I85PREP
⌘ K
CFSQA study materials
CFSQA study resources

CFSQA practice questions

One question at a time. Build your CFSQA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Audit Fundamentals, Standards, and Ethics

Under the IIA Global Internal Audit Standards, which two components together make up the mandatory elements that an internal audit function must conform with?

  1. The competency framework and the continuing education log
  2. The definition of internal auditing and the code of ethics only
  3. The quality assessment manual and the charter template
  4. The five domain-level principles and the standards themselves Correct answer.

Explanation

The current Global Internal Audit Standards structure mandatory conformance around the domain-level principles and the numbered standards that sit beneath them. Conformance is assessed against those mandatory elements, while the glossary and other guidance are supportive rather than binding.

Question 2Audit Fundamentals, Standards, and Ethics

An internal auditor is asked to lead an engagement on the same payroll process she managed two years ago before transferring to the audit function. What is the most appropriate action under the IIA Code of Ethics?

  1. Accept the engagement because two years have passed since the transfer
  2. Accept it only if the payroll manager also signs the report
  3. Decline the assignment or disclose the impairment so it can be managed Correct answer.
  4. Accept it provided a colleague reviews the final report

Explanation

Objectivity is impaired when an auditor audits activity for which she previously had operational responsibility, and the impairment persists regardless of a fixed waiting period. The auditor should decline the assignment or disclose the conflict so leadership can reassign or mitigate it.

Question 3Audit Fundamentals, Standards, and Ethics

Which statement best describes the purpose of the internal audit charter?

  1. It records the annual audit plan approved by management
  2. It lists the audit procedures to be performed on each engagement
  3. It documents the auditor's professional certifications
  4. It formally defines the internal audit activity's purpose, authority, and responsibility Correct answer.

Explanation

The charter is the formal document that establishes the internal audit activity's position within the organization and defines its purpose, authority, and responsibility. It must be approved by the board and reviewed periodically for continued adequacy.

Question 4Audit Fundamentals, Standards, and Ethics

During an engagement, an internal auditor discovers evidence suggesting senior management may have circumvented a key control. According to the standards, what should the chief audit executive do?

  1. Report the matter to the board or audit committee Correct answer.
  2. Resolve the issue directly with the responsible manager and close the engagement
  3. Wait until the next scheduled audit cycle to raise the concern
  4. Keep the matter confidential to protect the audit function's reputation

Explanation

Elevating significant risk and control matters, especially those involving senior management, to the board or audit committee is a core governance responsibility of the chief audit executive. Suppressing or delaying such communication would undermine the function's independence and fiduciary role.

Question 5Audit Fundamentals, Standards, and Ethics

What is the primary purpose of the internal audit activity's quality assurance and improvement program?

  1. To satisfy external regulator filing requirements
  2. To benchmark audit fees against peer organizations
  3. To replace the need for supervisory review of engagements
  4. To evaluate conformance with the standards and drive continuous improvement Correct answer.

Explanation

A quality assurance and improvement program is designed to assess whether the internal audit activity conforms with the standards and the code of ethics, and to identify opportunities for improvement. It encompasses both internal and external assessments.

Question 6Audit Fundamentals, Standards, and Ethics

An internal auditor is offered an expensive gift by a vendor whose contract she is currently auditing. Which course of action best aligns with the IIA Code of Ethics?

  1. Accept it only after the engagement report is issued
  2. Accept it if it is disclosed in the engagement workpapers
  3. Decline the gift because it could impair or appear to impair objectivity Correct answer.
  4. Accept it because refusing would damage the business relationship

Explanation

Accepting a gift from a party under audit creates at least the appearance of impaired objectivity and may constitute a conflict of interest. The ethical course is to decline it, and many organizations require such offers to be reported.

Question 7Audit Fundamentals, Standards, and Ethics

Which of the following is an example of a consulting engagement rather than an assurance engagement?

  1. Auditing compliance with environmental regulations
  2. Evaluating the design of internal controls over financial reporting
  3. Facilitating a risk workshop for a business unit at its request Correct answer.
  4. Assessing the effectiveness of the cybersecurity program

Explanation

Consulting engagements are advisory in nature and are performed at the specific request of an engagement client, with the nature and scope agreed upon. Facilitating a risk workshop is advisory, whereas the other options involve independent evaluation of controls or compliance.

Question 8Audit Fundamentals, Standards, and Ethics

An internal auditor is assigned to audit a department where her close relative is the department head. What does the IIA Code of Ethics require?

  1. Disclose the relationship and reassign the engagement to preserve objectivity Correct answer.
  2. Proceed because family relationships are outside the code's scope
  3. Proceed but exclude the department head from interviews
  4. Proceed if the relative agrees to sign a conflict waiver

Explanation

A close family relationship with a manager of the audited area creates a personal conflict of interest that impairs objectivity. The auditor must disclose the conflict so the engagement can be reassigned or otherwise managed.

Question 9Audit Fundamentals, Standards, and Ethics

Which of the following best reflects the principle of due professional care in an internal audit engagement?

  1. Applying the same procedures to every engagement regardless of risk
  2. Delegating all judgment to the engagement supervisor
  3. Performing the engagement with the diligence and skill expected of a reasonably prudent auditor Correct answer.
  4. Guaranteeing that no material errors exist after the engagement

Explanation

Due professional care requires the auditor to apply the diligence and skill that a reasonably prudent and competent auditor would exercise in comparable circumstances. It does not guarantee that all errors are found, nor does it require identical procedures across engagements.

Question 10Audit Fundamentals, Standards, and Ethics

An internal auditor lacks the specialized expertise needed to evaluate a complex derivatives model. What is the most appropriate response under the standards?

  1. Use the assistance of a competent specialist while retaining responsibility for the conclusions Correct answer.
  2. Skip the area and document it as out of scope
  3. Issue an opinion based on the general audit knowledge available
  4. Rely entirely on management's assertions about the model

Explanation

When an engagement requires knowledge or skills the auditor does not possess, the auditor should obtain competent advice or assistance from a specialist. The internal auditor remains responsible for the engagement conclusions, so full reliance on management is inappropriate.

Question 11Audit Fundamentals, Standards, and Ethics

Which of the following is the best indicator that an internal audit activity is organizationally independent?

  1. The audit budget is set by the operations director
  2. Audit staff are co-located with the business units they audit
  3. The audit plan is approved by the chief financial officer
  4. The chief audit executive reports functionally to the audit committee Correct answer.

Explanation

Functional reporting to the audit committee or board supports the internal audit activity's ability to set its own agenda and report objectively. Reporting lines that place the chief audit executive under operational management can compromise independence.

Question 12Audit Fundamentals, Standards, and Ethics

An auditor finds that a key control failed but concludes the overall risk is still acceptable because of compensating controls. How should this conclusion be documented?

  1. Escalate immediately to external regulators
  2. Omit the control failure because the risk is acceptable
  3. Record the failure and the basis for concluding compensating controls mitigate the risk Correct answer.
  4. Report only the compensating controls without mentioning the failure

Explanation

Workpapers should record the facts observed, the analysis performed, and the basis for the auditor's conclusion. Documenting both the control failure and the rationale for relying on compensating controls supports the conclusion and allows review.

Question 13Audit Fundamentals, Standards, and Ethics

Which of the following situations most clearly represents a threat to an internal auditor's objectivity?

  1. The auditor uses a standardized checklist during fieldwork
  2. The auditor attends a training course on fraud detection
  3. The auditor interviews staff in several departments
  4. The auditor recommends a new control design and later audits its implementation Correct answer.

Explanation

Auditing a control that the auditor previously designed creates a self-review threat to objectivity. Advisory work can precede assurance work, but safeguards such as reassignment are needed to avoid reviewing one's own recommendations.

Question 14Audit Fundamentals, Standards, and Ethics

According to the standards, who is responsible for approving the risk-based internal audit plan?

  1. The chief executive officer alone
  2. The external audit firm
  3. The engagement supervisor
  4. The board or audit committee, with input from senior management and the chief audit executive Correct answer.

Explanation

The risk-based audit plan should be developed by the chief audit executive and approved by the board or audit committee, typically after consultation with senior management. Board approval reinforces the function's independence and alignment with organizational objectives.

Question 15Audit Fundamentals, Standards, and Ethics

An internal auditor receives a request from the CEO to change a finding in a draft report because it is politically sensitive. What should the auditor do?

  1. Delay the report indefinitely to avoid conflict
  2. Change the finding as instructed by the CEO
  3. Remove the finding but note the change verbally
  4. Maintain the finding and escalate the pressure through appropriate channels Correct answer.

Explanation

Findings should reflect the auditor's objective conclusions, and pressure to alter them for political reasons undermines integrity. The auditor should retain the finding and escalate the matter through the chief audit executive and governance channels.

Question 16Audit Fundamentals, Standards, and Ethics

Which of the following best describes the concept of residual risk as used in internal audit work?

  1. The risk that remains after management's responses have been applied Correct answer.
  2. The risk that exists before any controls are considered
  3. The risk of loss from a specific fraud scheme
  4. The risk that the auditor will issue an incorrect opinion

Explanation

Residual risk is the level of risk remaining after management has implemented controls or other responses to mitigate inherent risk. Auditors compare residual risk with the organization's risk appetite to evaluate whether additional action is needed.

Question 17Audit Fundamentals, Standards, and Ethics

An internal auditor is evaluating whether a control is operating effectively. Which approach best demonstrates this?

  1. Reviewing the control design documented in the policy manual
  2. Interviewing the control owner about the control's purpose
  3. Reading the prior year's audit report
  4. Testing a sample of transactions to confirm the control operated as designed Correct answer.

Explanation

Operating effectiveness is demonstrated by testing whether the control actually functioned as designed over the period, typically through transaction testing or observation. Reviewing design documentation or interviewing the owner addresses design, not operation.

Question 18Audit Fundamentals, Standards, and Ethics

Which of the following best characterizes the relationship between internal audit and the external auditor?

  1. The two functions must never communicate to preserve independence
  2. Internal audit reports to the external auditor on all engagements
  3. Internal audit must follow the external auditor's work program
  4. They may coordinate work while maintaining separate objectives and independence Correct answer.

Explanation

Internal and external auditors can coordinate to avoid duplication and share relevant information, but each retains its own objectives and independence. Coordination does not mean subordination of internal audit to the external auditor's program.

Question 19Audit Fundamentals, Standards, and Ethics

An auditor is planning an engagement and must decide the nature, timing, and extent of procedures. Which factor most directly drives these decisions?

  1. The number of staff available in the audit department
  2. The assessed level of risk and the significance of the area Correct answer.
  3. The preferences of the engagement client
  4. The length of the prior year's report

Explanation

Engagement procedures should be designed in response to the assessed risks and the significance of the area under review. Resource availability and client preferences may influence logistics but should not determine the substantive scope.

Question 20Audit Fundamentals, Standards, and Ethics

What is the primary role of the audit committee in relation to the internal audit activity?

  1. To manage the day-to-day operations of the audit department
  2. To perform the detailed fieldwork on behalf of internal audit
  3. To set individual auditor performance ratings
  4. To provide governance oversight, approve the charter, and receive audit results Correct answer.

Explanation

The audit committee provides governance oversight of the internal audit activity, approves its charter and plan, and receives communications of results and significant matters. It does not perform fieldwork or manage daily operations of the function.

Question 21Audit Fundamentals, Standards, and Ethics

An internal auditor discovers that a colleague has falsified time records on an engagement. Applying the IIA Code of Ethics, what is the most appropriate first step?

  1. Report the matter through the organization's established channels Correct answer.
  2. Ignore it to avoid conflict within the team
  3. Adjust the records personally without informing anyone
  4. Confront the colleague publicly during a team meeting

Explanation

The code requires auditors to report unethical or illegal behavior through established organizational channels, which typically means the chief audit executive or a designated ethics hotline. Quietly correcting records or public confrontation does not fulfill this duty.

Question 22Audit Fundamentals, Standards, and Ethics

A chief audit executive is asked to take on the role of interim controller for six months while a replacement is hired. What is the most significant concern under the standards?

  1. The organization would save money on recruiting costs
  2. The controller's staff might resent the arrangement
  3. The CAE would audit activities for which she had operational responsibility Correct answer.
  4. The audit staff may have to work longer hours

Explanation

Accepting an operational management role creates a significant independence and objectivity impairment, because the CAE would later be in a position to audit her own operational decisions. Such assignments should be avoided or accompanied by strong safeguards and governance approval.

Question 23Audit Fundamentals, Standards, and Ethics

An internal audit function has never undergone an external quality assessment. According to the standards, what is the expected requirement?

  1. External assessments are optional for all organizations
  2. External assessments may only be performed by regulators
  3. External assessments must be performed annually by the external auditor
  4. An external assessment should be conducted at least once every five years by a qualified, independent assessor Correct answer.

Explanation

The standards call for an external quality assessment at least once every five years, performed by a qualified and independent assessor or assessment team from outside the organization. This provides independent validation of conformance with the standards.

Question 24Audit Fundamentals, Standards, and Ethics

An auditor concludes that management's action plan for a high-risk finding is inadequate but management disagrees. What is the most appropriate professional response?

  1. Escalate the disagreement to senior management and the audit committee Correct answer.
  2. Accept management's plan because they own the risk
  3. Close the finding without resolution to preserve the relationship
  4. Reclassify the finding as low risk to avoid conflict

Explanation

When management accepts a risk that the auditor believes exceeds the organization's risk appetite, the matter should be escalated to senior management and, if unresolved, to the board or audit committee. The auditor does not decide the response but must ensure governance is informed.

Question 25Audit Fundamentals, Standards, and Ethics

Which situation best illustrates a violation of the confidentiality principle in the IIA Code of Ethics?

  1. An auditor discusses sensitive client information with a friend at a social event Correct answer.
  2. An auditor retains workpapers according to the organization's retention policy
  3. An auditor consults a specialist under appropriate confidentiality arrangements
  4. An auditor shares engagement findings with the audit committee in a closed session

Explanation

The confidentiality principle requires auditors to be prudent in using and protecting information acquired during engagements. Disclosing sensitive information in a casual social setting is a clear breach, whereas sharing with governance or authorized specialists follows proper channels.

Question 26Audit Fundamentals, Standards, and Ethics

Under the IIA Global Internal Audit Standards, which two components together make up the mandatory elements that an internal audit activity must conform with?

  1. The Core Principles and the Definition of Internal Auditing
  2. The Definition of Internal Auditing and the Implementation Guides
  3. The Code of Ethics and the Quality Assessment Manual
  4. The Global Internal Audit Standards and the Topical Requirements Correct answer.

Explanation

The current framework treats the Global Internal Audit Standards and the Topical Requirements as the mandatory elements; conformance is measured against them. Implementation Guides and other supplemental materials are interpretive and not themselves mandatory. The Core Principles and Definition are foundational concepts embedded in the standards rather than the two named mandatory components.

Question 27Audit Fundamentals, Standards, and Ethics

An internal auditor is preparing engagement working papers. Which practice best supports the standard requiring that engagement records be sufficiently complete to allow an experienced auditor with no prior connection to the engagement to understand the work performed?

  1. Documenting identified issues, conclusions reached, and the supporting evidence for each significant judgment Correct answer.
  2. Recording only the audit program steps that resulted in exceptions
  3. Summarizing the engagement verbally at closeout and relying on team memory
  4. Retaining only final conclusions and deleting drafts to reduce storage costs

Explanation

Engagement records must let another experienced auditor reconstruct what was done, why, and what was concluded, which requires documenting issues, conclusions, and the evidence behind significant judgments. Deleting drafts, capturing only exceptions, or relying on memory leaves the reasoning trail incomplete and unreproducible.

Question 28Audit Fundamentals, Standards, and Ethics

A chief audit executive is deciding how to allocate limited audit resources across the annual plan. Which approach is most consistent with the standards on planning and risk assessment?

  1. Rotating coverage evenly across all auditable units regardless of risk so that every area is treated fairly
  2. Prioritizing units based on a documented risk assessment that considers likelihood, impact, and input from senior management and the board Correct answer.
  3. Auditing only the units that performed poorly in the prior year's external audit
  4. Scheduling engagements strictly in the order that department heads submit requests

Explanation

A risk-based plan derives priorities from a documented assessment of likelihood and impact, informed by management and board input, and is updated as risks change. Even rotation, prior-year failures alone, or request order do not reflect a systematic evaluation of risk and can misdirect limited resources.

Question 29Audit Fundamentals, Standards, and Ethics

During fieldwork an internal auditor finds evidence that a senior manager may have circumvented procurement controls. The auditor's supervisor instructs her to omit the matter from the report because it is outside the engagement's original scope. What is the most appropriate action consistent with the standards?

  1. Expand the engagement scope unilaterally and issue a separate report without informing anyone
  2. Delay any action until the next annual risk assessment cycle
  3. Escalate the matter through the chief audit executive so that it is assessed and, if significant, communicated to the board Correct answer.
  4. Comply with the supervisor and note the matter only in personal files

Explanation

Significant risk exposures and control failures must be communicated, and an auditor may not suppress a material finding on instruction. The appropriate channel is escalation to the chief audit executive, who determines significance and communicates to the board or audit committee. Unilateral scope changes or indefinite delay would leave a potentially serious matter unresolved.

Question 30Audit Fundamentals, Standards, and Ethics

An engagement team identifies a fraud risk indicator in a subsidiary's expense reporting. Which response best reflects the professional skepticism expected of internal auditors under the standards?

  1. Accepting management's explanation without further work because the subsidiary has a clean prior history
  2. Treating the indicator as immaterial unless the amount exceeds the overall engagement budget
  3. Corroborating explanations with independent evidence and considering alternative explanations for the pattern observed Correct answer.
  4. Referring the matter immediately to law enforcement before any additional audit procedures are performed

Explanation

Professional skepticism requires auditors to question information, corroborate assertions with independent evidence, and consider plausible alternative explanations rather than defaulting to management's account. Prior clean history, budget size, or premature referral do not substitute for the corroboration and evaluation the standards expect.

Question 31Audit Program Management and Planning

An audit manager is drafting the annual audit plan for a quality management system. Which input is most relevant when prioritizing which processes to audit first?

  1. The results of a risk assessment covering process criticality and prior findings Correct answer.
  2. The age of the organization's facilities
  3. The number of staff employed in each department
  4. The preferred meeting times of department heads

Explanation

Audit planning is risk-based: the annual plan should prioritize processes by risk, considering criticality, performance trends, and previous audit results. Staff headcount, facility age, and scheduling preferences may inform logistics but do not drive audit prioritization.

Question 32Audit Program Management and Planning

In audit program management, what is the primary purpose of an audit program?

  1. To record the personal performance reviews of individual auditors
  2. To describe the structure, responsibilities, and arrangements for conducting audits over a period Correct answer.
  3. To document the organization's financial statements
  4. To list the corrective actions closed in the previous year

Explanation

An audit program defines how audits are organized and managed, including scope, responsibilities, resources, and scheduling arrangements. It is a management framework, not a record of individual appraisals or financial reporting.

Question 33Audit Program Management and Planning

When establishing audit objectives for a specific audit, which characteristic makes an objective well-formed?

  1. It lists every clause of the standard in sequence
  2. It repeats the organization's mission statement
  3. It names the auditor who will lead the audit
  4. It is measurable and states what the audit will verify against defined criteria Correct answer.

Explanation

Audit objectives should be specific and measurable, stating what will be examined and against which criteria. Naming personnel or restating the mission does not define what the audit will verify.

Question 34Audit Program Management and Planning

A lead auditor is deciding the size of the audit team for a complex multi-site audit. Which factor most directly justifies adding a technical specialist?

  1. The preference to have an even number of team members
  2. The desire to reduce the average tenure of the team
  3. The convenience of sharing travel costs
  4. The need for competence in a specialized process that the generalist team cannot adequately evaluate Correct answer.

Explanation

Team composition should be driven by the competence required to achieve audit objectives. A technical specialist is justified when the audit scope includes specialized processes beyond the generalists' expertise.

Question 35Audit Program Management and Planning

Which document typically authorizes the audit and defines its scope, criteria, and schedule?

  1. The nonconformity report
  2. The management review minutes
  3. The audit plan Correct answer.
  4. The corrective action request

Explanation

The audit plan sets out the scope, criteria, schedule, and arrangements agreed for a specific audit. Nonconformity reports, review minutes, and corrective action requests are outputs generated during or after the audit.

Question 36Audit Program Management and Planning

An organization wants to ensure auditors are independent of the activity being audited. Which arrangement best supports this principle?

  1. Allowing the auditee to select the auditor
  2. Rotating auditors only when a finding is raised
  3. Assigning auditors who do not have operational responsibility for the area under review Correct answer.
  4. Assigning the process owner to audit their own process for efficiency

Explanation

Auditor independence requires that auditors are not auditing their own work or holding operational responsibility for the activity. Self-auditing and auditee-selected auditors undermine objectivity.

Question 37Audit Program Management and Planning

What is the main purpose of holding an opening meeting at the start of an audit?

  1. To issue nonconformity reports to the auditee
  2. To present the final audit findings and conclusions
  3. To confirm the audit plan, scope, and logistics and to establish communication arrangements Correct answer.
  4. To close out previously raised corrective actions

Explanation

The opening meeting confirms the agreed plan, scope, criteria, and communication and logistics arrangements. Findings and nonconformities are determined later during the audit and reported at the closing stage.

Question 38Audit Program Management and Planning

Which record best provides objective evidence that an audit was planned and conducted as agreed?

  1. The completed audit report with referenced working documents Correct answer.
  2. A verbal summary given to a colleague
  3. The auditor's personal calendar entry
  4. An informal email confirming a meeting time

Explanation

Objective evidence of audit planning and execution is retained through the audit report and supporting working documents. Informal notes or calendar entries do not demonstrate that the audit was conducted against the plan.

Question 39Audit Program Management and Planning

During planning, an auditor learns that a supplier's certification was suspended. How should this information most appropriately influence the audit plan?

  1. Remove the supplier from the audit scope to avoid conflict
  2. Ignore it because certification status is outside the audit criteria
  3. Delay the audit until certification is permanently withdrawn
  4. Treat it as a risk indicator and consider expanding scope or adjusting sampling in that supplier area Correct answer.

Explanation

Emerging risk information should feed back into planning, potentially changing scope, focus, or sampling. Certification status can be a relevant indicator of supplier risk and should be evaluated against the audit criteria.

Question 40Audit Program Management and Planning

An audit program covers multiple audits across a year. What is the most appropriate way to allocate audit resources across the program?

  1. By distributing equal effort to every process regardless of risk
  2. By allocating most effort to the processes with the most staff
  3. By following the order in which processes were established
  4. By weighting effort toward higher-risk and higher-criticality areas identified in the risk assessment Correct answer.

Explanation

Resource allocation within an audit program should follow risk, directing more effort to higher-risk and higher-criticality areas. Equal or arbitrary allocation ignores risk and weakens assurance where it matters most.

Question 41Audit Program Management and Planning

A lead auditor finds that the audit team lacks competence in a specialized measurement process included in scope. What is the most appropriate planning response?

  1. Obtain the needed technical competence before the audit or adjust the scope accordingly Correct answer.
  2. Assign the task to the least experienced auditor to build capability
  3. Proceed and rely on the auditee to explain the process fully
  4. Drop all measurement-related criteria from the audit silently

Explanation

Audit teams must collectively possess the competence needed to meet the objectives; gaps should be closed by adding expertise or adjusting scope with justification. Relying on the auditee or assigning unqualified staff undermines the audit's validity.

Question 42Audit Program Management and Planning

Which practice best demonstrates that an audit plan is being followed and adjusted appropriately during execution?

  1. Recording changes to the plan with the reason and approval for each change Correct answer.
  2. Avoiding any deviation from the original timetable
  3. Rewriting the plan after the audit to match what happened
  4. Delegating all planning decisions to the auditee

Explanation

Plans may need adjustment as the audit progresses; changes should be documented with justification and approved to maintain control and traceability. Retrospective rewriting hides deviations rather than managing them.

Question 43Audit Program Management and Planning

An auditor is selecting a sampling approach for a high-volume transactional process. Which consideration most supports a defensible sample?

  1. The sample should be representative of the population and the sampling rationale should be documented Correct answer.
  2. The sample should be chosen by the auditee to save time
  3. The sample should consist only of records that are easy to retrieve
  4. The sample should be limited to the most recent day of transactions

Explanation

Sampling must be representative and the rationale recorded so conclusions can be defended and reproduced. Convenience sampling or auditee-selected samples introduce bias and weaken the evidence base.

Question 44Audit Program Management and Planning

A program manager notices that the same minor finding recurs across several audits. What is the most appropriate program-level response?

  1. Remove the finding category from future audits
  2. Reduce the audit frequency for that process
  3. Close each finding individually and take no further action
  4. Analyze the recurring pattern as a potential systemic issue and adjust future audit focus or escalate it Correct answer.

Explanation

Recurring findings across audits signal possible systemic weakness and should be analyzed and escalated, with future audit focus adjusted accordingly. Treating each occurrence in isolation misses the program-level trend.

Question 45Audit Program Management and Planning

Which element is essential in an audit plan to allow effective coordination with the auditee?

  1. The full text of all applicable legislation
  2. The auditor's salary grade
  3. Agreed dates, locations, and contact points for the audit activities Correct answer.
  4. The organization's marketing strategy

Explanation

Coordination requires agreed logistics such as dates, locations, and contact points so both parties can prepare. Salary grades, marketing strategy, and full legal texts are not coordination elements of an audit plan.

Question 46Audit Program Management and Planning

An auditor identifies a potential conflict of interest because a team member previously managed the process under review. What is the most appropriate action?

  1. Ask the auditee to approve the team member's participation
  2. Allow the team member to audit the process because they know it best
  3. Reassign the team member to an area where independence is maintained Correct answer.
  4. Proceed but omit the conflict from the audit records

Explanation

Independence must be preserved; a team member who previously managed the process should be reassigned to avoid self-review. Familiarity with the process does not override the conflict.

Question 47Audit Program Management and Planning

When defining audit criteria in the plan, what should the criteria be?

  1. The set of requirements against which conformity will be evaluated, agreed with the auditee Correct answer.
  2. The auditee's preferred outcome for the audit
  3. The auditor's personal opinion of best practice
  4. The list of auditors assigned to the audit

Explanation

Audit criteria are the requirements used to evaluate conformity and should be defined and agreed in advance. Personal opinion, desired outcomes, or team lists are not valid criteria.

Question 48Audit Program Management and Planning

Which action best supports effective communication during an audit when a significant issue is discovered mid-audit?

  1. Wait until the closing meeting to mention it for the first time
  2. Discuss it only with the auditor's own manager
  3. Inform the auditee promptly through the agreed communication channel and record the issue Correct answer.
  4. Report it only in the final written report without discussion

Explanation

Agreed communication arrangements should be used to raise significant issues promptly so they can be understood and addressed. Delaying disclosure to the closing meeting or excluding the auditee reduces the audit's value.

Question 49Audit Program Management and Planning

An audit program is being reviewed for continual improvement. Which measure best indicates whether the program is effective?

  1. The extent to which audits achieve their objectives and drive effective corrective action Correct answer.
  2. The frequency of changes to the audit schedule
  3. The total number of pages in audit reports
  4. The number of auditors employed by the organization

Explanation

Program effectiveness is shown by whether audits meet their objectives and lead to meaningful corrective action and improvement. Volume metrics such as headcount or report length do not demonstrate effectiveness.

Question 50Audit Program Management and Planning

A multi-site organization wants to sample sites for audit during the year. Which approach best aligns with risk-based program planning?

  1. Select sites alphabetically to ensure fairness
  2. Select the smallest sites to reduce travel time
  3. Select only the sites that volunteer for audit
  4. Select sites based on risk factors such as performance, complaints, and prior findings, and document the rationale Correct answer.

Explanation

Site selection within a program should be risk-based, using indicators such as performance data, complaints, and prior findings, with the rationale documented. Alphabetical, voluntary, or convenience-based selection is not risk-driven.