I85PREP
⌘ K
CHA Healthcare Auditor study materials
CHA Healthcare Auditor study resources

CHA Healthcare Auditor practice questions

One question at a time. Build your CHA Healthcare Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Healthcare Compliance and Regulatory Environment

Which federal agency is primarily responsible for enforcing the Anti-Kickback Statute in federal health care programs?

  1. The Department of Labor
  2. The Office of Inspector General of the Department of Health and Human Services Correct answer.
  3. The Federal Trade Commission
  4. The Securities and Exchange Commission

Explanation

The Anti-Kickback Statute is a criminal statute enforced largely by HHS-OIG in coordination with the Department of Justice. OIG has civil and administrative authority over federal health care program integrity.

Question 2Healthcare Compliance and Regulatory Environment

Under the False Claims Act, a person who knowingly submits a false claim to the government may be liable for which type of damages?

  1. Only the actual loss suffered by the government
  2. Actual damages plus a statutory civil penalty per claim Correct answer.
  3. A flat administrative fine set by the state
  4. Criminal restitution only

Explanation

The False Claims Act imposes treble damages (three times the government's actual loss) plus a civil monetary penalty for each false claim. The civil penalty amount is adjusted periodically for inflation.

Question 3Healthcare Compliance and Regulatory Environment

Which law established the Medicare and Medicaid programs?

  1. The Health Insurance Portability and Accountability Act of 1996
  2. The Affordable Care Act of 2010
  3. The Social Security Amendments of 1965 Correct answer.
  4. The Public Health Service Act of 1944

Explanation

The Social Security Amendments of 1965 created the Medicare and Medicaid programs under Titles XVIII and XIX of the Social Security Act. These titles remain the statutory basis for both programs.

Question 4Healthcare Compliance and Regulatory Environment

Protected health information under the HIPAA Privacy Rule generally excludes which of the following?

  1. A billing statement containing a patient's name
  2. A patient's discharge summary stored in an electronic record
  3. A referral note containing a patient's date of birth
  4. De-identified health information Correct answer.

Explanation

De-identified information that has been stripped of the 18 specified identifiers and cannot be used to re-identify an individual falls outside the definition of PHI. Identifiable health data held by a covered entity remains PHI.

Question 5Healthcare Compliance and Regulatory Environment

A hospital bills Medicare for a service that was not medically necessary and the auditor finds the organization acted with reckless disregard for the truth. Which standard of liability under the False Claims Act does this best describe?

  1. Innocent mistake
  2. Knowing conduct Correct answer.
  3. Simple negligence
  4. Good-faith billing error

Explanation

The FCA defines "knowingly" to include actual knowledge, deliberate ignorance, or reckless disregard of the truth or falsity of information. Reckless disregard therefore satisfies the knowledge element even without proof of specific intent to defraud.

Question 6Healthcare Compliance and Regulatory Environment

Which of the following best describes the purpose of a Corporate Integrity Agreement entered into with HHS-OIG?

  1. To replace the Medicare Conditions of Participation
  2. To dismiss pending criminal charges against individual employees
  3. To guarantee the entity will not be audited again
  4. To impose a binding integrity and compliance program on a settling entity for a defined term Correct answer.

Explanation

A CIA is a negotiated compliance obligation that an entity agrees to as part of a civil settlement with OIG. It typically requires a compliance program, monitoring, and independent review for a set period.

Question 7Healthcare Compliance and Regulatory Environment

A physician receives free office space from a laboratory that refers testing to that physician's practice. Under the Anti-Kickback Statute, this arrangement is most likely to be:

  1. Automatically lawful if the value is under $1,000
  2. Permitted because the physician is not a federal employee
  3. Permitted because office space is not a remuneration
  4. Problematic unless it fits an enumerated safe harbor Correct answer.

Explanation

The Anti-Kickback Statute prohibits remuneration intended to induce referrals, and free rent is remuneration. An arrangement is only protected if it squarely meets all elements of an applicable safe harbor.

Question 8Healthcare Compliance and Regulatory Environment

What is the primary role of a Recovery Audit Contractor engaged by CMS?

  1. To investigate criminal fraud referrals
  2. To license new healthcare providers
  3. To set the annual Medicare fee schedule
  4. To identify and recover improper Medicare payments Correct answer.

Explanation

Recovery Audit Contractors review claims to identify overpayments and underpayments and recover improper Medicare payments. They operate under contract with CMS and must follow specific review processes.

Question 9Healthcare Compliance and Regulatory Environment

An auditor finds that a hospital disclosed a breach of unsecured PHI affecting 700 individuals. Under the HIPAA Breach Notification Rule, what is the entity's obligation regarding HHS notification?

  1. Notify HHS without unreasonable delay and no later than 60 days after discovery Correct answer.
  2. Notify HHS only if the individuals file a complaint
  3. Notify HHS only at the end of the calendar year
  4. No notification to HHS is required

Explanation

Breaches affecting 500 or more individuals require notification to HHS without unreasonable delay and no later than 60 days after discovery. Smaller breaches may be reported annually.

Question 10Healthcare Compliance and Regulatory Environment

Which of the following is a key element of an effective healthcare compliance program according to HHS-OIG guidance?

  1. Eliminating internal audits to reduce documentation
  2. Restricting compliance training to executives only
  3. Maintaining a confidential disclosure program for reporting concerns Correct answer.
  4. Using compliance staff to set clinical treatment protocols

Explanation

OIG guidance identifies a confidential disclosure program as one of the seven core elements of an effective compliance program. Such programs encourage reporting of potential violations without fear of retaliation.

Question 11Healthcare Compliance and Regulatory Environment

The Physician Self-Referral Law, commonly known as the Stark Law, primarily prohibits which conduct?

  1. Paying for patient referrals in cash
  2. Marketing of prescription drugs to physicians
  3. Billing Medicaid for undocumented services
  4. Physician referrals of designated health services to entities with which the physician has a financial relationship, absent an exception Correct answer.

Explanation

The Stark Law is a strict liability statute that prohibits physician referrals of designated health services to entities with which the physician or an immediate family member has a financial relationship, unless an exception applies. It does not require proof of intent.

Question 12Healthcare Compliance and Regulatory Environment

An auditor is reviewing a physician compensation arrangement and notes it is set at fair market value, is in writing, has a term of one year, and does not vary with the volume or value of referrals. This arrangement most closely fits which Stark exception?

  1. The bona fide employment exception
  2. The physician recruitment exception
  3. The in-office ancillary services exception
  4. The fair market value compensation exception Correct answer.

Explanation

The fair market value compensation exception requires a written agreement, a term of at least one year, compensation at fair market value, and no tie to the volume or value of referrals. These facts track those elements.

Question 13Healthcare Compliance and Regulatory Environment

Under the Civil Monetary Penalties Law, which conduct is specifically prohibited regarding beneficiary inducements?

  1. Providing free educational materials about a condition
  2. Offering a discount on an unrelated retail purchase
  3. Offering remuneration to a Medicare beneficiary that the offeror knows is likely to influence the beneficiary to select a particular provider Correct answer.
  4. Waiving a copayment based on financial hardship under a documented policy

Explanation

The beneficiary inducement CMP prohibits remuneration to Medicare or Medicaid beneficiaries that is likely to influence their selection of a particular provider, unless a safe harbor or exception applies. Financial hardship waivers under a documented policy may qualify for protection.

Question 14Healthcare Compliance and Regulatory Environment

Which of the following best describes the role of a compliance officer in a healthcare organization?

  1. To oversee the compliance program and report to senior leadership and the board Correct answer.
  2. To provide legal representation in court proceedings
  3. To manage the organization's investment portfolio
  4. To conduct external financial statement audits

Explanation

The compliance officer is responsible for the day-to-day operation of the compliance program and should have direct access to senior leadership and the governing body. This independence supports effective oversight.

Question 15Healthcare Compliance and Regulatory Environment

The Emergency Medical Treatment and Labor Act requires Medicare-participating hospitals to provide which of the following?

  1. A medical screening examination and stabilizing treatment for emergency conditions Correct answer.
  2. Free care to all uninsured patients
  3. Admission to all patients requesting inpatient care
  4. Transportation to another facility of the patient's choice

Explanation

EMTALA requires hospitals with emergency departments to provide an appropriate medical screening examination and stabilizing treatment for emergency medical conditions regardless of ability to pay. Transfer is permitted only under specific stabilizing and certification conditions.

Question 16Healthcare Compliance and Regulatory Environment

An auditor discovers that a skilled nursing facility submitted claims for therapy services that were not provided. Which type of fraud does this most directly represent?

  1. Balancing
  2. Upcoding
  3. Unbundling
  4. Phantom billing Correct answer.

Explanation

Phantom billing involves submitting claims for services that were never rendered. It differs from upcoding, which involves billing a higher-level service than was provided.

Question 17Healthcare Compliance and Regulatory Environment

Which of the following is a characteristic of the Medicare Conditions of Participation?

  1. They are voluntary guidelines for hospitals
  2. They are federal requirements that providers must meet to participate in Medicare Correct answer.
  3. They are billing codes maintained by CMS
  4. They are state-issued licenses for individual clinicians

Explanation

The Conditions of Participation are federal health and safety requirements that providers must satisfy to participate in Medicare. Compliance is verified through surveys and certification.

Question 18Healthcare Compliance and Regulatory Environment

Under the HIPAA Security Rule, which safeguard category addresses access controls, audit controls, and integrity protections?

  1. Administrative safeguards
  2. Technical safeguards Correct answer.
  3. Physical safeguards
  4. Organizational requirements

Explanation

Technical safeguards under the Security Rule include access control, audit controls, integrity, person or entity authentication, and transmission security. These are technology-based protections for electronic PHI.

Question 19Healthcare Compliance and Regulatory Environment

An auditor reviewing a hospital's compliance with the Anti-Kickback Statute finds a discount arrangement with a supplier. Which condition is generally required for the discount safe harbor to protect the arrangement?

  1. The discount must be given only to Medicare beneficiaries
  2. The discount must be disclosed and accurately reflected in the claims submitted Correct answer.
  3. The discount must exceed 50 percent of the list price
  4. The discount must be undocumented to preserve confidentiality

Explanation

The discount safe harbor protects discounts only if they are disclosed and accurately reflected in the charges and claims submitted to the federal program. Undisclosed discounts do not qualify.

Question 20Healthcare Compliance and Regulatory Environment

Which of the following best describes the purpose of the OIG Work Plan?

  1. To list approved billing codes for the coming year
  2. To set hospital licensure standards
  3. To publish final Stark Law regulations
  4. To identify audit and enforcement priorities for the agency Correct answer.

Explanation

The OIG Work Plan describes the audits, evaluations, and enforcement priorities OIG intends to pursue. Providers use it to anticipate risk areas and focus their compliance efforts.

Question 21Healthcare Compliance and Regulatory Environment

A hospital employee reports a suspected billing violation to the compliance hotline in good faith. Which protection is most relevant to this situation?

  1. EMTALA transfer protection
  2. Stark Law exception protection
  3. Business associate agreement coverage
  4. Whistleblower anti-retaliation protection Correct answer.

Explanation

Whistleblower protections, including those in the False Claims Act and related statutes, prohibit retaliation against individuals who report suspected fraud in good faith. Compliance programs should reinforce these protections.

Question 22Healthcare Compliance and Regulatory Environment

Which of the following is a required element of a valid Advance Beneficiary Notice of Noncoverage?

  1. A guarantee that Medicare will pay the claim
  2. A physician's signature authorizing the notice
  3. A waiver of the beneficiary's appeal rights
  4. A statement that the beneficiary may be personally liable for the cost if Medicare denies payment Correct answer.

Explanation

An ABN must inform the beneficiary that the item or service may not be covered and that the beneficiary may be personally liable if Medicare denies payment. It must also explain the right to appeal.

Question 23Healthcare Compliance and Regulatory Environment

An auditor is assessing whether a hospital's arrangement with a referring physician group creates a Stark Law violation. Which factor is most decisive in the analysis?

  1. Whether a financial relationship exists and whether an exception applies Correct answer.
  2. Whether the physician group has a marketing budget
  3. Whether the physician is board certified
  4. Whether the hospital is for-profit or nonprofit

Explanation

Stark analysis centers on whether a financial relationship exists between the physician and the entity and whether an exception applies. If no exception fits, the referral prohibition is triggered regardless of intent.

Question 24Healthcare Compliance and Regulatory Environment

Which of the following best describes the purpose of the Medicare Exclusion List maintained by HHS-OIG?

  1. To list providers eligible for bonus payments
  2. To identify individuals and entities barred from participating in federal health care programs Correct answer.
  3. To track patient satisfaction scores
  4. To publish hospital accreditation results

Explanation

The OIG exclusion list identifies individuals and entities excluded from participation in federal health care programs. Billing for services furnished by excluded persons can result in civil monetary penalties.

Question 25Healthcare Compliance and Regulatory Environment

A compliance auditor notes that a provider's Medicare claims include services furnished by an individual who was excluded from federal programs on the date of service. What is the most likely consequence?

  1. The claims may be subject to denial and civil monetary penalties Correct answer.
  2. The claims are payable because the service was medically necessary
  3. The claims are payable if the provider did not know of the exclusion
  4. The claims are payable if the patient signed a consent form

Explanation

Federal law prohibits payment for items or services furnished by excluded individuals, and providers may face civil monetary penalties for submitting such claims. Medical necessity and patient consent do not cure the exclusion problem.

Question 26Healthcare Compliance and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following is classified as protected health information?

  1. A de-identified dataset stripped of all eighteen identifiers
  2. A hospital's aggregate surgical infection rate published in a public report
  3. A patient's name combined with a diagnosis code stored in a billing system Correct answer.
  4. General treatment protocols posted on a clinic's public website

Explanation

Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate. Combining a direct identifier such as a name with health data like a diagnosis code keeps the information identifiable and therefore protected. Aggregated or de-identified data and general clinical guidance lack the individual identifier element.

Question 27Healthcare Compliance and Regulatory Environment

A compliance auditor is reviewing how a covered entity handles a patient's request for restrictions on the use and disclosure of PHI. Which statement reflects the entity's obligation under the HIPAA Privacy Rule?

  1. The entity may grant a restriction only with written approval from HHS
  2. The entity may deny any restriction request without explanation
  3. The entity must agree to every restriction a patient requests
  4. The entity must grant a restriction when the patient has paid in full out of pocket for the item or service Correct answer.

Explanation

The HIPAA Privacy Rule requires a covered entity to agree to a patient's requested restriction when the request concerns a health care item or service the patient has paid for in full out of pocket. Other restriction requests may be declined because the entity is not generally required to accept them. HHS approval is not part of the process.

Question 28Healthcare Compliance and Regulatory Environment

Which federal law established the Medicare and Medicaid programs and set the foundation for the Conditions of Participation that participating providers must meet?

  1. The Clinical Laboratory Improvement Amendments of 1988
  2. The Social Security Amendments of 1965 Correct answer.
  3. The Patient Protection and Affordable Care Act of 2010
  4. The Health Insurance Portability and Accountability Act of 1996

Explanation

The Social Security Amendments of 1965 created the Medicare and Medicaid programs. That legislation established the framework under which participating facilities must meet federal health and safety requirements. Later laws amended the programs but did not create them.

Question 29Healthcare Compliance and Regulatory Environment

An auditor is reviewing a provider's Medicare cost report and finds that the provider is a freestanding facility owned by a local government unit. Which classification most accurately describes this provider?

  1. A proprietary provider
  2. A government provider Correct answer.
  3. A voluntary nonprofit provider
  4. A physician-owned specialty hospital

Explanation

Medicare provider classifications turn on ownership and control. A facility owned and operated by a governmental unit is classified as a government provider regardless of size. Proprietary and voluntary designations apply to for-profit and nonprofit private ownership respectively.

Question 30Healthcare Compliance and Regulatory Environment

An auditor is evaluating whether a hospital's new outpatient department must obtain a separate Medicare provider agreement and certification. Which factor most directly determines whether a separately located site can operate under the hospital's existing agreement?

  1. The site's participation in a commercial insurance network
  2. The site's compliance with the hospital Conditions of Participation as a provider-based entity Correct answer.
  3. The number of physicians employed at the site
  4. The geographic distance from the hospital's primary referral region

Explanation

When a hospital wishes to treat a separate location as part of its certified provider, the site must satisfy the provider-based requirements and the applicable Conditions of Participation. Those requirements address organizational and clinical integration with the main provider. Commercial contracting and physician headcount do not determine Medicare certification status.

Question 31Internal Audit Standards, Ethics, and Professional Practice

Which body issues the International Standards for the Professional Practice of Internal Auditing that healthcare internal auditors commonly follow?

  1. The Centers for Medicare & Medicaid Services
  2. The American Medical Association
  3. The Institute of Internal Auditors Correct answer.
  4. The Financial Accounting Standards Board

Explanation

The Institute of Internal Auditors (IIA) publishes the International Professional Practices Framework, which contains the Standards governing internal audit practice. The other bodies issue medical, reimbursement, or accounting guidance rather than internal audit standards.

Question 32Internal Audit Standards, Ethics, and Professional Practice

According to the IIA Code of Ethics, which principle requires internal auditors to perform work with honesty, diligence, and responsibility?

  1. Objectivity
  2. Confidentiality
  3. Competency
  4. Integrity Correct answer.

Explanation

The Integrity principle obligates internal auditors to perform their work with honesty, diligence, and responsibility and to observe the law. Objectivity concerns unbiased judgments, confidentiality concerns information protection, and competency concerns skills and knowledge.

Question 33Internal Audit Standards, Ethics, and Professional Practice

An internal auditor assigned to review a hospital's revenue cycle discovers her spouse is the department's billing manager. Under the Code of Ethics, what is the most appropriate action?

  1. Decline the assignment and disclose the relationship to engagement management Correct answer.
  2. Proceed with the engagement but disclose the relationship in the final report
  3. Proceed because the review is limited to documentation rather than the manager
  4. Delegate the fieldwork to a junior auditor while remaining as reviewer

Explanation

Objectivity requires auditors to avoid conflicts of interest and to disclose circumstances that could impair impartial judgment. A close family relationship with the area under review creates an appearance of impairment, so the auditor should decline and disclose so the assignment can be reassigned.

Question 34Internal Audit Standards, Ethics, and Professional Practice

What is the primary purpose of the internal audit activity's charter?

  1. To document the annual audit plan approved by management
  2. To define the activity's purpose, authority, and responsibility Correct answer.
  3. To list the professional certifications held by audit staff
  4. To record the results of the most recent external quality assessment

Explanation

The charter formally defines the internal audit activity's purpose, authority, and responsibility, and is approved by the board. It establishes the activity's position within the organization and its right of access to records and personnel.

Question 35Internal Audit Standards, Ethics, and Professional Practice

An internal audit activity reports functionally to the audit committee and administratively to the chief financial officer. Which arrangement best preserves independence?

  1. The CFO sets the audit universe and the audit committee reviews findings
  2. The CFO approves the audit plan and the audit committee receives a copy
  3. The audit committee approves the charter and the CFO approves the budget
  4. The audit committee approves the charter, plan, and budget, and evaluates the CAE Correct answer.

Explanation

Functional reporting to the board or audit committee should include approving the charter, audit plan, budget, and the chief audit executive's performance. Administrative reporting to management may cover routine operations but must not give management control over audit scope or resources.

Question 36Internal Audit Standards, Ethics, and Professional Practice

An auditor is reviewing a department whose manager previously supervised the auditor and remains a close mentor. This situation most directly threatens which attribute?

  1. Confidentiality
  2. Proficiency
  3. Due professional care
  4. Objectivity Correct answer.

Explanation

Objectivity is the mental attitude of impartiality, and a close personal or former supervisory relationship can bias the auditor's judgments. The other attributes concern information handling, skills, or the quality of work performed rather than impartiality.

Question 37Internal Audit Standards, Ethics, and Professional Practice

Which of the following best describes the role of the chief audit executive in an organization?

  1. To oversee the internal audit activity and report to the board Correct answer.
  2. To serve as the organization's compliance officer for billing regulations
  3. To manage the organization's enterprise risk management program
  4. To certify the accuracy of the organization's financial statements

Explanation

The chief audit executive manages the internal audit activity, ensures it operates in accordance with the Standards, and reports functionally to the board. Certifying financial statements and managing ERM or compliance are management responsibilities that would impair audit independence.

Question 38Internal Audit Standards, Ethics, and Professional Practice

During an engagement, an internal auditor is offered a paid consulting engagement by the vendor whose contract is being audited. What should the auditor do?

  1. Accept it if the fee is disclosed to the audit committee
  2. Accept it after the audit report is issued
  3. Accept it only if the vendor is not a covered entity
  4. Decline it because it creates a conflict of interest Correct answer.

Explanation

Accepting a benefit from a party whose activities are being audited creates a conflict of interest that impairs objectivity, regardless of timing or disclosure. The auditor should decline to avoid the appearance and substance of compromised independence.

Question 39Internal Audit Standards, Ethics, and Professional Practice

Which statement correctly describes the relationship between internal audit and the organization's external auditor?

  1. Internal audit may coordinate with the external auditor while retaining independent objectives Correct answer.
  2. The external auditor directs the internal audit workplan for the year
  3. Internal audit should report all findings only to the external auditor
  4. Internal audit must not communicate with the external auditor without management approval

Explanation

Coordination between internal and external audit is encouraged to improve efficiency, but internal audit remains independent and reports to the board. The external auditor does not direct internal audit's work, and communication is not prohibited.

Question 40Internal Audit Standards, Ethics, and Professional Practice

An auditor discovers that a manager has been falsifying documentation to obtain higher reimbursement. The manager offers to correct the records if the issue is not reported. What is the auditor's most appropriate response?

  1. Allow the correction and note it as a management improvement
  2. Delay reporting until the audit is complete and management responds
  3. Refer the matter to the external auditor and take no further action
  4. Report the matter through the organization's established ethics and fraud channels Correct answer.

Explanation

Integrity requires reporting suspected fraud through proper channels, and internal auditors must not allow concealment of irregularities. Deferring or delegating the report does not fulfill the auditor's obligation to escalate the matter.

Question 41Internal Audit Standards, Ethics, and Professional Practice

An internal audit activity uses a risk-based approach to develop its annual plan. Which factor should receive the greatest weight in prioritizing engagements?

  1. The number of prior audit findings in each area
  2. The size of the department's budget
  3. The preferences of the department managers
  4. The significance of risks to the organization's objectives Correct answer.

Explanation

A risk-based plan prioritizes engagements according to the significance of risks to the organization's objectives, informed by management input and the audit activity's own judgment. Budget size and prior findings are inputs but not the primary driver.

Question 42Internal Audit Standards, Ethics, and Professional Practice

Which of the following is an example of a consulting engagement rather than an assurance engagement?

  1. Reviewing claims processing controls to express a conclusion
  2. Testing compliance with HIPAA privacy requirements
  3. Assessing the adequacy of medication reconciliation controls
  4. Facilitating a risk workshop for a clinical department Correct answer.

Explanation

Consulting engagements are advisory in nature, such as facilitating a workshop, and generally do not involve the auditor expressing an independent conclusion on the subject matter. Assurance engagements involve expressing a conclusion based on evidence.

Question 43Internal Audit Standards, Ethics, and Professional Practice

Before accepting a consulting engagement, what should the internal auditor confirm?

  1. That the engagement will generate revenue for the audit activity
  2. That the engagement will be excluded from the audit plan
  3. That the client will accept all recommendations without change
  4. That the engagement will not impair objectivity or assume management responsibility Correct answer.

Explanation

Internal auditors may perform consulting services only when it does not impair objectivity and when they do not assume management responsibilities. Revenue generation, client acceptance of all recommendations, and exclusion from planning are not valid conditions.

Question 44Internal Audit Standards, Ethics, and Professional Practice

What is the primary purpose of an external quality assessment of the internal audit activity?

  1. To replace the annual risk assessment process
  2. To satisfy the external financial audit requirement
  3. To evaluate the performance of individual auditors for promotion
  4. To provide an independent evaluation of conformance with the Standards Correct answer.

Explanation

An external quality assessment provides independent assurance that the internal audit activity conforms with the Standards and the Code of Ethics and is performed periodically. It is not a personnel evaluation tool or a substitute for risk assessment.

Question 45Internal Audit Standards, Ethics, and Professional Practice

An auditor must test a highly technical clinical protocol but lacks the necessary medical expertise. According to the Standards, what should the auditor do?

  1. Exclude the area from the audit scope without documentation
  2. Obtain competent advice or assistance to complete the engagement Correct answer.
  3. Perform the test and rely on the department's verbal assurances
  4. Issue a qualified report without performing any testing

Explanation

When auditors lack the knowledge or skills required, they should obtain competent advice and assistance to ensure the engagement is performed with proficiency and due professional care. Ignoring the gap or excluding the area without basis does not meet the Standards.

Question 46Internal Audit Standards, Ethics, and Professional Practice

Which action best demonstrates due professional care in a healthcare internal audit engagement?

  1. Considering the cost of assurance against the benefit Correct answer.
  2. Relying solely on management's self-assessment
  3. Guaranteeing that no fraud exists in the audited area
  4. Testing every transaction in the population

Explanation

Due professional care requires considering the cost of assurance relative to the benefits obtained, along with the probability of significant errors and fraud. Auditors cannot guarantee the absence of fraud, and exhaustive testing or sole reliance on self-assessment is inconsistent with professional judgment.

Question 47Internal Audit Standards, Ethics, and Professional Practice

An internal auditor is preparing working papers for a claims audit. Which practice best supports the Standards on engagement records?

  1. Storing working papers in personal files without organizational control
  2. Retaining only the final report and discarding fieldwork notes
  3. Recording the engagement's objectives, procedures, evidence, and conclusions Correct answer.
  4. Recording only findings that management disputes

Explanation

Engagement records should document the objectives, scope, procedures performed, evidence gathered, and conclusions reached, providing support for the reported results. Retaining only reports, discarding notes, or keeping uncontrolled personal files undermines the record.

Question 48Internal Audit Standards, Ethics, and Professional Practice

A hospital's audit committee asks internal audit to review a process and also implement the recommended corrective actions. How should the chief audit executive respond?

  1. Assign implementation to the auditor who performed the review
  2. Accept the review and decline to implement corrective actions Correct answer.
  3. Decline the review because implementation is also requested
  4. Accept both roles because the committee requested them

Explanation

Performing both assurance and implementation places the auditor in a management role and creates a self-review threat to objectivity. Internal audit may review the process but should not take responsibility for implementing corrective actions.

Question 49Internal Audit Standards, Ethics, and Professional Practice

An auditor identifies a significant risk that management has chosen to accept without action. What is the auditor's most appropriate course?

  1. Document the risk acceptance and communicate it to the board Correct answer.
  2. Escalate directly to external regulators without internal reporting
  3. Suppress the finding because management accepted the risk
  4. Override management's decision and report the risk as a fraud

Explanation

Management owns risk decisions, but internal audit must communicate significant risks and management's acceptance to the board. The auditor documents the acceptance and elevates it rather than overriding or concealing it.

Question 50Internal Audit Standards, Ethics, and Professional Practice

Which situation most clearly indicates that an internal auditor's objectivity has been impaired?

  1. The auditor uses data analytics tools to test claims
  2. The auditor requests additional evidence from the client
  3. The auditor previously managed the department now being audited Correct answer.
  4. The auditor interviews staff across multiple shifts

Explanation

Objectivity is impaired when an auditor audits an activity for which they previously had operational responsibility, creating a self-review threat. Using tools, requesting evidence, and interviewing staff are normal audit procedures.