Flash Cards V1C2 - V1C2
Question: V1C2-0001 What should the audit strategy be? Answers A: It should be knowledge based. B: It should be cycle based. C: It should be request based. D: It should be risk based.
Answer Explanations
Answer (a) is incorrect because it does not consider risk as explicitly as choice (d).
Answer (b) is incorrect because it does not consider risk as explicitly as choice (d).
Answer (c) is incorrect because it does not consider risk as explicitly as choice (d).
Answer (d) is correct. Audits should be planned and conducted according to the risk level; that is, high-risk auditable areas should be reviewed first, followed by medium-risk areas, which are followed by low-risk areas. The medium and low-risk auditable areas should be reviewed only when audit resources are available.
Question: V1C2-0002 Which one of the following items includes the other three items? Answers A: Inherent risk. B: Control risk. C: Audit risk. D: Detection risk.
Answer Explanations
Answer (a) is incorrect. Inherent risk is the susceptibility of a management assertion to a material misstatement, assuming that there are no related internal control structure policies or procedures.
Answer (b) is incorrect. Control risk is the risk that a material misstatement in a management assertion will not be prevented or detected on a timely basis by the entity’s internal control structure policies or procedures.
Answer (c) is correct. Audit risk is the risk that the auditor may unknowingly fail to appropriately modify his or her opinion on financial statements that are materially misstated. It is the product of the other three risks: It is equal to inherent risk multiplied by control risk, which is multiplied by detection risk. Audit risk is an all-inclusive term here.
Answer (d) is incorrect. Detection risk is the risk that the auditor will not detect a material misstatement present in a management assertion.
Question: V1C2-0003 Which of the following would not be considered in performing a risk analysis exercise? Answers A: System complexity. B: Results of prior audits. C: Auditor skills. D: System changes.
Answer Explanations
Answer (a) is incorrect. It is considered in performing a risk analysis exercise.
Answer (b) is incorrect. It is considered in performing a risk analysis exercise.
Answer (c) is correct. Auditor skills become a consideration during audit scheduling. Risk analysis is done prior to the start of an audit, where factors such as system complexity, system changes, and results of prior audit are very important to consider. These factors determine whether an auditable area is high risk, medium risk, or low risk.
Answer (d) is incorrect. It is considered in performing a risk analysis exercise.
Question: V1C2-0004 During a computer risk assessment process, which of the following would not be considered an auditable activity? Answers A: Application software. B: Systems software. C: Print software. D: Telecommunications software.
Answer Explanations
Answer (a) is incorrect. It is an auditable activity to audit due to its high-risk nature.
Answer (b) is incorrect. It is an auditable activity to audit due to its high-risk nature.
Answer (c) is correct. The audit resources should be allocated to those areas where the risk level is the highest. Print software is low risk compared to the other three types of software to be reviewed by an auditor.
Answer (d) is incorrect. It is an auditable activity to audit due to its high-risk nature.
Question: V1C2-0005
Management is concerned with a recent increase in expenditures and lower profits at a division and has asked the internal audit department to perform an operational audit of the division. Management would like to have the audit completed as quickly as possible and has asked the internal audit department to allocate all possible resources to the task. The director of internal audit is concerned with the time pressure since the internal audit department is heavily involved in a major legal compliance audit that had been requested by the audit committee
Which of the following comments are correct regarding the assessment of risk associated with the two projects?
I. Activities requested by the audit committee should always be considered higher risk than those requested by management.
II. Activities with higher dollar budgets should always be considered higher risk than those with lower dollar budgets.
III. Risk should always be measured by the potential dollar or adverse exposure to the organization.
Answers
A: I only.
B: II only.
C: III only.
D: I and III.
Answer Explanations
Answer (a) is incorrect. Requests from management and the audit committee should both be considered by the internal audit department. Although an audit committee request is important, it is not always more important, nor does it always imply higher risk (item I).
Answer (b) is incorrect. Risk is measured by the potential exposure to the organization. The size of the departmental budget is an important determinant, but is not a sufficient determinant (item II).
Answer (c) is correct. This is the basic definition of risk given in the IIA Standards (Item III).
Answer (d) is incorrect since it contains both correct and incorrect answers.
Question: V1C2-0006
Management is concerned with a recent increase in expenditures and lower profits at a division and has asked the internal audit department to perform an operational audit of the division. Management would like to have the audit completed as quickly as possible and has asked the internal audit department to allocate all possible resources to the task. The director of internal audit is concerned with the time pressure since the internal audit department is heavily involved in a major legal compliance audit that had been requested by the audit committee.
Which of the following factors would be considered the least important in deciding whether existing internal audit resources should be moved from the ongoing legal compliance audit to the management-requested division audit?
Answers
A: A financial audit of the division by the external auditor a year ago.
B: The potential of fraud associated with the legal compliance audit.
C: The increase in expenditures at the division for the past year.
D: The potential for significant regulatory fines associated with the legal compliance audit.
Answer Explanations
Answer (a) is correct. The results of a financial audit would be the least relevant factor in prioritizing the auditor’s tasks because the financial audit will not resolve the question asked by management. Also, the financial audit was prior to the recent problems.
Answer (b) is incorrect. Fraud is one of the major factors to be considered in analyzing risk and identifying audit activities.
Answer (c) is incorrect. The increase in expenditures provides a benchmark for potential exposure or loss to the organization.
Answer (d) is incorrect. Fines imposed by regulatory agencies could represent a significant risk.
Question: V1C2-0007
When gathering data, an audit team identified both subjective and objective criteria for measuring audit risk. Which one of the following risk factors is most objective?
Answers
A: Prior audit findings.
B: Size of the audit unit.
C: Comfort with operating management.
D: Changes in staff, systems, or the environment.
Answer Explanations
Answer (a) is incorrect. Assessment of prior audit findings is dependent on the auditor’s impressions and feelings.
Answer (b) is correct. The IIA Standards state, “Objective reports are factual. …” Sawyer states, “Every categorical statement, every figure, every reference must be based on hard evidence.” The size of the audit unit is a fact, and not affected by the auditor’s impressions and feelings.
Answer (c) is incorrect. Comfort with operating management is dependent on the auditor’s impressions and feelings.
Answer (d) is incorrect. Assessment of changes in staff systems or the environment is dependent on the auditor’s impressions and feelings.
Question: V1C2-0008
The director of internal auditing was reviewing recent reports that had recommended additional audits because of risk and exposure to the company. Which of the following represents the greatest risk to the company and should be the next assignment?
Answers
A: Three prenumbered receiving reports were missing.
B: Several purchase orders were issued without purchase requisitions.
C: Payment had been made for routine inventory items without a purchase order or receiving report.
D: Several times cash receipts had been held over an extra day before depositing.
Answer Explanations
Answer (a) is incorrect. This is an important item, but most important items include whether cash disbursements are properly controlled and payment will not be made without verification of receipt. The receipts could have been voided and destroyed.
Answer (b) is incorrect. Some types of purchases do not require purchases requisitions, such as routine inventory acquisition. There is some risk in this, but it is not the greatest risk posed in the problem.
Answer (c) is correct. There is a great risk when cash payments can be made with no authorization. Several possible types of fraud could be occurring.
Answer (d) is incorrect. Unless other controls are missing, the largest risk would be the loss of a day’s receipts. This is a risk, but not the greatest risk.
Question: V1C2-0009
The audit process is one of critical thinking, analysis, and careful evaluation. All mechanical procedures are integrated into a larger context of thoughtful inquiry. All audits include a description and analysis of internal controls. Auditees are selected in a number of ways, with risk being the primary basis for selection. The departments being considered for possible audit in the coming year and attributes of those departments are listed below.
All of these departments except two are on the potential list of auditees because of a risk analysis performed by the audit director. Production Department A is on the list because the president thinks too many bottlenecks occur in that department. The marketing department is on the list because the chief of security received an anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks from a media outlet. Internal controls seem adequate in all departments, with the possible exception of marketing.
Which department would most likely need a pure operational (nonfinancial) audit?
Answers
A: Production A.
B: Production C.
C: Purchasing.
D: Marketing.
Answer Explanations
Answer (a) is correct. A department causing production bottlenecks would seem to have problems with efficiency and effectiveness, and would thus warrant an operational audit.
Answer (b) is incorrect. There is no information given that would indicate that production C was particularly inefficient or ineffective.
Answer (c) is incorrect. There is nothing to indicate that purchasing has been particularly inefficient or ineffective.
Answer (d) is incorrect. There is nothing to indicate that marketing has been particularly inefficient or ineffective.
Question: V1C2-0010
The audit process is one of critical thinking, analysis, and careful evaluation. All mechanical procedures are integrated into a larger context of thoughtful inquiry. All audits include a description and analysis of internal controls. Auditees are selected in a number of ways, with risk being the primary basis for selection. The departments being considered for possible audit in the coming year and attributes of those departments are listed below.
All of these departments except two are on the potential list of auditees because of a risk analysis performed by the audit director. Production Department A is on the list because the president thinks too many bottlenecks occur in that department. The marketing department is on the list because the chief of security received an anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks from a media outlet. Internal controls seem adequate in all departments, with the possible exception of marketing.
Department Assets Annual Costs Probability of Loss
Production A $ 50,000 $ 700,000 10%
Production B 5,000,000 10,000,000 1%
Production C 1,000,000 1,000,000 1%
Purchasing 50,000 150,000 10%
Marketing 50,000 500,000 10%
Shipping 60,000 100,000 50%
Security 10,000 100,000 90%
Travel 6,000 30,000 50%
What is the audit director’s most logical definition of risk of loss to be used in selecting auditees?
Answers
A: Amount of risk exposure times the probability of loss.
B: Amount of annual costs in department.
C: Probability of loss.
D: Amount of assets in a department.
Answer Explanations
Answer (a) is correct. Risk is a combination of the amount of assets exposed to risk times the probability of a loss occurring.
Answer (b) is incorrect. Annual cost is not a sufficient reason to conduct an audit. The amount of costs at risk times the probability of loss would be a better risk measure.
Answer (c) is incorrect. The probability of loss is not sufficient reason to conduct an audit. If only a few assets are involved (i.e., a petty cash fund), then audit resources can best be utilized elsewhere.
Answer (d) is incorrect. Quantity of assets is not a sufficient reason to conduct an audit. The amount of assets at risk times the probability of loss would be a better risk measure.
Question: V1C2-0011
Department Assets Annual Costs Probability of Loss
Production A $ 50,000 $ 700,000 10%
Production B 5,000,000 10,000,000 1%
Production C 1,000,000 1,000,000 1%
Purchasing 50,000 150,000 10%
Marketing 50,000 500,000 10%
Shipping 60,000 100,000 50%
Security 10,000 100,000 90%
Travel 6,000 30,000 50%
The audit process is one of critical thinking, analysis, and careful evaluation. All mechanical procedures are integrated into a larger context of thoughtful inquiry. All audits include a description and analysis of internal controls. Auditees are selected in a number of ways, with risk being the primary basis for selection. The departments being considered for possible audit in the coming year and attributes of those departments are listed below.
All of these departments except two are on the potential list of auditees because of a risk analysis performed by the audit director. Production Department A is on the list because the president thinks too many bottlenecks occur in that department. The marketing department is on the list because the chief of security received an anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks from a media outlet. Internal controls seem adequate in all departments, with the possible exception of marketing.
The internal auditing department is assigned responsibility for investigating fraud by its charter. If obtaining access to outside media outlet records and personnel were not possible, the best action an auditor could take to investigate the allegation of marketing kickbacks would be to
Answers
A: Search for unrecorded liabilities from media outlets.
B: Obtain a list of approved media outlets.
C: Develop a financial/behavioral profile of the suspect.
D: Vouch any material past charge-off of receivables.
Answer Explanations
Answer (a) is incorrect. The issue is not unrecorded liabilities but direct financial kickbacks, which will not be determined by this action.
Answer (b) is incorrect. Although helpful in identifying possible sources of kickbacks, this action would not corroborate the allegation.
Answer (c) is correct. Developing a financial/behavioral profile may corroborate illegal income and provide a basis for tracing illegal payments.
Answer (d) is incorrect. Past charge-offs of receivables have no relation to kickbacks from a media outlet to a marketing manager.
Question: V1C2-0012
The audit process is one of critical thinking, analysis, and careful evaluation. All mechanical procedures are integrated into a larger context of thoughtful inquiry. All audits include a description and analysis of internal controls. Auditees are selected in a number of ways, with risk being the primary basis for selection. The departments being considered for possible audit in the coming year and attributes of those departments are listed below.
Department Assets Annual Costs Probability of Loss
Production A $ 50,000 $ 700,000 10%
Production B 5,000,000 10,000,000 1%
Production C 1,000,000 1,000,000 1%
Purchasing 50,000 150,000 10%
Marketing 50,000 500,000 10%
Shipping 60,000 100,000 50%
Security 10,000 100,000 90%
Travel 6,000 30,000 50%
All of these departments except two are on the potential list of auditees because of a risk analysis performed by the audit director. Production Department A is on the list because the president thinks too many bottlenecks occur in that department. The marketing department is on the list because the chief of security received an anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks from a media outlet. Internal controls seem adequate in all departments, with the possible exception of marketing.
If there is fraud in the marketing department, which of the following would be beyond the scope of the auditor’s responsibility?
Answers
A: Informing the wrongdoer of his or her legal rights.
B: Determining the effects of the wrongdoing.
C: Discussing the wrongdoing with an appropriate level of management.
D: Including the wrongdoing in a report that will go to the audit committee.
Answer Explanations
Answer (a) is correct. Informing the wrongdoer of legal rights is the responsibility of legal authorities.
Answer (b) is incorrect. This is a part of the auditor’s responsibility with respect to the discovery of fraud.
Answer (c) is incorrect. It is a part of the auditor’s responsibility.
Answer (d) is incorrect. It is a part of the auditor’s responsibility.
Question: V1C2-0013 Which of the following auditable activities represents the greatest risk to a postmerger manufacturing corporation and would therefore most likely be subjected to an audit? Answers A: Combining imprest funds. B: Combining purchasing functions. C: Combining legal functions. D: Combining marketing functions.
Answer Explanations
Answer (a) is incorrect. The usual size of imprest funds will not likely result in risk that matches a purchasing operation.
Answer (b) is correct. Of all the four answers, the purchasing function typically represents significant risk for a manufacturing operation. In a merger of two manufacturers’ purchasing functions, that auditable area can be a source of even more significant risk.
Answer (c) is incorrect. Legal functions typically do not represent the magnitude of risk that a purchasing operation has.
Answer (d) is incorrect. Marketing functions may have identifiable risks but typically not as much as purchasing operations.
Question: V1C2-0014
In planning an audit, the internal auditor should design audit objectives and procedures to address the risk associated with the activity. Risk is defined as
Answers
A: The risk that the balance or class of transactions and related assertions contain misstatements that could be material to the financial statements.
B: The probability that an event or action may adversely affect the activity under audit.
C: The failure to adhere to organizational policies, plans, and procedures, or not complying with relevant laws and regulations.
D: The failure to accomplish established objectives and goals for operations or programs.
Answer Explanations
Answer (a) is incorrect. This is the AICPA’s definition of inherent risk for financial statement audit purposes.
Answer (b) is correct. The IIA Standards specifically define risk as: “the probability that an event or action may adversely affect the activity under audit.”
Answer (c) is incorrect. It is listed in the Standards as a type of adverse action that can result from unmitigated risk.
Answer (d) is incorrect. It is listed in the Standards as a type of adverse action that can result from unmitigated risk.
Question: V1C2-0015
Two major retail companies, both publicly traded and operating in the same geographic area, have recently merged. Both companies are approximately the same size and have audit departments. Company B has invested heavily in information technology and has electronic data interchange (EDI) connections with its major vendors.
The audit committee has asked the internal auditors from both companies to analyze risk areas that should be addressed after the merger. The director of internal auditing of Company B has suggested that the two audit groups have a planning meeting to share audit programs, scope of audit coverage, and copies of audit reports that were delivered to their audit committees. Management has also suggested that the auditors review the compatibility of the companies’ two computer systems and control philosophy for individual store operations. Which of the following would be the least important risk factor when considering the ability to integrate the two companies’ computer systems?
Answers
A: The number of programmers and systems analysts employed by each company.
B: The extent of EDI connections with vendors.
C: The compatibility of existing operating systems and database structures.
D: The size of company databases and the number of database servers used.
Answer Explanations
Answer (a) is correct. This is the least risky area because the number of analysts and programmers may be more of a reflection of operating philosophy (buying new applications versus developing them). This philosophy is unlikely to affect the probability of the event adversely affecting the operations. See IIA Standards for a description of risk and materiality concepts.
Answer (b) is incorrect. This is a risk area because one of the companies has little experience with dealing with EDI, and the complexity of computer communications in an EDI environment creates risk for those companies that have not yet established strong communication controls.
Answer (c) is incorrect. This is a high-risk factor because the two different systems must be made compatible to achieve the economy of objectives and strategic plans of a merged organization. The conversion from one systems or database structure to another is risky because data or applications may be lost or modified. Employees will have to be retrained on the surviving system. There is always increased risk of error when people are not familiar with a computer system.
Answer (d) is incorrect. This is a heavy risk factor for all the reasons discussed in answer (c).
