I85PREP
⌘ K
Bulgarian Public Sector Internal Auditor Exam study materials
Bulgarian Public Sector Internal Auditor Exam study resources

Bulgarian Public Sector Internal Auditor Exam practice questions

One question at a time. Build your Bulgarian Public Sector Internal Auditor Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Legal and institutional framework of public sector internal audit in Bulgaria

Which body is the central harmonising institution for internal audit in the Bulgarian public sector, issuing methodological guidance and coordinating the internal audit function across public organisations?

  1. The Ministry of Finance, through its central harmonisation unit for internal audit Correct answer.
  2. The National Assembly budget committee
  3. The Public Financial Inspection Agency
  4. The Bulgarian National Audit Office

Explanation

Under the Public Sector Internal Audit Act the Minister of Finance exercises central harmonisation of internal audit, issuing methodology and coordinating the activity across public sector organisations. The National Audit Office performs external audit, not internal audit harmonisation.

Question 2Legal and institutional framework of public sector internal audit in Bulgaria

In a Bulgarian public sector organisation, to whom should the head of the internal audit unit report functionally so that independence is preserved?

  1. To the financial controller of the organisation
  2. To the external auditor of the organisation
  3. To the director of the human resources department
  4. To the head of the organisation, with the audit committee informed Correct answer.

Explanation

The internal audit unit reports functionally to the head of the organisation, who is responsible for ensuring its independence, and the audit committee oversees the audit activity. Reporting to a manager whose work is audited would compromise objectivity.

Question 3Legal and institutional framework of public sector internal audit in Bulgaria

What is the primary purpose of the internal audit activity in a Bulgarian public sector organisation?

  1. To prepare the annual financial statements for certification
  2. To add value and improve the organisation's operations through independent assurance and consulting Correct answer.
  3. To authorise payments before they are made
  4. To represent the organisation in relations with the National Audit Office

Explanation

Internal audit provides independent and objective assurance and consulting designed to add value and improve an organisation's operations. It does not take over management functions such as accounting or payment authorisation.

Question 4Legal and institutional framework of public sector internal audit in Bulgaria

Which statement best describes the internal audit charter of a Bulgarian public sector organisation?

  1. A formal document approved by the head of the organisation that defines the purpose, authority and responsibility of internal audit Correct answer.
  2. An internal note issued by the audit unit without management approval
  3. A contract between the organisation and an external audit firm
  4. A government regulation adopted by the Council of Ministers for each organisation

Explanation

The internal audit charter is a formal document approved by the head of the organisation that establishes the position of internal audit, its authority and its responsibilities. It is organisation-specific and requires top-level approval to give the function standing.

Question 5Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following is a core principle that the internal auditor must observe when performing an audit engagement?

  1. Efficiency, meaning the auditor completes engagements within a fixed number of days
  2. Objectivity, meaning the auditor avoids conflicts of interest and does not subordinate judgement to others Correct answer.
  3. Confidentiality toward the head of the organisation only
  4. Flexibility, meaning the auditor may amend findings to match management preferences

Explanation

Objectivity requires internal auditors to avoid conflicts of interest and not to subordinate their judgement on audit matters to others. Confidentiality applies broadly and is not limited to one person, and findings cannot be adjusted to suit management.

Question 6Legal and institutional framework of public sector internal audit in Bulgaria

According to the Bulgarian framework, who appoints and dismisses the head of the internal audit unit in a public sector organisation?

  1. The Minister of Finance personally
  2. The audit committee by simple majority
  3. The National Audit Office
  4. The head of the organisation, following the procedure set in the applicable legislation Correct answer.

Explanation

The head of the internal audit unit is appointed and dismissed by the head of the organisation under the procedure established by the Public Sector Internal Audit Act. The Minister of Finance and the National Audit Office do not make individual appointments.

Question 7Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following best describes the role of the audit committee in a Bulgarian public sector organisation?

  1. It supports the head of the organisation by monitoring and advising on internal audit and risk management Correct answer.
  2. It performs audit engagements alongside the internal audit unit
  3. It approves the organisation's annual budget
  4. It replaces the internal audit unit when staffing is insufficient

Explanation

The audit committee is an advisory body that supports the head of the organisation by monitoring the internal audit activity, risk management and internal control. It does not perform audits itself or approve the budget.

Question 8Legal and institutional framework of public sector internal audit in Bulgaria

What is the main purpose of the annual risk-based audit plan prepared by the internal audit unit?

  1. To prioritise audit engagements according to the risks facing the organisation Correct answer.
  2. To list every transaction the organisation will process during the year
  3. To set the salaries of the audit staff
  4. To replace the organisation's strategic plan

Explanation

The risk-based audit plan allocates limited audit resources to the areas of greatest risk, ensuring coverage where assurance is most needed. It is not a transaction listing, a payroll tool, or a substitute for strategic planning.

Question 9Legal and institutional framework of public sector internal audit in Bulgaria

A newly appointed internal auditor is asked by the head of the finance department to help design and then operate a new procurement control system. How should the auditor respond?

  1. Accept, because assisting management improves the auditor's knowledge
  2. Decline to operate the system, because assuming management responsibility would impair objectivity Correct answer.
  3. Decline all involvement, because auditors may never provide advice
  4. Accept only if the audit committee is not informed

Explanation

Internal auditors may provide advice, but they must not assume management responsibility for designing and operating controls, because this would impair their objectivity when later auditing those controls. Consulting is permissible; operational responsibility is not.

Question 10Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following matters is normally outside the scope of the internal audit function in a public sector organisation?

  1. Preparing and signing the organisation's annual financial statements Correct answer.
  2. Assessing compliance with laws and regulations
  3. Evaluating the effectiveness of internal controls
  4. Reviewing the reliability of financial reporting processes

Explanation

Internal audit evaluates and advises but does not prepare and sign the financial statements, which is a management responsibility. Auditing controls, compliance and reporting reliability are all legitimate audit areas.

Question 11Legal and institutional framework of public sector internal audit in Bulgaria

An internal auditor discovers that a close relative is the manager of the department scheduled for audit. What is the most appropriate course of action?

  1. Ask the relative to provide the audit evidence directly
  2. Proceed with the engagement without disclosure
  3. Conceal the relationship but rely on personal integrity
  4. Disclose the relationship and request reassignment to preserve objectivity Correct answer.

Explanation

A close personal relationship with an auditee creates a conflict of interest that must be disclosed and managed, typically by reassigning the engagement. Integrity alone does not resolve the appearance of bias, and using the relative as the evidence source compounds the conflict.

Question 12Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following best reflects the relationship between internal audit and the National Audit Office in Bulgaria?

  1. The National Audit Office directs the daily work of internal auditors
  2. They are separate functions, and internal audit may rely on its own work while the external auditor may use internal audit results Correct answer.
  3. Internal audit is subordinate to the National Audit Office and reports to it
  4. Internal audit and the National Audit Office are the same function under different names

Explanation

Internal audit and external audit by the National Audit Office are distinct functions with different reporting lines and objectives. They cooperate, and each may use the other's work, but neither directs the other's daily operations.

Question 13Legal and institutional framework of public sector internal audit in Bulgaria

What must an internal auditor generally do upon completing an engagement before issuing the final report?

  1. Delete working papers that contradict management's view
  2. Submit the draft to the National Audit Office for endorsement
  3. Discuss the findings and conclusions with the auditee to confirm factual accuracy Correct answer.
  4. Obtain the auditee's approval of the audit opinion

Explanation

Before finalising, the auditor discusses findings and conclusions with the auditee to confirm factual accuracy and give the auditee an opportunity to respond. The auditee does not approve the audit opinion, and working papers must be retained.

Question 14Legal and institutional framework of public sector internal audit in Bulgaria

An audit committee reviews the internal audit unit's performance and notes that management has not responded to several high-risk findings. What is the committee's most appropriate action?

  1. Issue a binding instruction directly to the operational staff
  2. Conduct the corrective actions itself
  3. Escalate the unresolved findings to the head of the organisation and monitor follow-up Correct answer.
  4. Close the findings to avoid conflict with management

Explanation

The audit committee supports the head of the organisation by monitoring whether management acts on audit findings and by escalating unresolved high-risk matters. It does not issue operational instructions, perform corrective actions, or close findings inappropriately.

Question 15Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following is the best example of an assurance engagement performed by a public sector internal auditor?

  1. Advice to management on drafting a new internal policy
  2. Training staff on fraud awareness
  3. Facilitating a risk workshop for a department
  4. An objective examination of evidence to provide an independent conclusion on a control process Correct answer.

Explanation

Assurance engagements involve the objective examination of evidence to provide an independent conclusion about a process, control or subject matter. Advice, training and facilitation are consulting services rather than assurance.

Question 16Legal and institutional framework of public sector internal audit in Bulgaria

Which document typically sets out the mission, scope, and reporting responsibilities of the internal audit unit and is reviewed periodically?

  1. The internal audit charter Correct answer.
  2. The collective labour agreement
  3. The organisation's annual budget
  4. The procurement plan

Explanation

The internal audit charter defines the mission, scope, authority and reporting responsibilities of the audit unit and is reviewed periodically to remain current. Budgets, labour agreements and procurement plans do not define the audit mandate.

Question 17Legal and institutional framework of public sector internal audit in Bulgaria

An internal auditor is offered a gift by a supplier whose contract is under audit. What is the most appropriate response under professional ethics?

  1. Accept it only after the engagement is finished
  2. Accept it and record it in the working papers
  3. Decline the gift because accepting it could impair or appear to impair objectivity Correct answer.
  4. Accept it if its value is modest

Explanation

Accepting gifts from parties whose activities are audited can create or appear to create an obligation that compromises objectivity. The safe and ethical course is to decline, regardless of value or timing.

Question 18Legal and institutional framework of public sector internal audit in Bulgaria

Which statement best describes the concept of 'three lines of defence' as it applies to a public sector organisation?

  1. Operational management, risk and compliance functions, and internal audit each play distinct roles in managing risk Correct answer.
  2. The audit committee manages operational risk directly
  3. External audit forms the first line of defence
  4. Internal audit alone is responsible for all risk management

Explanation

The three lines model assigns risk ownership and control to operational management, oversight to risk and compliance functions, and independent assurance to internal audit. Internal audit does not own or manage risk, and external audit is not part of the internal lines.

Question 19Legal and institutional framework of public sector internal audit in Bulgaria

What is the required professional competence expectation for an internal auditor under the Bulgarian framework?

  1. Holding only an accounting degree, regardless of audit training
  2. Possessing the knowledge, skills and qualifications necessary to perform audit work, with continuing professional development Correct answer.
  3. Having prior employment in the audited department
  4. Relying solely on the audit unit head's competence

Explanation

Internal auditors must possess the knowledge, skills and other competencies needed to perform their responsibilities and must maintain them through continuing professional development. A single degree or reliance on another person's competence is insufficient.

Question 20Legal and institutional framework of public sector internal audit in Bulgaria

An organisation has a small internal audit unit and wishes to outsource an engagement to an external provider. Which condition is most important to preserve the function's integrity?

  1. The provider must be selected solely on the lowest price
  2. The provider must be independent of the activity audited and work under the organisation's audit charter Correct answer.
  3. The provider must be a former employee of the audited department
  4. The provider must report to the audited department's manager

Explanation

Outsourced audit work must meet the same independence and objectivity standards as in-house work and operate under the organisation's audit charter. Price alone, prior ties to the audited area, or reporting to the auditee would undermine those standards.

Question 21Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following best describes the follow-up process an internal auditor should perform after issuing recommendations?

  1. Transferring responsibility for follow-up to the external auditor
  2. Implementing the recommendations personally
  3. Ignoring implementation because the report has been issued
  4. Monitoring whether management has implemented agreed actions and reporting unresolved matters Correct answer.

Explanation

The auditor monitors management's implementation of agreed actions and escalates matters that remain unresolved. Implementation itself is management's responsibility, and the auditor cannot delegate follow-up to the external auditor.

Question 22Legal and institutional framework of public sector internal audit in Bulgaria

Which of the following situations most clearly indicates a threat to the independence of an internal audit unit?

  1. The audit committee reviews the audit plan
  2. The head of the audit unit also serves as the organisation's chief accountant Correct answer.
  3. The audit plan is approved by the head of the organisation
  4. The audit unit reports to the head of the organisation

Explanation

Combining the role of head of internal audit with chief accountant means the auditor would audit work they themselves perform, creating a serious self-review threat. Reporting to and obtaining plan approval from the head of the organisation are normal, appropriate arrangements.

Question 23Legal and institutional framework of public sector internal audit in Bulgaria

An auditor is asked to audit a process that they previously designed and implemented two years earlier in the same organisation. What is the most appropriate response?

  1. Proceed but omit the prior involvement from the working papers
  2. Proceed because two years have passed
  3. Disclose the prior involvement and arrange for an independent auditor to conduct the engagement Correct answer.
  4. Ask management to confirm that the prior work was adequate

Explanation

Having designed and implemented the process creates a self-review threat that persists regardless of elapsed time. The appropriate response is to disclose the involvement and assign the engagement to an independent auditor, ensuring objectivity is preserved.

Question 24Legal and institutional framework of public sector internal audit in Bulgaria

A public sector organisation wants to give its internal audit unit a role in investigating a suspected fraud while also requiring it to recommend improvements to fraud controls. How should this be handled?

  1. The two roles may be combined, provided the unit maintains objectivity and clearly separates investigation duties from control advice Correct answer.
  2. The investigation must be delegated to the audited department
  3. The unit must abandon the control advice because auditors cannot advise on controls
  4. The unit must abandon the investigation because auditors cannot investigate fraud

Explanation

Internal audit can both investigate fraud and advise on fraud controls, provided it maintains objectivity and manages any self-review threat by separating the roles appropriately. Auditors are not barred from fraud work or from advising on controls.

Question 25Legal and institutional framework of public sector internal audit in Bulgaria

Which statement best captures the relationship between the internal audit charter and the audit committee's oversight role?

  1. The committee amends the charter without involving the head of the organisation
  2. The charter is irrelevant to the committee's oversight
  3. The charter is confidential to the audit unit and is not shared with the committee
  4. The charter should be reviewed with the audit committee, which advises the head of the organisation on its adequacy Correct answer.

Explanation

The audit committee advises the head of the organisation on the adequacy of the internal audit charter and periodically reviews it. The charter is not a secret document, and the committee does not amend it unilaterally without the head of the organisation.

Question 26Legal and institutional framework of public sector internal audit in Bulgaria

Which body is responsible for the external independent assessment (quality review) of the internal audit activity in a Bulgarian public sector organisation at least once every five years?

  1. An independent external assessor or assessment team meeting the qualification criteria set in the internal audit methodology Correct answer.
  2. The National Audit Office acting in its regular financial audit capacity
  3. The accounting department of the organisation under a mandate from the executive director
  4. The organisation's own internal audit unit acting through self-assessment alone

Explanation

The internationally recognised standard requires an external quality assessment of the internal audit activity at least once every five years, performed by a qualified independent assessor or team outside the organisation. Self-assessment alone does not satisfy this requirement, and neither the accounting department nor the external financial auditor performs this role. The purpose is to give objective confirmation that the internal audit function conforms to professional standards.

Question 27Legal and institutional framework of public sector internal audit in Bulgaria

Under the Bulgarian public sector internal audit framework, which of the following best describes the status of the internal audit unit within the organisation?

  1. It operates as a subordinate section of the finance directorate and follows the finance director's instructions
  2. It is a temporary working group formed only when a specific audit is commissioned by the minister
  3. It is part of the external audit structure of the state and answers to the National Audit Office
  4. It is functionally independent of management and reports to the head of the organisation, with a direct reporting line to the audit committee Correct answer.

Explanation

The internal audit unit must be positioned so that it can carry out its work objectively and report its findings without management interference. This is achieved by functional independence, a direct reporting line to the head of the organisation, and reporting to the audit committee. Subordination to the finance directorate or ad hoc formation would destroy that independence.

Question 28Legal and institutional framework of public sector internal audit in Bulgaria

An internal auditor has completed fieldwork on a procurement process and drafted findings. Before the report is finalised, management disagrees with one finding and states that the supporting evidence is incomplete. What is the most appropriate professional response by the auditor?

  1. Accept management's view without further review because management owns the process
  2. Escalate the matter immediately to the prosecution authorities before any further discussion
  3. Re-examine the evidence, discuss the disagreement with management, and document management's position in the report if the finding is upheld Correct answer.
  4. Remove the disputed finding so that the report can be issued without delay

Explanation

The auditor must ensure findings are supported by sufficient, reliable evidence and should give management the opportunity to respond before the report is finalised. Where disagreement persists and the finding stands, management's comments are recorded in the report to preserve balance and accuracy. Simply deleting the finding or capitulating undermines the assurance role, while immediate criminal referral is disproportionate.

Question 29Legal and institutional framework of public sector internal audit in Bulgaria

An internal auditor is assigned to audit the payroll system and, in the same period, is asked to prepare and post the monthly payroll journal entries because the payroll officer is on long leave. What is the principal professional concern with accepting this task?

  1. It creates a self-review threat, because the auditor would later be auditing work they performed themselves Correct answer.
  2. It raises no concern because payroll is a financial process outside the audit universe
  3. It is acceptable because the task is temporary and the payroll officer will return
  4. It is acceptable provided the auditor works overtime and keeps a private record of the entries

Explanation

Performing operational tasks that the auditor may later have to audit compromises objectivity and creates a self-review threat. The auditor should decline such assignments or, where the organisation insists, ensure the task is clearly separated and disclosed so that assurance on payroll is not given by the same person. Temporary duration or private record-keeping does not remove the conflict.

Question 30Legal and institutional framework of public sector internal audit in Bulgaria

A public sector organisation's internal audit unit reports to the audit committee. The head of the unit is invited to attend audit committee meetings only when a report is tabled, and the committee never reviews the unit's annual plan or budget. Which conclusion best follows from this arrangement?

  1. The arrangement is sound, because the unit's budget is a management matter unrelated to audit independence
  2. The oversight link is too weak, because the audit committee should review the audit plan and resources and support the unit's independence Correct answer.
  3. The arrangement is sound, because the committee's role is limited to receiving completed audit reports
  4. The arrangement is sound, because the head of the unit should not attend meetings where management is present

Explanation

An effective audit committee oversees the internal audit function, including approving or reviewing the risk-based plan, monitoring resources and performance, and protecting the unit's independence. Restricting contact to report presentations leaves the committee unable to exercise that oversight. Resource and planning decisions are precisely the matters through which the committee safeguards the function's capacity and objectivity.

Question 31International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Under the IPPF, which two mandatory components together form the core of the International Standards for the Professional Practice of Internal Auditing?

  1. The Standards and the Code of Ethics Correct answer.
  2. The Mission of Internal Audit and the Core Principles
  3. The Definition of Internal Auditing and the Code of Ethics
  4. The Standards and the Core Principles

Explanation

The mandatory elements of the IPPF include the Core Principles, the Code of Ethics, the Standards, and the Definition of Internal Auditing, but the Standards themselves are structured around two mandatory parts: the Attribute Standards and the Performance Standards, and the Code of Ethics is a separate mandatory element. The Standards and the Code of Ethics are the two components that together constitute the mandatory guidance most directly governing engagements.

Question 32International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

An internal auditor discovers that a close family member is the director of an area the auditor has been assigned to review. According to the Code of Ethics, what is the most appropriate course of action?

  1. Proceed with the engagement and disclose the relationship in the final report
  2. Proceed because family relationships are outside the Code's scope
  3. Decline the assignment and disclose the conflict so it can be reassigned Correct answer.
  4. Perform the review but have a colleague sign the engagement report

Explanation

The Code of Ethics requires internal auditors to avoid conflicts of interest and to disclose any impairment to objectivity. When a close family relationship creates a conflict, the auditor should not perform the engagement and must disclose the situation so that appropriate reassignment occurs.

Question 33International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Which statement best describes the principle of integrity as set out in the Code of Ethics?

  1. Internal auditors shall engage only in services for which they have competence
  2. Internal auditors shall be cautious in using information acquired in the course of duties
  3. Internal auditors shall perform work with honesty, diligence, and responsibility Correct answer.
  4. Internal auditors shall disclose all material facts that could distort reporting

Explanation

Integrity is the first principle in the Code of Ethics and requires internal auditors to perform their work with honesty, diligence, and responsibility. The other principles address objectivity, confidentiality, and competency respectively.

Question 34International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

According to the Standards, the chief audit executive must report functionally to whom in order to ensure independence?

  1. The external auditor of the organization
  2. The operational managers of audited units
  3. The chief financial officer of the organization
  4. The board or an equivalent governing body Correct answer.

Explanation

The Standards require the chief audit executive to report functionally to the board so that the internal audit activity's independence is protected. Functional reporting to the board supports the CAE's ability to set audit scope and report results without management interference.

Question 35International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Which of the following best defines the purpose of the Standards within the IPPF?

  1. To set mandatory requirements for the internal audit activity and evaluate its performance Correct answer.
  2. To explain the history and evolution of the internal audit profession
  3. To provide a training curriculum for new internal auditors
  4. To describe recommended practices that internal auditors may adopt voluntarily

Explanation

The Standards are principle-focused mandatory requirements consisting of statements, interpretations, and considerations for implementation. They serve to delineate basic principles, provide a framework for performing and promoting internal auditing, establish the basis for evaluating the internal audit activity, and foster improved organizational processes.

Question 36International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

An internal auditor is asked by a manager to omit a significant control weakness from a draft report because it might embarrass the department. What should the auditor do?

  1. Report the weakness fully and objectively as required by the Standards Correct answer.
  2. Report the weakness only to the manager privately
  3. Delay reporting until the manager agrees to its inclusion
  4. Omit the finding to preserve a cooperative working relationship

Explanation

The Standards require internal auditors to communicate engagement results accurately and objectively, and the Code of Ethics requires honesty in reporting. Pressure from management does not justify suppressing a significant finding; the auditor must report it through proper channels.

Question 37International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Which of the following is a mandatory element of the IPPF that applies to both individual internal auditors and the internal audit activity?

  1. Practice Advisories
  2. The Code of Ethics Correct answer.
  3. Supplemental Guidance
  4. Implementation Guides

Explanation

The Code of Ethics is a mandatory element of the IPPF and applies to individuals and entities that provide internal audit services. Implementation and supplemental guidance are non-mandatory supporting materials.

Question 38International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

The chief audit executive of a public sector entity is asked to take operational responsibility for a new procurement system. What does the Standards guidance indicate about this request?

  1. Accepting operational responsibility impairs independence and should be declined Correct answer.
  2. The CAE may accept if the internal audit activity is adequately staffed
  3. The CAE may accept because public sector entities need flexibility
  4. The CAE should accept if the board approves the arrangement

Explanation

The Standards state that if the CAE assumes operational responsibilities, objectivity is presumed to be impaired and independence is compromised. Accepting responsibility for a system the internal audit activity would later review creates a self-review threat that cannot be cured by approval or staffing.

Question 39International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Under the Standards, what is the primary purpose of an internal audit charter?

  1. To record the budget approved for the internal audit activity
  2. To list the qualifications of each internal auditor
  3. To document the audit plan for the coming year
  4. To formally define the internal audit activity's purpose, authority, and responsibility Correct answer.

Explanation

The internal audit charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility and is approved by the board. It establishes the activity's position within the organization and the nature of the reporting relationship.

Question 40International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

An internal auditor is preparing working papers on a sensitive investigation. Which action is most consistent with the confidentiality principle?

  1. Storing the papers securely and limiting access to those with a need to know Correct answer.
  2. Sharing the working papers with colleagues outside the engagement for general discussion
  3. Retaining copies on a personal device for later reference
  4. Publishing the findings on the organization's internal website

Explanation

The confidentiality principle requires internal auditors to be prudent in the use and protection of information acquired in the course of their duties. Sensitive investigation materials should be secured and disclosed only to those with a legitimate need to know.

Question 41International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Which of the following best describes the relationship between the Core Principles and the Standards?

  1. The Core Principles apply only to private sector organizations
  2. The Core Principles are a mandatory element that the Standards help implement Correct answer.
  3. The Core Principles replace the Standards for small internal audit activities
  4. The Core Principles are optional guidance for mature internal audit functions

Explanation

The Core Principles form a mandatory element of the IPPF and articulate the fundamental principles of the profession. The Standards provide the requirements through which those principles are put into practice.

Question 42International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

A public sector internal auditor is offered a gift of substantial value by a supplier whose contract is being audited. How should the auditor respond under the Code of Ethics?

  1. Accept the gift and disclose it in the audit report
  2. Accept the gift only if it is shared with the whole audit team
  3. Accept the gift because it does not influence the auditor's judgment
  4. Decline the gift because it could impair objectivity and create an appearance of impropriety Correct answer.

Explanation

The Code of Ethics requires internal auditors to avoid activities or relationships that could impair, or appear to impair, their objectivity. Accepting a substantial gift from an audited supplier creates an unacceptable conflict and appearance of impropriety, so it should be declined.

Question 43International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

What does the Standards guidance require regarding the internal audit activity's quality assurance and improvement program?

  1. It must rely solely on self-assessment by individual auditors
  2. It must include internal assessments and an external assessment at least once every five years Correct answer.
  3. It must be performed by the external audit firm annually
  4. It must be conducted only when the board specifically requests it

Explanation

The Standards require the CAE to develop and maintain a quality assurance and improvement program covering all aspects of the internal audit activity. This includes ongoing and periodic internal assessments and an external assessment conducted at least once every five years by a qualified, independent assessor or assessment team.

Question 44International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

An internal auditor lacks the knowledge needed to evaluate a specialized IT security control. What is the most appropriate action under the Standards?

  1. Delegate the entire engagement conclusion to the IT department
  2. Exclude the control from the audit universe permanently
  3. Seek competent advice or assistance while retaining responsibility for the conclusion Correct answer.
  4. Perform the review anyway and note the limitation in the report

Explanation

The Standards require internal auditors to possess or obtain the knowledge, skills, and other competencies needed to perform their responsibilities. Where specialized expertise is lacking, the auditor should obtain competent advice or assistance while remaining responsible for the conclusions reached.

Question 45International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Which of the following situations most clearly demonstrates a threat to the objectivity of an internal auditor?

  1. The auditor previously managed the process now being audited within the past year Correct answer.
  2. The auditor attends professional training on public sector auditing
  3. The auditor coordinates the timing of the engagement with the auditee
  4. The auditor uses a standardized audit program approved by the CAE

Explanation

Objectivity is compromised when an auditor evaluates a process for which they recently had operational responsibility, creating a self-review threat. Standardized programs, training, and scheduling coordination do not impair objectivity.

Question 46International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

The Standards address the CAE's responsibility to communicate the internal audit activity's plans and resource requirements to whom?

  1. To senior management and the board for review and approval Correct answer.
  2. To the public through an annual report
  3. Only to the external auditor
  4. To the individual operational managers being audited

Explanation

The Standards require the CAE to communicate the internal audit activity's plans and resource requirements to senior management and the board for review and approval. This supports the activity's authority and alignment with organizational objectives.

Question 47International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

An internal auditor is asked to audit a process in which the auditor's spouse is a supervisor. Which combination of Code principles is most directly engaged?

  1. Confidentiality and competency
  2. Objectivity and integrity Correct answer.
  3. Competency and integrity
  4. Confidentiality and objectivity

Explanation

A close family relationship with a supervisor in the audited area creates a conflict of interest that threatens objectivity, and the auditor's obligation to act honestly requires disclosing and avoiding the conflict, engaging integrity. Confidentiality and competency are not the primary principles at issue here.

Question 48International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Under the Standards, the internal audit activity's scope of work must include which of the following?

  1. Only the activities requested by the external auditor
  2. Exclusively compliance with laws and regulations
  3. Evaluation of governance, risk management, and control processes Correct answer.
  4. Only financial and accounting controls

Explanation

The Standards require the internal audit activity to evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach. Limiting scope to financial controls or compliance alone would not meet this requirement.

Question 49International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

Which statement about the Code of Ethics' applicability is most accurate?

  1. It applies only to certified internal auditors
  2. It applies only when the board formally adopts it
  3. It applies to individuals and entities that perform internal audit services Correct answer.
  4. It applies only to engagements in the private sector

Explanation

The Code of Ethics applies to individuals and entities that provide internal audit services, regardless of whether they hold a certification. It is a mandatory element of the IPPF and is not limited by sector or conditional on separate board adoption.

Question 50International Standards for the Professional Practice of Internal Auditing and the Code of Ethics

A CAE is pressured by the chief executive to reduce the audit scope on a politically sensitive program. Which action best reflects the Standards?

  1. Comply with the request and document the reduced scope
  2. Escalate the matter to the board to protect the activity's independence Correct answer.
  3. Postpone the engagement indefinitely to avoid conflict
  4. Reduce the scope but add a general disclaimer to the report

Explanation

The Standards require the CAE to report functionally to the board and to communicate any interference that threatens the internal audit activity's independence. Escalating scope restrictions to the board protects the activity's ability to determine its own scope objectively.