I85PREP
⌘ K
CHAE study materials
CHAE study resources

CHAE practice questions

One question at a time. Build your CHAE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Internal Audit Standards, Governance and Risk Management

Under the IIA's definition, internal auditing is best described as which of the following?

  1. A regulatory inspection function carried out on behalf of government agencies and payers
  2. An independent, objective assurance and consulting activity that adds value Correct answer.
  3. A mandatory external attestation function performed by an outside public accounting firm
  4. A management control activity that prepares financial statements for external users and lenders

Explanation

The IIA definition frames internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluating governance, risk management, and control. External attestation and regulatory inspection are performed by parties outside the organization, not by internal audit.

Question 2Internal Audit Standards, Governance and Risk Management

Which set of principles forms the IIA Code of Ethics that internal auditors must apply?

  1. Independence, transparency, efficiency, and accountability
  2. Integrity, objectivity, confidentiality, and competency Correct answer.
  3. Objectivity, materiality, consistency, and prudence
  4. Integrity, independence, profitability, and efficiency

Explanation

The IIA Code of Ethics rests on four principles: integrity, objectivity, confidentiality, and competency. Each principle is accompanied by rules of conduct that describe expected behavior in practice. Independence and profitability are not principles of the Code, although independence supports objectivity.

Question 3Internal Audit Standards, Governance and Risk Management

An internal audit charter primarily serves which purpose within an organization?

  1. It records management's acceptance of each residual risk identified during the audit year
  2. It lists the specific audit procedures to be applied during each individual engagement by the assigned staff
  3. It documents the annual audit fee negotiated with the external auditor and the payment schedule over the year
  4. It defines the activity's purpose, authority, and responsibility and is approved by the board Correct answer.

Explanation

The charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility, and it must be approved by the board. It establishes the activity's position in the organization, its access to records and personnel, and its scope of work. Detailed procedures belong in engagement work programs, and risk acceptances belong in the risk register.

Question 4Internal Audit Standards, Governance and Risk Management

In the Three Lines Model, how is the internal audit function positioned?

  1. Second line, providing risk and compliance oversight across the business
  2. An external line that replaces the board's oversight responsibilities
  3. First line, owning and managing risk in the delivery of products and services
  4. Third line, providing independent assurance on risk management and control Correct answer.

Explanation

The Three Lines Model places operational management as the first line, risk and compliance functions as the second line, and internal audit as the third line providing independent assurance. Internal audit's independence from management is what allows it to report objectively to the governing body. The board sits above all three lines and retains ultimate oversight.

Question 5Internal Audit Standards, Governance and Risk Management

Which statement correctly distinguishes independence from objectivity for an internal auditor?

  1. Independence concerns the auditor's personal attitude; objectivity concerns the size of the audit budget and staffing
  2. Independence applies only to the chief audit executive; objectivity applies only to staff auditors
  3. Both terms refer only to the auditor's freedom from travel restrictions and outside employment
  4. Independence concerns the organizational position of the activity; objectivity is an unbiased mental attitude Correct answer.

Explanation

Independence refers to the freedom from conditions that threaten the ability of the internal audit activity to carry out its responsibilities, which is largely a matter of organizational placement and reporting lines. Objectivity is a mental attitude of impartiality that each auditor must maintain regardless of reporting structure. Both are necessary for reliable assurance.

Question 6Internal Audit Standards, Governance and Risk Management

To support independence, the chief audit executive most commonly reports functionally to which party?

  1. The audit committee of the board Correct answer.
  2. The human resources director
  3. The external audit partner
  4. The organization's financial controller

Explanation

Functional reporting to the audit committee or board supports the chief audit executive's independence, particularly regarding approval of the charter, audit plan, budget, and reporting of results. Administrative reporting typically runs to a senior executive such as the chief executive officer for day-to-day matters. Reporting to the controller or human resources director would compromise independence, since those functions are subject to audit.

Question 7Internal Audit Standards, Governance and Risk Management

In governance and risk management, risk is best defined as which of the following?

  1. The effect of uncertainty on objectives Correct answer.
  2. The certainty that organizational objectives will be achieved as planned
  3. Any event that has already caused a documented financial loss to the organization
  4. A control weakness identified during an audit engagement

Explanation

Risk is generally defined as the effect of uncertainty on objectives, encompassing both potential negative and positive deviations. This definition underlies the COSO ERM and ISO 31000 frameworks and links risk directly to objective setting. A realized loss or a control weakness is a manifestation or indicator of risk rather than the definition itself.

Question 8Internal Audit Standards, Governance and Risk Management

Residual risk is best described as which of the following?

  1. The risk that exists before any controls have been applied to the process
  2. The risk remaining after management's response has been applied Correct answer.
  3. The risk that management has formally decided not to measure or report
  4. The maximum loss the organization could suffer in a worst-case scenario

Explanation

Residual risk is what remains after management designs and operates a risk response, such as controls, transfer, or avoidance. It is compared with the organization's risk appetite to determine whether further action is needed. Inherent risk, by contrast, is the exposure before any response is applied.

Question 9Internal Audit Standards, Governance and Risk Management

An audit committee asks the chief audit executive to build a risk-based annual audit plan. Which approach best aligns with the Standards?

  1. Rotate coverage among departments alphabetically to ensure an even distribution of attention
  2. Rank auditable entities and processes by risk and allocate audit resources accordingly Correct answer.
  3. Audit only the areas where prior audits found no findings, to confirm they remain sound
  4. Base the plan on the number of staff requests received from each business unit

Explanation

A risk-based plan prioritizes auditable entities and processes according to an assessment of risk, then aligns staffing and budgets to those priorities. The assessment should consider factors such as impact, likelihood, control maturity, and changes affecting the organization. Alphabetical rotation or request volume ignores relative risk and can leave high-exposure areas unaudited.

Question 10Internal Audit Standards, Governance and Risk Management

At the start of an engagement, establishing clear objectives and scope is important mainly because it does which of the following?

  1. Eliminates the need to document audit evidence in the working papers for the engagement
  2. Focuses the work and allows the auditor to determine whether the engagement's aims were met Correct answer.
  3. Transfers responsibility for control design from management to the internal audit function
  4. Guarantees that the engagement will find every material control weakness

Explanation

Engagement objectives define what the audit is meant to achieve, and scope defines its boundaries, together focusing fieldwork and providing the basis for judging whether the engagement succeeded. They also support communication with the auditee about what will and will not be covered. They do not eliminate documentation requirements or shift control ownership.

Question 11Internal Audit Standards, Governance and Risk Management

Which set of attributes best describes information that is adequate to support audit conclusions?

  1. Sufficient, reliable, relevant, and useful Correct answer.
  2. Confidential, anecdotal, and undocumented
  3. Timely, verbal, and provided only by senior management
  4. Lengthy, technical, and supported by vendor brochures

Explanation

Audit evidence must be sufficient in quantity, reliable in quality, relevant to the engagement objectives, and useful in supporting findings and conclusions. These four attributes guide the auditor in deciding how much and what type of evidence to gather. Evidence that is merely voluminous, verbal, or anecdotal does not meet the standard.

Question 12Internal Audit Standards, Governance and Risk Management

Which statement about engagement working papers is most consistent with internal audit standards?

  1. They remain the property of the organization and are retained under an approved policy Correct answer.
  2. They may be released to any external party who requests them in writing
  3. They become the personal property of the individual auditor who prepared them
  4. They must be destroyed at the conclusion of each engagement to protect privacy

Explanation

Working papers are the property of the organization and must be controlled, retained, and released according to organizational policy and legal requirements. Retention schedules balance legal, regulatory, and professional recordkeeping needs, and release generally requires management or legal approval. Individual auditors do not hold ownership, and premature destruction undermines the audit trail.

Question 13Internal Audit Standards, Governance and Risk Management

An auditor finds that management has not implemented an agreed corrective action by the promised date. What is the most appropriate response?

  1. Remove the finding from prior reports so that the current report shows no open issues
  2. Re-audit the process indefinitely until the issue is resolved to the auditor's satisfaction
  3. Escalate the issue per the follow-up policy, ultimately to senior management or the board Correct answer.
  4. Close the finding because management accepted the original recommendation at the exit meeting and signed the report

Explanation

Follow-up procedures should track remediation against agreed action plans and dates, and unresolved high-risk items should be escalated through defined channels up to the board. Acceptance of a recommendation is not equivalent to implementation, so the finding cannot simply be closed. Removing the finding would conceal an unresolved exposure from governance bodies.

Question 14Internal Audit Standards, Governance and Risk Management

Under the IIA quality assurance and improvement requirements, an external assessment of the internal audit activity is expected at what minimum frequency?

  1. Every year, conducted by the audit committee
  2. At least once every five years Correct answer.
  3. Only when a fraud is reported to the audit committee
  4. At least once every ten years

Explanation

The Standards require an external assessment of the internal audit activity at least once every five years, performed by a qualified independent assessor or assessment team. Ongoing internal monitoring and periodic self-assessments supplement that external review. Annual and ten-year frequencies do not match the requirement.

Question 15Internal Audit Standards, Governance and Risk Management

Regarding fraud, the internal audit activity's role is best described as which of the following?

  1. Assessing fraud risk and evaluating the adequacy of controls that deter and detect fraud Correct answer.
  2. Assuming management's responsibility for designing and operating anti-fraud controls across the organization
  3. Guaranteeing that no material fraud exists in the audited area at the reporting date
  4. Prosecuting suspected fraudsters on behalf of the organization in cooperation with law enforcement

Explanation

Internal audit considers fraud risk when planning engagements and evaluates whether controls are adequate to deter and detect fraudulent activity. The auditor may assist in investigations but does not take over management's responsibility for anti-fraud programs. Audit work provides reasonable, not absolute, assurance, so no guarantee against undetected fraud is possible.

Question 16Internal Audit Standards, Governance and Risk Management

An auditor selects a judgmental sample rather than a statistical sample. What is the principal consequence of that choice?

  1. Sampling risk cannot be quantified, so conclusions are limited to the items tested Correct answer.
  2. The sample cannot be used to support any audit conclusion about the population as a whole
  3. Results must be extrapolated to the population with a stated confidence level and error rate
  4. The auditor no longer needs to document the sampling rationale in the working papers

Explanation

Statistical sampling permits the auditor to measure sampling risk and project results to the population with a stated confidence level, whereas a judgmental sample cannot support quantified projection. Judgmental samples still provide useful evidence about the items selected and remain valid for many audit purposes. In both cases the selection method and rationale must be documented.

Question 17Internal Audit Standards, Governance and Risk Management

Which of the following best describes the governing board's role in organizational governance?

  1. Independently auditing the organization's internal controls each year
  2. Designing and operating day-to-day internal controls in each process
  3. Setting strategic direction and overseeing risk management and control Correct answer.
  4. Preparing the financial statements and certifying their accuracy to regulators

Explanation

The board provides strategic direction, approves risk appetite, and oversees management's risk management and internal control systems on behalf of stakeholders. It relies on internal audit, external audit, and management reporting for assurance. Financial statement preparation, control operation, and detailed control testing are management or audit functions, not board responsibilities.

Question 18Internal Audit Standards, Governance and Risk Management

Which of the following is a recognized component of the COSO enterprise risk management framework?

  1. Governance and culture Correct answer.
  2. Engagement planning
  3. Substantive testing
  4. Segregation of duties testing

Explanation

The COSO ERM framework is organized around five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting. Testing techniques and engagement planning are audit methods rather than ERM framework components. The framework links risk management to strategy and performance.

Question 19Internal Audit Standards, Governance and Risk Management

Management proposes to accept a residual risk that exceeds the organization's stated risk appetite. What is the most appropriate action?

  1. Accept the risk silently because risk acceptance is entirely a management prerogative
  2. Escalate it to the appropriate management level or the board for a decision Correct answer.
  3. Reduce the audit plan until the residual risk falls within the stated appetite
  4. Record the risk in the register and take no further action during the year

Explanation

Risk appetite is set by the board, and exposures that exceed it require a decision at a level authorized to accept deviations, typically senior management or the board. Internal audit should ensure the matter is visible to those charged with governance rather than accepting it implicitly. Recording the risk without action or weakening the audit plan would leave the exposure unaddressed.

Question 20Internal Audit Standards, Governance and Risk Management

An internal auditor is asked to design and implement a new claims-processing control. Which response is most consistent with the Standards?

  1. Decline to assume management responsibility, though consulting advice may be provided with safeguards Correct answer.
  2. Decline any consulting work, because internal auditors may never provide advice to management
  3. Accept the assignment as long as the audit committee is not informed of the arrangement
  4. Accept the assignment and later audit the implemented control as part of the annual plan

Explanation

Internal auditors may provide consulting services and advice, but they must not assume management responsibilities or make decisions that belong to management. Accepting ownership of control design and later auditing that same control would create a self-review threat to objectivity. Appropriate safeguards, disclosure, and clarity of roles preserve the auditor's ability to provide objective assurance.

Question 21Internal Audit Standards, Governance and Risk Management

An auditor transferred from managing the revenue cycle into internal audit six months ago. Which statement best describes the resulting situation?

  1. Auditing the revenue cycle now would create a self-review threat and should be avoided Correct answer.
  2. The threat is resolved automatically once the auditor completes the annual audit training program
  3. No issue exists, because the auditor is now organizationally independent of the revenue cycle
  4. Objectivity is preserved as long as the auditor works overtime on the engagement and documents the hours

Explanation

An auditor who recently managed a process creates a self-review threat when assigned to audit that same process, because the individual would be evaluating decisions and controls for which they were responsible. Safeguards include reassigning the engagement, delaying participation, or having the work independently reviewed and supervised. Organizational placement alone does not eliminate a personal objectivity impairment.

Question 22Internal Audit Standards, Governance and Risk Management

Combined assurance is best described as which of the following?

  1. Combining all assurance activities into the external audit function under one integrated engagement letter and fee
  2. Coordinating assurance work across management, compliance, risk, and internal audit to cover key risks Correct answer.
  3. Replacing internal audit work with management self-certifications and survey results
  4. Outsourcing the entire internal audit function to a single firm under a multiyear contract

Explanation

Combined assurance coordinates and integrates the assurance obtained from multiple providers, including management monitoring, compliance, risk management, and internal audit, so that key risks are covered without duplication or gaps. A mapping of risks to assurance sources supports this coordination and informs the audit plan. It does not eliminate independent internal audit assurance or merge it into the external audit.

Question 23Internal Audit Standards, Governance and Risk Management

Which statement best reflects how risk appetite should be used in audit planning and reporting?

  1. Risk appetite provides the benchmark against which residual risk and escalation decisions are judged Correct answer.
  2. Risk appetite replaces the need for a risk register in large, mature organizations
  3. Risk appetite is set by internal audit to guide management's risk decisions
  4. Risk appetite sets the exact number of findings that may be issued per engagement

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of its objectives, providing the benchmark for comparing residual exposures and deciding when escalation is required. Internal audit uses it to prioritize coverage and to frame the significance of findings. It does not replace the risk register, cap the number of findings, or originate within internal audit.

Question 24Internal Audit Standards, Governance and Risk Management

During fieldwork, an auditor receives management assurances that contradict system-generated logs. What is the most appropriate course of action?

  1. Report the conflict only after the engagement report has been issued and closed
  2. Accept management's explanation, because managers know the process best
  3. Pursue additional evidence, corroborate the conflict, and document the resolution Correct answer.
  4. Discard the system logs as unreliable technical data

Explanation

Professional skepticism requires the auditor to resolve contradictory evidence rather than defer to seniority or dismiss data. The auditor should obtain additional corroborating evidence, determine which source is more reliable, and document the analysis and conclusion in the working papers. Unresolved conflicts that could affect the conclusion should be escalated before the report is finalized.

Question 25Internal Audit Standards, Governance and Risk Management

An external quality assessment finds that an internal audit activity does not conform with one Standard. What is the most appropriate response?

  1. Remove the Standard from the quality program so conformance can be achieved
  2. Implement a documented improvement plan and report progress to the board Correct answer.
  3. Suspend all audit work until the next external assessment is completed
  4. Ask the external assessor to withdraw the rating as a matter of professional courtesy

Explanation

Nonconformance identified through quality assessment should be addressed with a documented remediation plan, with progress monitored and reported to senior management and the board. The chief audit executive is responsible for ensuring the activity achieves conformance over a reasonable period. Removing standards or suspending all work would not correct the underlying deficiency and would compound the governance failure.

Question 26Internal Audit Standards, Governance and Risk Management

In the IIA's Three Lines Model, how is the internal audit activity best characterized?

  1. A temporary task force that supports the external auditor.
  2. A second-line function that designs compliance controls.
  3. A first-line function that owns and manages operational risks.
  4. An independent assurance function that provides objective assurance to the governing body. Correct answer.

Explanation

In the Three Lines Model, the first line owns and manages risk, the second line provides oversight and compliance support, and internal audit provides independent assurance to the governing body. Internal audit does not own operational risks or design controls.

Question 27Internal Audit Standards, Governance and Risk Management

In the context of risk management, inherent risk is best described as which of the following?

  1. The risk that a control will fail to operate as designed.
  2. The risk that remains after management has implemented controls.
  3. The exposure that exists before any controls are applied. Correct answer.
  4. The risk that an auditor will fail to detect a material error.

Explanation

Inherent risk is the level of exposure that exists before mitigating controls are applied. Residual risk is the risk remaining after controls, while detection risk and control risk are separate audit concepts.

Question 28Internal Audit Standards, Governance and Risk Management

Which of the following is one of the four principles of the IIA Code of Ethics?

  1. Objectivity Correct answer.
  2. Efficiency
  3. Transparency
  4. Profitability

Explanation

The four principles of the IIA Code of Ethics are integrity, objectivity, confidentiality, and competency. Transparency, profitability, and efficiency may be desirable organizational traits but are not Code principles.

Question 29Internal Audit Standards, Governance and Risk Management

An internal audit charter primarily serves which of the following purposes?

  1. It documents management's acceptance of the annual audit plan.
  2. It defines the internal audit activity's purpose, authority, and responsibility. Correct answer.
  3. It lists the specific audit procedures to be performed during each engagement.
  4. It records the qualifications of each internal auditor.

Explanation

The charter is a formal document, approved by the governing body, that establishes the internal audit activity's mandate, reporting lines, and scope. It is not an engagement work program, a plan acceptance record, or a staffing qualifications log.

Question 30Internal Audit Standards, Governance and Risk Management

An internal auditor is assigned to audit the procurement department, where her spouse is the department manager. What is the most appropriate action?

  1. Proceed with the engagement because the auditor can remain impartial.
  2. Perform the engagement but exclude the spouse's transactions from testing.
  3. Disclose the relationship and decline the assignment or ensure it is reassigned. Correct answer.
  4. Ask the spouse to review the draft report before it is issued.

Explanation

Objectivity requires auditors to avoid conflicts of interest and to disclose impairments that could affect judgment. Reassignment is the appropriate safeguard because relying on self-control or selective testing does not eliminate the threat.

Question 31Internal Audit Standards, Governance and Risk Management

Which statement best describes the appropriate relationship between internal auditors and external auditors?

  1. Internal audit should take direction from the external auditor on scope and testing.
  2. Internal audit must adopt the external auditor's materiality thresholds for all engagements.
  3. Internal audit and external audit must never communicate in order to preserve confidentiality.
  4. Internal audit should coordinate with external auditors to avoid duplication and share relevant information while maintaining independence. Correct answer.

Explanation

Professional standards encourage coordination and information sharing between internal and external auditors to improve efficiency and coverage. External auditors cannot direct the internal audit activity, and communication is permitted with appropriate confidentiality safeguards.

Question 32Internal Audit Standards, Governance and Risk Management

The chief audit executive believes the internal audit plan cannot be completed with current staffing. What is the most appropriate action?

  1. Require auditors to work overtime until all engagements are complete.
  2. Reduce the scope of every engagement to match available staff without informing the audit committee.
  3. Communicate the resource constraint and its impact to the audit committee and recommend a solution. Correct answer.
  4. Cancel the engagements with the highest risk ratings first.

Explanation

The chief audit executive must ensure the internal audit activity has sufficient resources and must communicate limitations to the governing body. Reducing scope or canceling high-risk work without disclosure impairs the function's ability to fulfill its mandate.

Question 33Internal Audit Standards, Governance and Risk Management

An audit committee member asks the chief audit executive to investigate a specific manager's expense reports without a documented basis. What is the most appropriate response?

  1. Begin the investigation immediately without documenting the request.
  2. Discuss the request with the audit committee chair and, if appropriate, incorporate it into the audit plan with documented rationale. Correct answer.
  3. Refer the request to the external auditor and take no further action.
  4. Refuse the request because audit committees cannot request specific engagements.

Explanation

The audit committee may request specific engagements, but the chief audit executive should ensure such requests are properly evaluated, documented, and aligned with the audit plan. Outright refusal and undocumented action are both inappropriate.

Question 34Internal Audit Standards, Governance and Risk Management

During risk assessment, an auditor uses a heat map that plots likelihood against impact. What is the primary purpose of this tool?

  1. To prioritize risks visually based on their relative likelihood and impact. Correct answer.
  2. To document the audit procedures performed for each risk.
  3. To eliminate the need for professional judgment in planning.
  4. To calculate the exact monetary value of each risk.

Explanation

A heat map displays risks by likelihood and impact so the audit activity can prioritize its work. It supports professional judgment but does not quantify exact monetary values or replace auditor judgment.

Question 35Internal Audit Standards, Governance and Risk Management

Internal audit is reviewing the compliance function, which operates as a second-line function. Which of the following is the most appropriate consideration?

  1. Internal audit should rely entirely on the compliance function's work without further testing.
  2. Internal audit should assess whether the compliance function's own monitoring is effective and whether it provides reliable assurance. Correct answer.
  3. The compliance function should be treated as part of the first line because it interacts with operations.
  4. Internal audit should not review the compliance function because it is independent of operations.

Explanation

The second line provides oversight and monitoring, and internal audit may provide assurance on the effectiveness of that monitoring. Internal audit must evaluate second-line work before relying on it rather than accepting it without assessment.

Question 36Internal Audit Standards, Governance and Risk Management

During engagement planning, a preliminary risk assessment primarily helps the auditor to do which of the following?

  1. Determine the exact sample size for substantive testing.
  2. Guarantee that no material misstatement exists.
  3. Eliminate the need for further risk assessment during fieldwork.
  4. Identify areas of higher risk and focus engagement procedures accordingly. Correct answer.

Explanation

Preliminary risk assessment guides the nature, timing, and extent of procedures by identifying higher-risk areas. It does not fix sample sizes precisely, eliminate fieldwork judgment, or guarantee that no misstatement exists.

Question 37Internal Audit Standards, Governance and Risk Management

The chief audit executive is asked to advise management on the design of a new vendor onboarding process. Which of the following is the most appropriate safeguard?

  1. Perform the engagement without documenting the nature of the consulting services.
  2. Decline all consulting engagements because they impair independence.
  3. Accept the engagement only if internal audit will also implement the process.
  4. Clarify that internal audit will provide advice only and will not assume management responsibility for the process. Correct answer.

Explanation

Consulting services are permitted when internal audit does not assume management responsibilities. Maintaining an advisory role and documenting the engagement preserves objectivity and independence.

Question 38Internal Audit Standards, Governance and Risk Management

A board is considering outsourcing its internal audit function to a firm that also provides significant consulting services to the organization. Which of the following is the most significant concern?

  1. The board will lose the ability to approve the internal audit plan.
  2. Outsourcing always eliminates the need for an internal audit charter.
  3. The firm may face self-review and independence threats that could undermine the objectivity of internal audit assurance. Correct answer.
  4. The firm will be unable to perform any audit engagements for the organization.

Explanation

Using the same firm for significant consulting and internal audit can create self-review and independence threats. The charter, plan approval, and audit work can still be maintained with proper safeguards.

Question 39Internal Audit Standards, Governance and Risk Management

The chief audit executive reports administratively to the CFO. During an engagement, the chief audit executive finds that the CFO has bypassed a key control and the matter is material. What is the most appropriate action?

  1. Escalate the matter to the audit committee or governing body in accordance with the internal audit charter. Correct answer.
  2. Report the matter only to the CFO and allow the CFO to decide whether to escalate it.
  3. Delay reporting until the next annual audit plan is approved.
  4. Remove the finding from the report to avoid conflict with the CFO.

Explanation

When a material matter involves the chief audit executive's administrative reporting line, escalation to the governing body is necessary to preserve independence and ensure appropriate oversight. Reporting only to the CFO would create a conflict of interest.

Question 40Internal Audit Standards, Governance and Risk Management

An internal auditor is evaluating governance and finds that the board has delegated all risk oversight to management without retaining any oversight. Which conclusion is most appropriate?

  1. This weakens governance because the board retains responsibility for overseeing risk management and cannot fully delegate it. Correct answer.
  2. This strengthens independence because the board avoids involvement in operations.
  3. This is acceptable if management documents its risk decisions.
  4. This is acceptable because management owns risk.

Explanation

While management owns and manages risk, the governing body retains oversight responsibility and cannot fully delegate it. Retaining no oversight role weakens governance and board accountability.

Question 41Healthcare Regulatory Compliance and Fraud, Waste and Abuse

Under the federal False Claims Act, a provider found liable for submitting false claims is generally subject to which combination of remedies?

  1. Restitution of the overpayment plus assessed interest
  2. Actual damages only, with no civil penalty imposed
  3. Double the government's damages plus a criminal fine
  4. Treble damages plus a per-claim civil penalty Correct answer.

Explanation

The civil False Claims Act authorizes treble the government's damages plus a civil penalty for each false claim, with penalty amounts adjusted annually for inflation. Criminal fines come from separate statutes, such as the federal health care offense provisions, not from the civil False Claims Act itself.

Question 42Healthcare Regulatory Compliance and Fraud, Waste and Abuse

A laboratory gives referring physicians free supplies and a monthly consulting payment. Which standard determines whether the arrangement violates the Anti-Kickback Statute?

  1. Whether the physicians referred an unusually high volume of tests
  2. Whether the payment exceeded fair market value for the supplies
  3. Whether the arrangement appeared in the compliance plan
  4. Whether one purpose of the payment was to induce referrals Correct answer.

Explanation

The Anti-Kickback Statute is an intent-based criminal statute, and courts apply a one-purpose test: if any purpose of the remuneration is to induce referrals for federally reimbursable items, the statute is violated even when legitimate purposes also exist. Fair market value and compliance-plan documentation matter for Stark or safe harbor analysis but do not cure unlawful intent.

Question 43Healthcare Regulatory Compliance and Fraud, Waste and Abuse

Which statement best describes liability under the physician self-referral (Stark) statute?

  1. It requires proof that the physician intended to profit from referrals
  2. It applies only when the government proves actual patient harm
  3. It is strict liability; proof of improper intent is not required Correct answer.
  4. It is enforced exclusively through criminal prosecution

Explanation

Stark prohibits physicians from referring Medicare patients for designated health services to entities with which they have a financial relationship unless an exception applies. It is a civil strict-liability statute, so intent to induce referrals is not an element, unlike the Anti-Kickback Statute.

Question 44Healthcare Regulatory Compliance and Fraud, Waste and Abuse

Which of the following is one of the seven elements of an effective healthcare compliance program?

  1. A designated compliance officer and compliance committee Correct answer.
  2. A published schedule of discounted self-pay rates
  3. An annual marketing plan approved by the board
  4. A policy requiring employees to waive copayments

Explanation

HHS-OIG guidance lists seven elements: written policies and procedures, a compliance officer and compliance committee, training and education, open lines of communication, internal auditing and monitoring, enforcement and discipline, and corrective action. Discounted rates, marketing plans, and copay waivers are not elements, and routine copay waivers can themselves create fraud and abuse exposure.

Question 45Healthcare Regulatory Compliance and Fraud, Waste and Abuse

A clinic continues billing Medicare for services furnished by a physician it knows has been excluded by the OIG. Which exposure does the clinic face?

  1. A warning letter only, because exclusion applies to the physician alone
  2. No liability, because the physician performed the services personally
  3. Liability only if the physician's care was below the standard of care
  4. Civil monetary penalty liability and repayment for the billed services Correct answer.

Explanation

Items and services furnished by an excluded individual are not payable by federal health care programs, and submitting claims for them can create civil monetary penalty liability for the billing entity. The billing entity can be liable even when the excluded person personally performed the service.

Question 46Healthcare Regulatory Compliance and Fraud, Waste and Abuse

The HIPAA Privacy Rule's minimum necessary standard requires covered entities to:

  1. Limit uses and disclosures to the minimum necessary for the purpose Correct answer.
  2. Retain all clinical records for at least ten years before any release
  3. Obtain a signed authorization before any use or disclosure of health information
  4. Disclose a patient's entire medical record whenever a consulting specialist requests it

Explanation

The minimum necessary standard requires reasonable efforts to limit uses, disclosures, and requests for protected health information to what is needed to accomplish the intended purpose. Treatment disclosures, disclosures to the patient, and disclosures made under a valid authorization are not subject to the standard.

Question 47Healthcare Regulatory Compliance and Fraud, Waste and Abuse

EMTALA requires a hospital with an emergency department to provide which service to every person who comes to the emergency department?

  1. A medical screening examination to determine whether an emergency exists Correct answer.
  2. A written estimate of charges before any screening is performed
  3. Free follow-up care after discharge from the emergency department
  4. Admission to an inpatient bed regardless of the examination findings

Explanation

EMTALA requires an appropriate medical screening examination and, if an emergency medical condition exists, stabilizing treatment, regardless of insurance status or ability to pay. Financial discussions cannot delay the screening examination.

Question 48Healthcare Regulatory Compliance and Fraud, Waste and Abuse

Which situation best illustrates waste rather than fraud or abuse?

  1. Billing for a service that was never performed
  2. Stocking excessive surgical supplies that expire unused Correct answer.
  3. Upcoding an office visit to obtain a higher payment
  4. Paying a physician for referrals of laboratory testing

Explanation

Waste is the overutilization or misuse of resources that creates unnecessary cost without an intent to deceive and without a clear statutory violation, such as over-purchasing perishable supplies. Billing for services not rendered, upcoding, and paying for referrals are fraud or abuse because they involve misrepresentation or prohibited remuneration.

Question 49Healthcare Regulatory Compliance and Fraud, Waste and Abuse

A billing manager identifies a pattern of duplicate Medicare payments on the same claims. Under the ACA overpayment provision, the practice must:

  1. Return the overpayment only if a contractor requests repayment
  2. Return the overpayment within the next calendar year
  3. Keep the overpayment and offset it against future underpayments
  4. Report and return the overpayment within 60 days of identification Correct answer.

Explanation

Under ACA Section 6402, a provider that receives an overpayment must report and return it by the later of 60 days after identification or the date a corresponding cost report is due. Retaining an identified overpayment past that deadline can create reverse false claims liability.

Question 50Healthcare Regulatory Compliance and Fraud, Waste and Abuse

In a qui tam action that the government joins and wins, the relator's statutory share of the recovery is generally:

  1. Between 15 and 30 percent of the recovery Correct answer.
  2. The relator's documented costs and attorney fees only
  3. A fixed 50 percent of the total recovery
  4. Nothing, because the government takes the entire recovery

Explanation

When the government intervenes in a qui tam action, the relator generally receives between 15 and 30 percent of the proceeds, depending on the relator's contribution to the case. If the government declines and the relator proceeds alone, the statutory range rises to 25 to 30 percent.