.

To comply with regulatory requirements

C.

OPTION C.

To document the internal audit function’s activities

D.

OPTION D.

To provide actionable recommendations to management and the board

d

Which of the following sets of factors best represents the "triple bottom line” framework used to assess an organization's corporate citizenship?

	A. OPTION A.	Economic, environmental, social responsibility.
	B. OPTION B.	Economic, cultural, environmental.
	C. OPTION C.	Social responsibility, economic, cultural.
	D. OPTION D.	Environmental, governance, social responsibility.

a

A technology company's research and development team is consistently failing to meet deadlines for new product releases, resulting in a significant delay in bringing innovative products to market. This delay is causing the company to lose market share to its competitors. This scenario primarily illustrates which type of risk?

	A. OPTION A.	Strategic risk.
	B. OPTION B.	Operational risk.
	C. OPTION C.	Reputational risk.
	D. OPTION D.	Financial risk.

a

Which of the following statements best describes risk appetite?

	A. OPTION A.	The types and amount of risk that an organization is willing to accept in the pursuit of its strategies and objectives.
	B. OPTION B.	The total amount of all types of residual risk that the organization is willing to accept in pursuit of its objectives.
	C. OPTION C.	The total amount of all types of inherent risk that the organization is willing to accept in pursuit of its objectives.
	D. OPTION D.	The total amount of risk that the organization is willing to accept around specific objectives.

a

Following the discovery of a significant fraud incident, the executive vice president of the affected department questions the chief audit executive (CAE) about the lack of recent internal audit engagements in her area. Which of the following is the most appropriate response from the CAE?

	A. OPTION A.	"Internal auditing’s scope is limited, and we cannot guarantee the detection of all potential fraud."
	B. OPTION B.	"The absence of recent audit engagements in your area does not absolve management of their responsibility to maintain effective controls."
	C. OPTION C.	"We will immediately conduct a special investigation into this department to identify all control weaknesses."
	D. OPTION D.	"While management is primarily responsible for ongoing monitoring, we will review our risk assessment to ensure this area is adequately considered in future audit plans."

d

During an audit engagement of the risk management process, an internal auditor notes the following observations. Which observation indicates the greatest potential risk to the organization?

A. OPTION A.	Control operating effectiveness testing for risk mitigation is not performed annually.
B. OPTION B.	Identified risks have not been prioritized to determine their significance and management focus.
C. OPTION C.	The process for identifying and evaluating new risks is informal and poorly documented.
D. OPTION D.	A comprehensive review to confirm the completeness of identified risks has not occurred within the past two years.

c

What is the primary benefit of utilizing risk assessment and likelihood-impact matrices within a risk management process?

A. OPTION A.	They eliminate the potential for collateral damage from unforeseen crises.
B. OPTION B.	They facilitate a standardized and consistent visualization of organizational risks.
C. OPTION C.	They enable the direct linkage of top risks to financial resources such as budgets, capital, and shareholder value.
D. OPTION D.	They clarify and distribute risk management responsibilities between the board and executive management.

b

Which of the following is true of enterprise risk management (ERM)?

	A. OPTION A.	It includes the audit committee's selection of the best risk response for the organization.
	B. OPTION B.	It guarantees achievement of organizational objectives.
	C. OPTION C.	It requires establishment of risk and control activities by internal auditors.
	D. OPTION D.	It involves the identification of events with impact on organizational objectives.

d

What is the primary advantage of adopting a portfolio view of organizational risks?

	A. OPTION A.	It identifies correlations between internal risks and fluctuations in the external environment.
	B. OPTION B.	It classifies risks into distinct categories and illustrates the relationships between risks within those categories.
	C. OPTION C.	It reveals the aggregate impact of risks across the organization, highlighting those that pose the greatest overall threat.
	D. OPTION D.	It demonstrates how individual risks can counterbalance each other at the business unit level.

c

When gathering information about controls during a risk assessment process, what is the primary advantage of using facilitated workshops rather than structured interviews?

	A. OPTION A.	During facilitated workshops, people more openly say things to internal auditors than during private interviews.
	B. OPTION B.	The testimonial evidence obtained during facilitated workshops is generally considered more reliable.
	C. OPTION C.	Internal auditors do not need other sources of information, as the data gathered during facilitated workshops is sufficient.
	D. OPTION D.	Facilitated workshops create a synergy of discussion that can bring multiple perspectives to the same issue.

d

An organization's internal control system is most effective at detecting irregularities committed by which of the following?

	A. OPTION A.	Group of managers in collusion.
	B. OPTION B.	Group of employees in collusion.
	C. OPTION C.	Single non-management employee.
	D. OPTION D.	Single manager

c

Which of the following detective control activities would be most effective in identifying fictitious employees?

	A. OPTION A.	Matching the payroll master file against the vendor master file, searching for duplicate addresses.
	B. OPTION B.	Running an analytics script on every payroll file, searching for payroll without income tax and/or health insurance deductions.
	C. OPTION C.	Requiring those who receive physical paychecks to sign for receipt of their paychecks when picked up at the payroll office.
	D. OPTION D.	Ensuring that the payroll supervisor distributes manual payroll checks to employees

b

Which of the following internal controls is most appropriate for mitigating the risk of unauthorized wire transfers in a multinational corporation's branch office monetary transfer unit?

	A. OPTION A.	The branch manager should receive and authorize all wire transfers.
	B. OPTION B.	Foreign currency rates should be independently computed by two different employees.
	C. OPTION C.	Corporate management should approve the hiring of all monetary transfer unit employees.
	D. OPTION D.	The individual who initiates wire transfers should not reconcile the bank statement.

d

During an assurance engagement, the internal audit function found that process-level risks were not adequately addressed. Which of the following is a process-level control?

	A. OPTION A.	Authorizations.
	B. OPTION B.	Inventory counts.
	C. OPTION C.	IT input controls.
	D. OPTION D.	Segregation of duties.

b

A bank requires annual privacy training to ensure its employees comply with relevant privacy policies and regulations. Which of the following types of controls best describes this annual training requirement?

	A. OPTION A.	Detective.
	B. OPTION B.	Preventive.
	C. OPTION C.	Directive.
	D. OPTION D.	Compensating.

c

A well-designed records management system primarily functions as what type of internal control?

A.

OPTION A.

Detective.

B.

OPTION B.

Directive.

C.

OPTION C.

Corrective.

D.

OPTION D.

Preventive.

a

Which control procedure is most effective in ensuring payroll checks are issued only for authorized amounts?

A.

OPTION A.

Requiring the return of undelivered checks to the cashier.

B.

OPTION B.

Periodically witnessing the distribution of payroll checks.

C.

OPTION C.

Requiring supervisory approval of employee timecards.

D.

OPTION D.

Conducting periodic floor verification of employees on the payroll.

c

A retailer's marketing department assigns product managers to each product line. Products are delivered to a central distribution center, and individual stores do not have receiving functions. Product managers are evaluated on sales and gross profit. Which of the following represents the most significant deficiency in the inventory control environment?

	A. OPTION A.	Evaluating product managers by total gross profit generated by product line will lead to dysfunctional behavior.
	B. OPTION B.	The store manager can require items to be removed, thus affecting the potential performance evaluation of individual product managers.
	C. OPTION C.	There is no receiving function located at individual stores.
	D. OPTION D.	The product manager negotiates the purchase price and sets the selling price.

C

An employee in the payroll department is considering adding a fictitious employee and inputting fraudulent hours, with the paycheck sent to the employee’s home. Which of the following control procedures would be MOST effective in preventing this fraud?

	A. OPTION A.	The payroll department physically delivers paychecks to employees rather than mailing them to the employees.
	B. OPTION B.	A report on all added employees approved by someone outside of the payroll department and reports showing all employees and hours worked are sent to the supervisor's department for review.
	C. OPTION C.	All new employees and their hours worked are input by the human resources department.
	D. OPTION D.	All changes to employee records are approved by supervisors outside of both human resources and payroll.

D

For a nonprofit organization conducting telephone fundraising, which of the following control procedures best serves as a detective control to ensure all pledges are accurately recorded?

	A. OPTION A.	Management reports that compare funds raised this year with funds raised last year on a per-call basis.
	B. OPTION B.	Monitoring of all phone calls by management personnel.
	C. OPTION C.	Confirmation program that randomly selects donations received and confirms the amounts with the donors.
	D. OPTION D.	Automatic computer recording of all phone calls for archive purposes.

C

An internal audit engagement is requested by the finance department to assess its fraud detection controls. Which of the following activities would most likely be included within the scope of this engagement?

		Compensation programs and background investigations.
	B. OPTION B.	Background investigations and authority limits.
	C. OPTION C.	Red-flag training and transaction-level procedures.
	D. OPTION D.	Reconciliations and whistleblower hotline.

D

Which control would best prevent a factory from releasing wastewater that does not meet discharge standards?

	A. OPTION A.	Establishing a reactive maintenance program for repairing the factory's pretreatment system quickly if it breaks.
	B. OPTION B.	Performing chemical analysis of the water just downstream from the point of discharge for components specified in the permit.
	C. OPTION C.	Specifying (by policy, training, and advisory signs) which substances may be disposed of via sinks and floor drains within the factory.
	D. OPTION D.	Periodically flushing sinks and floor drains with a large volume of clean water, hoping that pollutants are sufficiently diluted.

C

Which of the following is a typical processing control in a computer system?

	A. OPTION A.	Reviewing the computer processing logs to determine that all of the correct computer jobs executed properly.
	B. OPTION B.	Matching input data with information in master files and placing unmatched items in a suspense file.
	C. OPTION C.	Maintaining formal procedures and documentation specifying authorized recipients of output reports, checks, or other critical documents.
	D. OPTION D.	Periodically reconciling output reports to make sure that totals, formats, and critical details are correct and agree with input.

B

When an internal auditor reviews an organization's internal control framework, what is the primary benefit of referencing a globally accepted framework?

	A. OPTION A.	To ensure the organization's internal control framework was designed exactly like the globally accepted framework.
	B. OPTION B.	To assess the organization’s internal control framework design.
	C. OPTION C.	To design the organization's internal control framework.
	D. OPTION D.	To provide assurance that the organization’s internal control framework is effective.

B

What is the most direct way the implementation of an internal control framework contributes to an organization's objectives?

	A. OPTION A.	It assists in the determination of audit resources to improve time and solve issues during audit planning.
	B. OPTION B.	It standardizes control processes across all organizational units.
	C. OPTION C.	It helps the auditors in establishing the scope required to meet the objectives of the audit engagement.
	D. OPTION D.	It provides reasonable assurance that the organization achieves its objectives.

D

In a smaller organization with limited resources, what is often the most practical and efficient way for the internal audit function to gather evidence about the effectiveness of internal controls?

	A. OPTION A.	Examining data that is continuously monitored via technology.
	B. OPTION B.	Examining documentation from the activity under review and outside sources.
	C. OPTION C.	Gathering testimonial evidence through interviews, surveys, or risk control self-assessments.
	D. OPTION D.	Conducting a walk-through to observe a process in action.

C

During an audit engagement, an internal auditor discovers multiple instances where management has overridden established internal controls, instructing employees to deviate from documented policies and procedures. What is the auditor's most appropriate next step?

	A. OPTION A.	Report the noncompliance cases to the board of directors.
	B. OPTION B.	Recommend that employees report the cases through the designated whistleblowing channel.
	C. OPTION C.	Investigate the rationale for management's actions.
	D. OPTION D.	Recommend that management update its policies and procedures based on the circumstances.

C

A staff auditor discovers that investment securities were improperly used as collateral during a treasury audit engagement. The loan was repaid, the securities were returned, and control weaknesses were corrected. However, the auditor also uncovers significant errors in last year's audit review process, which failed to detect the issue. The auditor is unsure whether to report the past misuse, given that the issue has been resolved. Which of the following describes the auditor's best course of action?

	A. OPTION A.	Report the past misuse of securities to the appropriate authorities, even though the issue is resolved, to ensure transparency and accountability.
	B. OPTION B.	Focus on the fact that the issue has been resolved and avoid reporting the past misuse to protect the reputation of the audit team.
	C. OPTION C.	Report the errors in last year's audit review process, but omit the past misuse of securities, as it is no longer an active issue.
	D. OPTION D.	Discuss the situation with the engagement supervisor but only report the past misuse if explicitly instructed to do so.

A

A staff auditor is assigned to a treasury audit for the second consecutive year. The auditor confirms investment securities held by a brokerage house and realizes that several large securities were improperly used as collateral for personal loans a few years ago by the current treasurer. Last year the staff auditor mistakenly signed off on the audit steps involving the confirmations and verification of the securities without completing all of the steps. The audit manager also mistakenly signed off on the review last year. When the error is detected this year, the audit manager comments, "It was an error, but the loan has been repaid and the securities returned. We've corrected the control weakness, and I'm positive it won't happen again. Pursuit of this issue will embarrass everyone involved.” Which of the following responses to audit manager by the staff auditor best demonstrates integrity?

	A. OPTION A.	"I will immediately remove the prior year's sign-off and replace it with a new workpaper that reflects the current year’s findings. Then I will only document the current year’s findings."
	B. OPTION B.	"To ensure transparency and allow for proper risk assessment, I will prepare a draft finding that includes all relevant details. I will then share this draft with you and the CAE for review and discussion."
	C. OPTION C.	"While I understand your concern, I must document the finding and its root cause in the workpapers. I will ensure the language is factual and objective, focusing on the control weakness and its remediation."
	D. OPTION D.	"I propose we schedule a meeting with the treasurer and the relevant stakeholders to discuss the incident and the corrective actions taken. This will allow for open communication and demonstrate our commitment to addressing control weaknesses."

C

Organization A has a formal corporate code of ethics; Organization B does not. Organization A's code of ethics covers purchase agreements and relationships with vendors, along with many other issues to guide individual behavior in the organization. Which of the following statements can be logically inferred?

	A. OPTION A.	Organization A exhibits a higher standard of ethical behavior than does Organization B.
	B. OPTION B.	Organization A has established objective criteria by which an employee's actions can be evaluated.
	C. OPTION C.	Organization A has a lower need for controls related to purchase agreements and vendor relationships than does Organization B.
	D. OPTION D.	The absence of a formal corporate code of ethics in Organization B would prevent a successful audit engagement of ethical behavior in that organization.

B

In a large internal audit function, an experienced staff internal auditor is preparing to become an engagement supervisor. The staff auditor has a goal of leading an engagement team for the first time next year. Which of the following competency goals would be most appropriate for the staff auditor’s current year's professional development plan?

	A. OPTION A.	Conduct a risk assessment, prioritize engagements, and develop a risk-based internal audit plan.
	B. OPTION B.	Describe the importance of internal audit objectivity; identify factors that may impair objectivity.
	C. OPTION C.	Develop key performance indicators for the internal audit function.
	D. OPTION D.	Prepare draft reports with recommendations that will enhance and protect organization value.

D

Which of the following best describes a foundational competency requirement for all internal auditors, regardless of their specific role or industry?

A. OPTION A.	Internal auditors must possess or develop knowledge of The IIA’s Global Internal Audit Standards.
B. OPTION B.	Internal auditors must have advanced proficiency in data analytics and visualization tools.
C. OPTION C.	Internal auditors must hold a Certified Public Accountant (CPA) license.
D. OPTION D.	Internal auditors must have extensive experience in information technology security.

A

Which of The IIA resources is the best tool for the internal auditor to use as a basis for creating a professional development plan?

A.

OPTION A.

Global Technology Audit Guides (GTAG).

B.

OPTION B.

Global Guidance.

C.

OPTION C.

The Competency Framework.

D.

OPTION D.

The IIA's Global Internal Audit Standards.

D

What does exercising due professional care during an advisory engagement require?

	A. OPTION A.	Internal auditors identify additional risk areas to add to the scope.
	B. OPTION B.	Internal auditors follow up on reported audit findings to ascertain that appropriate action was taken.
	C. OPTION C.	Internal auditors be more closely linked with the activities they are reviewing, in comparison to the independence required in an assurance review.
	D. OPTION D.	The advisory engagement be performed by those persons who collectively possess the necessary knowledge, skills, and abilities to conduct the work properly and objectively.

D

When an internal auditor is reviewing work they previously performed, which measure best reduces self-review bias to maintain objectivity?

A. OPTION A.	Implementing a dual-review process within the audit team.
B. OPTION B.	Rotating the auditor to a different assignment.
C. OPTION C.	Engaging an independent external reviewer to supervise the engagement.
D. OPTION D.	Increasing the frequency of internal quality reviews.

C

An internal auditor is assigned to audit a process she helped design and implement six months prior. Which of the following best describes the potential impact of self-review bias on this engagement?

	A. OPTION A.	The auditor may apply more rigorous testing procedures to compensate for potential bias.
	B. OPTION B.	The auditor may rely solely on prior knowledge of the process, skipping necessary testing.
	C. OPTION C.	The auditor may be overly critical of the process to demonstrate objectivity.
	D. OPTION D.	The auditor may overlook deficiencies in the process due to a lack of critical perspective.

D

When an internal auditor is reviewing work they previously performed, which measure best reduces self-review bias to maintain objectivity?

A. Option A.	Implementing a dual-review process within the audit team.
B. Option B.	Increasing the frequency of internal quality reviews.
C. Option C.	Rotating the auditor to a different assignment.
D. Option D.	Engaging an independent external reviewer to supervise the engagement.

D

An internal auditor is assigned to audit a process she helped design and implement six months prior. Which of the following best describes the potential impact of self-review bias on this engagement?

	A. Option A.	The auditor may overlook deficiencies in the process due to a lack of critical perspective.
	B. Option B.	The auditor may apply more rigorous testing procedures to compensate for potential bias.
	C. Option C.	The auditor may be overly critical of the process to demonstrate objectivity.
	D. Option D.	The auditor may rely solely on prior knowledge of the process, skipping necessary testing.

A

An internal auditor has audited the same department for the past five years. Over time, the auditor has developed a strong working relationship with the department's management and staff. Which of the following best describes the potential impact of familiarity bias on the auditor's current engagement?

	A. Option A.	The internal auditor may become overly critical of the department's operations to avoid any perception of favoritism.
	B. Option B.	The internal auditor may apply excessively strict testing procedures to demonstrate independence.
	C. Option C.	The internal auditor may overlook potential control weaknesses due to assumptions based on past experiences.
	D. Option D.	The internal auditor may rely solely on documented procedures, ignoring any informal practices within the department.

C

An organization's policy states that internal auditors must disclose any potential conflicts of interest to their supervisor. The policy also recommends, but does not require, auditors to recuse themselves from audit engagements where a significant conflict exists. An internal auditor discloses that her close friend is the CFO of a subsidiary she is assigned to audit. The supervisor approves the audit engagement with enhanced review procedures as a mitigation strategy. After the engagement, concerns are raised that it did not adequately address potential financial discrepancies within the subsidiary. Which of the following best describes the effectiveness of the organization's policy and the implemented mitigation strategy?

	A. Option A.	The policy and mitigation strategy were effective, as the internal auditor complied with the disclosure requirement and the supervisor implemented enhanced review procedures.
	B. Option B.	The policy and mitigation strategy were ineffective, as they did not prevent the internal auditor from conducting the audit engagement despite a significant conflict of interest.
	C. Option C.	The policy was effective in promoting disclosure, but the mitigation strategy was ineffective, as it did not prevent potential bias from impacting the audit results.
	D. Option D.	The policy was ineffective, as it did not mandate recusal in cases of significant conflicts of interest, and the mitigation strategy was unnecessary.

C

An internal auditor is asked to perform an operational audit engagement of telephone marketing operations and provide recommendations for improved management controls. The auditor previously worked in the telephone marketing department for three years. Which of the following best describes the auditor's appropriate course of action regarding objectivity?

	A. Option A.	Perform the audit engagement without any special considerations, as providing recommendations does not impair objectivity.
	B. Option B.	Decline to perform the audit engagement, as previous experience in the department creates an inherent conflict of interest.
	C. Option C.	Perform the audit engagement but avoid providing any recommendations for improved management controls to maintain objectivity.
	D. Option D.	Disclose previous employment in the telephone marketing department to management before accepting the audit engagement.

D

Which of the following best describes what an internal auditor must always do to exercise due professional care during an engagement?

	A. Option A.	Ensure that all financial information is reviewed and included in the audit plan.
	B. Option B.	Promptly report noncompliance or irregularities discovered to the audit committee.
	C. Option C.	Consider the possibility of nonconformance or irregularities during the engagement.
	D. Option D.	Fully document all audit tests and related procedures in the workpapers.

C

Which of the following best describes a requirement for internal audit advisory services?

	A. Option A.	A formal documented risk assessment.
	B. Option B.	Evaluation criteria.
	C. Option C.	A documented work program.
	D. Option D.	Scope limitations.

C

An internal auditor is planning an engagement to evaluate the efficiency of a newly implemented inventory management system. During the planning phase, the auditor identifies a minor control deficiency that, while technically non-compliant, has minimal impact on the overall inventory accuracy. In determining the work program, what is the most important aspect of due professional care the auditor should consider regarding the control deficiency?

	A. Option A.	The extent and timeliness of work needed to achieve the engagement's objectives.
	B. Option B.	The probability of significant errors, fraud, or noncompliance related to the inventory system.
	C. Option C.	Cost relative to the potential benefits of evaluating the control deficiency.
	D. Option D.	The organization's strategy and objectives related to inventory management.

C

An internal auditor believes that the accounts receivable account balances may not be accurate. Which of the following procedures would best demonstrate the internal auditor's professional skepticism?

	A. Option A.	Issuing third-party confirmations to the customers owing the money.
	B. Option B.	Interviewing the company's salespeople responsible for generating the sales.
	C. Option C.	Tracing the fund balance to the general ledger.
	D. Option D.	Performing a statistical sample of the accounts and tracing them to the source documentation.

A

When handling sensitive third-party information during an audit engagement, which of the following methods provide the highest level of protection?

	A. Option A.	Collecting third-party information from trusted sources and archiving it on a dedicated drive with restricted permissions.
	B. Option B.	Obtaining the information via secure channels, using it solely for the engagement, and disposing of it according to established policies.
	C. Option C.	Accessing third-party data after obtaining verbal assurances of confidentiality and using secure networks for storage.
	D. Option D.	Receiving third-party information through formal data sharing agreements and storing it in secured folders with limited access.

B

As part of cash management procedures, the treasurer of a nonprofit organization has decided to invest in a variety of new financial instruments. The audit committee has asked the internal audit function to conduct an audit engagement of the adequacy of controls over the new investing techniques. Which is an important part of such an audit engagement?

	A. Option A.	Determining whether the treasurer is getting higher or lower rates of return on investments than are treasurers in comparable organizations.
	B. Option B.	Determining the nature of controls established by compliance professionals to monitor the risks in the investments.
	C. Option C.	Determining the extent of management oversight of investments in sophisticated instruments.
	D. Option D.	Determining if policies exist that describe the risks the treasurer may take as long as there is no loss of principal balances in stock market investments.

C

An internal audit function conducts an engagement to determine whether the organization is in compliance with a particular set of laws and regulations. Engagement results do not reveal any issues of noncompliance but do reveal that the organization does not have an established system to ensure such compliance. What is the internal auditor's responsibility in this situation?

	A. Option A.	Report that one significant compliance issue was noted related to the lack of a compliance system.
	B. Option B.	Report that the organization has a significant control deficiency because management has not established a system to manage compliance.
	C. Option C.	Get management approval to establish a system to ensure compliance with applicable laws and regulations.
	D. Option D.	Report that the organization has no issues of noncompliance and inform the chief audit executive that an advisory project to design a compliance monitoring system should be recommended.

B

An internal auditor reviews the technology infrastructure to assure integrity of information and provides this information to senior management. Which of the following parties is most likely to also be involved in this engagement?

	A. Option A.	A total quality management (TQM) reviewer.
	B. Option B.	A consultant.
	C. Option C.	The operational manager.
	D. Option D.	The process owner.

D

An organization is considering establishing a business-to-business (B2B) e-commerce relationship with a new trading partner. Which would be appropriate risk factors to consider when setting the objectives of an external business relationship assurance engagement?

	A. Option A.	Privacy of data arrangements.
	B. Option B.	Assurance of trustworthiness.
	C. Option C.	The adequacy of the trading partner's data retention policies.
	D. Option D.	Financial stability of the trading partner.

A

If a quality audit engagement finds that a manufacturing organization's quality and continuous improvement plans are adequate and are being followed, what can be reasonably concluded?

	A. Option A.	The organization's products will have significantly reduced internal and external failure costs.
	B. Option B.	The organization's products will likely be perceived as more valuable to consumers, though they may cost more to produce.
	C. Option C.	The desired quality will be attained.
	D. Option D.	Minimum compliance with quality laws and regulations will be attained.

C

After signing a contract with a third-party service provider, senior management asked the internal audit function to provide assurance on the governance and control processes of the service provider. This requested service best describes which of the following?

	A. Option A.	A contract audit engagement.
	B. Option B.	An operational audit engagement.
	C. Option C.	A vendor audit engagement.
	D. Option D.	A due diligence audit engagement.

C

After analyzing the electricity sales process, the chief audit executive concludes that control activities are weak and inconsistently performed. The electricity sales unit was recently established, and most of the staff are new hires from outside the organization. According to IIA guidance, which of the following actions would contribute most to the improvement of governance practices?

	A. Option A.	Conduct an advisory engagement that includes internal control training.
	B. Option B.	Conduct benchmarking to identify and compare to industry best practices.
	C. Option C.	Conduct a performance audit engagement to identify key performance indicators.
	D. Option D.	Conduct a formal assurance engagement to assess the full control environment.

A

Which of the following statements is accurate regarding internal auditors and planning engagements of governance processes?

	A. Option A.	Internal auditors cannot provide assurance services to governance processes, as these processes relate to senior management and board activities.
	B. Option B.	Internal auditors must provide both assurance and advisory services to assess governance practices due to level of the area.
	C. Option C.	Internal auditors may provide advisory services to assess governance practices only as an addition to assurance engagements.
	D. Option D.	Internal auditors, during the annual planning process, may replace an assurance engagement on governance practices, with advisory services for the same area.

D

A corporation is planning to acquire a smaller competitor. The internal audit function is engaged to evaluate the target company's financial records, operational processes, and compliance with regulations. The internal auditor identifies potential risks, such as weak internal controls over financial reporting and noncompliance with labor laws, and provides recommendations to management. What is the primary role of the internal audit function in this engagement?

	A. Option A.	Benchmarking the target company's performance against industry standards.
	B. Option B.	Performing due diligence services to assess risks and provide recommendations.
	C. Option C.	Conducting a compliance audit of the target company.
	D. Option D.	Providing assurance on the target company's financial statements.

B

Which of the following best describes competitive benchmarking?

	A. Option A.	It looks at industry-wide measures as a target for improvement.
	B. Option B.	It looks at a process in one operation and compares it to a process with similar characteristics but in another industry.
	C. Option C.	It looks within the department or process itself by selecting a stellar performance that rises (but not unreachably) above the current baseline performance.
	D. Option D.	It looks at the performance of other organizations that have similar processes as the benchmark.

D

A department within an organization has requested the internal audit function’s involvement in a business process benchmarking initiative. The objective is to achieve a “world-class” work process and improve customer satisfaction. In this context, which of the following is the most appropriate activity for the internal audit function to perform?

	A. Option A.	Identify the activity to benchmark.
	B. Option B.	Determine how to measure the activity.
	C. Option C.	Evaluate the appropriateness of the benchmark.
	D. Option D.	Analyze the benchmark data and set goals and an action plan.

C

Which of the following is the most appropriate role for an internal auditor during a systems development life cycle (SDLC) review?

	A. Option A.	Provide the go/no-go recommendation based on feasibility study conclusions.
	B. Option B.	Screen the technical expertise of employees participating in the study.
	C. Option C.	Ensure that controls are designed during the conversion and implementation phase.
	D. Option D.	Restrict stakeholder representation.

B

What is the most significant reason to involve employees in a control self-assessment (CSA)?

	A. Option A.	Employees become more motivated to do their jobs right.
	B. Option B.	Employees can provide an independent assessment of internal controls.
	C. Option C.	Employees are objective about their jobs.
	D. Option D.	Employees can get meaningful feedback from their managers.

a

A hospital engages the internal audit function to help with the procurement of software to integrate a new cost accounting system with the existing system. The hospital wants to use process mapping to identify potential risks related to the integration. Which of the following activities would be most relevant for the internal audit function during this process mapping engagement?

	A. Option A.	The internal audit function evaluates whether the application design meets internal development and documentation standards.
	B. Option B.	The internal audit function evaluates whether performance specifications are consistent with the hospital's needs.
	C. Option C.	The internal audit function determines whether the prototyped model is validated and reviewed with users before production use begins.
	D. Option D.	The internal audit function has no involvement, since the system has already been developed externally.

b

A manufacturing company is seeking to improve its operational efficiency. They've engaged the internal audit function for an advisory engagement to benchmark their production cycle times against industry best practices. Which of the following best describes the internal auditor's primary role in this benchmarking exercise?

	A. Option A.	Independently verifying the accuracy of the benchmarking data provided by external sources and recommending potential areas for process improvement.
	B. Option B.	Facilitating the benchmarking process by providing guidance on data collection, analysis techniques, and identifying relevant benchmarks, while maintaining objectivity.
	C. Option C.	Implementing the chosen best practices and managing the operational changes necessary to achieve the benchmarked performance levels.
	D. Option D.	Establishing the target performance metrics and dictating the specific benchmarking partners to ensure alignment with the company’s strategic objectives.

b

Which of the following methods would be most effective in gathering reliable information about an organization's "tone at the top" regarding ethical behavior and commitment to integrity?

	A. Option A.	Employee questionnaires asking for a ranking of specific characteristics as they apply to senior management.
	B. Option B.	Focus groups with senior management.
	C. Option C.	Analysis of articles on the subject in professional journals.
	D. Option D.	Control self-assessment workshops with a variety of stakeholders.

D

Which of the following scenarios most directly relates to the organizational independence of the internal audit function?

	A. Option A.	A chief audit executive writes a negative comment about the process owner in the audit report due to a personal disagreement during the engagement.
	B. Option B.	A chief audit executive faces opposition from management on a budget request regarding an upcoming audit engagement.
	C. Option C.	An internal auditor declines to be assigned to an audit engagement due to conflict of interest issues.
	D. Option D.	An internal auditor requests to be rotated so as to avoid conducting monthly compliance engagements.

b

The chief audit executive (CAE) believes that the proposed organizational budget will not enable the internal audit function to perform planned risk management projects. What action should the CAE take?

	A. Option A.	Arrange to co-fund risk management projects with other functions, ensuring that the internal audit function maintains control over the scope and objectives.
	B. Option B.	Use time at a board meeting to educate senior management about the process and benefits of risk management.
	C. Option C.	Accept the budget constraints and adjust the internal audit plan to reduce the scope of planned risk management activities.
	D. Option D.	Communicate the budget concerns to the board and seek their support in obtaining the necessary resources from senior management.

B

Which of the following is the most appropriate course of action for an internal auditor who works in an organization that does not have a risk management process?

	A. Option A.	The internal auditor should avoid responsibility for managing identified risks.
	B. Option B.	The internal auditor should establish a full enterprise risk management process and framework.
	C. Option C.	Internal auditors should avoid working in organizations that have not yet established a risk management process.
	D. Option D.	The internal auditor should establish a process for identifying high-level risks and ensuring all risks are mitigated.

A

Which of the following best describes the internal audit function's third line role regarding internal financial reports?

	A. Option A.	To ensure compliance with reporting procedures and confirm accuracy.
	B. Option B.	To identify inadequate controls that increase the likelihood of unauthorized expenditures.
	C. Option C.	To delegate internal financial reporting responsibilities to management.
	D. Option D.	To review expenditure items and match each item with the expenses incurred.

b

Which of the following activities is most important for the chief audit executive (CAE) to complete before initiating an advisory engagement?

	A. Option A.	Determine if the first or second lines are responsible or better equipped to provide the service.
	B. Option B.	Include in the work program, procedures for identifying, analyzing, evaluating, and documenting information during the engagement.
	C. Option C.	Conduct a preliminary assessment of the risks relevant to the activity under review.
	D. Option D.	Ascertain the extent to which management has established adequate criteria to determine whether objectives have been accomplished.

a