I85PREP
⌘ K
IAMI CPMA study materials
IAMI CPMA study resources

IAMI CPMA practice questions

One question at a time. Build your IAMI CPMA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Coding and Documentation Standards

Under ICD-10-CM official guidelines, what is the correct action when the physician documents a diagnosis as 'probable' at the time of an inpatient discharge?

  1. Code the condition only if a pathology report confirms it
  2. Assign the code as though the condition were confirmed Correct answer.
  3. Report the condition using an outpatient 'rule out' convention
  4. Query the physician before assigning any code for the stay

Explanation

For inpatient admissions, conditions documented as probable, suspected, or likely are coded and reported as though they exist, because the facility's final diagnosis reflects the reason for the admission and the workup performed. The 'rule out' convention applies only to outpatient encounters, where uncertain diagnoses are not coded.

Question 2Coding and Documentation Standards

A coder is abstracting an outpatient visit where the provider wrote 'evaluate for cholecystitis.' Per ICD-10-CM outpatient guidelines, how should this be handled?

  1. Defer coding until the diagnosis is confirmed in writing
  2. Code only the signs or symptoms that prompted the visit Correct answer.
  3. Assign an unspecified abdominal pain code plus cholecystitis
  4. Code cholecystitis as the first-listed diagnosis

Explanation

In outpatient settings, diagnoses documented as 'rule out,' 'evaluate for,' or 'suspected' are not coded. Instead, the coder reports the presenting signs or symptoms that justified the encounter, such as abdominal pain.

Question 3Coding and Documentation Standards

Which document establishes the legal authority for a hospital's medical record documentation requirements and retention?

  1. The facility's medical staff bylaws and state licensure regulations Correct answer.
  2. The CPT Assistant archive
  3. The ICD-10-CM Tabular List preface
  4. The payer's provider manual only

Explanation

Medical record content, authentication, and retention are governed by state law, licensing bodies such as The Joint Commission, and the facility's own medical staff bylaws and policies. Coding manuals and payer manuals describe code selection but do not set legal record-keeping authority.

Question 4Coding and Documentation Standards

When a physician documents 'acute on chronic systolic heart failure,' what does correct ICD-10-CM coding require?

  1. Only the chronic systolic heart failure code
  2. Separate codes for acute and chronic, sequenced by severity
  3. Only the acute heart failure code
  4. A combination code for acute on chronic systolic heart failure Correct answer.

Explanation

ICD-10-CM provides a single combination code (I50.23) for acute on chronic systolic heart failure. Coders should not split the diagnosis into two codes when a combination code fully describes the documented condition.

Question 5Coding and Documentation Standards

A coder notices that a documented diagnosis lacks sufficient specificity to select a code. What is the appropriate first step?

  1. Report the case to compliance without querying
  2. Assign the unspecified code and move on
  3. Choose the most specific code the coder believes fits
  4. Query the provider for clarification Correct answer.

Explanation

When documentation is ambiguous or insufficient, the coder should query the provider using a compliant query that offers clinically supported options. Assigning unspecified codes or guessing specificity undermines data quality and may misrepresent the encounter.

Question 6Coding and Documentation Standards

Which element is required for a medical record entry to be considered properly authenticated?

  1. A stamp indicating the code assigned
  2. A co-signature from the billing department
  3. A typed name without credentials
  4. An identifiable author signature with date Correct answer.

Explanation

Authentication requires an identifiable author's signature (electronic or handwritten) and the date of the entry. Co-signatures from billing staff or code stamps do not authenticate clinical documentation.

Question 7Coding and Documentation Standards

What does the ICD-10-CM convention of 'code also' instruct the coder to do?

  1. Report the additional code only if the payer requests it
  2. Report an additional code for a related condition when present Correct answer.
  3. Sequence the additional code first
  4. Use the additional code in place of the primary code

Explanation

'Code also' is a note directing the coder to assign an additional code for a related condition that is present. Sequencing of the additional code is not dictated by the note, and it never replaces the primary code.

Question 8Coding and Documentation Standards

A provider documents 'status post hip replacement' with no complications. How should this be coded in ICD-10-CM?

  1. The appropriate Z code for presence of the joint prosthesis Correct answer.
  2. A complication code for the prosthetic joint
  3. A fracture code for the original injury
  4. No code, because the surgery is historical

Explanation

When a patient has a joint prosthesis without complication, the appropriate Z code (such as Z96.64 for a hip prosthesis) is assigned to indicate the presence of the implant. Complication codes are used only when a problem is documented.

Question 9Coding and Documentation Standards

Which statement best describes the role of the CPT code set in documentation and coding?

  1. It describes medical services and procedures for reporting Correct answer.
  2. It defines the provider query format
  3. It classifies inpatient diagnoses for facility reporting
  4. It governs the legal retention period for records

Explanation

CPT is a procedure and service code set used to report what was performed, whereas ICD-10-CM classifies diagnoses. Retention periods and query formats come from facility policy and compliance guidance, not CPT.

Question 10Coding and Documentation Standards

A coder reviews a note documenting 'diabetes with diabetic nephropathy.' Which coding principle applies?

  1. Code the diabetes and nephropathy as unrelated conditions
  2. Code nephropathy first, diabetes second
  3. Code only the diabetes and add a symptom code
  4. Use the combination code linking diabetes with renal manifestation Correct answer.

Explanation

ICD-10-CM provides combination codes for diabetes with its manifestations, so diabetes with nephropathy is captured with a single code. Coding them separately or sequencing nephropathy first misrepresents the causal relationship.

Question 11Coding and Documentation Standards

What is the principal diagnosis for an inpatient admission, as defined by official guidelines?

  1. The condition requiring the most expensive treatment
  2. The most chronic condition present
  3. The condition established after study to have chiefly occasioned the admission Correct answer.
  4. The first diagnosis listed by the physician

Explanation

The principal diagnosis is the condition established after study to be chiefly responsible for occasioning the admission. It is determined by clinical study, not by cost, order of documentation, or chronicity.

Question 12Coding and Documentation Standards

A coder must assign a code from a category where the Tabular List includes an Excludes1 note. What does this note signify?

  1. The excluded condition cannot be reported with the code in question Correct answer.
  2. The excluded condition must be sequenced first
  3. The two conditions may be coded together
  4. The excluded code is optional

Explanation

An Excludes1 note indicates that the excluded condition is not coded with the code in question because the two are mutually exclusive. Excludes2 notes, by contrast, permit both conditions to be reported.

Question 13Coding and Documentation Standards

When a patient is admitted for a complication of a device, how does ICD-10-CM direct the coder to sequence the codes?

  1. Complication code first, then a code for the device involved Correct answer.
  2. Only the device status code
  3. Only the complication code
  4. Device status code first, complication second

Explanation

For device complications, the complication code is sequenced first followed by a code identifying the device and its presence. Device status codes alone do not capture the complication, and sequencing the device first misrepresents the reason for care.

Question 14Coding and Documentation Standards

Which of the following is an acceptable element of a compliant physician query?

  1. Leading the provider toward a specific code
  2. Requesting the provider to sign a pre-written diagnosis
  3. Stating that reimbursement will be denied without a response
  4. Presenting the clinical indicators and offering options Correct answer.

Explanation

A compliant query is non-leading and presents clinical evidence with clinically supported options for the provider to choose. It must not steer toward a code, cite reimbursement consequences, or ask the provider to sign a pre-drafted diagnosis.

Question 15Coding and Documentation Standards

A coder is coding an encounter where two diagnoses are equally supported and either could be principal. What does the guideline advise?

  1. Select the one with the lower code number
  2. Select the one with the higher relative weight always
  3. Select the one the physician listed first
  4. Select either code, as both are equally valid Correct answer.

Explanation

When two conditions equally meet the definition of principal diagnosis, either may be sequenced first. Code number order and relative weight are not the deciding criteria in that scenario.

Question 16Coding and Documentation Standards

How should a coder report a condition that the provider documents as 'history of' when the condition no longer exists?

  1. Omit it entirely from the record
  2. Use an appropriate history Z code Correct answer.
  3. Code the condition as active
  4. Code the condition with a complication code

Explanation

A condition that has resolved and no longer requires treatment is reported with a history Z code rather than an active condition code. Coding it as active overstates the current clinical picture.

Question 17Coding and Documentation Standards

Which documentation practice best supports accurate code assignment for a surgical procedure?

  1. Listing the surgeon's preferred billing codes
  2. Recording only the procedure name in the operative title
  3. Relying on the anesthesia record alone
  4. Documenting approach, site, laterality, and findings in the body of the report Correct answer.

Explanation

Accurate procedure coding requires documentation of approach, anatomic site, laterality, and findings within the operative report. A title alone or a preference list of codes does not capture the necessary detail.

Question 18Coding and Documentation Standards

Under ICD-10-CM, how is laterality handled when the documentation specifies the right side of a paired organ?

  1. Laterality is reported only with an external cause code
  2. Laterality is captured when a specific code exists for that side Correct answer.
  3. Laterality is captured with a CPT modifier alone
  4. Laterality is never captured in ICD-10-CM

Explanation

ICD-10-CM includes laterality in many diagnosis codes for paired organs, and the coder should select the side-specific code when one exists. Laterality is not exclusively a procedure modifier concept.

Question 19Coding and Documentation Standards

A coder sees a note documenting 'sepsis due to MRSA.' Which coding approach is consistent with ICD-10-CM?

  1. Code MRSA only
  2. Code sepsis first, then the MRSA infection code Correct answer.
  3. Code sepsis only
  4. Code the MRSA first, then sepsis

Explanation

ICD-10-CM directs that sepsis be sequenced first when the causative organism is documented, followed by the code for the specific infection. Coding only one element would fail to capture the full clinical picture.

Question 20Coding and Documentation Standards

What does the ICD-10-CM instruction 'see also' typically indicate?

  1. The condition is excluded from coding
  2. The coder should consider additional entries that may describe the condition more specifically Correct answer.
  3. The referenced code is the only valid choice
  4. The code is invalid for outpatient use

Explanation

'See also' is an index instruction pointing the coder to other entries that may better describe the condition. It does not make the reference mandatory or exclusive, nor does it exclude the condition.

Question 21Coding and Documentation Standards

A patient is admitted with pneumonia and also has documented dehydration that required IV fluids. How should the coder determine whether dehydration is a secondary diagnosis?

  1. Never report secondary diagnoses on inpatient records
  2. Report it if it was clinically evaluated, treated, or affected care during the stay Correct answer.
  3. Report it only if it is a chronic condition
  4. Report it only if the physician lists it last

Explanation

Secondary diagnoses are reportable when they were clinically evaluated, treated, or affected the care provided during the encounter. Chronicity and documentation order are not the criteria.

Question 22Coding and Documentation Standards

A provider documents 'AKI and CKD' without further staging. How should the coder proceed to meet specificity requirements?

  1. Assign unspecified AKI and CKD codes without querying
  2. Assign the most severe stage documented anywhere in the record
  3. Query the provider for AKI stage and CKD stage Correct answer.
  4. Code only CKD because AKI is transient

Explanation

Both acute kidney injury and chronic kidney disease require stage specificity in ICD-10-CM, so a query is appropriate when stages are not documented. Assigning unspecified codes or inferring severity from unrelated notes is not acceptable coding practice.

Question 23Coding and Documentation Standards

An inpatient record documents 'urosepsis' and separately documents 'E. coli UTI.' What is the most defensible coding rationale?

  1. Code urosepsis only, since it is one word
  2. Code the UTI and organism, treating urosepsis as an index term not coded separately Correct answer.
  3. Code only the organism code
  4. Code urosepsis and UTI as unrelated conditions

Explanation

ICD-10-CM does not provide a code for the term 'urosepsis'; coders instead code the documented systemic infection and the urinary source with organism. Reporting 'urosepsis' as a standalone code is not supported by the classification.

Question 24Coding and Documentation Standards

A coder must code a pressure ulcer documented as stage 3 on the sacrum. Which elements are essential to select the most specific code?

  1. Stage only
  2. Neither site nor stage
  3. Site only
  4. Site and stage Correct answer.

Explanation

ICD-10-CM pressure ulcer codes require both the anatomic site and the stage to reach the highest specificity. Missing either element forces an unspecified or less specific code.

Question 25Coding and Documentation Standards

During an audit, a reviewer finds a diagnosis code supported only by a nursing note and not by any provider documentation. What is the correct coding determination?

  1. The code may stand if the coder believes it is accurate
  2. The code may stand because nursing notes are part of the record
  3. The code should be replaced with a symptom code automatically
  4. The code should be removed because diagnoses require provider documentation Correct answer.

Explanation

Diagnosis codes must be supported by provider documentation, not by nursing notes or coder inference. A code lacking provider support should be removed or corrected through the facility's query and amendment process.

Question 26Coding and Documentation Standards

Under ICD-10-CM Official Guidelines, what does the abbreviation NEC in the Alphabetic Index signal to the coder?

  1. The entry requires a query because the provider used nonstandard terminology
  2. The condition must be coded elsewhere in a different chapter of the Tabular List
  3. The condition is not elsewhere classifiable and a more specific code does not exist in the classification Correct answer.
  4. The code should be reported only as an additional diagnosis after the underlying cause

Explanation

NEC stands for not elsewhere classifiable and is used when the classification provides no more specific code for the documented condition. The coder assigns the code for the specified condition rather than seeking an unspecified code. NEC differs from NOS, which means not otherwise specified and indicates the provider has not documented greater detail.

Question 27Coding and Documentation Standards

A coder is selecting a code from a category whose Tabular List entry carries an Excludes2 note listing a related condition. What does that note mean for code assignment?

  1. The listed condition is excluded from the category and may be coded separately if documented Correct answer.
  2. The coder must query the provider before assigning the category code
  3. The listed condition can never be reported on the same claim as the category code
  4. The category code is invalid and a more specific subcategory must be found

Explanation

An Excludes2 note indicates that the condition listed is not part of the category but may legitimately coexist, so it is coded separately when documented. This differs from Excludes1, which prohibits reporting the two codes together. The note does not invalidate the category code or require a query.

Question 28Coding and Documentation Standards

Which documentation element is essential before a coder can assign a code for a fracture with the correct seventh character for encounter type?

  1. The patient's occupation and external cause of injury
  2. Identification of whether the encounter is initial, subsequent, or a sequela visit Correct answer.
  3. The name of the surgeon who performed reduction
  4. The mechanism of injury stated in the history of present illness

Explanation

Many ICD-10-CM fracture categories require a seventh character identifying the encounter as initial, subsequent, or sequela. That character is driven by the episode of care documented in the record, not by the injury mechanism. External cause codes are reported separately and do not change the fracture seventh character.

Question 29Coding and Documentation Standards

A coder is reporting a neoplasm documented as metastatic to the bone from a known primary lung cancer. How should the neoplasm codes be sequenced?

  1. Only the primary site code is reported because the metastasis is a manifestation
  2. Only the secondary site code is reported because the metastasis is the focus of treatment
  3. The primary site code is sequenced first, followed by the secondary site code
  4. The secondary site code is sequenced first, followed by the primary site code Correct answer.

Explanation

ICD-10-CM guidelines direct that when a primary malignancy has been excised or is no longer being treated and a secondary site is treated, the secondary neoplasm is sequenced first with the primary site reported as an additional code. When the primary is still being treated, the primary is sequenced first. Both sites should be reported rather than dropping one.

Question 30Coding and Documentation Standards

A record documents a patient with chronic systolic heart failure who is also documented as having acute decompensation. How should the coder select the code?

  1. Assign only the chronic systolic heart failure code
  2. Assign separate codes for acute and chronic systolic heart failure
  3. Assign an unspecified heart failure code because two types are present
  4. Assign the acute and chronic combined code for systolic heart failure Correct answer.

Explanation

ICD-10-CM provides combination codes that capture both acute and chronic heart failure within a single code for the specified type. When documentation supports both acute and chronic systolic failure, the combined acute-on-chronic systolic code is assigned. Separate codes are not used when a combination code exists.

Question 31Coding and Documentation Standards

A coder is assigning an external cause code for an injury. Which principle from the official guidelines applies?

  1. External cause codes are reported only for inpatient admissions
  2. External cause codes are secondary and are never sequenced as the principal diagnosis Correct answer.
  3. External cause codes replace the injury code when the mechanism is known
  4. External cause codes are required only when the injury is work related

Explanation

External cause codes describe how and where an injury occurred and are always reported as secondary codes; they never serve as the principal diagnosis. They are used across inpatient and outpatient settings when the injury is coded. They do not replace the injury code itself.

Question 32Coding and Documentation Standards

During an audit a coder finds that a provider documented a diagnosis in the assessment without linking it to any clinical findings, and the record otherwise lacks support. What is the most appropriate action?

  1. Defer the diagnosis and code only the presenting symptoms without comment
  2. Query the provider for clarification and supporting clinical information Correct answer.
  3. Report the diagnosis with an unspecified code to reflect uncertainty
  4. Report the diagnosis because it appears in the provider's assessment

Explanation

A diagnosis must be supported by the provider's clinical documentation, not merely listed. When the record lacks supporting findings, the coder should query the provider rather than assume. Coding an unspecified version of an unsupported diagnosis does not resolve the documentation gap.

Question 33Coding and Documentation Standards

Which statement describes how the CPT code set and ICD-10-CM work together on a single claim?

  1. CPT describes the service or procedure performed while ICD-10-CM describes the reason for the encounter Correct answer.
  2. CPT describes the diagnosis while ICD-10-CM describes the procedure performed
  3. CPT and ICD-10-CM are interchangeable and either may describe the procedure
  4. CPT is used only for inpatient claims while ICD-10-CM is used only for outpatient claims

Explanation

CPT is a procedure and service classification, while ICD-10-CM is a diagnosis classification. Claims pair the procedure or service codes with the diagnosis codes that justify them. The two systems address different content and are not interchangeable.

Question 34Coding and Documentation Standards

A coder is coding a diabetic patient documented with gangrene of the toe attributed to diabetes. Which coding approach follows ICD-10-CM?

  1. Assign a combination code for diabetes with peripheral angiopathy with gangrene Correct answer.
  2. Assign a diabetes code with an unspecified complication code
  3. Assign a diabetes code plus a separate code for gangrene only
  4. Assign only the gangrene code because it is the focus of treatment

Explanation

ICD-10-CM provides combination codes for diabetes with circulatory complications, including a specific code for diabetes with peripheral angiopathy with gangrene. The combination code captures both the etiology and the manifestation in one code. Separate or unspecified codes would lose the documented specificity.

Question 35Coding and Documentation Standards

A patient is seen for a scheduled chemotherapy session for an established malignancy. How should the encounter be coded for an outpatient visit?

  1. The chemotherapy code alone is reported with no diagnosis
  2. The malignancy is coded as the first-listed diagnosis with the chemotherapy code reported Correct answer.
  3. A code for the adverse effect of chemotherapy is reported
  4. An encounter code for follow-up examination is reported

Explanation

When a patient presents for chemotherapy, the malignancy is reported as the first-listed diagnosis with the appropriate chemotherapy procedure code. The encounter is not a follow-up exam, and adverse effect coding applies only when a reaction is documented. Coding the procedure alone would omit the reason for the encounter.

Question 36Coding and Documentation Standards

A coder is assigning a code for a condition documented as 'impending' or 'threatened' in the record. Which principle governs code selection?

  1. Code the condition as documented using the code for the threatened or impending state when the classification provides one Correct answer.
  2. Do not code the condition until it actually occurs
  3. Code only the underlying cause and ignore the threatened state
  4. Code the condition as if it had occurred because it is imminent

Explanation

ICD-10-CM includes codes for certain threatened or impending conditions, and the coder should follow the Alphabetic Index entry for the documented state. Coding the condition as if it occurred would misrepresent the record. Omitting the documented threatened state would lose clinical information the provider recorded.

Question 37Coding and Documentation Standards

A coder must assign a code for a bilateral condition when the classification provides a single code covering both sides. How should this be reported?

  1. Report the unilateral code once and note the other side in a comment
  2. Report the single bilateral code once Correct answer.
  3. Report the unilateral code twice with a modifier
  4. Report two separate codes, one for each side

Explanation

When ICD-10-CM provides a code that specifically identifies a bilateral condition, that single code is reported once. Reporting a unilateral code twice would misrepresent the code's meaning and is incorrect. The classification already captures laterality, so no duplicate code is needed.

Question 38Coding and Documentation Standards

A coder is reviewing a record where the provider documented 'anemia' and later in the same note documented 'acute blood loss anemia.' How should the coder proceed?

  1. Code the unspecified anemia because it was documented first
  2. Query the provider to choose between the two entries
  3. Code the more specific acute blood loss anemia supported by the record Correct answer.
  4. Code both anemia codes to capture both statements

Explanation

When the record contains both a general and a more specific statement of the same condition, the coder assigns the code for the most specific condition supported by the documentation. The later, more specific entry clarifies the diagnosis. A query is unnecessary when the record already supports specificity.

Question 39Coding and Documentation Standards

A coder is selecting a code for a pressure ulcer and the record documents the site and stage but not the laterality, which the code requires. What is the best action?

  1. Assign the code for the documented site using the stage only
  2. Query the provider for laterality before assigning the most specific code Correct answer.
  3. Report the ulcer as unspecified site and stage
  4. Assign an unspecified laterality code without querying

Explanation

When the classification requires an element such as laterality that the record does not document, the coder should query the provider rather than default to unspecified. Defaulting to unspecified laterality or site loses available specificity and may misrepresent the record. The stage and site alone do not satisfy the code's required elements.

Question 40Coding and Documentation Standards

Which statement correctly distinguishes an inpatient principal diagnosis from a first-listed outpatient diagnosis?

  1. The principal diagnosis is always the condition documented first in the history and physical
  2. The principal diagnosis is the condition established after study to be chiefly responsible for admission Correct answer.
  3. The first-listed outpatient diagnosis must be confirmed by study before it is reported
  4. The principal diagnosis is chosen by the billing department based on reimbursement

Explanation

The principal diagnosis for inpatient care is defined as the condition established after study to be chiefly responsible for the admission. For outpatient care, the first-listed diagnosis is the condition reported first, which may be a symptom. Neither is determined by documentation order or by reimbursement considerations.

Question 41Audit Process and Methodology

Under the IIA Global Internal Audit Standards, which activity best describes the purpose of an internal audit engagement's preliminary survey?

  1. Re-performing the client's month-end close to validate the financial statements
  2. Confirming the final wording of the audit report with the audit committee before fieldwork
  3. Understanding the audited activity well enough to define scope, objectives, and a risk-based test plan Correct answer.
  4. Completing the audit program exactly as approved in the prior year's working papers

Explanation

The preliminary survey is a planning activity: the auditor gathers background, interviews process owners, and reviews data to understand risks and controls before finalizing objectives and scope. It is not a reporting step, a re-performance of client work, or a mechanical reuse of last year's program. Its output feeds the engagement work plan and resource estimate.

Question 42Audit Process and Methodology

An audit team is deciding how many items to test in a population of 4,000 purchase orders. Which factor most directly increases the sample size the auditor should select?

  1. A higher tolerable deviation rate set by the auditor
  2. A higher level of confidence the auditor requires Correct answer.
  3. A lower expected deviation rate in the population
  4. A larger population size relative to the sample

Explanation

Sample size rises as the required confidence level rises, because the auditor needs more evidence to support the same conclusion with greater assurance. Tolerable and expected deviation rates work in the opposite direction: higher tolerable rates and lower expected rates both reduce the required sample. Population size has a diminishing effect once the population is reasonably large.

Question 43Audit Process and Methodology

During fieldwork an auditor finds that a key approval control was bypassed for three transactions. What is the most appropriate immediate audit action?

  1. Expand testing to determine the nature and extent of the deviation and assess its effect on the engagement conclusion Correct answer.
  2. Delete the three items from the sample because they were processed by a senior manager
  3. Conclude the control is ineffective and stop all further testing of that process
  4. Immediately issue a qualified audit report to the audit committee

Explanation

A deviation is investigated rather than ignored: the auditor extends testing to establish whether the exception is isolated or systemic and evaluates the impact on the planned reliance and conclusions. Removing items from a sample biases the result and is prohibited. Reporting and scope decisions follow the investigation, not precede it.

Question 44Audit Process and Methodology

Which document ordinarily authorizes the auditor to access records, personnel, and physical property needed for an internal audit engagement?

  1. The audit charter and the engagement's approved scope statement Correct answer.
  2. The prior year's management action plan
  3. The client's process narrative flowchart
  4. The engagement work program

Explanation

Access rights derive from the internal audit charter and are operationalized through the approved engagement scope and objectives communicated to the auditee. The work program, process narrative, and prior action plan are working tools that do not themselves confer authority. Documenting access in the engagement letter or scope memo supports the auditor's right to obtain information.

Question 45Audit Process and Methodology

An auditor is testing whether segregation of duties exists between purchase requisition and vendor master maintenance. Which evidence is most persuasive for this objective?

  1. The organization chart showing separate purchasing and accounts payable departments
  2. A verbal confirmation from the purchasing director that duties are separated
  3. System access logs and role assignments showing which users can perform each function Correct answer.
  4. A management representation letter stating that controls are operating effectively

Explanation

System-generated role assignments and access logs are independent, documentary evidence of who can actually perform each function, which directly addresses segregation of duties. Verbal confirmation and an organization chart show intended structure rather than actual access. A representation letter is management's assertion, not proof of control operation.

Question 46Audit Process and Methodology

Which statement correctly describes the relationship between audit objectives and audit procedures in an engagement work program?

  1. Objectives are set by the auditee and procedures are set by the audit team
  2. Procedures and objectives are independent and need not be linked in the work program
  3. Procedures are designed to achieve stated objectives, and each objective should be supported by at least one procedure Correct answer.
  4. Objectives are derived after procedures are performed so they match the results obtained

Explanation

A work program maps each engagement objective to the procedures that will generate sufficient evidence to conclude on it. Objectives are set during planning, before procedures are executed, and they belong to the auditor rather than the auditee. The linkage is what allows a reviewer to judge whether evidence is sufficient.

Question 47Audit Process and Methodology

An auditor plans to use computer-assisted audit techniques to test all 50,000 payroll records for duplicate bank accounts. What is the primary advantage of this approach over sampling?

  1. It guarantees that no fraudulent payments exist in the population
  2. It removes the need for auditor judgment in interpreting results
  3. It eliminates the need to understand the payroll system's data structure
  4. It provides examination of the entire population, removing sampling risk for that test Correct answer.

Explanation

Testing the full population through data analytics removes sampling risk for the attribute tested, because every record is examined. It does not remove the need to validate data integrity and completeness, nor does it guarantee the absence of fraud beyond the defined test logic. Auditor judgment is still required to define criteria and interpret exceptions.

Question 48Audit Process and Methodology

An internal auditor is assigned to audit the accounts payable function and learns that a close family member manages that department. What is the most appropriate course of action under the standards on objectivity?

  1. Ask the family member to review the draft findings before they are issued
  2. Proceed with the engagement but disclose the relationship in the final report
  3. Perform only the testing that does not involve the family member's approvals
  4. Disclose the impairment to the chief audit executive so the assignment can be reassessed Correct answer.

Explanation

Objectivity requires that the auditor avoid conflicts of interest and disclose impairments so the chief audit executive can decide whether reassignment is necessary. Disclosure only in the final report is too late to protect the engagement's credibility. Narrowing testing or letting the auditee pre-review findings does not cure the impairment.

Question 49Audit Process and Methodology

Which of the following best describes the purpose of a walkthrough in an internal audit engagement?

  1. To trace one or a few transactions through the process to confirm the auditor's understanding of the flow and controls Correct answer.
  2. To test the mathematical accuracy of the general ledger account balances
  3. To obtain statistical evidence that a control operated effectively throughout the period
  4. To document the auditee's strategic objectives for the coming fiscal year

Explanation

A walkthrough follows a small number of transactions end to end to validate the auditor's documented understanding of the process and where controls sit. It is a qualitative confirmation of design and flow, not a statistical test of operating effectiveness. Balance accuracy testing and strategy documentation are separate procedures.

Question 50Audit Process and Methodology

An audit finding states: 'Invoices are paid without matching to receiving reports.' Which additional element is essential to make this a complete finding?

  1. The name of the clerk who processed the payments
  2. The criteria, the effect or risk, and the supporting evidence Correct answer.
  3. The date the vendor was added to the master file
  4. A recommendation to terminate the accounts payable manager

Explanation

A complete finding links the condition observed to criteria (the expected control or policy), the effect or risk of the gap, and the evidence supporting it, usually with a recommendation. Individual names, vendor dates, and personnel sanctions are not required elements and may be inappropriate. The structure lets management understand and act on the issue.