I85PREP
⌘ K
IIA IAP study materials
IIA IAP study resources

IIA IAP practice questions

One question at a time. Build your IIA IAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Internal Audit Fundamentals

Which phrase best completes the IIA definition of internal auditing: internal auditing is an independent, objective ______ activity designed to add value and improve an organization's operations?

  1. compliance and inspection
  2. accounting and reporting
  3. assurance and consulting Correct answer.
  4. investigative and enforcement

Explanation

The IIA definition describes internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve risk management, control, and governance processes.

Question 2Internal Audit Fundamentals

Which two elements of the International Professional Practices Framework are mandatory?

  1. Position papers and research reports
  2. Practice guides and supplemental guidance
  3. Code of Ethics and the Standards Correct answer.
  4. Implementation guidance and toolkits

Explanation

The IPPF distinguishes mandatory elements from strongly recommended guidance. The Code of Ethics and the Global Internal Audit Standards are the mandatory elements that internal auditors and audit activities must follow.

Question 3Internal Audit Fundamentals

The chief audit executive's functional reporting line should normally go to:

  1. The chief operating officer
  2. The external auditor
  3. The chief financial officer
  4. The board or audit committee Correct answer.

Explanation

Functional reporting to the board or audit committee supports the independence of the internal audit activity and allows the governing body to direct, oversee, and hold the activity accountable. Administrative reporting usually runs to senior management for day-to-day operational matters.

Question 4Internal Audit Fundamentals

An internal auditor's objectivity is most clearly impaired when the auditor:

  1. Audits a function the auditor managed within the past year Correct answer.
  2. Documents the work performed in the engagement workpapers
  3. Uses data analytics to test a sample of transactions
  4. Reviews a process owned by a colleague in another department

Explanation

Objectivity is a state of mind that allows internal auditors to perform engagements without compromising quality and without subordinating judgment to others. Assessing an activity for which the auditor was recently responsible creates a self-review threat that impairs objectivity.

Question 5Internal Audit Fundamentals

The primary purpose of an internal audit charter is to:

  1. list the detailed audit steps to be performed on each engagement
  2. specify the salary grades assigned to audit staff positions
  3. record the engagements scheduled for the coming year
  4. define purpose, authority and responsibility Correct answer.

Explanation

The internal audit charter is a formal document approved by the board that defines the purpose, authority, and responsibility of the internal audit activity. It establishes the activity's position within the organization and the scope of its work.

Question 6Internal Audit Fundamentals

A compliance audit primarily evaluates whether:

  1. financial statements are presented fairly under the applicable reporting framework
  2. the organization adheres to laws, regulations, and prescribed policies Correct answer.
  3. operational processes are carried out efficiently and effectively
  4. information systems safeguard data against unauthorized access

Explanation

A compliance audit tests whether the organization is following laws, regulations, contracts, and internal policies. The other options describe financial statement, operational, and information systems audits, which address different objectives.

Question 7Internal Audit Fundamentals

Exercising due professional care requires an internal auditor to:

  1. guarantee that no material error remains undetected
  2. weigh the work needed against complexity and materiality Correct answer.
  3. perform every engagement to the same depth regardless of risk
  4. delegate all professional judgment to the engagement supervisor

Explanation

Due professional care means applying the care and skill expected of a reasonably prudent internal auditor, considering the extent of work needed, relative complexity, materiality, and cost-benefit. It does not mean infallibility or unlimited testing.

Question 8Internal Audit Fundamentals

In the Three Lines Model, the internal audit activity primarily provides:

  1. independent assurance and advice to the governing body Correct answer.
  2. day-to-day management of risk and control
  3. governance oversight on behalf of stakeholders
  4. external reporting to regulators

Explanation

The Three Lines Model places internal auditing in the third line, providing independent assurance and advice on risk management, control, and governance to the governing body. First and second line roles belong to management and risk/compliance functions.

Question 9Internal Audit Fundamentals

The chief audit executive reports administratively to the controller, who also oversees the accounts payable area that internal audit is currently reviewing. The most appropriate action is to:

  1. ask the controller to review the draft engagement report
  2. raise the reporting conflict with the board or audit committee Correct answer.
  3. drop the accounts payable engagement from the annual plan
  4. assign the engagement to the controller's former deputy

Explanation

Independence is impaired when the administrative reporting line sits with an executive who manages an area under audit. The situation should be disclosed and escalated to the board or audit committee so that the governing body can address the conflict.

Question 10Internal Audit Fundamentals

An auditor transferred into internal audit six months ago from the procurement department is assigned to review procurement contracts. The most appropriate response is to:

  1. perform the engagement under supervision without any reassignment
  2. assign a different auditor, since objectivity is presumed impaired Correct answer.
  3. ask procurement management to approve the auditor's assignment
  4. proceed, because six months have already passed since the transfer

Explanation

Internal auditors must not assess operations for which they were responsible within the previous twelve months, because a self-review threat is presumed to exist. Reassignment to another engagement is the appropriate safeguard.

Question 11Internal Audit Fundamentals

Which characteristic distinguishes a consulting engagement from an assurance engagement?

  1. It may only be performed by an external consulting firm
  2. It is exempt from the requirements of the Code of Ethics
  3. Its nature and scope are agreed with the client and the work is advisory Correct answer.
  4. It requires no documentation in the engagement file

Explanation

In a consulting engagement the internal auditor advises and the nature and scope of the work are agreed with the client. In an assurance engagement the auditor determines scope and expresses an independent conclusion on the area examined.

Question 12Internal Audit Fundamentals

Which party should approve the risk-based annual internal audit plan?

  1. The chief executive officer alone
  2. The external audit firm
  3. The board or audit committee Correct answer.
  4. The internal audit staff collectively

Explanation

The board or audit committee approves the risk-based audit plan, which supports the activity's independence and aligns coverage with the organization's objectives and risks. The chief audit executive develops the plan but does not have final approval authority alone.

Question 13Internal Audit Fundamentals

When audit resources are insufficient to cover every risk in the audit universe, the chief audit executive should:

  1. silently reduce the scope of each engagement
  2. audit only the areas that have the strongest controls
  3. present the resource limitation and its risk implications to the board Correct answer.
  4. postpone all engagements until staffing levels improve

Explanation

The chief audit executive must communicate the impact of resource limitations on audit coverage to the board or audit committee. This allows the governing body to accept the residual risk or provide additional resources.

Question 14Internal Audit Fundamentals

Under the IIA's quality standards, an external quality assessment of the internal audit activity should be performed:

  1. whenever an engagement finding is disputed by management
  2. at least once every five years by a qualified independent assessor Correct answer.
  3. only when an instance of fraud has been uncovered
  4. annually by the chief audit executive

Explanation

The quality assurance and improvement program requires internal assessments, both ongoing and periodic, plus an external assessment at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

Question 15Internal Audit Fundamentals

An audit team lacks the expertise needed to assess cloud security controls in an upcoming engagement. The chief audit executive should:

  1. obtain competent advice or resources before the work proceeds Correct answer.
  2. remove the engagement from the plan permanently
  3. rely on management's self-assessment as a substitute for audit work
  4. let the least experienced auditor learn the topic on the job

Explanation

Internal auditors must collectively possess or obtain the knowledge, skills, and competencies needed to perform each engagement. Where expertise is missing, the activity should obtain competent advice or resources before proceeding.

Question 16Internal Audit Fundamentals

Regarding fraud, the internal audit activity's role is primarily to:

  1. assess fraud risk and related controls Correct answer.
  2. serve as legal counsel during fraud investigations
  3. accept primary responsibility for fraud prevention
  4. determine guilt and impose disciplinary action on employees

Explanation

Management is responsible for establishing and maintaining controls to prevent and detect fraud. Internal auditing assists the organization by assessing fraud risk exposure and evaluating the adequacy and effectiveness of related controls.

Question 17Internal Audit Fundamentals

An auditee offers an internal auditor an expensive gift during an engagement. Under the Code of Ethics, the auditor should:

  1. accept it if the auditee is a personal friend
  2. accept it only after the engagement report is issued
  3. accept it and disclose the gift in the workpapers
  4. decline the gift because it may impair objectivity Correct answer.

Explanation

The Code of Ethics requires internal auditors to avoid accepting anything that impairs, or appears to impair, their professional judgment. Accepting a valuable gift from an auditee creates at least the appearance of a conflict and should be declined.

Question 18Internal Audit Fundamentals

Follow-up procedures performed by internal audit primarily determine whether:

  1. management has implemented the agreed corrective actions Correct answer.
  2. the external auditor concurs with the engagement findings
  3. management has been disciplined for control failures
  4. the engagement was completed within its budgeted hours

Explanation

Internal audit monitors and follows up on whether management has implemented the corrective actions agreed in response to findings. The purpose is to confirm that the underlying risk or control weakness has been addressed.

Question 19Internal Audit Fundamentals

An auditor who previously advised management on the design of a new procurement system is later assigned to audit that system. The greatest threat to the auditor is to:

  1. confidentiality
  2. due professional care
  3. proficiency
  4. objectivity Correct answer.

Explanation

Having helped design the system, the auditor would effectively be reviewing their own work, which is a self-review threat to objectivity. Consulting work that becomes the subject of a later assurance engagement requires safeguards or reassignment.

Question 20Internal Audit Fundamentals

Which set of principles is contained in the IIA Code of Ethics?

  1. Honesty, loyalty, efficiency, and profitability
  2. Integrity, objectivity, confidentiality, and competency Correct answer.
  3. Independence, transparency, efficiency, and accountability
  4. Fairness, prudence, secrecy, and compliance

Explanation

The IIA Code of Ethics is built on four principles: integrity, objectivity, confidentiality, and competency. Each principle is accompanied by rules of conduct that describe the behavior expected of internal auditors.

Question 21Internal Audit Fundamentals

A board routinely defers all internal audit matters to the chief executive officer and has never approved an internal audit charter. This situation most likely means that:

  1. impairment exists only if an engagement report is actually suppressed
  2. the independence of the internal audit activity is impaired Correct answer.
  3. independence is preserved because the CEO is accountable to the board
  4. no impairment exists as long as the audit work is performed competently

Explanation

Independence depends on the internal audit activity having a charter approved by the board and direct access to the governing body. When the board abdicates oversight and the activity operates under management's direction, organizational independence is impaired.

Question 22Internal Audit Fundamentals

Which statement best distinguishes organizational independence from individual objectivity?

  1. The two terms are interchangeable in the IPPF
  2. Independence relates to reporting lines; objectivity is a state of mind Correct answer.
  3. Objectivity concerns reporting lines; independence concerns mental attitude
  4. Independence applies only to the chief audit executive and objectivity only to staff auditors

Explanation

Organizational independence refers to the internal audit activity's status and reporting structure, which free it from undue influence. Objectivity is an individual attribute, a mental attitude that lets an auditor perform work without compromising judgment.

Question 23Internal Audit Fundamentals

During an engagement, management refuses to provide records for a key process. The chief audit executive's most appropriate action is to:

  1. issue an opinion on the process without the records
  2. communicate the scope limitation and its implications to the board Correct answer.
  3. close the engagement quietly and drop the finding
  4. obtain the records covertly from the IT department

Explanation

A scope limitation prevents the activity from delivering complete assurance, and the chief audit executive must disclose it and its implications to the board. The limitation should also be reflected in the engagement's communication of results.

Question 24Internal Audit Fundamentals

An internal auditor is asked to take operational responsibility for implementing a new control. Accepting would most likely:

  1. be acceptable because consulting is part of internal auditing
  2. be acceptable if the auditor documents the assistance
  3. impair objectivity by placing the auditor in a management role Correct answer.
  4. strengthen the auditor's understanding of the control

Explanation

Internal auditors must not assume management responsibilities, because doing so places them in the position of auditing their own work. Assisting with advice or reviewing the design is acceptable only while management retains ownership of decisions and implementation.

Question 25Internal Audit Fundamentals

A chief audit executive is asked by the CEO to remove a significant revenue recognition finding from the final engagement report. The chief audit executive should:

  1. comply, because the CEO outranks the chief audit executive
  2. remove the finding but mention it verbally to audit staff
  3. retain the finding and escalate the matter to the board Correct answer.
  4. postpone the report indefinitely to avoid conflict with the CEO

Explanation

The chief audit executive must report significant matters to the board and cannot allow management to suppress or alter a material finding. Pressure to remove a legitimate finding is itself a matter the governing body needs to know about.

Question 26Internal Audit Fundamentals

According to the IIA's definition, internal auditing is an independent, objective assurance and consulting activity designed primarily to do which of the following?

  1. Guarantee that the financial statements contain no material errors
  2. Add value and improve an organization's operations Correct answer.
  3. Certify that management has complied with all applicable laws
  4. Replace the work performed by the organization's external auditor

Explanation

The IIA definition states that internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations, helping it accomplish its objectives through a systematic approach to evaluating governance, risk management, and control. It never guarantees results or substitutes for other assurance providers.

Question 27Internal Audit Fundamentals

Which statement best describes the purpose of the internal audit activity?

  1. To enforce compliance with the organization's internal policies on behalf of senior management and the board
  2. To prepare the organization's annual financial statements and the related narrative disclosures for external filing
  3. To eliminate the organization's most significant risks before they can materialize into losses
  4. To help the organization accomplish its objectives through independent, objective assurance and advice Correct answer.

Explanation

The internal audit activity exists to strengthen the organization's ability to create, protect, and sustain value by giving the board and management independent, objective, risk-based assurance, advice, insight, and foresight. It supports the achievement of objectives rather than taking over management's operational duties.

Question 28Internal Audit Fundamentals

An internal audit charter primarily establishes the internal audit activity's:

  1. Testing methodologies and sampling techniques to be used in engagements
  2. Annual engagement schedule with start and end dates
  3. Budget, headcount, and the salary structure applied to the audit staff
  4. Purpose, authority, and responsibility within the organization Correct answer.

Explanation

The charter is a formal written document, approved by the board, that defines the internal audit activity's purpose, authority, and responsibility; it also establishes the activity's position in the organization, its reporting relationships, and its right of access to records and personnel.

Question 29Internal Audit Fundamentals

An internal auditor is assigned to review the treasury function, which is managed by the auditor's spouse. Under the IIA's ethical requirements, the auditor should:

  1. Proceed, because technical auditing skills are unaffected by personal relationships
  2. Complete the engagement and disclose the relationship only if a problem is found
  3. Proceed, provided the spouse agrees not to participate in the review discussions
  4. Disclose the relationship and decline the assignment or request reassignment Correct answer.

Explanation

Objectivity requires auditors to avoid conflicts of interest and to disclose any relationship or circumstance that could bias their judgment, because the appearance of bias is as damaging as actual bias. The appropriate response is prompt disclosure and removal from the engagement, documented and communicated to the chief audit executive.

Question 30Internal Audit Fundamentals

Which of the following generally provides the most reliable audit evidence?

  1. The department's own written procedures describing how the process should work
  2. A signed confirmation received directly from an independent third party Correct answer.
  3. An oral statement made by the process owner during the opening meeting
  4. A draft internal memorandum summarizing a meeting about the process

Explanation

Evidence is more reliable when it comes from an independent source, is obtained directly by the auditor, is documentary rather than oral, and consists of original rather than draft documents. Third-party written confirmation meets all four of these conditions.

Question 31Internal Audit Fundamentals

An engagement designed to assess whether a department achieves its objectives in an economical and effective manner is best described as:

  1. A compliance audit
  2. A financial statement audit
  3. An assurance engagement on a third-party service provider
  4. A performance (operational) audit Correct answer.

Explanation

Performance or operational audits examine the economy, efficiency, and effectiveness of operations and whether objectives are being achieved. Financial audits address the reliability of records and statements, while compliance audits address adherence to laws, regulations, and policies.

Question 32Internal Audit Fundamentals

Engagement workpapers, including those created by an individual auditor, are owned by:

  1. The audit committee chair, who takes custody at year end
  2. The individual auditor who prepared them, since authorship creates personal ownership rights
  3. The external auditor, once the engagement is completed and archived
  4. The organization, since they are prepared as part of the auditor's duties Correct answer.

Explanation

Workpapers are the property of the organization and remain under the control of the internal audit activity. The chief audit executive must control access to them and ensure retention and protection consistent with organizational policy and legal requirements.

Question 33Internal Audit Fundamentals

When auditors describe evidence as 'sufficient' and 'appropriate,' these terms refer respectively to:

  1. Its format (paper or electronic) and its source
  2. Its timeliness and its cost-effectiveness to obtain
  3. The quantity obtained and its relevance and reliability Correct answer.
  4. Whether it was obtained internally and whether it is current

Explanation

Sufficiency is a measure of quantity, meaning enough evidence to support the engagement's conclusions. Appropriateness is a measure of quality, covering the relevance of the information to the engagement objectives and the reliability of its source.

Question 34Internal Audit Fundamentals

Under the IIA's standards, internal auditors are expected to maintain their technical competence through continuing professional development of at least:

  1. 20 hours per year, at least 5 of which must relate directly to the audit profession
  2. 30 hours per year, with at least half earned through external conference attendance
  3. 40 hours per year, including computer-related and audit-related training Correct answer.
  4. 60 hours per year, all of which must be earned in the auditor's own industry

Explanation

The standards require internal auditors who perform audit work to maintain and develop proficiency through continuing professional development of at least 40 hours per year, including computer-related and audit-related subjects.

Question 35Internal Audit Fundamentals

Engagement objectives should be established so that they address the:

  1. Performance of the external auditor who reviews the same records
  2. Administrative costs that the audit activity will incur
  3. Risks, controls, and governance processes relevant to the area under review Correct answer.
  4. Personal development goals of each auditor assigned to the engagement team

Explanation

Engagement objectives define what the engagement is intended to accomplish and must be aligned with the internal audit activity's objectives and the organization's goals. They consider the results of the risk assessment and address the risks, controls, and governance processes in the area under review.

Question 36Internal Audit Fundamentals

The scope of an internal audit engagement defines:

  1. The criteria used to judge whether a finding is significant
  2. The date on which the final report will be issued
  3. The boundaries of the engagement, including activities, records, and the period covered Correct answer.
  4. The specific audit procedures and sampling methods that will be used to test each transaction selected

Explanation

Scope establishes what the engagement will and will not cover, such as the systems, processes, records, personnel, and time period examined. It allows readers of the engagement communication to understand the limits of the conclusions reached.

Question 37Internal Audit Fundamentals

Supervision of internal audit staff during an engagement most appropriately includes:

  1. Restricting team members from communicating with the auditee to protect objectivity
  2. Reviewing workpapers and coaching staff so the work meets the activity's quality standards Correct answer.
  3. Assigning all significant judgments to the least experienced team member in order to build capability quickly
  4. Reviewing only the final engagement report after fieldwork is complete

Explanation

Supervision is an ongoing process of directing work, reviewing workpapers and conclusions, and coaching staff, and it forms part of the activity's quality assurance and improvement program. It continues throughout the engagement rather than being confined to one stage.

Question 38Internal Audit Fundamentals

A final engagement communication should ordinarily include:

  1. Only the list of findings, with no background or context for the reader
  2. Objectives, scope, results, conclusions, and management's responses Correct answer.
  3. The individual performance ratings of each auditor who performed the engagement fieldwork
  4. The names of staff in the audited area who were interviewed

Explanation

Final communications should present the engagement's objectives and scope together with the results, including findings, conclusions, and recommendations where appropriate, along with management's response or action plan so readers can act on the work.

Question 39Internal Audit Fundamentals

During an engagement, an auditor finds a control failure that could imminently endanger employees' safety. The most appropriate action is to:

  1. Discuss it only with the auditee's supervisor and take no further action
  2. Report the matter immediately to appropriate management and the chief audit executive Correct answer.
  3. Wait until the end of fieldwork so that all findings can be reported together in the final communication
  4. Document the finding and include it in the next annual audit plan

Explanation

Significant risk exposures require prompt communication. When a matter is serious enough to demand immediate action, the auditor should escalate it through interim reporting to the chief audit executive and appropriate management rather than waiting for the final report.

Question 40Internal Audit Fundamentals

Coordination between the internal and external audit functions most appropriately involves:

  1. Internal audit performing the substantive testing that supports the external auditor's formal opinion on the financial statements
  2. Internal audit reporting its findings to the external auditor for approval
  3. Both functions working independently without any exchange of information
  4. Sharing information and aligning coverage to avoid duplication while preserving independence Correct answer.

Explanation

Coordination means sharing information and planning coverage jointly so that the combined audit effort is efficient and no significant area is missed. Each function nevertheless retains its own independence, objectives, and accountability.

Question 41Internal Audit Fundamentals

A risk-based internal audit plan should be based primarily on:

  1. The engagement hours available in the budget and staff preferences for topics
  2. A rotation schedule that cycles through every department in the organization at fixed, equal intervals of time
  3. A documented assessment of the organization's risks, objectives, and changes affecting the business Correct answer.
  4. Requests from department managers for help with their operational problems

Explanation

The risk-based plan must reflect the organization's risk profile and strategic objectives, and it must be updated for significant changes in the business, operations, systems, and controls. The chief audit executive develops it and the board approves it.

Question 42Internal Audit Fundamentals

A monthly reconciliation of bank statements to the general ledger is best classified as which type of control?

  1. Corrective control
  2. Preventive control
  3. Directive control
  4. Detective control Correct answer.

Explanation

Detective controls are designed to identify errors or irregularities after they have occurred; a reconciliation compares two independent records and surfaces discrepancies for follow-up. Preventive controls, by contrast, stop an event from happening in the first place.

Question 43Internal Audit Fundamentals

Before beginning a consulting engagement, the internal audit activity should establish an understanding with the client that covers:

  1. The audit procedures to be applied and the sampling method to be used
  2. Objectives, scope, responsibilities, and any restrictions on use of the results Correct answer.
  3. Only the fee to be charged for the work and the delivery date for the final presentation
  4. The names of client staff who will be evaluated and rated in the report

Explanation

Consulting engagements require a documented understanding of the engagement's objectives and scope, the respective responsibilities of the internal audit activity and the client, and any restrictions on how the results may be used or distributed.

Question 44Internal Audit Fundamentals

When assessing the organization's governance processes, internal audit primarily evaluates whether those processes:

  1. Eliminate the need for a separate risk management function
  2. Guarantee that all employees follow the code of conduct
  3. Support oversight, accountability, ethics, and communication of risk and control information Correct answer.
  4. Ensure that the organization's share price outperforms those of its principal competitors each year

Explanation

Governance assessments consider whether the organization has structures and processes for strategic direction, oversight, accountability, ethical culture, and communication of risk and control information to the board and senior management.

Question 45Internal Audit Fundamentals

When formulating recommendations, internal audit adds the most lasting value by:

  1. Repeating management's proposed solution without independent evaluation
  2. Listing every control weakness observed, regardless of significance
  3. Recommending additional layers of approval for all transactions
  4. Addressing the underlying root cause of the observed condition Correct answer.

Explanation

Recommendations are most useful when they address the cause of a condition rather than only its symptom, and when they are practical, cost-effective, and directed to the party able to act on them.

Question 46Internal Audit Fundamentals

The most appropriate role for internal audit in enterprise risk management is to:

  1. Transfer all identified risks to the internal audit plan for mitigation
  2. Provide assurance on risk management effectiveness and advise, without owning risks Correct answer.
  3. Own the risk register and decide which risks management must mitigate and which it may accept
  4. Set the organization's risk appetite and approve risk acceptance decisions

Explanation

Management owns risk and the enterprise risk management process, while internal audit evaluates and gives assurance on how well those processes work and may offer advisory services. Taking ownership of risk would impair the objectivity and independence the activity needs.

Question 47Internal Audit Fundamentals

Management has formally accepted a level of residual risk that the chief audit executive believes is unacceptable to the organization. According to IIA guidance, the CAE should:

  1. Remove the affected process from future audit plans to avoid conflict
  2. Implement additional controls in the affected area to reduce the risk
  3. Accept the situation, since risk acceptance is management's decision
  4. Escalate the matter to the board or audit committee for resolution Correct answer.

Explanation

When the CAE concludes that residual risk may be unacceptable to the organization, the matter must first be discussed with senior management. If it remains unresolved, it must be communicated to the board so that the board can decide how to proceed.

Question 48Internal Audit Fundamentals

Which of the following is most consistent with functional reporting by the chief audit executive to the board?

  1. Directing the day-to-day work assignments of the audit team
  2. Approving the internal audit charter and audit plan and receiving status reports Correct answer.
  3. Setting the audit activity's software, hardware, and equipment purchasing standards
  4. Approving the CAE's expense reimbursements and annual leave requests

Explanation

Functional reporting gives the board oversight of the audit activity's mandate and performance: approving the charter and the risk-based plan, receiving the CAE's reports, and being involved in decisions on the CAE's appointment or removal. Administrative reporting covers day-to-day resourcing and operations.

Question 49Internal Audit Fundamentals

During a consulting engagement, the client asks the audit team to write the final version of a new risk policy and sign it as the policy owner. The team should:

  1. Refuse to provide any input on the policy once a conflict becomes apparent
  2. Provide advice and facilitation while leaving ownership and approval with management Correct answer.
  3. Sign the policy, since internal audit's independent view strengthens the final product
  4. Have the engagement's working papers altered to show the client as the author

Explanation

Internal auditors may advise and facilitate, but they must not assume management responsibilities. Signing as policy owner would place the activity in an operational role and impair its objectivity for future assurance work over that policy.

Question 50Internal Audit Fundamentals

An internal auditor reports that the engagement found 'no fraud in the procurement process.' The statement is inappropriate mainly because:

  1. Procurement fraud is generally too small a topic to warrant coverage in engagement reports to the board
  2. Fraud findings may never be reported in writing to management
  3. Fraud detection is exclusively the responsibility of the external auditor and of the legal department
  4. Audit provides reasonable, not absolute, assurance, so conclusions must be framed accordingly Correct answer.

Explanation

Conclusions must be expressed in light of the evidence obtained and the inherent limitations of any engagement. Because internal audit provides reasonable rather than absolute assurance, absolute statements such as 'no fraud exists' claim more than the work can support.