4: The Internal Audit Plan

Question 1

How is risk measured?

Answer 1

In terms of impact and likelihood.

Question 2

What is a risk-based audit plan?

Answer 2

An audit plan that is logically related to the identified risks of the organization.

Question 3

What is included in the audit universe?

Answer 3

All business units, processes, or operations that can be evaluated and defined.

Question 4

Besides the audit universe, what else is the internal audit activity’s audit plan based on?

Answer 4

Assessed risks
Input from senior management and the Board

Question 5

List internal risk factors.

Answer 5

Quality of and adherence to controls
Degree of change
Timing and results of last engagement
Impact
Likelihood
Materiality
Asset liquidity
Management competence

Question 6

List external risk factors.

Answer 6

Competitor actions
Supplier prices and quality
Industry issues
Employee relations
Government relations

Question 7

Define risk management as defined by The IIA.

Answer 7

A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives.

Question 8

Define inherent risk.

Answer 8

The susceptibility of information or data to a material misstatement given no related mitigating controls.

Question 9

Define current (residual) risk.

Answer 9

Risk managed within existing controls or control systems.

Question 10

With regard to risk, an internal audit plan focuses on

Answer 10

Unacceptable current risks requiring management action
Control systems on which the organization is most reliant
Areas where the difference between inherent risk and residual risk is great
Areas where inherent risk is very high

Question 11

The internal audit plan prioritizes the internal audit activity’s engagements to obtain an understanding of the organization’s

Answer 11

Strategies
Objectives
Risks
Risk management procedures

Question 12

What is the key input in the evaluation of risk?

Answer 12

The internal auditor’s judgment.

Question 13

The internal audit activity’s audit plan is based on

Answer 13

The audit universe
Input from senior management and the board
Assessed risks

Question 14

Define risk modeling.

Answer 14

An effective method used to rank and validate risk priorities when prioritizing engagements in the audit plan.

Question 15

What is the audit risk model used by the AICPA?

Answer 15

Audit risk =
Risk of material misstatement × Detection risk-base
Audit risk =
(Inherent risk × Control risk) × Detection risk

Question 16

Define audit risk in an internal audit context.

Answer 16

The risk that the auditor will provide senior management and the Board with flawed or incomplete information about governance, risk management, and control.

Question 17

Define inherent risk in an internal audit context.

Answer 17

The risk arising from the nature of the account or activity under review.

Question 18

Define control risk in an internal audit context.

Answer 18

The risk that the system of internal control designed and implemented by management will fail to achieve management’s goals and objectives for the account or activity under review.

Question 19

Define detection risk in an internal audit context.

Answer 19

The risk that the auditor will fail to discover conditions relevant to the established audit objectives for the account or activity under review.

Question 20

Which of the four risks–audit, inherent, control, or detection–is under the auditor’s direct control?

Answer 20

Detection risk.

Question 21

The components of inherent risk, control risk, and detection risk may be assessed in ____[1]____ or ____[2]____ terms.

Answer 21

1. Quantitative
2. Nonquantitative

Question 22

Risk modeling in a consulting service can be accomplished by ranking the engagement’s potential to

Answer 22

Improve management of risks,
Add value, and
Improve the organization’s operations.

Question 23

Risk factors (e.g., impact and likelihood) may be ____[1]____ based on professional judgments to determine their ____[2]____, but the ____[3]____ need not be quantified.

Answer 23

1. Weighted
2. Relative significance
3. Weights

Question 24

Who is responsible for communicating the internal audit activity’s plans, resource requirements, purpose, responsibility, etc., to senior management and the Board for review and approval?

Answer 24

Chief Audit Executive.