Governance

Question 1

Standard 2100 - Nature of work, states that the internal audit activity must what in relational to the organisations governance, risk management and controls processes?

Answer 1

The internal activity must evaluate and contribute to the improvement of the organisations governance, risk management, and control processes using a systematic, disciplined, and risk based approach.

Internal audit credibility and value are enhanced when auditors are proactive and their evaluations offer new insights and consider future impact.

Question 2

The IPPF defines governance as

Answer 2

The combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives.

Question 3

The IPPF defines risk management as

Answer 3

A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives.

Question 4

The IPPF defines control as

Answer 4

Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved.

Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.

Question 5

What is the role of the Board in the context of GRC

Answer 5

• To take the lead role in governance
• providing strategic direction
• Governance oversight
• Sets the risk appetite
• interacts directly with internal and external audit

Question 6

What is the role of senior management in the context of GRC

Answer 6

• executing the strategy and governance on a day to day basis
• accountable for risk management and control processes

Question 7

What should the CAE do to devise an appropriate strategy for assessing GRC processes

Answer 7

• Consider the level of maturity of the GRC processes.
• The organization’s culture and the seniority of the individuals who maintain responsibility for the processes.
• Assess the risks associated with the three processes.
• Use established frameworks adopted by senior management (e.g COSO or ISO 31000) to guide the assessment.
• Discuss relevant observations and conclusions with senior management.
• Make recommendations to strengthen the processes and escalate significant observations to the board.

Question 8

What documents may demonstrate conformance with standard 2100 - Nature of Work

Answer 8

Documents that may demonstrate conformance:

• The internal audit charter
• Internal audit plan
• Minutes of meetings showing that GRC was discussed with the Board

Question 9

What are the 6 principles of the three lines model

Answer 9

1. Governance
2. Governing body roles
3. Management and first and second line roles
4. Third line roles
5. Third line independence
6. Creating and protecting value

Question 10

According to standard 2110 Governance, the internal audit activity must assess and make appropriate recommendations to do what?

Answer 10

The internal audit activity must assess and make appropriate recommendations to improve the organisation’s governance processes for:

• making strategic and operational decisions
• overseeing risk management and control
• promoting ethics and values within the organisation
• ensuring effective organisational performance management
• communicating risk and control information
• coordinating and communicating information among the Board, external and internal auditors, other assurance providers, and management.

Question 11

What are stakeholders

Answer 11

Persons or entities affected by the activities of the entity.
For example - employees, shareholders, suppliers, neighbours…

Question 12

Examples of effective governance include

Answer 12

• tone at the top
• risk appetite and tolerance
• culture
• oversight of risk management

Question 13

What does standard 2110.A1 state the internal audit activity must evaluate in respect of ethics?

Answer 13

The internal audit activity must evaluate the design, implementation, and effectiveness of the organization’s ethics-related objectives, programs, and activities.

Question 14

Standard 2110.A2 states the internal audit activity must assess whether the IT governance of the organisation supports what?

Answer 14

supports the organization’s strategies and objectives

The internal audit activity must assess whether the information technology governance of the organization supports the organization’s strategies and objectives

Question 15

The IPPF states that IT governance consists of what?

Answer 15

Consists of the leadership, organizational structures, and processes that ensure that the enterprise’s information technology supports the organization’s strategies and objectives.

Question 16

Who has overall responsibility for IT governance?

Answer 16

IT governance is a shared responsibility of the board and senior management. That is, the board and senior management “own” IT governance. The board is responsible for overall strategic IT guidance. Senior management carries out the day-to-day direction of IT strategy execution.

Question 17

What does effective IT governance look like

Answer 17

IT strategies are aligned with organizational objectives.

The board and senior management understand the potential and limitations of IT.

IT senior management understands organizational objectives and needs.

An IT governance structure is used to apply and monitor this understanding.

Risks are identified and managed properly.

IT investments are optimized to deliver value.

IT performance is defined, measured, and reported using meaningful metrics.

IT resources are managed effectively.

Question 18

A typical IT governance framework consists of what 5 key areas

Answer 18

Strategic alignment
Risk Management
Value Delivery
Performance Measurement
Resource Management

Question 19

IT audits should include what types of engagements

Answer 19

Assurance and consulting

Question 20

Audits of IT governance should focus on the organisation’s implementation of what

Answer 20

Internal audits of IT governance should focus on the organization’s implementation of governance practices, which include clearly defined policies, roles, and responsibilities, risk appetite alignment, effective communication, tone at the top, management of IT value, and clear accountability.