Flash Cards V1C1 - V1C1
Question: V1C1-0001
According to the IIA Standards, which of the following is not included in the scope of the internal audit function?
Answers
A: Appraising the economy and efficiency with which resources are employed.
B: Reviewing the strategic management process, assessing the quality of management decision.
C: Reviewing the means of safeguarding assets and, as appropriate, verifying the existence of such assets.
D: Reviewing operations or programs to ascertain whether results are consistent with established objectives
and goals and whether the operations or programs are being carried out as planned.
Answer Explanations
Answer (a) is incorrect. It is included in the scope of internal auditing as stated in the IIA Standards.
Answer (b) is the correct answer. The scope of the internal audit function does not include an assessment of the company’s strategic management process.
Answer (c) is incorrect. It is included in the scope of internal auditing as stated in the IIA Standards.
Answer (d) is incorrect. It is included in the scope of internal auditing as stated in the IIA Standards.
Question: V1C1-0002
An internal auditor is auditing the financial operations of an organization. Which of the following is not specified by
the IIA Standards for inclusion in the scope of the audit?
Answers
A: Reviewing the reliability and integrity of financial information.
B: Reviewing systems established to ensure compliance with appropriate policy, plans, procedures, and other types of authority.
C: Appraising economy, efficiency, and effectiveness of the employment of resources.
D: Reviewing the financial decision-making process.
Answer Explanations
Answer (a) is incorrect. Reviewing the reliability and integrity of financial information is the basic element of the audit.
Answer (b) is incorrect. The Statement includes compliance and there are compliance aspects in financial operations.
Choice (c) is incorrect. The auditor would review the economy, efficiency, and effectiveness of the financial functions.
Answer (d) is the correct answer. This element of the audit is not included in the IIA Standards.
Question: V1C1-0003
The audit committee of an organization has charged the director of internal auditing with bringing the department into full compliance with the IIA Standards. The director’s first task is to develop a charter. Identify the item that should be included in the statement of objectives.
Answers
A: Report all audit findings to the audit committee every quarter.
B: Notify governmental regulatory agencies of unethical busiess practices by organization management.
C: Determine the adequacy and effectiveness of the organization’s systems of internal controls.
D: Submit departmental budget variance reports to management every month.
Answer Explanations
Answer (a) is incorrect. Only significant audit findings should be discussed with the audit committee.
Answer (b) is incorrect. Internal auditors are not required to report deficiencies in regulatory compliance to the appropriate agencies. However, IIA members and Certified Internal Auditors (CIAs) may not knowingly be involved in illegal acts.
Answer (c) is the correct answer. This is a primary function of any internal auditing department.
Answer (d) is incorrect. This is not a primary objective of the internal auditing department. It is a budgetary control that management may require on a periodic basis.
Question: V1C1-0004
A charter is being drafted for a newly formed internal auditing department. Which of the following best describes the appropriate organizational status that should be incorporated into the charter?
Answers
A: The director of internal auditing should report to the chief executive officer but have access to the board
of directors.
B: The director of internal auditing should be a member of the audit committee of the board of directors.
C: The director of internal auditing should be a staff officer reporting to the chief financial officer.
D: The director of internal auditing should report to an administrative vice president.
Answer Explanations
Answer (a) is the correct answer. This arrangement provides for the most operating flexibility and independence.
Answer (b) is incorrect. That would place the director in a position of operational control.
Answer (c) is incorrect. It is not the best choice; it limits influence and independence.
Answer (d) is incorrect. It is not the best choice; it limits influence and independence.
Question: V1C1-0005
If an auditee’s operating standards are vague and thus subject to interpretation, the auditor should
Answers
A: Seek agreement with the auditee as to the standards to be used to measure operating performance.
B: Determine best practices in this area and use them as the standard.
C: Interpret the standards in their strictest sense because standards are otherwise only minimum measures of acceptance.
D: Omit any comments on standards and the auditee’s performance in relationship to those standards, because such an analysis would be meaningless.
Answer Explanations
Answer (a) is the correct answer. This is what is required by the IIA’s Standards.
Answer (b) is incorrect. The auditor should seek to understand the operating standards as they are applied to the organization.
Answer (c) is incorrect. Agreement is necessary.
Answer (d) is incorrect. The auditor should first seek to gain an understanding with the auditee on the appropriate standards.
Question: V1C1-0006
In which of the following situations does the auditor potentially lack objectivity?
Answers
A: An auditor reviews the procedures for a new electronic data interchange (EDI) connection to a major
customer before it is implemented.
B: A former purchasing assistant performs a review of internal controls over purchasing four months after
being transferred to the internal auditing department.
C: An auditor recommends standards of control and performance measures for a contract with a service
organization for the processing of payroll and employee benefits.
D: A payroll accounting employee assists an auditor in verifying the physical inventory of small motors.
Answer Explanations
Answer (a) is incorrect. The IIA Standards says the internal auditor’s objectivity is not adversely affected when the auditor reviews procedures before they are implemented.
Answer (b) is the correct answer. The IIA Standards say that persons transferred to the internal auditing department should not be assigned to audit those activities they previously performed until a reasonable period of time has elapsed.
Answer (c) is incorrect. Standards say the internal auditor’s objectivity is not adversely affected when the auditor recommends standards of control for systems before they are implemented.
Answer (d) is incorrect. Use of staff from other areas to assist the internal auditor does not impair objectivity,
especially when the staff is from outside of the area being audited.
Question: V1C1-0007
Which of the following actions would be a violation of auditor independence?
Answers
A: Continuing on an audit assignment at a division for which the auditor will soon be responsible as the result of a promotion.
B: Reducing the scope of an audit due to budget restrictions.
C: Participating on a task force which recommends standards for control of a new distribution system.
D: Reviewing a purchasing agent’s contract drafts prior to their execution.
Answer Explanations
Answer (a) is the correct answer. The IIA Standards specifies that an auditor who has been promoted to an operating department should not continue on an audit of the new department.
Answer (b) is incorrect. The Standards state that budget restrictions do not constitute a violation of an auditor’s independence.
Answer (c) is incorrect. The Standards state that an auditor may participate on a task force that recommends new systems. However, designing, installing, or operating such systems might impair objectivity.
Answer (d) is incorrect. The Standards state that an auditor may review contracts prior to their execution.
Question: V1C1-0008
Which of the following activities would not be presumed to impair the independence of an internal auditor?
I. Recommending standards of control for a new information system application.
II. Drafting procedures for running a new computer application to ensure that proper controls are installed.
III. Performing reviews of procedures for a new computer application before it is installed.
Answers
A: I only.
B: II only.
C: III only.
D: I and III.
Answer Explanations
Answer (a) is incorrect. It is presumed not to impair independence per the IIA Standards.
Answer (b) is incorrect. This is presumed to impair independence per the Standards.
Answer (c) is incorrect. It is presumed not to impair independence per the IIA Standards.
Answer (d) is the correct answer.
Question: V1C1-0009
Which of the following is not a true statement about the relationship between internal auditors and external auditors?
Answers
A: Appraising the economy
B: There may be periodic meetings between internal and external auditors to discuss matters of mutual interest.
C: There may be an exchange of audit reports and management letters between internal and external auditors.
D: Internal auditors may provide audit programs and work papers to external auditors.
Answer Explanations
Answer (a) is the correct answer. Oversight of external audit work is generally the responsibility of the board.
Answer (b) is incorrect. When internal auditors are assigned to assist in the external audit, they are allowed to share relevant information with the external auditors.
Answer (c) is incorrect. When internal auditors are assigned to assist in the external audit, they are allowed to share relevant information with the external auditors.
Answer (d) is incorrect. If the external auditor plans to rely on the work of an internal auditor, the work must be reviewed and tested. This would require access to both programs and workpapers.
Question: V1C1-0010 A quality assurance program of an internal audit department provides reasonable assurance that audit work conforms to applicable standards. Which of the following activities are designed to provide feedback on the effectiveness of an audit department? I. Proper supervision. II. Proper training. III. Internal reviews. IV. External reviews. Answers A: I, II, and III only. B: II, III, and IV only. C: I, III, and IV only. D: I, II, III, and IV.
Answer Explanations
Answer (a) is incorrect. Proper training is an important component of maintaining a current staff, but does not provide feedback.
Answer (b) is incorrect. Proper training is an important component of maintaining a current staff, but does not provide feedback.
Answer (c) is the correct answer. The purpose of a quality assurance program is to evaluate the operations of the internal audit department. The IIA Standards note that a program should include supervision, internal reviews, and external reviews.
Answer(d) is incorrect. Proper training is an important component of maintaining a current staff, but does not provide feedback.
Question: V1C1-0011
An internal audit team recently completed an audit of the company’s compliance with its lease-versus-purchase policy
concerning company automobiles. The audit report noted that the basis for several decisions to lease rather than
purchase automobiles had not been documented and was not auditable. The report contained a recommendation that
operating management ensure that such lease agreements not be executed without proper documentation of the basis
for the decision to lease rather than buy. The internal auditors are about to perform follow-up work on this audit
report.
The primary purpose for performing a follow-up review is to
Answers
A: Ensure timely consideration of the internal auditors’ recommendations.
B: Ascertain that appropriate action was taken on reported findings.
C: Allow the internal auditors to evaluate the effectiveness of their recommendations.
D: Document what management is doing in response to the audit report and close the audit file in a timely
manner.
Answer Explanations
Answer (a) is incorrect. It is not the best answer. It implies that the auditor’s recommendations, not the findings, are
the most important elements of the report.
Answer (b) is the correct answer. This is what the IIA Standards require.
Answer (c) is incorrect. It is not the best choice. This implies that the auditor’s recommendations, not findings, are
primary.
Answer (d) is incorrect. It implies that processes in the internal auditing activity are primary.
Question: V1C1-0012
An internal audit team recently completed an audit of the company’s compliance with its lease-versus-purchase policy concerning company automobiles. The audit report noted that the basis for several decisions to lease rather than purchase automobiles had not been documented and was not auditable. The report contained a recommendation that operating management ensure that such lease agreements not be executed without proper documentation of the basis for the decision to lease rather than buy. The internal auditors are about to perform follow-up work on this audit report.
Assume that senior management has decided to accept the risk involved in failure to document the basis for leaseversus-purchase decisions involving company automobiles. In such a case, what would be the auditors’ reporting obligation?
Answers
A: The auditors have no further reporting responsibility.
B: Management’s decision and the auditors’ concern should be reported to the company’s board of directors.
C: The auditors should issue a follow-up report to management clearly stating the rationale for the recommendation that the basis for lease-versus-purchase decisions be properly documented.
D: The auditors should inform the external auditor and any responsible regulatory agency that no action has been taken on the finding in question.
Answer Explanations
Answer (a) is the correct answer. When senior management has assumed such risk, reporting to the board is only required for significant findings. There is no indication that the failure to document several decisions is significant enough to report to the board.
This answer is incorrect. Refer to the correct answer explanation.
Answer (c) is incorrect. Senior management has already indicated that it understands and has accepted the related risk.
Answer (d) is incorrect. Reporting to anyone outside the organization is not required or appropriate.
Question: V1C1-0013
Auditors realize that at times corrective action is not taken even when agreed to by the appropriate parties. This
should lead an internal auditor to
Answers
A: Decide the extent of necessary followup work.
B: Allow management to decide when to follow-up, since it is management’s ultimate responsibility.
C: Decide to conduct follow-up work only if management requests the auditor’s assistance.
D: Write a follow-up audit report with all findings and their significance to the operations.
Answer Explanations
Answer (a) is the correct answer. The IIA Standards state that the nature, timing and extent of follow-up should be determined by the director of internal auditing.
Answer (b) is incorrect. The IIA Standards state that follow-up work is not management’s responsibility.
Answer (c) is incorrect. The IIA Standards state that follow-up work is not management’s responsibility.
Answer (d) is incorrect. The auditor has to provide an opinion as to the decision made with regard to lack of action.
Question: V1C1-0014
In publicly held companies, management often requires the internal auditing department’s involvement with quarterly financial statements that are made public and/or used internally. Which one of the following is generally not a reason for such involvement?
Answers
A: Management may be concerned about its reputation in the financial markets.
B: Management may be concerned about potential penalties that could occur if quarterly financial statements that are made public are misstated.
C: The Standards state that internal auditors should be involved with reviewing quarterly financial statements.
D: Management may perceive that having quarterly financial information examined by the internal auditors enhances its value for internal decision making.
Answer Explanations
Answer (a) is incorrect. This is a reason that management desires internal audit involvement.
Answer (b) is incorrect. This is a reason that management desires internal audit involvement.
Answer (c) is the correct answer. This material does not exist in the IIA Standards.
Answer (d) is incorrect. This is a reason that management desires internal audit involvement.
Question: V1C1-0015
During testing of the effectiveness of inventory controls, the auditor makes a note in the working papers that most of the cycle count adjustments for the facility involved transactions of the machining department. The machining department also had generated an extraordinary number of cycle count adjustments in comparison to other departments last year. The auditor should
Answers
A: Interview management and apply other audit techniques to determine whether transaction controls and
procedures within the machining department are adequate.
B: Do no further work because the concern was not identified by the analytical procedures designed in the
audit program.
C: Notify internal audit management that fraud is suspected.
D: Place a note in the working papers to review this matter in detail during the next review.
Answer Explanations
Answer (a) is the correct answer. The Standards call for follow-up when analytical procedures identify unexpected
results.
Answer (b) is incorrect. The audit program is a guide, but it does not restrict the auditor from pursuing information unknown at the time that the program was written.
Answer (c) is incorrect. The facts belie an indication of fraud.
Answer (d) is incorrect. The risk of a material error caused by the machining department’s activity is not addressed by delaying appropriate audit procedures.
Question: V1C1-0016
Developing an audit finding involves comparing the condition to the relevant standard or criterion. Which of the following choices best represents an appropriate standard or criterion to support a finding?
Answers
A: A quality standard operating procedure (number and date) for the department.
B: An internal accounting control principle, cited and copied from a public accounting reference.
C: A sound business practice, based on the internal auditor’s knowledge and experience obtained during many audit assignments within the company.
D: All of the above.
Answer Explanations
Answer (a) is incorrect. Standard operating procedures are an appropriate source.
Answer (b) is incorrect. Textbook references are appropriate authority for standards and criteria.
Answer (c) is incorrect. Sound business practice is valid as a criterion as long as the auditee agrees.
Answer (d) is the correct answer. Provided that the auditee agrees with the standard or criterion, any of the above choices is appropriate.
Question: V1C1-0017
An internal audit director for a large manufacturing company is considering revising the department’s audit charter with respect to the minimum educational and experience qualifications required. The audit director wants to require all staff auditors to possess specialized training in accounting and a professional auditing certification such as the Certified Internal Auditor (CIA) or the Chartered Accountant (CA). One of the disadvantages of imposing this requirement would be
Answers
A: The policy might negatively affect the department’s ability to perform quality examinations of the company’s financial and accounting systems.
B: The policy would not promote the professionalism of the department.
C: The policy would prevent the department from using outside consultants when the department did not have the skills and knowledge required in certain audit situations.
D: The policy could limit the range of activities that could be audited by the department due to the department’s narrow expertise and backgrounds.
Answer Explanations
Answer (a) is incorrect. Auditing departments that hired only CIAs or CAs and individuals possessing accounting degrees would be better equipped to audit certain operations, for example, financial and accounting systems, than others that did not have these minimum standards.
Answer (b) is incorrect. A charter which set minimum professional standards, that is, CIA or CA, for its department’s auditors would promote professionalism.
Answer (c) is incorrect. The impact of this requirement would not affect whether consultants were used. Standard states that when auditors do not possesses adequate knowledge and skills in certain required area consultants should be used.
Answer (d) is the correct answer. The mix of audit skills in an audit staff affects the range of activities that can be audited. Auditing departments that comprise only people trained in accounting probably would be better able to examine financial and accounting systems than engineering systems, for example. As a result, departments should strive for an appropriate balance of experience, training, and ability in order to audit a range of activities within their respective organizations.
Question: V1C1-0018
An organization was in the process of establishing its new internal audit department. The controller had no previous experience with internal auditors. Due to this lack of experience, the controller advised the applicants that they would be reporting to the external auditors. However, the new director of internal audit would have free access to the controller to report anything important. The controller would convey the director’s concerns to the board of directors.
Which of the following is true?
Answers
A: The internal audit department will be independent because the director has direct access to the board of directors.
B: The internal audit department will not be independent because the director reports to the external auditors.
C: The internal audit department will not be independent because the controller has no experience with internal auditors.
D: The internal audit department will not be independent because the company did not specify that the
applicants must be Certified Internal Auditors.
Answer Explanations
Answer (a) is incorrect. The internal audit department will not have direct access to the board of directors. The access is indirect, via the controller. According to the Standards, the “director should have direct communication with the board.”
Answer (b) is the correct answer. According to the IIA’s Standards, “the director of the internal auditing department should be responsible to an individual in the organization with sufficient authority to promote independence.” External auditors are not individuals in the organization.
Answer (c) is incorrect. Whether the controller has experience with internal auditors or not does not affect the audit department’s independence.
Answer (d) is incorrect. Although desirable, the Certified Internal Auditor designation is not mandatory for a person to become an internal auditor. A CIA would, of course, insist on internal audit department independence.
Question: V1C1-0019
During a year-end planning meeting with senior management, the director of internal auditing learns that a recent draft audit report on one of the company’s inventory costing systems had provoked a discussion in the accounting area. The audit report proposed a relatively large adjustment due to an error in the local inventory system. The auditor’s conclusion stated that six other production facilities using the same costing system would require similar inventory adjustments. The total required adjustment for all seven locations represented a material adjustment to the financial statements, according to the chief financial officer (CFO). The CFO questioned the method used by the auditor to calculate the amount of the inventory adjustment and asked the director of internal auditing to delay processing the audit report until all aspects of the finding had been fully considered. The director of internal auditing reports directly to the CFO. The audit committee has not been apprised of this audit because the audit report is still in draft stage
awaiting management comment.
Assuming that there is a meeting later the same day with the audit committee of the board, which of the following is not a responsibility of the director of internal auditing?
Answers
A: Inform the audit committee of senior management’s decisions on all significant audit findings.
B: Highlight significant audit findings and recommendations and report on the approved audit work schedule.
C: Inform the audit committee of the outcome of earlier meetings with the CFO and the options being considered for recording the inventory adjustment.
D: Attempt to resolve the inventory issue before reporting the finding to the audit committee.
Answer Explanations
Answer (a) is incorrect. The Standards prescribe informing the board of management’s decision on significant audit findings.
Answer (b) is incorrect. The Standards prescribe highlighting significant audit findings and recommendations and reporting on the approved audit work schedule.
Answer (c) is the correct answer. There is no provision for the discussion of the meeting or the related options for handling the necessary transaction in the Standards.
Answer (d) is incorrect. The auditor does not yet know if this is actually a problem that can adversely affect the organization.
Question: V1C1-0020
During a year-end planning meeting with senior management, the director of internal auditing learns that a recent draft
audit report on one of the company’s inventory costing systems had provoked a discussion in the accounting area. The
audit report proposed a relatively large adjustment due to an error in the local inventory system. The auditor’s
conclusion stated that six other production facilities using the same costing system would require similar inventory
adjustments. The total required adjustment for all seven locations represented a material adjustment to the financial
statements, according to the chief financial officer (CFO). The CFO questioned the method used by the auditor to
calculate the amount of the inventory adjustment and asked the director of internal auditing to delay processing the
audit report until all aspects of the finding had been fully considered. The director of internal auditing reports directly
to the CFO. The audit committee has not been apprised of this audit because the audit report is still in draft stage
awaiting management comment.
A: Schedule audits to review the inventory costing systems at all locations after year-end.
B: Recall all copies of the draft audit report sent out for management review and response.
C: Tell the representatives of senior management that distorting financial reports is not acceptable.
D: Offer to review the basis for the conclusion about the inventory valuation at all locations.
Answer Explanations
Answer (a) is incorrect. Reviews after year-end will not address the current year’s financial reporting integrity.
Answer (b) is incorrect. The director of internal auditing cannot do this and maintain independence.
Answer (c) is incorrect. Reviews after year-end will not address the current year’s financial reporting integrity.
Answer (d) is the correct answer. Because the case indicates that the amount of the inventory adjustment is in question, this would be the appropriate step for the audit director to take.
Question: V1C1-0021
An inexperienced internal auditor notified the senior auditor of a significant variance from the auditee’s budget. The senior told the new auditor not to worry as the senior had heard that there had been an unauthorized work stoppage that probably accounted for the difference. Which of the following statements is most appropriate?
Answers
A: The new auditor should have investigated the matter fully and not bothered the senior.
B: The senior used proper judgment in curtailing what could have been a wasteful investigation.
C: The senior should have halted the audit until the variance was fully explained.
D: The senior should have aided the new auditor in formulating a plan for accumulating appropriate evidence.
Answer Explanations
Answer (a) is incorrect. The Standards provide that the extent of supervision should vary with the proficiency of the auditor. It is not inappropriate for an inexperienced auditor to refer this to the senior.
Answer (b) is incorrect. The Standards provide that the extent of supervision should vary with the proficiency of the auditor. It is not inappropriate for an inexperienced auditor to refer this to the senior.
Answer (c) is incorrect. The variance does need explanation and the rest of the audit can continue.
Answer (d) is the correct answer. The IIA Standards provide that unexpected results from applying analytical auditing procedures should be investigated since unexplained results could indicates a potential error or irregularity. The variance was not adequately investigated or explained.
Question: V1C1-0022
The IIA Standards state that internal auditors are “responsible for continuing their education in order to maintain their proficiency.” Which of the following is correct regarding the continuing education requirements of the practicinginternal auditor?
Answers
A: Internal auditors are required to obtain 40 hours of continuing professional development each year and a
minimum of 120 hours over a three-year period.
B: CIAs have formal requirements that must be met in order to continue as a CIA.
C: Attendance, as an officer or committee member, at formal Institute of Internal Auditors meetings does not
meet the criteria of continuing professional development.
D: In-house programs meet continuing professional development requirements only if they have been
preapproved by the Institute of Internal Auditors.
Answer Explanations
Answer (a) is incorrect. There are no formal “hours” requirements for internal auditors contained in the Standards. The
intent of the Standards is to ensure that internal auditors maintain their technical competence.
Answer (b) is the correct answer. In order to maintain the CIA designation, the CIA must commit to a formal program
of continuing professional development (CPD) and report to the Certification Department of the IIA.
Answer (c) is incorrect. Attendance at professional meetings does meet the criteria of continuing education.
Answer (d) is incorrect. Prior approval by the IIA is not necessary for CPD courses.
Question: V1C1-0023
A significant part of the auditor’s working papers will be the conclusions reached by the auditor regarding the audit area. In some situations, the supervisor might not agree with the conclusions and will ask the staff auditor to perform more work. Assume that after subsequent work is performed, the staff auditor and the supervisor continue to disagree on the conclusions documented in the working paper developed by the staff auditor. Which of the following audit department responses would not be appropriate?
Answers
A: Both the staff auditor and the supervisor document their reasons for reaching different conclusions. Retain the rationale of both parties in the working papers.
B: Note the disagreement and retain the notice of disagreement and follow-up work in the audit working papers.
C: Present both conclusions to the director of internal auditing for resolution. The director may resolve the matter.
D: Present both conclusions in the audit report and let management and the auditee react to both.
Answer Explanations
Answer (a) is incorrect. It would be an appropriate response.
Answer (b) is incorrect. It would be an appropriate response.
Answer (c) is incorrect. This is an appropriate response since the director of internal auditing is ultimately responsiblefor the supervision of the audit staff as well as the quality of the working papers.
Answer (d) is the correct answer. This would not be an appropriate response. The director of internal auditing should determine the most reasonable conclusion and present that to the auditee and management. The issue of disagreements on the working papers should not necessarily affect the reporting to management unless the director of internal auditing believes that both conclusions are equally appropriate and it would enhance management’s understanding to be presented with both.
Question: V1C1-0024
The IIA Standards specify that supervision of the work of internal auditors be “carried out continuously.” Which of the following statements regarding supervision is correct?
I. “Continuously” indicates that supervision should be performed throughout the planning, examination, evaluation, report, and follow-up stages of the audit.
II. Supervision should also be extended to training, time reporting, and expense control, as well as similar administrative matters.
III. The extent and nature of supervision needs to be documented, preferably in the appropriate working papers.
Answers
A: I only.
B: I and III only.
C: II only.
D: I, II, and III.
Answer Explanations
Answer (a) is incorrect. It is a partial answer.
Answer (b) is incorrect. It is a partial answer.
Answer (c) is incorrect. It is a partial answer.
Answer (d) is the correct answer. All of the statements are correct according to the IIA Standards.
Question: V1C1-0025
It would be appropriate for internal auditing departments to use consultants with expertise in health care benefits when
the internal auditing department is
Answers
A: Conducting an audit of the organization’s estimate of its liability for postretirement benefits, which
include health care benefits.
B: Comparing the cost of the organization’s health care program with other programs offered in the industry.
C: Training its staff to conduct an audit of health care costs in a major division of the organization.
D: All of the above.
Answer Explanations
Answer (a) is incorrect. This would be an appropriate use of such experts according to the Standards. It also describes appropriate uses of consultants
Answer (b) is incorrect. This is an example of an operational audit and would be an appropriate use of such experts according to the Standards. It also describes appropriate uses of consultants.
Answer (c) is incorrect. This would be an appropriate example of training. It also describes appropriate uses of consultants.
Answer (d) is the correct answer. All of the above items are appropriate uses of consultants.
Question: V1C1-0026
An auditor has uncovered facts that could be interpreted as indicating unlawful activity on the part of an auditee. The auditor decides not to inform senior management of these facts since he cannot prove that an irregularity occurred. The auditor, however, decides that if questions are raised regarding the omitted facts, they will be answered fully and truthfully. In taking this action, the auditor
Answers
A: Has not violated the Code of Ethics or the Standards because confidentiality takes precedence over all other standards.
B: Has not violated the Code of Ethics or the Standards because the auditor is committed to answering all questions fully and truthfully.
C: Has violated the Code of Ethics because unlawful acts should have been reported to the appropriate regulatory agency to avoid potential “aiding and abetting” by the auditor.
D: Has violated the Standards because the auditor should inform the appropriate authorities in the organization if fraud may be indicated.
Answer Explanations
Answer (a) is incorrect. The action does violate the Code of Ethics.
Answer (b) is incorrect. The action does violate the Code of Ethics.
Answer (c) is incorrect. The action does violate the Code of Ethics, but the auditor should report the unlawful activities to the appropriate personnel within the organization, not to a regulatory agency.
Answer (d) is the correct answer. The IIA Standards indicate that the auditor should inform the appropriate authorities in the organization if there are sufficient indicators of the commission of a fraud.
Question: V1C1-0027
A new staff auditor was told to perform an audit in an area with which the auditor was not familiar. Because of time constraints, there was no supervision of the audit. The auditor was given the assignment because it represented a good learning experience, but the area was clearly beyond the auditor’s competence. Nonetheless, the auditor prepared comprehensive working papers and reported the results to management. In this situation
Answers
A: The audit department violated the IIA Standards by hiring an auditor without proficiency in the area.
B: The audit department violated the IIA Standards by not providing adequate supervision.
C: The director of internal auditing has not violated the Code of Ethics since the code does not address supervision.
D: The IIA’s Standards and the Code of Ethics were followed by the audit department.
Answer Explanations
Answer (a) is incorrect. The Standards do not require all auditors to be proficient in all areas. The department should have an appropriate mix of skills.
Answer (b) is the correct answer. The IIA Standards require the director to ensure that audit work conforms to the Standards. The Standards require the department to provide adequate supervision depending on the proficiency of the auditor.
Answer (c) is incorrect. Although the Code does not address supervision directly, it does require the director to follow the Standards.
This answer is incorrect. Refer to the correct answer explanation.
Question: V1C1-0028
Management has requested the internal auditing department to perform an operational audit of the telephone marketing operations of a major division and to recommend procedures and policies for improving management control over the operation. The auditor should
Answers
A: Not accept the engagement because recommending controls would impair future objectivity of the department regarding this auditee.
B: Not accept the engagement because audit departments are presumed to have expertise on accounting controls, not marketing controls.
C: Accept the engagement, but indicate to management that recommending controls would impair audit independence so management knows that future audits of the area would be impaired.
D: Accept the audit engagement because independence would not be impaired.
Answer Explanations
Answer (a) is incorrect. The auditor should accept the engagement. Recommending controls is not considered a violation of the auditor’s independence or objectivity.
Answer (b) is incorrect. The auditor should accept the engagement. Auditors should have control knowledge that is not limited to accounting controls.
Answer (c) is incorrect. The audit is not impaired by making control recommendations.
Answer (d) is the correct answer. The auditor should accept the engagement, assign staff with sufficient control knowledge, and make recommendations where appropriate. This would not impair objectivity.
Question: V1C1-0029
A new staff auditor has been assigned to an audit of the cash management operations of the organization. The staff auditor has no background in cash management, and this is the auditor’s first audit. Under which of the following conditions would the internal auditing department be in compliance with the Standards regarding knowledge and skills?
Answers
A: The senior auditor is skilled in the area and closely supervises the staff auditor.
B: The staff auditor performs the work and prepares a report that is reviewed in detail by the director of audit.
C: Both a. and b.
D: Neither a. nor b.
Answer Explanations
Answer (a) is the correct answer. The internal audit department would, in composite, have the requisite skills to perform the audit. The other key element is that the staff auditor is carefully supervised such that significant deviations from good business practices would be noted.
Answer (b) is incorrect. The audit would not be conducted in accordance with the Standards because the staff auditor might not have noted significant deviations to include in the audit report. The review by the director at the time the report is generated would be too late.
Answer (c) is incorrect. Response (b) would not meet the Standards.
Answer (d) is incorrect. Response (a) would be consistent with the Standards.
Question: V1C1-0030
Communication skills are important to internal auditors. According to the Standards, the auditor should be able to effectively convey all of the following to the auditee except:
Answers
A: The audit objectives designed for a specific auditable entity.
B: The audit evaluations based on a preliminary survey of an auditable entity.
C: The risk assessment used in selecting the area for audit investigation.
D: Recommendations that are generated in relationship to a specific auditable entity.
Answer Explanations
Answer (a) is incorrect. Auditors should be proficient in communicating audit objectives.
Answer (b) is incorrect. Auditors should be proficient in communicating audit evaluations.
Answer (c) is the correct answer. The risk assessment process is not normally communicated to the auditee.
Answer (d) is incorrect. Auditors should be proficient in communicating audit recommendations.
Question: V1C1-0031
Internal auditing is unique in that its scope often encompasses all areas of an organization. Thus, it is not possible for each internal auditor to possess detailed competence in all areas that might be audited. Which of the following competencies is required by the IIA Standards for every internal auditor?
Answers
A: Taxation and law as it applies to operation of the organization.
B: Proficiency in accounting principles.
C: Understanding of management principles.
D: Proficiency in computer systems and databases.
Answer Explanations
Answer (a) is incorrect. Such skills should be included within the staff, but not required for each auditor.
Answer (b) is incorrect. Detailed knowledge of accounting is required only for those auditors who work extensively with financial records and reports.
Answer (c) is the correct answer. An understanding of management principles is required of all internal auditors.
Answer (d) is incorrect. An appreciation of computerized information systems is required, but this is less expertise than is needed for proficiency.
Question: V1C1-0032
The IIA Standards would not require the director of internal auditing to
Answers
A: Contribute resources for the annual audit of financial statements.
B: Coordinate audit work with that of the external auditors.
C: Communicate to senior management and the board the results of evaluations of the coordination between internal and external auditors.
D: Communicate to senior management and the board the results of evaluations of the performance of external auditors.
Answer Explanations
Answer (a) is the correct answer. According to the IIA Standards, “The director may agree to perform work…in connection with (the) annual audit….”
Answer (b) is incorrect. According to the IIA Standards, “Actual coordination [of audit efforts] should be the responsibility of the director of internal auditing.”
Answer (c) is incorrect. According to the IIA Standards, “The director of internal auditing should communicate to senior management and the board the results of evaluations of coordination with external auditors.”
Answer (d) is incorrect. According to the IIA Standards, “The director should communicate to senior management and the board…any relevant comments about the performance of external auditors.”
Question: V1C1-0033
Follow-up activity may be required to ensure that corrective action has taken place for certain findings. The internal
audit department’s responsibility to perform follow-up activities as required should be defined in the
Answers
A: Internal auditing department’s written charter.
B: Mission statement of the audit committee.
C: Engagement memo issued prior to each audit assignment.
D: Purpose statement within applicable audit reports.
Answer Explanations
Answer (a) is the correct answer. Responsibility for follow-up should be defined in the internal auditing department’s written charter.
Answer (b) is incorrect. Follow-up is not specified in the content of the audit committee’s mission statement.
Answer (c) is incorrect. This memo may contain a statement about responsibility for follow-up, but such a statement should be based on the wording and authority of the departmental charter.
Answer (d) is incorrect. Follow-up authority and responsibility may be cited in applicable audit reports, but the definition should be first contained in the departmental charter.
Question: V1C1-0034
As a particular audit is being planned in a high-risk area, the director of internal auditing determines that the available staff does not have the requisite skills to perform the assignment. The best course of action consistent with audit planning standards would be to
Answers
A: Not perform the audit, since the requisite skills are not available.
B: Use the audit as a training opportunity and let the auditors learn as the audit is performed.
C: Consider using external resources to supplement the needed knowledge, skills, and disciplines and complete the assignment.
D: Perform the audit but limit the scope in light of the skill deficiency.
Answer Explanations
Answer (a) is incorrect. The director is responsible for staffing each assignment as needed to meet the audit responsibilities
Answer (b) is incorrect. Training is to be properly supervised, and the department does not have anyone with knowledge in this area to provide supervision.
Answer (c) is the correct answer. Proper planning includes documented determination of resources including consideration of supplementation.
Answer (d) is incorrect because it is not the best course of action. If the requisite skills are not accessible through supplementation, this might be necessary, but the resource constraint should be communicated to management in an interim report.
Question: V1C1-0035
According to the IIA Standards, internal auditors must be objective in performing audits. Assume that the internal audit director received an annual bonus as part of that individual’s compensation package. The bonus may impair the audit director’s objectivity if
Answers
A: The bonus is administered by the board of directors or its salary administration committee.
B: The bonus is based on dollar recoveries or recommended future savings as a result of audits.
C: The scope of internal auditing work is reviewing control rather than account balances.
D: All of the above.
Answer Explanations
Answer (a) is incorrect. According to the IIA Standards, objectivity is not impaired if the bonus is administered by the board of directors or its salary administration committee. Use of a board compensation committee would be an environmental factor, which would enhance the director’s independence and objectivity.
Answer (b) is the correct answer. According to the IIA Standards, objectivity may be impaired if the bonus is based on dollar recoveries or recommended future savings as a result of audits. A bonus based on either of these criteria could unduly influence the type of audits performed or the recommendations made.
Answer (c) is incorrect. According to the IIA Standards, objectivity is not impaired if the scope of internal auditing work is reviewing control rather than account balances. Compensation packages are often tied to financial results. If the scope of work was reviewing account balances, the director might be unduly influenced to report results, which would be favorable to his bonus. In contrast, there would be less inducement if the scope of work were limited to reviewing controls.
Answer (d) is incorrect since only one answer is correct.
Question: V1C1-0036
A company is planning to develop and implement a new computerized purchase order system in one of its manufacturing subsidiaries. The vice president of manufacturing has requested that internal auditors participate on a team consisting of representatives from finance, manufacturing, purchasing, and marketing. This team will be responsible for the implementation effort. Eager to take on this high-profile project, the Director of Auditing assigns a senior auditor to the project to assist “as needed.” Assuming the senior auditor performed all of the following activities, which one of the following would impair objectivity if asked to review the purchase order system on a postaudit basis?
Answers
A: Helping to identify and define control objectives.
B: Testing for compliance with system development standards.
C: Reviewing the adequacy of systems and programming standards.
D: Drafting operating procedures for the new system.
Answer Explanations
Answer (a) is incorrect. According to the IIA Standards, an internal auditor’s objectivity would not be impaired when performing such tasks as helping to identify and define control objectives. Identifying and defining control objectives are necessary parts of any audit. The auditor’s familiarity with the process of documenting systems and integrating recommendations into systems of control would be helpful to management in developing new systems. As long as the auditor’s involvement did not cross over in operating areas, which are the responsibility of management, the auditor’s objectivity would not be compromised.
Answer (b) is incorrect. According to the IIA Standards, testing for compliance with system development standards would be a standard procedure for any system under development. Participation in this area would not place the auditor in an operating capacity. Consequently, this would not impair the auditor’s objectivity.
Answer (c) is incorrect. According to the IIA Standards, reviewing the adequacy of systems and programming standards would be standard procedures in performing a review of systems under development. Participation in this area would not place the auditor in an operating capacity. Consequently, this would not impair the auditor’s objectivity.
Answer (d) is the correct answer. According to the IIA Standards, “the internal auditor’s objectivity is not impaired when the auditor recommends standards of control for systems or reviews procedures before they are implemented. Designing, installing, and operating systems are not audit functions. Also, the drafting of procedures for systems is not an audit function. Performing such activities is presumed to impair audit objectivity.” Internal auditors are not independent if they cannot do their work objectively.
Question: V1C1-0037
An internal audit department is currently undergoing its first external quality assurance review since its formation three years ago. From interviews with a few of the staff auditors, the review team is informed of certain auditor activities that occurred over the past year. Which of the following activities could affect the quality assurance review team’s evaluation of the objectivity of the internal audit department?
Answers
A: One internal auditor told the review team that, during the payroll audit, the payroll manager approached him. The manager indicated he was looking for an accountant to prepare his financial statements for his parttime business. The internal auditor agreed to perform this work for a reduced fee during nonwork hours.
B: During the audit of the company’s construction of a building addition to the corporate office, the vicepresident of facilities management gave the auditor a commemorative mug with the company’s logo. These mugs were distributed to all employees present at the groundbreaking ceremony.
C: After reviewing the installation of a data processing system, the auditor made recommendations on standards of control. Three months after completing the audit, the auditee requested the auditor’s review of certain procedures for adequacy. The auditor agreed and performed this review.
D: An auditor’s participation was requested on a task force to reduce the company’s inventory losses from theft and shrinkage. This is the first consulting assignment undertaken by the audit department. The auditor’s role is to advise the task force on appropriate control techniques.
Answer Explanations
Answer (a) is the correct answer. According to the IIA Standards, internal auditors should be independent of the activities they audit. Accepting a fee or gift from an auditee would impair the auditor’s objectivity. As a result, the auditor might feel obligated to render a more favorable result than would be warranted if the auditor maintained professional objectivity.
Answer (b) is incorrect. According to the IIA Standards, the receipt of promotional items, such as pens, calendars, or samples available to the general public that have minimal value, would not impair the auditor’s objectivity. Under these circumstances, it is unlikely that the receipt of these items would unduly influence the auditor to render a more favorable opinion than warranted under the circumstances.
Answer (c) is incorrect. According to the IIA Standards, reviewing the installation of a data processing system would not impair the auditor’s objectivity. Reviewing and documenting systems are necessary parts of auditing a system under development. As long as the auditor did not assume any operating responsibilities, for example, documenting operating procedures, the auditor’s objectivity would not be compromised.
Answer (d) is incorrect. According to the IIA Standards, participation in a task force and advising on control techniques would not impair the auditor’s objectivity. As long as the auditor refrained from performing operating functions such as designing or installing operating systems or drafting detailed control procedures, the auditor’s objectivity would not be compromised.
Question: V1C1-0038
A medium-size publicly owned corporation operating in Country X has grown to a size that the directors of the corporation believe warrants the establishment of an internal auditing department. Country X has legislated internal auditing requirements for government-owned companies. The company changed the corporate bylaws to reflect the establishment of the internal auditing department. The directors decided that the director of internal auditing must be a Certified Internal Auditor and will report directly to the newly established audit committee of the board of directors.
Which of the items discussed above will contribute the most to the new audit director’s independence?
Answers
A: The establishment of the internal auditing department is documented in corporate bylaws.
B: Legislated internal auditing requirements in Country X.
C: The fact that the director will report to the audit committee of the board of directors.
D: The fact that the director is to be a Certified Internal Auditor.
Answer Explanations
Answer (a) is incorrect. The IIA Standards state “It [independence] is achieved through organizational status and objectivity,” which is more directly related to the reporting level of the director.
Answer (b) is incorrect. The IIA Standards state “It [independence] is achieved through organizational status and objectivity.” Independence is not ensured by regulations.
Answer (c) is the correct answer. The IIA Standards state “It [independence] is achieved through organizational status and objectivity.” The auditor is reporting to the highest level possible.
Answer (d) is incorrect. The IIA Standards state “It [independence] is achieved through organizational status and objectivity.” A CIA designation will ensure a better auditor, but does not guarantee independence.
Question: V1C1-0039
An internal auditor reports directly to the board of directors. The auditor discovered a material cash shortage. When questioned, the person responsible explained that the cash was used to cover sizable medical expenses for a child and agreed to replace the funds. Because of the corrective action, the internal auditor did not inform management. In this instance, the auditor
Answers
A: Has organizational independence but not objectivity.
B: Has both organizational independence and objectivity.
C: Does not have organizational independence but has objectivity.
D: Does not have either organizational independence or objectivity.
Answer Explanations
Answer (a) is the correct answer. Because the auditor reports directly to the board of directors, he has organizational independence.
Answer (b) is incorrect. Because the auditor reports directly to the board of directors, he has independence and therefore objectivity.
Answer (c) is incorrect. The auditor has objectivity because he reports directly to the board of directors. He is, however, not exercising objectivity because he is trying to avoid conflict.
Answer (d) is incorrect. The auditor has organizational independence because he reports directly to the board of directors (the highest level in the organization). The auditor has not exercised his independence because, although he can render any opinion he wants, he has lost his objectivity by adjusting his opinion.
Question: V1C1-0040
During a purchasing audit, the internal auditor finds that the largest blanket purchase order is for tires, which are expensed as vehicle maintenance items. The fleet manager requisitions tires against the blanket order for the company’s 400-vehicle service fleet based on a visual inspection of the cars and trucks in the parking lot each week. Sometimes the fleet manager picks up the tires, but she always signs the receiving report for payment. Vehicle service data are entered into a maintenance database by the mechanic after the tires are installed. Which would be the best course of action for the auditor in these circumstances?
Answers
A: Determine whether the number of tires purchased can be reconciled to maintenance records.
B: Count the number of tires on hand and trace them to the related receiving reports.
C: Select a judgmental sample of requisitions and verify that the fleet manager signs each one.
D: Compare the number of tires purchased under the blanket purchase order with the number of tires purchased in the prior year for reasonableness.
Answer Explanations
Answer (a) is the correct answer. Based on the control weakness and the potential for fraud, the auditor should look for other indicators of fraud or verify that no fraud has occurred.
Answer (b) is incorrect. Tracing the tires on hand to the receiving reports would not reveal a fraud since manager signs the receiving report.
Answer (c) is incorrect. Testing for signed requisitions would not necessarily reveal whether fraud is present. The manager is the signor.
Answer (d) is incorrect. While the comparison may provide useful information, it would be less conclusive than Choice (a). If a fraud existed, it could have occurred last year also. The need for tires may vary.
Question: V1C1-0042
Several members of senior management have questioned whether the internal audit department should report to the newly established quality audit function as part of the total quality management process within the company. The director of internal auditing has reviewed the quality standards and the programs that the quality audit manager have proposed. The director’s response to senior management should include
Answers
A: Changing the applicable standards for internal auditing within the company to provide compliance with quality audit standards.
B: Changing the qualification requirements for new staff members to include quality audit experience.
C: Estimating departmental cost savings from eliminating the internal auditing function.
D: Identifying appropriate liaison activities with the quality audit function to ensure coordination of audit schedules and overall audit responsibilities.
Answer Explanations
Answer (a) is incorrect. Adopting the full set of quality auditing standards for the internal auditing function would duplicate functions within the organization.
Answer (b) is incorrect. The issue is the reporting relationship of internal auditing, not the qualifications of audit staff.
Answer (c) is incorrect. Sufficient information in not given to conclude that the internal audit function should be eliminated.
Answer (d) is the correct answer. Coordination of audit efforts and the efficiency of audit activities should be primary responsibilities of the director of internal auditing.
Question: V1C1-0041
Auditors need to determine if management has established criteria to determine if goals and objectives have been accomplished. If the auditor determines such criteria are inadequate or nonexistent, which of the following actions would be appropriate?
I. Report the inadequacies to the appropriate level of management and recommend appropriate courses of action.
II. Recommend alternative sources of criteria to management such as acceptable industry standards.
III. Formulate criteria the auditor believes to be adequate and perform the audit and report in relationship to the alternative criteria.
Answers
A: I only.
B: I and II only.
C: I, II, and III.
D: II only.
Answer Explanations
This answer is incorrect. Refer to the correct answer explanation.
This answer is incorrect. Refer to the correct answer explanation.
Answer (c) is the correct answer. All three responses would be appropriate according to the IIA Standards.
This answer is incorrect. Refer to the correct answer explanation.
Question: V1C1-0043
Internal auditors are often called on either to perform or to assist the external auditor in performing a due diligence review. A due diligence review is
Answers
A: A review of interim financial statements as directed by an underwriting firm.
B: An operational audit of a division of a company to determine if divisional management is complying with laws and regulations.
C: A review of operations as requested by the audit committee to determine whether the operations comply with audit committee and organizational policies.
D: A review of financial statements and related disclosures in conjunction with a potential acquisition.
Answer Explanations
Answer (a) is incorrect. Although the underwriter may use the reviews, the underwriter does not direct them.
Answer (b) is incorrect. The due diligence review is not an operational audit.
Answer (c) is incorrect. It is not a review for compliance with company policies.
Answer (d) is the correct answer. This is a broad definition of due diligence reviews per the IIA’s Standards.
Question: V1C1-0044
The director of internal auditing of a midsize internal auditing organization was concerned that management might outsource the internal auditing function. Therefore, the manager adopted a very aggressive program to promote the internal auditing department within the organization. The manager planned to present the results to management and the audit committee and recommend modification of the Internal Audit Charter after using the new program. The following lists six actions the audit manager took to promote a positive image within the organization:
1. Audit assignments concentrated on economy and efficiency audits. The audits focused solely on cost savings, and each audit report highlighted potential costs to be saved. Negative findings were omitted. The focus on economy and efficiency audits was new, but the auditees seemed very happy.
2. Drafts of all audit reports were carefully reviewed with the auditee to get their input. Their comments were carefully considered when developing the final audit report.
3. The information technology auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development.
4. Given limited resources, the audit manager performed a risk analysis to determine which locations to audit.
This was a marked departure from the previous approach of ensuring that all operations are reviewed at least every three years.
5. In order to save time, the manager no longer required that a standard internal control questionnaire be completed for each audit.
6. When the auditors found that management and the auditee had not developed specific criteria or data to evaluate the operations of the auditee, the audit team was instructed to perform research, develop specific criteria, review the criteria with the auditee, and, if acceptable, use that criteria to evaluate the auditee’s operations. If the auditee disagreed with the criteria, a negotiation took place until acceptable criteria could be agreed on. The audit report commented on the auditee’s operations in conjunction with the agreed-on criteria. Which of the following elements of Action 1 taken by the audit manager would be considered a violation of the IIA Standards?
I. The type of audits was changed before modifying the charter and going to the audit committee.
II. Negative findings were omitted from the audit reports.
III. Cost savings and recommendations were highlighted in the report.
Answers
A: I and II.
B: I and III.
C: I only.
D: II and III.
Answer Explanations
Answer (a) is the correct answer. The audit manager dramatically changed the nature of the audit function without consulting with the audit committee, management, or the audit department charter. A second violation is the omission of negative findings.
Answer (b) is incorrect. Highlighting potential cost savings is appropriate for an audit report.
Answer (c) is incorrect. Item II is also a violation.
Answer (d) is incorrect. Highlighting cost savings is appropriate.
Question: V1C1-0045
The director of internal auditing of a midsize internal auditing organization was concerned that management might outsource the internal auditing function. Therefore, the manager adopted a very aggressive program to promote the internal auditing department within the organization. The manager planned to present the results to management and the audit committee and recommend modification of the Internal Audit Charter after using the new program. The following lists six actions the audit manager took to promote a positive image within the organization:
1. Audit assignments concentrated on economy and efficiency audits. The audits focused solely on cost savings, and each audit report highlighted potential costs to be saved. Negative findings were omitted. The focus on economy and efficiency audits was new, but the auditees seemed very happy.
2. Drafts of all audit reports were carefully reviewed with the auditee to get their input. Their comments were carefully considered when developing the final audit report.
3. The information technology auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development.
4. Given limited resources, the audit manager performed a risk analysis to determine which locations to audit.
This was a marked departure from the previous approach of ensuring that all operations are reviewed at least every three years.
5. In order to save time, the manager no longer required that a standard internal control questionnaire be completed for each audit.
6. When the auditors found that management and the auditee had not developed specific criteria or data to evaluate the operations of the auditee, the audit team was instructed to perform research, develop specific criteria, review the criteria with the auditee, and, if acceptable, use that criteria to evaluate the auditee’s operations. If the auditee disagreed with the criteria, a negotiation took place until acceptable criteria could be agreed on. The audit report commented on the auditee’s operations in conjunction with the agreed-on criteria. Considering Actions 2, 3, and 4 that were taken, which would be considered a violation of the IIA Standards?
Answers
A: Actions 2, 3, and 4.
B: Action 4 only.
C: Action 2 and 3 only.
D: None of the actions.
Answer Explanations
This answer is incorrect. Refer to the correct answer explanation.
This answer is incorrect. Refer to the correct answer explanation.
This answer is incorrect. Refer to the correct answer explanation.
Answer (d) is the correct answer. None of the actions constitutes a violation of the Standards. Action 2 is consistent with the IIA’s Standards. Action 3 is consistent with the IIA’s Standards. Action 4 is consistent with the IIA’s Standards on planning the audit. Auditors are not required to review all operations, unless mandated by law, within a specific time frame.
Question: V1C1-0046
The director of internal auditing of a midsize internal auditing organization was concerned that management might outsource the internal auditing function. Therefore, the manager adopted a very aggressive program to promote the internal auditing department within the organization. The manager planned to present the results to management and the audit committee and recommend modification of the Internal Audit Charter after using the new program. The following lists six actions the audit manager took to promote a positive image within the organization:
1. Audit assignments concentrated on economy and efficiency audits. The audits focused solely on cost savings, and each audit report highlighted potential costs to be saved. Negative findings were omitted. The focus on economy and efficiency audits was new, but the auditees seemed very happy.
2. Drafts of all audit reports were carefully reviewed with the auditee to get their input. Their comments were carefully considered when developing the final audit report.
3. The information technology auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development.
4. Given limited resources, the audit manager performed a risk analysis to determine which locations to audit.
This was a marked departure from the previous approach of ensuring that all operations are reviewed at least every three years.
5. In order to save time, the manager no longer required that a standard internal control questionnaire be completed for each audit.
6. When the auditors found that management and the auditee had not developed specific criteria or data to evaluate the operations of the auditee, the audit team was instructed to perform research, develop specific criteria, review the criteria with the auditee, and, if acceptable, use that criteria to evaluate the auditee’s operations. If the auditee disagreed with the criteria, a negotiation took place until acceptable criteria could be agreed on. The audit report commented on the auditee’s operations in conjunction with the agreed-on criteria.
Is Action 5 a violation of the IIA Standards?
Answers
A: Yes. Internal control should be evaluated on every audit, but the internal control questionnaire is not the mandated approach to evaluate the controls.
B: No. Auditors may omit necessary procedures if there is a time constraint. It is a matter of audit judgment.
C: Yes. Internal control should be evaluated on every audit engagement, and the internal control questionnaire is the most efficient method to do so.
D: No. Auditors are not required to fill out internal control questionnaires on every audit.
Answer Explanations
Answer (a) is incorrect. Internal control evaluations are not required on every audit.
Answer (b) is incorrect. Auditors cannot omit necessary procedures because of a time constraint.
Answer (c) is incorrect. It is not a violation of the Standards.
Answer (d) is the correct answer. Auditors are not required to perform control evaluations and are certainly not required to fill out standard internal control questionnaires.
Question: V1C1-0047
The director of internal auditing of a midsize internal auditing organization was concerned that management might outsource the internal auditing function. Therefore, the manager adopted a very aggressive program to promote the internal auditing department within the organization. The manager planned to present the results to management and the audit committee and recommend modification of the Internal Audit Charter after using the new program. The following lists six actions the audit manager took to promote a positive image within the organization:
1. Audit assignments concentrated on economy and efficiency audits. The audits focused solely on cost savings, and each audit report highlighted potential costs to be saved. Negative findings were omitted. The focus on economy and efficiency audits was new, but the auditees seemed very happy.
2. Drafts of all audit reports were carefully reviewed with the auditee to get their input. Their comments were carefully considered when developing the final audit report.
3. The information technology auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development.
4. Given limited resources, the audit manager performed a risk analysis to determine which locations to audit.
This was a marked departure from the previous approach of ensuring that all operations are reviewed at least every three years.
5. In order to save time, the manager no longer required that a standard internal control questionnaire be completed for each audit.
6. When the auditors found that management and the auditee had not developed specific criteria or data to evaluate the operations of the auditee, the audit team was instructed to perform research, develop specific criteria, review the criteria with the auditee, and, if acceptable, use that criteria to evaluate the auditee’s operations. If the auditee disagreed with the criteria, a negotiation took place until acceptable criteria could be agreed on. The audit report commented on the auditee’s operations in conjunction with the agreed-on criteria.
Regarding Action 6, which of the following elements of the action would be considered a violation of the IIA Standards?
Answers
A: Failing to report the lack of criteria to appropriate level of management.
B: Developing a set of criteria to present to the auditee as a basis for evaluating the auditee’s operations.
C: Commenting on the agreed-on criteria.
D: All of the above.
Answer Explanations
Answer (a) is the correct answer. This is a violation of the Standards, which require that the lack of established criteria should be reported to the appropriate levels of management. This would normally be one level above the auditee. The negotiated formulation of the criteria may result in the correct criteria, but it should be discussed with, and communicated to, the appropriate level of management.
Answer (b) is incorrect because, according to the Standards, auditors may formulate criteria they believe is adequate.
Answer (c) is incorrect. Auditors should comment on the quality of operations in comparison with suitable criteria. The problem in this situation was the manner in which the criteria were formulated.
Answer (d) is incorrect because of the responses given for answers (a), (b), and (c).
Question: V1C1-0048
Given the acceptance of the cost savings audits and the scarcity of internal audit resources, the audit manager also decided that follow-up action was not needed. The manager reasoned that cost savings should be sufficient to motivate the auditee to implement the auditor’s recommendations. Therefore, follow-up was not scheduled as a regular part of the audit plan. Does the audit manager’s decision violate the Standards?
Answers
A: No. The Standards do not specify whether follow-up is needed.
B: Yes. The Standards require the auditors to determine whether the auditee has appropriately implemented all of the auditor’s recommendations.
C: Yes. Scarcity of resources is not a sufficient reason to omit follow-up action.
D: No. When there is evidence of sufficient motivation by the auditee, there is no need for follow-up action.
Answer Explanations
Answer (a) is incorrect. Follow-up is required.
Answer (b) is incorrect. Follow-up is to see that actions are taken, not just that the auditor’s recommendations have been implemented.
Answer (c) is the correct answer. The IIA Standards require follow-up action. Lack of resources is not a sufficient reason.
Answer (d) is incorrect. Follow-up is required.
Question: V1C1-0049
Reporting to senior management and the board is an important part of the auditor’s obligation. Which of the following items is not required to be reported to senior management and/or the board?
Answers
A: Subsequent to the completion of an audit, but prior to the issuance of an audit report, the audit senior in charge of the audit was offered a permanent position in the auditee’s department.
B: An annual report summary of the department’s audit work schedule and financial budget.
C: Significant interim changes to the approved audit work schedule and financial budget.
D: An audit plan was approved by senior management and the board. Subsequent to the approval, senior management informed the audit director not to perform an audit of a division because the division’s activities were very sensitive.
Answer Explanations
Answer (a) is the correct answer. This would not have to be communicated. The audit work was done. The director of internal auditing would have to determine that there was no impairment of the independence of the senior’s work. If there was none, the report could be issued without reporting the personnel change.
Answer (b) is incorrect. This is a standard part of the required reporting to senior management and the board.
Answer (c) is incorrect. This is a standard part of the required reporting to senior management and the board.
Answer (d) is incorrect. The audit plan had been approved by both senior management and the board. The change dictated by senior management should be reported to the board.
Question: V1C1-0050
It has been established that an internal auditing charter is one of the more important factors positively affecting the internal auditing department’s independence. The IIA Standards help clarify the nature of the charter by providing guidelines as to the contents of the charter. Which of the following is not suggested in the Standards as part of the charter?
Answers
A: The department’s access to records within the organization.
B: The scope of internal auditing activities.
C: The length of tenure for the internal auditing director.
D: The department’s access to personnel within the organization.
Answer Explanations
Answer (a) is incorrect. It is suggested by the Standards.
Answer (b) is incorrect. It is suggested by the Standards.
Answer (c) is the correct answer. This is not included in the IIA Standards.
Answer (d) is incorrect. It is suggested by the Standards.
Question: V1C1-0051
The preliminary survey indicates that severe staff reductions at the audit location have resulted in extensive amounts of overtime among accounting staff. Department members are visibly stressed and very vocal about the effects of the cutbacks. Accounting payrolls are nearly equal to prior years, and many key controls, such as segregation of duties, are no longer in place. The accounting supervisor now performs all operations within the cash receipts and posting process, and has no time to review and approve transactions generated by the remaining members of the department. Journal entries for the last six months since the staff reductions show increasing numbers of prior month adjustments and corrections, including revenues, cost of sales, and accruals that had been misstated or forgotten during month-end closing activity. The auditor should
Answers
A: Discuss these findings with audit management to determine whether further audit work would be an efficient use of audit resources at this time.
B: Proceed with the scheduled audit but add audit personnel based on the expected number of findings and anticipated lack of assistance from local accounting management.
C: Research temporary helps agencies and evaluates the cost and benefit of outsourcing needed services.
D: Suspend further audit work because the findings are obvious and issue the audit report.
Answer Explanations
Answer (a) is the correct answer. Additional planning is necessary to align the audit effort to the circumstances and address the responsibilities of the audit department.
Answer (b) is incorrect. It is not clear at this point what additional audit work will be necessary.
Answer (c) is incorrect. Management has not accepted this plan of action.
Answer (d) is incorrect. This action would not address applicable standards of the auditor or the audit department, including objectivity, due professional care, and performance of audit work standards.
Question: V1C1-0052
Auditors realize that at times corrective action is not taken even when agreed to by the appropriate parties. This should lead an internal auditor to
Answers
A: Decide the extent of necessary follow-up work.
B: Allow management to decide when to followup, since it is management’s ultimate responsibility.
C: Decide to conduct follow-up work only if management requests the auditor’s assistance.
D: Write a follow-up audit report with all findings and their significance to the operations.
Answer Explanations
Answer (a) is the correct answer. The IIA Standards states that the director of internal auditing should determine the nature, timing, and extent of follow-up.
Answer (b) is incorrect. The Standards state that follow-up work is not management’s responsibility.
Answer (c) is incorrect. The Standards state that follow-up work is not management’s responsibility.
Answer (d) is incorrect. The auditor has to provide an opinion as to the decision made with regard to lack of action.
Question: V1C1-0053
Which of the following actions would be a violation of independence?
Answers
A: Continuing on an audit assignment at a division for which the auditor will soon be responsible as the result of a promotion.
B: Reducing the scope of an audit due to budget restrictions.
C: Participating on a task force that recommends standards for control of a new distribution system.
D: Reviewing a purchasing agent’s contract drafts prior to execution.
Answer Explanations
Answer (a) is the correct answer. The IIA Professional Standard specifies that an auditor who has been promoted to an operating department should not continue on an audit of his or her new department.
Answer (b) is incorrect. The Standard states that budget restrictions do not constitute a violation of an auditor’s independence.
Answer (c) is incorrect. The Standard states that an auditor may participate on a task force that recommends new systems. However, designing, installing, or operating such systems might impair objectivity.
Answer (d) is incorrect. The Standard states that an auditor may review contracts prior to their execution.
Question: V1C1-0054
Management has requested the audit department to conduct an audit of the implementation of its recently developed company code of conduct. In preparing for the audit, the auditor reviews the newly developed code, compares it with several others for comparable companies, and concludes that the newly developed code has severe deficiencies. Based= on this conclusion, the auditor should
Answers
A: Plan an audit for the implementation of management’s code of conduct and also for compliance with the “best practices” from the other codes since this represents the best available criteria.
B: Report the nature of the deficiencies in a formal report to management.
C: Inform management of the problems with the existing code and report that it would be inappropriate to conduct an audit until the code is revised to incorporate the “best practices” from industry.
D: Conduct the audit as requested by management, reporting only noncompliance with the code.
Answer Explanations
Answer (a) is incorrect. It is not appropriate to conduct an audit for compliance with criteria that have never been communicated to auditees.
Answer (b) is the correct answer. This would be the best solution. The auditor is responsible for reporting deficiencies in criteria to management.
Answer (c) is incorrect. It is okay to inform management and discuss whether now is the best time to conduct the audit. But it is not inappropriate to conduct the audit if management wants feedback on the implementation of its code.
Answer (d) is incorrect. The auditor needs to communicate deficiencies in criteria to management. Just reporting on the implementation of the current code would be deficient.
Question: V1C1-0055 Internal auditing standards assign the responsibility for providing appropriate audit supervision to the Answers A: Audit committee. B: Director of internal auditing. C: Audit supervisor. D: Senior auditor.
Answer Explanations
Answer (a) is incorrect. Although the audit committee may determine whether due care is being exercised by the audit director, audit supervision is not the committee’s responsibility.
Answer (b) is the correct answer. Per the IIA Standards, the director of internal auditing is responsible for providing appropriate audit supervision.
Answer (c) is incorrect. Although the audit supervisor may act on behalf of the director, the director is ultimately responsible for audit supervision.
Answer (d) is incorrect. It is the senior or in-charge auditor who is in need of supervision, for which the director is responsible.
Question: V1C1-0056
The IIA Standards require that the director of internal auditing seek the approval of management and acceptance by the board of a formal written charter for the internal auditing department. The purpose of this charter is to
Answers
A: Protect the internal auditing department from undue outside influence.
B: Establish the purpose, authority, and responsibility of the internal auditing department.
C: Clearly define the relationship between internal and external auditing.
D: Establish the director’s status as a staff executive.
Answer Explanations
Answer (a) is incorrect. While a charter may help to do this, this option is not the best choice.
Answer (b) is the correct answer. This is the purpose established by Standards.
Answer (c) is incorrect. It is not the best choice.
Answer (d) is incorrect. While a charter may help to do this, this option is not the best choice.
Question: V1C1-0057
The primary criteria for determining the adequacy of working papers can be found in the
Answers
A: IIA Standards.
B: Institute’s Code of Ethics.
C: Statement of Responsibilities of Internal Auditing.
D: Foreign Corrupt Practices Act.
Answer Explanations
Answer (a) is the correct answer. The IIA Standards address this aspect of working paper content.
Answer (b) is incorrect. The Code of Ethics does not address working papers.
Answer (c) is incorrect. The Statement of Responsibilities of Internal Auditing does not address working papers.
Answer (d) is incorrect. The Foreign Corrupt Practices Act does not deal with workpaper content.
Question: V1C1-0058
Based on the IIA Standards, an internal auditing department’s staff development program will be deficient if individual employees are
Answers
A: Given a large variety of tasks to perform.
B: Expected to study current events on an independent basis.
C: Assigned to a different supervisor on each job.
D: Formally evaluated once every two years.
Answer Explanations
Answer (a) is incorrect. Diversified tasks enhance an auditor’s experience by allowing him to become familiar with various components of the audit.
Answer (b) is incorrect. Internal auditors must be aware of current events in the field. Independent study is one means of accomplishing this.
Answer (c) is incorrect. Rotating supervisors is desirable because it helps to broaden on-the-job training.
Answer (d) is the correct answer. The IIA Standards states that each auditor must be formally evaluated at least annually.
Question: V1C1-0059
The IIA Standards require written policies and procedures to guide the audit staff. Which of the following statements is false with respect to this requirement?
Answers
A: The form and content of written policies and procedures should be appropriate to the size of the department.
B: All internal audit departments should have a detailed policies and procedures manual.
C: Formal administrative and technical audit manuals may not be needed by all internal auditing departments.
D: A small internal auditing department may be managed informally through close supervision and written memos.
Answer Explanations
Answer (a) is incorrect. It is a true statement.
Answer (b) is the correct answer. The form and content of written policies and procedures should be appropriate to the size and structure of the department and the complexity of its work. A small department may be managed informally.
Answer (c) is incorrect. It is a true statement.
Answer (d) is incorrect. It is a true statement.
Question: V1C1-0060
Paragraph 1: The production department has the newest production equipment available because of a fire that required the replacement of all equipment.
Paragraph 2: The members of the production department have become completely comfortable with the state of the- art technology over the past year and a half. As a result, the production department has become an industry leader in production efficiency and effectiveness.
Paragraph 3: The production department produces an average of 25 units per worker per shift. The defect rate is 1%.
Paragraph 4: The industry average productivity is 20 units per worker per shift. The industry defect rate is 3%.
Which paragraph would be characterized as the attribute described in the IIA Standards as “Criteria”?
Answers
A: 1
B: 2
C: 3
D: 4
Answer Explanations
Answer (a) is incorrect. Paragraph 1 explains the reason that the firm’s productivity is greater than is the industry average. This is the attribute called “Cause,” and it is the reason for the difference between the expected and actual conditions (“why the difference exists”).
Answer (b) is incorrect. Paragraph 2 describes the result of the firm’s access to state-of-the-art technology. This attribute is called “Effect,” and it is the risk or exposure the auditee organization and/or others encounter because the condition is not the same as the criteria (“the impact of the difference”). In this case the effect is positive, rather than negative.
Answer (c) is incorrect. Paragraph 3 describes the actual productivity extant within the firm. This attribute is called “Condition,” and it is the factual evidence that the internal auditor found in the course of the examination (“what does exist”).
Answer (d) is the correct answer. Paragraph 4 describes the standards by which the production department is measured. These are the “criteria,” and they are the standards, measures, or expectations used in making an evaluation and/or verification (“what should exist”).
Question: V1C1-0061
Paragraph 1: The production department has the newest production equipment available because of a fire that required the replacement of all equipment.
Paragraph 2: The members of the production department have become completely comfortable with the state-of the- art technology over the past year and a half. As a result, the production department has become an industry leader in production efficiency and effectiveness.
Paragraph 3: The production department produces an average of 25 units per worker per shift. The defect rate is 1%.
Paragraph 4: The industry average productivity is 20 units per worker per shift. The industry defect rate is 3%.
Which paragraph would be characterized as the attribute described in the IIA Standards as “Condition”?
Answers
A: 1
B: 2
C: 3
D: 4
Answer Explanations
Answer (a) is incorrect. Paragraph 1 is the statement of “Cause.”
Answer (b) is incorrect. Paragraph 2 is the statement of “Effect.”
Answer (c) is the correct answer. Paragraph 3 is the statement of “Condition.”
Answer (d) is incorrect. Paragraph 4 is the statement of “Criteria.”
Question: V1C1-0062
A relatively new internal auditor is completing an audit report. The final report should most appropriately be signed by
Answers
A: The auditor because of a greater level of detail knowledge of the report.
B: The auditor and the person in charge of the area being audited to indicate review of the report.
C: The director of internal auditing.
D: The chairman of the audit committee of the board of directors.
Answer Explanations
Answer (a) is incorrect. Although the internal auditor performing the audit has much detail knowledge, the final audit report should be signed by the head of the internal audit department who has performed an objective review of the findings and recommendations.
Answer (b) is incorrect. The person in charge of the area being reviewed will indicate his or her review of the report through a written reply.
Answer (c) is the correct answer. The director of internal auditing has ultimate responsibility for the quality of reports issued by the internal auditing group and should signify formal approval of the report by his or her signature.
Answer (d) is incorrect. The chair of the audit committee is responsible for reviewing the ongoing activities of the internal auditing group and should not be directly involved in the preparation and review of the audit report.
Question: V1C1-0063
An auditor often faces special problems when auditing a foreign subsidiary. Which of the following statements is false with respect to the conduct of international audits?
Answers
A: The IIA Standards do not apply outside of the United States.
B: The auditor should determine whether managers are in compliance with local laws.
C: There may be justification for having different company policies in force in foreign branches.
D: It is preferable to have multilingual auditors conduct audits at branches in non-English-speaking nations.
Answer Explanations Answer (a) is the correct answer. The IIA Standards are not limited to U.S. locations. Answer (b) is incorrect. It is true. Answer (c) is incorrect. It is true. Answer (d) is incorrect. It is true.
Question: V1C1-0064
The interpretation related to quality assurance given by the IIA Standards is that
Answers
A: Quality assurance reviews can provide senior management and the audit committee with an assessment of the internal auditing function.
B: Appropriate follow-up to an external review is the responsibility of the internal auditing director’s immediate supervisor.
C: The internal auditing department is primarily measured against the Institute’s Code of Ethics.
D: Continual supervision is limited to the planning, examination, evaluation report, and follow-up process.
Answer Explanations
Answer (a) is the correct answer. This is the correct answer based on the IIA Standards.
Answer (b) is incorrect. Standard 560.04.5: Appropriate follow-up is the director’s responsibility.
Answer (c) is incorrect. The key criterion should be an assessment of the department to the Standards.
Answer (d) is incorrect. It also includes training, employee performance evaluations, time and expense control, and similar administrative areas.
Question: V1C1-0065
An internal auditor fails to discover an employee fraud during an audit. The nondiscovery is most likely to suggest a violation of the IIA Standards if it was the result of a
Answers
A: Failure to perform a detailed audit of all transactions in the area.
B: Determination that any possible fraud in the area would not involve a material amount.
C: Determination that the cost of extending audit procedures in the area would exceed the potential benefits.
D: Presumption that the internal controls in the area were adequate and effective.
Answer Explanations
Answer (a) is incorrect. The Standards state “Due care . . . does not require detailed audits of all transactions.”
Answer (b) is incorrect. The Standards state: “the relative materiality . . . of matters to which audit procedures are applied” is a legitimate consideration.
Answer (c) is incorrect. The Standards state that “the internal auditor should consider . . . the cost of auditing in relation to potential benefits.”
Answer (d) is the correct answer. Although the IIA Standards state that “the internal auditor should consider . . . the adequacy and effectiveness of internal control,” the Standards make clear that this consideration must be based on an examination and evaluation, not just an assumption.
Question: V1C1-0066
Which of the following will best promote the independence of the internal auditing function?
Answers
A: A quality control system within the internal auditing function designed to ensure that departmental objectives are met.
B: Direct lines of communication between the audit committee and the director of internal auditing.
C: A written charter that reflects the concepts contained in the Statement of Responsibilities of Internal Auditing.
D: Direct reporting responsibilities to the company’s chief financial officer.
Answer Explanations
Answer (a) is incorrect. While this is important, it is not the best choice.
Answer (b) is the correct answer. The IIA Standards note that access to the board helps assure independence and provides a means for the board and director to keep each other informed on matters of mutual interest.
Answer (c) is incorrect. While this is important, it is not the best choice.
Answer (d) is incorrect. Since much of internal auditing involves evaluating activities directly under the control of this officer, independence might be hampered by such an arrangement.
Question: V1C1-0067
The charter of a newly formed internal auditing department contains the following statement: “The organizational status of the internal auditing department will be sufficient to permit the accomplishment of its audit responsibilities.”
From the following relationships, select the best reporting lines that would promote the accomplishment of the intended organizational status. Solid line to
Answers
A: Board of directors, dotted line to vice president of finance.
B: President, dotted line to board of directors.
C: Controller, dotted line to board of directors.
D: Vice president, finance, dotted line to board of directors.
Answer Explanations
Answer (a) is incorrect. Solid line should be to a top executive.
Answer (b) is the correct answer. Direct reporting to top executive, dotted line to board.
Answer (c) is incorrect. Internal auditing department should not be responsible to controller.
Answer (d) is incorrect. Solid line should be to a top executive.
Question: V1C1-0068
According to the IIA Standards, the purpose of an internal auditor’s review for effectiveness of the system of internal control is to ascertain if
Answers
A: The system is functioning as intended.
B: The system is functioning efficiently and economically.
C: The organization’s goals and objectives have been achieved.
D: Financial and operating data are reliable.
Answer Explanations
Answer (a) is the correct answer. The IIA Standards state that effectiveness of the system of internal control is to ascertain whether the system is functioning as intended.
Answer (b) is incorrect. It defines the purpose of the review for adequacy of the system of internal control.
Answer (c) is incorrect. It defines the purpose of the review of the quality of performance.
Answer (d) is incorrect. It defines one of the objectives of internal control.
Question: V1C1-0069
The best description of the purpose of internal auditing is that it
Answers
A: Furnishes members of the organization with information needed to effectively discharge their responsibilities.
B: Reviews the reliability and integrity of financial and operating information.
C: Reviews the means of safeguarding assets and, as appropriate, verifies the existence of such assets.
D: Appraises the economy and efficiency with which resources are employed.
Answer Explanations
Answer (a) is the correct answer. Service to all members of the organization is the pervasive theme of the introduction to the Standards.
Answer (b) is incorrect. It has just one of the specific activities outlined in the Standards.
Answer (c) is incorrect. It has just one of the specific activities outlined in the Standards.
Answer (d) is incorrect. It has just one of the specific activities outlined in the Standards.
Question: V1C1-0070
The director of a newly formed internal auditing department is seeking management approval of a charter. What is the authoritative source for seeking such approval?
Answers
A: The IIA Standards, which clearly place that responsibility on the director.
B: The appropriate Practice Advisories, which require the director to take that course of action.
C: The Code of Ethics, which requires internal auditors to document company policy.
D: According to the IIA Standards, no approval is necessary.
Answer Explanations
Answer (a) is the correct answer. This is the correct answer per the IIA Standards.
Answer (b) is incorrect. Professional Standards Bulletins are not authoritative sources.
Answer (c) is incorrect. The Code makes no such requirement.
Answer (d) is incorrect. This is not true.
Question: V1C1-0071
According to the IIA Standards, the staff of a newly developed internal auditing department should include
Answers
A: Members with bachelor’s degrees in accounting and related fields.
B: Members possessing appropriate professional designations.
C: Members proficient in applying internal auditing standards, procedures, and techniques.
D: Members with prior internal audit experience.
Answer Explanations
Answer (a) is incorrect. The level of formal education will vary according to position requirements or departmental needs.
Answer (b) is incorrect. Some entry-level positions require less than two years’ experience, which is one of the prerequisites for many certification programs.
Answer (c) is the correct answer. This is the correct answer based on the IIA Standards.
Answer (d) is incorrect. Some of the staff positions may not require previous audit experience.
Question: V1C1-0072
According to the IIA Standards, which of the following best describes the nature of opinions that are appropriate for internal audit reports?
Answers
A: Opinions are generally the auditor’s subjective judgments concerning why deficiencies exist.
B: Opinions are the auditor’s evaluations of the effects of the findings on the activities reviewed.
C: Opinions are conclusions that the auditor has reached concerning the appropriateness of the auditee’s objectives.
D: Opinions should only involve the fairness of the auditee’s financial statements.
Answer Explanations
Answer (a) is incorrect. It is not the best answer. Opinions should be solidly based and involve more than is given here.
Answer (b) is the correct answer. This is the nature of opinions per the IIA Standards.
Answer (c) is incorrect. It is not the best answer. Auditors usually take the auditee’s objectives as given.
Answer (d) is incorrect. Opinions in internal audit reports are not limited to the fairness of financial statements.
Question: V1C1-0073
The director of internal auditing is concerned that a recently disclosed fraud was not uncovered during the last audit of cash operations. A review of the work papers indicated that the fraudulent transaction was not included in a properly designed statistical sample of transactions tested. Which of the following applies to this situation?
Answers
A: Because cash operation is a high-risk area, 100% testing of transactions should have been performed.
B: The internal auditor acted with due professional care since an appropriate statistical sample of material transactions was tested.
C: Fraud should not have gone undetected in a recently audited area.
D: Extraordinary care is necessary in the performance of a cash operations audit and the auditor should be held responsible for the oversight.
Answer Explanations
Answer (a) is incorrect. “Due care requires the auditor to conduct examinations and verification to a reasonable extent, but does not require detailed audits of all transactions.”
Answer (b) is the correct answer. This is the correct answer based on the IIA Standards, “The possibility of material irregularities or noncompliance should be considered whenever the internal auditor undertakes an internal auditing assignment.”
Answer (c) is incorrect. “The internal auditor cannot give absolute assurance that noncompliance or irregularities do not exist.”
Answer (d) is incorrect. “Due care implies reasonable care and competence, not infallibility or extraordinary performance.”
Question: V1C1-0074
In the course of their work, internal auditors must be alert for fraud and other forms of white-collar crime. The important characteristic that distinguishes fraud from other varieties of white-collar crime is that
Answers
A: Fraud encompasses an array of irregularities and illegal acts that involve intentional deception.
B: Unlike other white-collar crimes, fraud is always perpetrated against an outside party.
C: White-collar crime is usually perpetrated for the benefit of an organization, whereas fraud benefits an individual.
D: White-collar crime is usually perpetrated by outsiders to the detriment of an organization, whereas fraud is perpetrated by insiders to benefit the organization.
Answer Explanations
Answer (a) is the correct answer. This is in accord with the IIA Standards.
Answer (b) is incorrect. Fraud may be perpetrated against the organization.
Answer (c) is incorrect. Fraud may be for the benefit of an organization.
Answer (d) is incorrect. Parts of this statement may or may not be true.
Question: V1C1-0075
During an audit of purchasing, internal auditors found several violations of company policy concerning competitive bidding. The same condition had been reported in an audit report last year, and corrective action had not been taken.
Which of the following best describes the appropriate action concerning this repeat finding?
Answers
A: The audit report should note that this same condition had been reported in the prior audit.
B: During the exit interview, management should be made aware that a finding from the prior report had not been corrected.
C: The director of internal auditing should determine whether management or the board has assumed the risk of not taking corrective action.
D: The director of internal auditing should determine whether this condition should be reported to the independent auditor and any regulatory agency.
Answer Explanations
Answer (a) is incorrect. This action is insufficient.
Answer (b) is incorrect. This action is insufficient.
Answer (c) is the correct answer. This action meets the requirements of the Standards.
Answer (d) is incorrect. This action would be inappropriate.
Question: V1C1-0076
Internal auditing is responsible for assisting in the prevention of fraud by
Answers
A: Informing the appropriate authorities within the organization and recommending whatever investigation is considered necessary in the circumstances when wrongdoing is suspected.
B: Establishing the systems designed to ensure compliance with the organization’s policies, plans, and procedures, as well as applicable laws and regulations.
C: Examining and evaluating the adequacy and the effectiveness of control, commensurate with the extent of the potential exposure/risk in the various segments of the organization’s operations.
D: Determining whether operating standards have been established for measuring economy and efficiency, and whether these standards are understood and are being met.
Answer Explanations
Answer (a) is incorrect. This response relates to the internal auditor’s obligation for reporting suspected fraud, not for preventing fraud.
Answer (b) is incorrect. Management, not internal auditing, is responsible for establishing these systems.
Answer (c) is the correct answer. The principal means of preventing fraud is internal control; the internal auditor’s role is related to evaluating the control.
Answer (d) is incorrect. The standards referred to relate to operational efficiency, not to prevention of fraud.
Question: V1C1-0077
Which of the following combination of participants would be most appropriate to attend an exit conference?
Answers
A: The responsible internal auditor and representatives from management who are knowledgeable regarding detailed operations and those who can authorize implementation of corrective action.
B: The director of internal audit and the executive in charge of the activity or function audited.
C: Staff auditors who conducted the fieldwork and operating personnel in charge of the daily performance of the activity or function audited.
D: Staff auditors who conducted the fieldwork and the executive in charge of the activity or function audited.
Answer Explanations
Answer (a) is the correct answer. This is the option most in line with what is suggested by the Standards.
Answer (b) is incorrect. These executives may not be knowledgeable enough about details.
Answer (c) is incorrect. These persons might not have the necessary perspectives and/or authority.
Answer (d) is incorrect. The staff auditor might lack the proper perspective and may be “overmatched.”
Question: V1C1-0078
An internal audit of sales contracts revealed that a bribe had been paid to secure a major contract. It was considered possible that a senior executive had authorized the bribe. Which of the following best describes the proper distribution of the completed audit report?
Answers
A: The report should be distributed to the chief executive officer and the appropriate regulatory agency.
B: The report should be distributed to the board of directors, the chief executive officer, and the independent auditor.
C: The director of internal auditing should provide the board of directors a copy of the report and decide whether further distribution is appropriate.
D: The report should be distributed to the board of directors, the appropriate law enforcement agency, and the appropriate regulatory agency.
Answer Explanations
Answer (a) is incorrect. Outside distribution is probably not appropriate.
Answer (b) is incorrect. Outside distribution is probably not appropriate.
Answer (c) is the correct answer. This is basically what the Standards require.
Answer (d) is incorrect. Outside distribution is probably not appropriate.
Question: V1C1-0079
The IIA Standards define “relevant evidence” as
Answers
A: Factual, adequate, and convincing.
B: Reliable and the best attainable through the use of appropriate audit techniques.
C: Consistent with the audit objectives and supports audit findings and recommendations.
D: Information that helps the organization meets its goals.
Answer Explanations
Answer (a) is incorrect. This defines sufficient information.
Answer (b) is incorrect. This defines competent information.
Answer (c) is the correct answer. This defines relevant information.
Answer (d) is incorrect. This defines useful information.
Question: V1C1-0080
Which is the lowest organizational level to which the internal auditing department should address the final report of the operational audit of the production department?
Answers
A: The audit committee of the board of directors.
B: The chief executive officer.
C: The vice president of production.
D: The first-line supervisor.
Answer Explanations
Answer (a) is incorrect. Audit committees usually do not require the full audit report to be submitted to them. Instead, they ordinarily ask for a summary of the audit report. This summary is sometimes nothing more than the summary referred to in the Standards. The audit committee may ask for the full audit report. If it does, however, it is the highest organizational level to receive it. Three lower levels, which may or must receive the full final audit report, are identified in the other responses.
Answer (b) is incorrect. The chief executive officer (CEO) qualifies as one of those “higher-level members in the organization” who “may receive only a summary report.” Like the audit committee, the CEO can request the full audit report. If the CEO does receive the full report, however, this represents a high organizational level. Two of the other three responses identify lower organizational levels that receive the full final audit report.
Answer (c) is incorrect. The vice president of production is the head of the audited unit. As such, he or she should receive the complete final audit report. There are organizational levels lower than the unit head that “are in a position to take corrective action or insure that corrective action is taken.” One such organizational level is identified among the other three responses.
Answer (d) is the correct answer. The stem identifies the first-line position as the lowest-level persons “who are in a position to take corrective action or insure that corrective action is taken.” In any case, the foremen are in a position “to insure that audit results are given due consideration.” As a result, the foremen should each receive a full final audit report. Since the foreman’s position is the lowest report-receiving organizational level, this response is correct.
Question: V1C1-0081
Which of the following is not ordinarily an objective of a quality assurance review? To determine compliance with
Answers
A: Applicable laws and regulations.
B: The general standards for the professional practice of internal auditing.
C: The specific standards for the professional practice of internal auditing.
D: The goals of the internal audit function.
Answer Explanations
Answer (a) is the correct answer. This is not an objective of the Standards.
Answer (b) is incorrect. Each one is an objective under the Standards.
Answer (c) is incorrect. Each one is an objective under the Standards.
Answer (d) is incorrect. Each one is an objective under the Standards.
Question: V1C1-0082
According to the IIA Standards, the independence of internal auditors is achieved through
Answers
A: Staffing and supervision.
B: Continuing education and due professional care.
C: Human relations and communications.
D: Organizational status and objectivity.
Answer Explanations
Answer (a) is incorrect. Staffing and supervision relate to the professional proficiency of the internal auditing department.
Answer (b) is incorrect. Continuing education and due professional care is related to the professional proficiency of the internal auditor.
Answer (c) is incorrect. Human relations and communications relate to the professional proficiency of the internal auditor.
Answer (d) is the correct answer. Organizational status and objectivity permit internal auditors to render the impartial and unbiased judgments essential to the proper conduct of audits.
Question: V1C1-0083
According to the IIA Standards, an internal auditor should possess proficiency in
Answers
A: Management principles.
B: The fundamentals of such subjects as accounting, economics, and finance.
C: Computerized information systems.
D: Applying internal auditing standards, procedures, and techniques.
Answer Explanations
Answer (a) is incorrect. The Standards specify only an understanding of management principles.
Answer (b) is incorrect. The Standards specify only an appreciation of the fundamentals of such subjects as accounting, economics, and finance.
Answer (c) is incorrect. The Standards specify only an appreciation of the fundamentals of computerized information systems.
Answer (d) is the correct answer. The Standards specify, in the area of applying internal auditing standards, procedures, and techniques, that an internal auditor should possess the ability to “apply knowledge to situations likely to be encountered and to deal with them without extensive recourse to technical research and assistance.”
Question: V1C1-0084
Which of the following audit committee activities would be of the greatest benefit to the internal auditing department?
Answers
A: Review and approval of audit programs.
B: Assurance that the external auditor will rely on the work of the internal auditing department whenever possible.
C: Review and endorsement of all internal audit reports prior to their release.
D: Support for appropriate follow-up of recommendations made by the internal auditing department.
Answer Explanations
Answer (a) is incorrect. Review and approval of audit programs is the responsibility of internal audit supervision.
Answer (b) is incorrect. External audit’s reliance on the work of internal auditing is the subject of an AICPA pronouncement.
Answer (c) is incorrect. Review and approval of internal audit reports is the responsibility of the director of internal auditing or designee.
Answer (d) is the correct answer. The audit committee can lend considerable weight to the recommendations of internal auditing.
Question: V1C1-0085
Which of the following relationships best depicts the appropriate dual reporting responsibility of the internal auditor?
Administratively to the
Answers
A: Board of directors, functionally to the chief executive officer.
B: Controller, functionally to the chief financial officer.
C: Chief executive officer, functionally to the board of directors.
D: Chief executive officer, functionally to the external auditor.
Answer Explanations
Answer (a) is incorrect. Reversed.
Answer (b) is incorrect. This reporting responsibility would not be independent when reporting to controller.
Answer (c) is the correct answer. This is an ideal reporting relation.
Answer (d) is incorrect. Internal auditor does not report to external auditors.
Question: V1C1-0086
According to the IIA Standards, the documentation required to plan an internal auditing project should include evidence that the
Answers
A: Expected findings were clearly identified.
B: Internal auditing department’s resources are effectively and efficiently employed.
C: Planned audit work will be completed on a timely basis.
D: Resources needed to perform the audit have been considered.
Answer Explanations
Answer (a) is incorrect. The Standards do not require it.
Answer (b) is incorrect. The Standards do not require it.
Answer (c) is incorrect. The Standards do not require it.
Answer (d) is the correct answer. The Standards require that resources needed to perform the audit have been considered.
Question: V1C1-0087
The IIA Standards require an internal auditor to exercise due professional care in performing internal audits. This includes
Answers
A: Establishing direct communication between the director of internal auditing and the board of directors.
B: Evaluating established operating standards and determining whether those standards are acceptable and are being met.
C: Accumulating sufficient evidence so that the auditor can give absolute assurance that irregularities do not exist.
D: Establishing suitable criteria of education and experience for filling internal audit positions.
Answer Explanations
Answer (a) is incorrect. Communication between the director of internal auditing and the board of directors is part of the Independence standard, not the Due Professional Care standard.
Answer (b) is the correct answer. Within the definition of due professional care, the Standards include the evaluation of operating standards for acceptability and determining whether they are being met.
Answer (c) is incorrect. The amount of audit time and effort required to give absolute assurance that there are no irregularities would be so great that the audit costs would exceed the benefits.
Answer (d) is incorrect. Criteria for filling internal audit positions relate to the Staffing standard; they do not relate directly to the performance of an audit.
Question: V1C1-0088
The director of internal auditing for a large retail organization reports to the controller and is responsible for designing and installing computer applications relating to inventory control. Which of the following is the major limitation of this arrangement?
Answers
A: It prevents the audit organization from devoting full time to auditing.
B: Auditors generally do not have the required expertise to design and implement such systems.
C: It potentially affects the director’s independence and thereby lessens the value of audit services.
D: Such arrangements are unlawful because the director participates in incompatible functions.
Answer Explanations
Answer (a) is incorrect. It is not the best choice.
Answer (b) is incorrect. Auditors often have the required expertise.
Answer (c) is the correct answer. Independence would be adversely affected since internal auditors would be expected to review systems for which the director and the director’s immediate superior were responsible.
Answer (d) is incorrect. Such arrangements are not illegal.
Question: V1C1-0089
According to the IIA Standards, the internal auditing department’s goals should specify
Answers
A: Audit work schedules and activities to be audited.
B: Policies and procedures to guide the audit staff.
C: Measurement criteria and target dates for completion.
D: Staffing plans and financial budgets.
Answer Explanations
Answer (a) is incorrect. Planning does include specifying audit work schedules and the activities to be audited. However, the goals for the internal auditing department do not ordinarily include this information. The goals tend to be broader in scope.
Answer (b) is incorrect. The department’s goals are separate from its policies and procedures should be based on goals.
Answer (c) is the correct answer. The Standards specify that goals should include measurement criteria and targeted dates of completion.
Answer (d) is incorrect. Staffing plans include the number of auditors required for an engagement, and the knowledge, skills, and disciplines required, as partly determined from audit work schedules. Goals do not include budgets, either. Instead, goals should be achievable within relevant budget constraints.
Question: V1C1-0090 According to the IIA Standards, internal auditors should possess the knowledge, skills, and disciplines essential to the performance of internal auditing. This means that all internal auditors should be proficient in applying Answers A: Internal auditing standards. B: Quantitative methods. C: Management principles. D: Structured systems analysis.
Answer Explanations
Answer (a) is the correct answer. Auditors should have a proficiency in applying internal auditing standards.
Answer (b) is incorrect. Only an appreciation is required.
Answer (c) is incorrect. Only an appreciation is required.
Answer (d) is incorrect. Only an appreciation is required.
Question: V1C1-0091
Coordination of internal and external auditing can reduce the overall audit costs. According to the IIA Standards, who is responsible for coordinating internal and external audit efforts?
Answers
A: Director of internal auditing.
B: External auditor.
C: Audit committee of the board of directors.
D: Management.
Answer Explanations Answer (a) is the correct answer. The Standards specify that the director of internal auditing is responsible for coordination. Answer (b) by definition is incorrect. Answer (c) by definition is incorrect. Answer (d) by definition is incorrect.
Question: V1C1-0092
You have been asked to be a member of a peer review team. In assessing the independence of the internal audit department being reviewed, you should consider all of the following factors except:
Answers
A: Access to and frequency of communications with the board of directors or its audit committee.
B: The criteria of education and experience considered necessary when filling vacant positions on the audit staff.
C: The degree to which auditors assume operating responsibilities.
D: The scope and depth of audit objectives for the audits included in the review.
Answer Explanations
Answer (a) is incorrect. Communication is related to independence.
Answer (b) is the correct answer. These criteria are related to skill, not independence.
Answer (c) is incorrect. Assumption of operating duties is related to independence.
Answer (d) is incorrect. The scope and depth of the audit objectives reflect on the department’s independence.
Question: V1C1-0093 The IIA Standards require that, in most cases, an internal auditing department have documented policies and procedures to ensure the consistency and quality of audit work. The exception to this requirement is directly related to Answers A: Departmentalization. B: Division of labor. C: Span of control. D: Authority.
Answer Explanations
Answer (a) is incorrect. Departmentalization can improve communications among team members, but sufficient direct supervision may be lacking if spans of control are large.
Answer (b) is incorrect. Division of labor produces highly specialized individuals, but formalized guidance is necessary for newer employees if the department is large.
Answer (c) is the correct answer. With a small audit department, substantial direct supervision can be provided by the audit director.
Answer (d) is incorrect. The audit director is the ultimate authority for the internal auditing department, but direct supervision by this individual will be lacking in a large department. Formal policies are needed.
Question: V1C1-0094
The director of internal auditing routinely provides activity reports to the board as part of the board meeting agenda each quarter. Senior management has asked to review the director’s board presentation before each board meeting so that any issues or questions can be discussed beforehand. The director should
Answers
A: Provide the activity reports to senior management as requested and discuss any issues that may require action to be taken.
B: Not provide activity reports to senior management because such matters are the sole province of the board.
C: Disclose only those matters in the activity reports to the board that pertain to expenditures and financial budgets of the internal auditing department.
D: Provide information to senior management that pertains only to completed audits and findings available in published audit reports.
Answer Explanations
Answer (a) is the correct answer. Activity reports should be submitted periodically to both senior management and the board; no distinction between the contents of the reports is necessary except in extraordinary situations requiring confidentiality.
Answer (b) is incorrect. This is not included in the provisions of the Standards.
Answer (c) is incorrect. Financial budget information is only part of the provisions established in the Standards; there is no need to restrict the information to this subject.
Answer (d) is incorrect. The Standards do not provide for limiting information in this manner.
Question: V1C1-0095
An auditor finds a situation where there is some suspicion, but no evidence, of potential misstatement. The standard of due professional care would be violated if the auditor
Answers
A: Identified potential ways in which an error could occur and ranked the items for audit investigation.
B: Informed the audit manager of the suspicions and asked for advice on how to proceed.
C: Did not test for possible misstatement because the audit program had already been approved by audit management.
D: Expanded the audit program, without the auditee’s approval, to address the highest-ranked ways in which a misstatement may have occurred.
Answer Explanations
Answer (a) is incorrect. This action would be consistent with the Standards on due professional care.
Answer (b) is incorrect. This action would be consistent with the Standards on due professional care.
Answer (c) is the correct answer. This would violate the IIA Standards because the auditor has not acted on audit evidence that indicated that the audit should be expanded.
Answer (d) is incorrect. The auditor does not need the auditee’s approval to expand the audit test.
Question: V1C1-0096
Which of the following combination of participants would be most appropriate to attend an exit conference?
Answers
A: The responsible internal auditor and representatives from management who are knowledgeable of detailed operations and those who can authorize implementation of corrective action.
B: The director of internal auditing and the executive in charge of the activity or function audited.
C: Staff auditors who conducted the fieldwork and operating personnel in charge of the daily performance of the activity or function audited.
D: Staff auditors who conducted the fieldwork and the executive in charge of the activity or function audited.
Answer Explanations
Answer (a) is the correct answer. This is the option most in line with what is suggested by the IIA Standards.
Answer (b) is incorrect. These executives may not be knowledgeable enough about details.
Answer (c) is incorrect. These persons might not have the necessary perspectives and/or authority.
Answer (d) is incorrect. The staff auditor might lack the proper perspective and may be “overmatched.”
Question: V1C1-0097
An internal audit director initiated an audit of the corporate code of ethics and the environment for ethical decision making. Which of the following would most likely be considered inappropriate regarding the scope and/or recommendations of the audit?
Answers
A: A review of the corporate code of ethics and a comparison to other corporate codes.
B: A survey of corporate employees, asking general questions regarding the ethical quality of corporate decision making.
C: Administration of an anonymous “ethics test” to determine if employees know of unethical behavior or have acted unethically themselves.
D: A survey of the board of directors to determine members’ level of support for a corporate code of ethics.
Answer Explanations
Answer (a) is incorrect. This would be included in the “normal scope” of this type of audit.
Answer (b) is incorrect. Surveys of employees are not prohibited by the Standards.
Answer (c) is incorrect. Ethics Test is not prohibited by the Standards.
Answer (d) is the correct answer. Not much benefit is gained by surveying the board of directors since members’ views will be biased for this audit.
