I85PREP
⌘ K
AICB Bank Audit Practices (BKA, Malaysia) study materials
AICB Bank Audit Practices (BKA, Malaysia) study resources

AICB Bank Audit Practices (BKA, Malaysia) practice questions

One question at a time. Build your AICB Bank Audit Practices (BKA, Malaysia) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, risk management and the internal control framework

Under Bank Negara Malaysia's policy on corporate governance for financial institutions, which body holds ultimate responsibility for approving the bank's overall risk appetite and for overseeing the effectiveness of the internal control system?

  1. The external auditor
  2. The Shariah committee
  3. The internal audit department
  4. The Board of Directors Correct answer.

Explanation

The board is accountable for setting and approving the bank's strategic direction and risk appetite and for ensuring a sound internal control framework is in place. Management implements that framework, while audit functions provide independent assurance rather than ultimate ownership. External auditors express an opinion on financial statements, not on governance ownership.

Question 2Governance, risk management and the internal control framework

In the three lines model applied by Malaysian banks, which function is best described as providing independent objective assurance to the board on the adequacy and effectiveness of the internal control system?

  1. The business line that originates loans
  2. The internal audit function Correct answer.
  3. The front-office customer service team
  4. The risk-taking trading desk

Explanation

Under the three lines model, business units own and manage risk in the first line, while risk and compliance functions provide oversight in the second line. Internal audit forms the third line and gives independent assurance to the board and its audit committee on how effectively controls are designed and operating. Front-office and trading functions take risk rather than assure on it.

Question 3Governance, risk management and the internal control framework

A bank separates the duties of loan approval, loan disbursement and loan reconciliation among different officers. Which internal control concept does this arrangement primarily illustrate?

  1. Business continuity planning
  2. Outsourcing governance
  3. Capital adequacy buffering
  4. Segregation of duties Correct answer.

Explanation

Segregation of duties divides incompatible tasks so that no single person can initiate, authorise and record a transaction without independent check. This reduces the risk of error and fraud by ensuring that one officer's work is verified by another. Business continuity, capital buffers and outsourcing rules address different risks entirely.

Question 4Governance, risk management and the internal control framework

Which statement best describes the role of the audit committee within a Malaysian bank's governance structure?

  1. It prepares the bank's daily liquidity reports
  2. It sets the interest rates offered on deposit products
  3. It oversees the internal audit function and reviews the adequacy of internal controls on behalf of the board Correct answer.
  4. It approves individual customer credit facilities

Explanation

The audit committee is a board committee that oversees financial reporting, the internal and external audit processes and the adequacy of internal controls. It provides a direct line of oversight between the board and the assurance functions. Operational tasks such as liquidity reporting, credit approvals and pricing belong to management.

Question 5Governance, risk management and the internal control framework

A bank's internal control system is commonly described as comprising five interrelated components. Which of the following is one of those components?

  1. Risk assessment Correct answer.
  2. Marketing and product development
  3. Branch expansion planning
  4. Shareholder dividend policy

Explanation

The widely adopted internal control framework identifies five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Risk assessment is the process by which the bank identifies and evaluates risks to its objectives. Marketing, dividend policy and expansion planning are business decisions, not control components.

Question 6Governance, risk management and the internal control framework

A bank's internal audit charter should be formally approved and periodically reviewed by which party?

  1. The external audit engagement partner
  2. The head of the largest business unit
  3. The bank's largest corporate borrower
  4. The audit committee of the board Correct answer.

Explanation

The internal audit charter defines internal audit's purpose, authority and responsibilities and should be approved by the audit committee on behalf of the board. This preserves the independence of internal audit from management. Business heads, external auditors and customers have no authority to approve the charter.

Question 7Governance, risk management and the internal control framework

Which of the following best describes the purpose of a bank's risk appetite statement?

  1. To set out the salary bands for senior management
  2. To articulate the amount and type of risk the bank is willing to accept in pursuing its objectives Correct answer.
  3. To record the minutes of the audit committee meetings
  4. To list the names of all credit officers authorised to approve loans

Explanation

A risk appetite statement expresses the level and types of risk the bank is prepared to accept in pursuit of its strategic objectives, often supported by quantitative limits and qualitative statements. It guides decision-making and limit-setting across the bank. It is not an operational authorisation list, meeting record or remuneration schedule.

Question 8Governance, risk management and the internal control framework

In the context of internal controls, what does the term 'control environment' primarily refer to?

  1. The interest rate environment affecting the bank's margins
  2. The physical security systems installed at branch premises
  3. The software used to process customer transactions
  4. The tone set by the board and senior management, including integrity, ethical values and governance structures Correct answer.

Explanation

The control environment is the foundation of the internal control system, reflecting the tone at the top set by the board and management through integrity, ethical values, commitment to competence and governance structures. It shapes the discipline and culture within which other controls operate. Physical security, transaction software and market rates are not the control environment itself.

Question 9Governance, risk management and the internal control framework

A bank discovers that a single treasury dealer can both execute trades and independently confirm them with counterparties without any secondary review. Which control weakness does this most directly represent?

  1. Weak business continuity planning
  2. Excessive customer concentration
  3. Insufficient capital adequacy
  4. Inadequate segregation of duties Correct answer.

Explanation

Allowing one person to execute and confirm the same trade removes the independent check that segregation of duties is meant to provide, creating opportunity for error or concealment of unauthorised trades. The weakness is a control design flaw, not a capital, concentration or continuity issue. Remediation would separate execution from confirmation.

Question 10Governance, risk management and the internal control framework

A bank's internal audit function reports functionally to the audit committee and administratively to the chief executive officer. What is the main governance benefit of this reporting arrangement?

  1. It removes the need for external audit
  2. It guarantees that no control failures will occur
  3. It reduces the cost of the audit function
  4. It preserves internal audit's independence from the management it assesses Correct answer.

Explanation

Functional reporting to the audit committee gives internal audit an independent line to the board, while administrative reporting to the CEO supports day-to-day operations. This dual reporting structure protects objectivity so that audit findings are not suppressed by the management being audited. It does not eliminate control failures or replace external audit.

Question 11Governance, risk management and the internal control framework

A bank's credit card operations are outsourced to a third-party service provider. Under sound outsourcing governance, which responsibility remains with the bank?

  1. Ongoing oversight and management of the outsourced activity and its risks Correct answer.
  2. The obligation to obtain a banking licence for the provider
  3. None, because the activity has been transferred to the provider
  4. The duty to fund the provider's capital requirements

Explanation

Outsourcing transfers the performance of an activity but not the accountability for it; the bank remains responsible for managing the risks and overseeing the provider's performance. This includes due diligence, contractual controls and ongoing monitoring. The provider's licensing and capital are the provider's own regulatory matters.

Question 12Governance, risk management and the internal control framework

An internal auditor is asked by the head of the lending division to help design and implement a new loan origination control process. Which action best preserves the auditor's independence?

  1. Refuse any contact with the lending division
  2. Accept the task and later audit the same process
  3. Accept the task and exclude the process from future audit coverage
  4. Decline to design the control but offer to provide advisory input on control risks, with the audit committee informed Correct answer.

Explanation

Internal audit must avoid taking on management responsibilities that it would later have to assess independently. Providing advisory input on risks while leaving design and implementation to management, with disclosure to the audit committee, preserves objectivity. Designing and then auditing the same control creates a self-review threat.

Question 13Governance, risk management and the internal control framework

A bank's board delegates authority to a management risk committee to monitor risk limits within an approved framework. What is the board's responsibility once this delegation is made?

  1. It retains ultimate accountability and must receive regular reporting to oversee that the framework is operating effectively Correct answer.
  2. It has no further role until the next annual general meeting
  3. It must personally approve every transaction within the limits
  4. It must transfer accountability to the external auditor

Explanation

Delegation of authority does not extinguish board accountability; the board must oversee the delegated function through regular, reliable reporting and challenge. It therefore remains responsible for ensuring the risk framework and limits are effective. It neither approves every transaction nor shifts accountability to external parties.

Question 14Governance, risk management and the internal control framework

Which of the following is the most appropriate example of a detective control in a bank's payment processing function?

  1. Restricting system access to trained payment officers
  2. Requiring dual authorisation before a payment is released
  3. A policy requiring staff to complete annual anti-fraud training
  4. A daily reconciliation that identifies payments processed without matching authorisation Correct answer.

Explanation

Detective controls are designed to identify errors or irregularities after they occur, such as reconciliations and exception reports. A daily reconciliation that flags unauthorised payments detects problems so they can be corrected. Dual authorisation, access restriction and training are preventive controls that aim to stop problems arising.

Question 15Governance, risk management and the internal control framework

A bank identifies a material weakness in its internal controls over financial reporting. According to sound governance practice, how should this be escalated?

  1. It should be withheld until the next external audit
  2. It should be recorded only in the branch's operational log
  3. It should be reported to senior management and the audit committee so that remediation can be overseen Correct answer.
  4. It should be communicated only to the affected customer

Explanation

Material control weaknesses must be escalated promptly to senior management and the audit committee, which has oversight responsibility for internal controls and remediation. Timely escalation allows resources and accountability to be directed to the fix. Restricting the information to logs, waiting for external audit or informing only a customer would leave the governance body uninformed.

Question 16Governance, risk management and the internal control framework

A bank uses a risk and control self-assessment (RCSA) process. What is the primary purpose of an RCSA in the internal control framework?

  1. To enable business units to identify risks, assess the effectiveness of related controls and determine residual risk Correct answer.
  2. To replace the internal audit function
  3. To determine the credit rating of corporate borrowers
  4. To calculate the bank's regulatory capital requirement

Explanation

An RCSA is a structured process in which business units identify the risks inherent in their activities, evaluate the design and operation of controls and assess the resulting residual risk. It supports ownership of risk at the first line and informs the audit plan. It does not compute capital, replace internal audit or rate borrowers.

Question 17Governance, risk management and the internal control framework

A bank's compliance function is described as part of the second line of defence. Which activity is most consistent with that role?

  1. Monitoring and advising the business on compliance with regulatory requirements and internal policies Correct answer.
  2. Executing trades on the bank's proprietary account
  3. Preparing the bank's audited financial statements
  4. Approving a customer's mortgage application

Explanation

The second line provides independent oversight and challenge to the first line, including monitoring compliance with laws, regulations and internal policies and advising the business. It does not take commercial risk by approving loans or trading, nor does it prepare the audited financial statements. This separation keeps oversight objective.

Question 18Governance, risk management and the internal control framework

A bank's internal audit plan is developed using a risk-based approach. Which factor most appropriately drives the prioritisation of audit coverage?

  1. The seniority of the managers who request an audit
  2. The number of staff employed in each department
  3. The assessed level of risk and the materiality of the activity, including emerging risks and prior findings Correct answer.
  4. The alphabetical order of department names

Explanation

A risk-based audit plan allocates limited audit resources to the areas of greatest risk and materiality, taking account of inherent risk, control effectiveness, emerging risks and the status of prior findings. This focuses assurance where it matters most. Seniority of requesters, alphabetical order and headcount are not risk-based criteria.

Question 19Governance, risk management and the internal control framework

A bank's board is considering whether to establish a separate risk management committee. Which outcome would best indicate that the committee is functioning effectively in the governance framework?

  1. It confines its review to historical financial results
  2. It meets once a year and endorses management's papers without discussion
  3. It regularly reviews risk exposures against appetite, challenges management and escalates significant matters to the board Correct answer.
  4. It delegates all risk decisions to the internal audit function

Explanation

An effective board risk committee provides active oversight by monitoring exposures against the approved risk appetite, challenging management and escalating material issues to the board. Meeting frequency, quality of challenge and escalation are indicators of effectiveness. Passive endorsement, delegation to internal audit or a backward-looking focus would undermine its purpose.

Question 20Governance, risk management and the internal control framework

Which of the following best describes the relationship between the internal control framework and the bank's enterprise risk management (ERM) framework?

  1. They are entirely unrelated and operated by separate regulators
  2. Internal controls apply only to financial reporting, while ERM applies only to credit risk
  3. Internal controls are the mechanisms through which many identified risks are mitigated, and both operate within the same governance structure Correct answer.
  4. ERM replaces the need for internal controls

Explanation

ERM identifies, assesses and prioritises risks across the bank, and internal controls are among the principal mechanisms used to mitigate those risks and keep exposures within appetite. The two frameworks are complementary and operate under the same board and management governance. ERM does not replace controls, and neither framework is confined to a single risk type.

Question 21Governance, risk management and the internal control framework

A bank's internal audit function follows up on a prior finding that a critical control gap in its online banking platform remained unresolved beyond the agreed remediation date. What is the most appropriate audit response?

  1. Close the finding because time has passed
  2. Remove the finding from the audit system to avoid duplication
  3. Escalate the overdue finding to the audit committee and senior management for action Correct answer.
  4. Transfer responsibility for remediation to the internal auditor

Explanation

Overdue remediation of a critical control gap represents a continuing risk and should be escalated to the audit committee and senior management so that accountability and action are enforced. Internal audit tracks and reports on remediation but does not take over the management responsibility to fix it. Closing or deleting the finding would conceal an unresolved risk.

Question 22Governance, risk management and the internal control framework

A bank's chief executive officer also chairs the audit committee. Which governance concern does this arrangement most directly raise?

  1. It improves efficiency by consolidating decision-making
  2. It automatically breaches the bank's outsourcing policy
  3. It compromises the independence of the audit committee's oversight of management Correct answer.
  4. It reduces the bank's capital adequacy ratio

Explanation

The audit committee oversees management and the assurance functions, so having the CEO chair it creates a conflict because management would be overseeing itself. Independence of the committee from executive management is fundamental to effective governance. The issue is not efficiency, capital or outsourcing.

Question 23Governance, risk management and the internal control framework

A bank's internal audit function is significantly under-resourced relative to its risk-based plan, and management proposes to use the shortfall as a reason to reduce audit scope. How should the audit committee respond to best protect the control framework?

  1. Disband the audit function until funding is restored
  2. Accept the reduced scope because resources are limited
  3. Require the resource gap to be addressed or formally documented and reported, while ensuring the reduced plan is risk-justified and disclosed to the board Correct answer.
  4. Direct internal audit to rely entirely on management's self-assessments

Explanation

Resource constraints should be transparently escalated so the board understands the resulting assurance gap, and any reduction in scope must be risk-justified rather than driven by convenience. The audit committee should press for adequate resourcing or formal documentation of the limitation. Relying solely on management self-assessment or disbanding audit would destroy independent assurance.

Question 24Governance, risk management and the internal control framework

A bank's management overrides an established control by instructing staff to bypass a system limit for a large transaction. Which governance principle is most directly undermined by management override?

  1. The principle that customers must be charged uniform fees
  2. The principle that controls apply consistently and cannot be set aside at will, even by senior staff Correct answer.
  3. The principle that all transactions must be profitable
  4. The principle that branches must be geographically dispersed

Explanation

Management override attacks the integrity of the control environment because it allows individuals to circumvent controls designed to protect the bank. Sound governance requires that controls operate consistently and that any exception follows an authorised, documented approval process. Profitability, fee uniformity and branch dispersion are unrelated to the integrity of controls.

Question 25Governance, risk management and the internal control framework

A bank's board wants assurance that its internal control system remains effective over time. Which arrangement best provides continuous, independent evidence of control effectiveness rather than a one-off assessment?

  1. A review conducted only when a loss event occurs
  2. A combination of ongoing monitoring by management, periodic self-assessment and independent internal audit review Correct answer.
  3. A single external audit performed every few years
  4. Reliance solely on staff declarations of compliance

Explanation

Effective monitoring combines ongoing management monitoring, periodic self-assessment and independent internal audit review, giving layered and continuous evidence of whether controls are operating. Each layer contributes a different perspective and reinforces the others. One-off external audits, self-declarations alone or reactive reviews after losses provide insufficient ongoing assurance.

Question 26Governance, risk management and the internal control framework

Under the three lines of defence model as applied to a Malaysian bank, which group is responsible for owning and managing risk on a day-to-day basis within approved limits?

  1. The Shariah advisory committee overseeing Islamic products
  2. The business line management that originates and processes the transactions Correct answer.
  3. The external auditor engaged to opine on the financial statements
  4. The internal audit function reporting to the board audit committee

Explanation

In the three lines of defence model, the first line consists of business line management, which owns and manages risk directly as it conducts the bank's activities. The second line provides independent oversight of risk and compliance, while internal audit forms the third line and gives independent assurance to the board.

Question 27Governance, risk management and the internal control framework

A bank's internal control system is built on the COSO framework. Within that framework, which component covers the policies, procedures and activities that actually prevent, detect or correct errors and irregularities?

  1. Risk assessment
  2. Information and communication
  3. Monitoring activities
  4. Control activities Correct answer.

Explanation

Control activities are the policies and procedures that help ensure management directives are carried out, such as authorisations, reconciliations and segregation of duties. They are the component that directly prevents, detects or corrects errors and irregularities.

Question 28Governance, risk management and the internal control framework

A bank's board wants a single, documented statement of the maximum level of risk it is willing to accept across its principal risk types, expressed in both qualitative and quantitative terms. Which governance tool best meets this need?

  1. The business continuity plan maintained by operations
  2. The risk appetite framework approved by the board Correct answer.
  3. The annual external audit management letter
  4. The internal audit charter approved by the audit committee

Explanation

A risk appetite framework articulates the amount and type of risk the board is willing to accept, usually combining qualitative statements with quantitative limits and tolerances across risk types. It is approved at board level and cascades into risk limits used by management.

Question 29Governance, risk management and the internal control framework

A bank's internal audit function is preparing to assess whether management's risk management framework is operating as intended. Which arrangement best preserves the independence of that assessment?

  1. Internal audit reports findings to the board audit committee and does not take on operational risk ownership Correct answer.
  2. Internal audit jointly owns the risk register with the risk management department it will assess
  3. Internal audit reports to the head of the business unit whose controls it is reviewing
  4. Internal audit staff rotate permanently into the risk function to build expertise

Explanation

Independence requires that internal audit reports to the audit committee and avoids assuming management responsibilities such as owning or operating controls. If auditors design or own the risk framework, they would effectively be assessing their own work, which undermines objectivity.

Question 30Governance, risk management and the internal control framework

During a review of a bank's loan approval process, an auditor finds that credit officers can raise a customer's approved limit without any secondary authorisation, and that exception reports are produced but never reviewed. Which conclusion most accurately reflects the state of the internal control system?

  1. No deficiency exists because exception reports are generated and available for inspection
  2. Only an operating deficiency exists because the credit officers are experienced and the limits are small
  3. The deficiencies are immaterial because credit approval is a business decision rather than a control
  4. A design deficiency exists because the control is absent, and an operating deficiency exists because the exception report is not reviewed Correct answer.

Explanation

A design deficiency arises where a necessary control, such as secondary authorisation for limit increases, is missing from the process. An operating deficiency arises where a control that exists, such as the exception report review, is not actually performed as designed. Both must be reported and remediated according to their severity.

Question 31Audit planning, risk assessment and materiality

Under BNM's risk-based approach, which factor most directly increases the inherent risk rating assigned to a bank's credit card portfolio during audit planning?

  1. A high proportion of unsecured exposures with rapid recent portfolio growth Correct answer.
  2. A long-standing branch network with stable staffing levels
  3. Regular internal audit coverage of the retail lending function
  4. The existence of a documented credit policy approved by the board

Explanation

Inherent risk reflects the nature of the activity before controls are considered. Unsecured exposures and rapid growth raise both potential loss severity and uncertainty, so the planner should rate inherent risk higher.

Question 32Audit planning, risk assessment and materiality

In the audit planning phase, materiality for a bank audit is best described as the amount by which misstatements could influence the economic decisions of:

  1. Users of the financial statements Correct answer.
  2. The regulator's licensing department
  3. The bank's internal audit committee only
  4. The external auditor's engagement partner

Explanation

Materiality is judged by reference to the common information needs of users of the financial statements as a group. The engagement partner applies judgement, but the benchmark is the users, not the auditor personally.

Question 33Audit planning, risk assessment and materiality

Which benchmark is most commonly used to set overall materiality for a commercial bank whose earnings are relatively stable?

  1. Gross fee income
  2. Number of customer accounts
  3. Total equity
  4. Profit before tax Correct answer.

Explanation

For stable, profit-oriented entities, profit before tax is a common benchmark because users focus on earnings performance. Banks with volatile earnings may instead use total assets or equity.

Question 34Audit planning, risk assessment and materiality

An auditor sets performance materiality below overall materiality primarily to:

  1. Replace the need to document the audit strategy
  2. Reduce the risk that uncorrected and undetected misstatements exceed overall materiality Correct answer.
  3. Eliminate the need for substantive testing on low-risk balances
  4. Allow the audit opinion to be issued earlier than planned

Explanation

Performance materiality provides a cushion so that the aggregate of individually immaterial misstatements, plus undetected ones, is unlikely to exceed overall materiality. It drives the extent of testing, not its elimination.

Question 35Audit planning, risk assessment and materiality

A bank's audit universe is being refreshed for the annual plan. Which approach best reflects a risk-based prioritisation of audit coverage?

  1. Scoring business units by inherent risk and control effectiveness, then allocating coverage to the highest scores Correct answer.
  2. Covering only units that requested an audit in the prior year
  3. Scheduling audits according to the availability of the internal audit team
  4. Auditing every branch on a fixed three-year cycle regardless of risk

Explanation

Risk-based planning ranks the audit universe using assessed risk so that limited audit resources focus on areas of greatest exposure. Cyclical or convenience-driven scheduling ignores differential risk.

Question 36Audit planning, risk assessment and materiality

Which document sets out the scope, timing and direction of a bank audit and guides the development of the detailed audit plan?

  1. The engagement letter
  2. The overall audit strategy Correct answer.
  3. The internal control questionnaire
  4. The management representation letter

Explanation

The overall audit strategy establishes scope, timing, direction and resourcing, and then informs the more detailed audit plan. The engagement letter confirms the terms of the engagement rather than the audit approach.

Question 37Audit planning, risk assessment and materiality

During planning, the auditor identifies a significant risk in the bank's loan loss provisioning. What is the most appropriate response?

  1. Rely entirely on the bank's automated provisioning model without testing
  2. Design focused substantive procedures and evaluate the model's assumptions and data Correct answer.
  3. Reduce sample sizes because the area is significant
  4. Defer the area to the next audit cycle

Explanation

For a significant risk, the auditor must obtain a deeper understanding and design responsive procedures, including evaluating estimates and underlying data. Reliance on the model without testing is not sufficient.

Question 38Audit planning, risk assessment and materiality

When planning a bank audit, analytical procedures at the risk assessment stage are used mainly to:

  1. Replace the need for an understanding of internal controls
  2. Confirm the accuracy of the general ledger trial balance
  3. Identify unusual relationships and areas of higher risk Correct answer.
  4. Provide substantive assurance over individual transactions

Explanation

Planning analytics highlight unexpected fluctuations or relationships that may signal risk and direct attention to areas needing further work. They are not by themselves substantive evidence for individual transactions.

Question 39Audit planning, risk assessment and materiality

A bank's treasury division has grown rapidly and now holds complex derivative positions. In the risk assessment, this most likely indicates:

  1. Reduced need for specialist involvement
  2. Higher inherent risk due to complexity and valuation uncertainty Correct answer.
  3. No change in risk because treasury is a support function
  4. Lower inherent risk because derivatives are exchange-traded

Explanation

Complex instruments and rapid growth increase valuation uncertainty and the potential for error or manipulation, raising inherent risk. Such areas often warrant involving valuation specialists.

Question 40Audit planning, risk assessment and materiality

An auditor determines overall materiality of RM10 million for a bank. Which performance materiality level is most consistent with professional guidance?

  1. RM7 million Correct answer.
  2. RM12 million
  3. RM1,000
  4. RM10 million

Explanation

Performance materiality is set below overall materiality, commonly at a percentage of it, to allow for undetected and aggregated misstatements. A level above overall materiality or equal to it defeats that purpose.

Question 41Audit planning, risk assessment and materiality

In planning the audit of a bank's IT environment, which matter is most relevant to the auditor's assessment of the reliability of automated controls?

  1. The bank's marketing budget for digital products
  2. The tenure of the branch managers
  3. The design of IT general controls over change management and access Correct answer.
  4. The number of ATMs operated by the bank

Explanation

Automated application controls depend on reliable IT general controls such as change management, access and operations. Weak general controls undermine reliance on automated processing.

Question 42Audit planning, risk assessment and materiality

The auditor is deciding whether to use the work of the bank's internal audit function in a credit review area. Which consideration is most important?

  1. Whether internal audit uses the same audit software as the external auditor
  2. The number of internal audit staff located at head office
  3. The internal auditors' objectivity and the competence of the work performed Correct answer.
  4. Whether internal audit reports to the marketing department

Explanation

Reliance on internal audit depends on the objectivity of the function and the competence and rigour of its work, including whether it is properly planned, supervised and documented.

Question 43Audit planning, risk assessment and materiality

A bank operates in a jurisdiction introducing stricter capital adequacy rules during the audit period. How should this affect audit planning?

  1. It should be ignored because the rules take effect after the year end
  2. It should be deferred to the following year's audit
  3. It should be treated as a regulatory risk requiring assessment of compliance and disclosure Correct answer.
  4. It should reduce audit effort because regulation is the regulator's responsibility

Explanation

New or changing regulation is a planning consideration that can affect compliance, disclosures and estimates. The auditor assesses the bank's readiness and the adequacy of related disclosures.

Question 44Audit planning, risk assessment and materiality

When setting materiality for a bank, the auditor decides to use total assets rather than profit before tax. Which circumstance best justifies this choice?

  1. The bank's share price increased during the year
  2. The bank recently rebranded its retail products
  3. The bank has a large number of small depositors
  4. The bank has highly volatile earnings and users focus on balance sheet strength Correct answer.

Explanation

Where earnings are volatile or near break-even, profit is an unstable benchmark. Total assets or equity better reflect the information needs of users focused on financial strength.

Question 45Audit planning, risk assessment and materiality

The audit team plans to test the completeness of loan interest income. Which direction of testing best addresses completeness?

  1. From recorded interest entries to supporting loan agreements
  2. From customer complaints to the complaints register
  3. From the loan portfolio listing to recorded interest income Correct answer.
  4. From the general ledger to the trial balance

Explanation

Completeness is tested by starting from a source population of loans and checking that related income has been recorded. Testing from recorded entries backwards addresses occurrence or accuracy instead.

Question 46Audit planning, risk assessment and materiality

A bank's management applies an expected credit loss model with significant judgemental overlays. In audit planning, the auditor should:

  1. Treat the overlays as immaterial because they are management's judgement
  2. Accept the model output without challenge
  3. Restrict testing to the arithmetic of the model
  4. Assess the risk of management bias in the assumptions and plan targeted procedures Correct answer.

Explanation

Estimates with significant judgement carry a risk of management bias, which is a planning consideration. The auditor evaluates assumptions, data and the rationale for overlays, not just arithmetic.

Question 47Audit planning, risk assessment and materiality

Which matter would ordinarily be documented in the audit plan rather than the overall audit strategy?

  1. The expected audit timetable and key reporting deadlines
  2. The resources required for the engagement
  3. The reporting framework applicable to the bank
  4. The nature and extent of planned substantive procedures for loan impairment Correct answer.

Explanation

The audit plan is more detailed and sets out the nature, timing and extent of procedures. The strategy addresses scope, reporting framework, timing and resources at a higher level.

Question 48Audit planning, risk assessment and materiality

An auditor uses a lower materiality threshold for the audit of a bank's related party transactions than for the financial statements as a whole. This is best explained because:

  1. The bank has fewer related party transactions than loans
  2. Related party disclosures may influence decisions even at lower amounts due to their nature Correct answer.
  3. Regulators require all related party amounts to be audited in full
  4. Related party transactions are always illegal

Explanation

Materiality can differ for particular classes of transactions where qualitative factors make smaller amounts sensitive. Related party dealings often attract heightened user interest, justifying a lower threshold.

Question 49Audit planning, risk assessment and materiality

During planning, the auditor learns that the bank's head of credit was dismissed for overriding approval limits. How should this affect the risk assessment?

  1. It should increase assessed risk of fraud and management override of controls Correct answer.
  2. It should be disregarded as a personnel matter
  3. It should reduce risk because the individual has left
  4. It should only affect the following year's audit

Explanation

Evidence of override of controls signals a heightened fraud risk, particularly management override. The auditor should plan procedures responsive to that risk for the current period.

Question 50Audit planning, risk assessment and materiality

A bank's loan portfolio is concentrated in a single industry now facing a severe downturn. The auditor's planning response should be to:

  1. Reduce provisioning testing because the downturn is widely known
  2. Increase focus on impairment estimates and going concern considerations Correct answer.
  3. Rely on the prior year's audit conclusions
  4. Exclude the portfolio from sampling as it is too large

Explanation

Concentration risk in a stressed sector raises the risk of understated impairment and potential going concern issues. The plan should direct more attention to those estimates and disclosures.