I85PREP
⌘ K
IPPC study materials
IPPC study resources

IPPC practice questions

One question at a time. Build your IPPC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Professional Practices Framework and Standards

Under the IPPC Professional Practices Framework, which component is mandatory for members and provides the authoritative body of pronouncements that internal auditors must follow?

  1. The Mandatory Guidance element, comprising the Core Principles, Definition of Internal Auditing, Code of Ethics, and Standards Correct answer.
  2. The developmental guidance published only for public comment periods
  3. The Strongly Recommended Guidance element, comprising Implementation Guidance and Supplemental Guidance
  4. The practice advisories issued by the examination board for candidate preparation

Explanation

The IPPF separates mandatory and strongly recommended guidance. The mandatory element binds members and certified individuals and includes the Core Principles, the Definition of Internal Auditing, the Code of Ethics, and the Standards. Implementation and Supplemental Guidance sit in the strongly recommended element and do not carry the same obligation.

Question 2Professional Practices Framework and Standards

Which two components together form the Standards within the IPPF?

  1. The Definition of Internal Auditing and the mission statement
  2. Implementation Guidance and Supplemental Guidance
  3. The Code of Ethics and the Core Principles
  4. The Attribute Standards and the Performance Standards Correct answer.

Explanation

The Standards are organized into Attribute Standards, which address the characteristics of organizations and parties performing internal audit, and Performance Standards, which describe the nature of internal audit work and quality criteria for measuring it. The Code of Ethics and the Definition are separate mandatory components.

Question 3Professional Practices Framework and Standards

According to the Code of Ethics, which principle requires internal auditors to perform work with the care and skill expected of a reasonably prudent and competent internal auditor?

  1. Competency Correct answer.
  2. Confidentiality
  3. Objectivity
  4. Integrity

Explanation

The Competency principle obliges internal auditors to engage only in services for which they have the necessary knowledge, skills, and experience, and to perform work with the diligence of a reasonably prudent and competent practitioner. Objectivity concerns impartial assessment, confidentiality concerns information use, and integrity concerns honesty.

Question 4Professional Practices Framework and Standards

An internal auditor is asked to lead the implementation of a new enterprise resource planning system and later to audit that same system. Which attribute standard governs this situation?

  1. Standard on Quality Assurance, because the engagement was not supervised
  2. Standard on Proficiency, because the auditor lacks technical ERP knowledge
  3. Standard on Engagement Planning, because the scope was not documented
  4. Standard on Independence and Objectivity, because assuming management responsibility impairs objectivity Correct answer.

Explanation

Independence and objectivity are impaired when internal auditors assume management responsibilities or perform work they will later review. Leading an implementation creates a self-review threat that must be avoided or managed, so the independence and objectivity standard applies. The other standards address different attributes of the engagement.

Question 5Professional Practices Framework and Standards

The chief audit executive reports functionally to the audit committee and administratively to the chief financial officer. Which statement best reflects how this dual reporting structure supports conformance with the Standards?

  1. Reporting lines are irrelevant as long as the internal audit charter has been approved
  2. Functional reporting to the audit committee protects independence and objectivity, while administrative reporting to the CFO supports day-to-day operations Correct answer.
  3. Administrative reporting to the CFO protects independence, while functional reporting to the audit committee supports operational efficiency
  4. Both reporting lines must be to the CFO to ensure the internal audit activity has adequate resources

Explanation

Functional reporting to the board or audit committee safeguards the internal audit activity's independence, including approving the charter, audit plan, and appointment or removal of the chief audit executive. Administrative reporting supports daily operations such as budget and human resources. Reversing these lines would weaken independence.

Question 6Professional Practices Framework and Standards

Which of the following best describes the purpose of the internal audit charter required by the Standards?

  1. It formally defines the internal audit activity's purpose, authority, and responsibility, and is approved by the board Correct answer.
  2. It records management's acceptance of individual engagement recommendations
  3. It lists the professional certifications held by each member of the internal audit staff
  4. It documents the engagement work program and detailed testing procedures for each audit

Explanation

The charter is a formal document approved by the board that defines the internal audit activity's purpose, authority, and responsibility, and establishes its position within the organization. It authorizes access to records and personnel and is reviewed periodically. Work programs and staffing records serve other purposes.

Question 7Professional Practices Framework and Standards

An internal auditor discovers that a senior manager has been overriding purchasing controls for personal benefit. The auditor's supervisor suggests omitting the matter to avoid conflict. Under the Code of Ethics, what is the most appropriate action?

  1. Defer to the supervisor because the supervisor holds greater authority over the engagement
  2. Wait until the next annual audit cycle to raise the issue formally
  3. Document the finding but remove the manager's name to protect the audit team
  4. Report the matter through the established channels, escalating to the audit committee if needed, despite the pressure Correct answer.

Explanation

Integrity requires internal auditors to report findings honestly and not subordinate judgment to pressure from others. Suspected fraud involving senior management should be escalated to the audit committee or board when normal channels are compromised. Concealment or delay would breach the Code of Ethics.

Question 8Professional Practices Framework and Standards

Which statement correctly distinguishes consulting services from assurance services under the Standards?

  1. Assurance services are performed only by external auditors and fall outside the IPPF
  2. Consulting services involve the internal auditor providing advice and assistance to management, while assurance services involve an objective examination of evidence to provide an independent assessment Correct answer.
  3. Consulting services are prohibited because they inevitably impair independence
  4. Consulting services always require the internal auditor to assume management responsibility for the outcome

Explanation

The Standards recognize that internal audit activities may perform both assurance and consulting work. Consulting provides advice and assistance, typically at management's request, while assurance provides independent, objective evaluation of evidence. Consulting is permitted provided objectivity is preserved and management retains responsibility.

Question 9Professional Practices Framework and Standards

The Standards require the chief audit executive to establish a quality assurance and improvement program. Which pair of elements must that program include?

  1. Risk registers and control self-assessment workshops
  2. Annual financial statement audits and tax compliance reviews
  3. Ongoing internal assessments and periodic external assessments Correct answer.
  4. Customer satisfaction surveys and employee performance appraisals

Explanation

A quality assurance and improvement program must cover both internal assessments, including ongoing monitoring and periodic self-assessments, and external assessments conducted at least once every five years by a qualified independent assessor. These elements together evaluate conformance and efficiency.

Question 10Professional Practices Framework and Standards

An internal audit activity has completed an external quality assessment that concluded it generally conforms with the Standards. How should this result be communicated?

  1. The chief audit executive should communicate the results to senior management and the board, including any improvement plans Correct answer.
  2. The results should be filed without communication because conformance was achieved
  3. The results should be reported only to the external auditor for reliance purposes
  4. The results should remain confidential to the external assessment team

Explanation

The chief audit executive must communicate the results of the external quality assessment to senior management and the board, together with any action plans to address deficiencies. Transparency about quality results is part of the accountability the Standards require.

Question 11Professional Practices Framework and Standards

Which statement best describes the relationship between the Core Principles and the Standards?

  1. The Core Principles are issued only to external auditors for reliance purposes
  2. The Standards are optional where the Core Principles have been adopted
  3. The Core Principles articulate the fundamental values of internal auditing and the Standards provide the requirements that operationalize them Correct answer.
  4. The Core Principles replace the Standards for small internal audit activities

Explanation

The Core Principles state the fundamental principles relevant to the profession and to the evaluation of internal auditors. The Standards translate those principles into specific requirements governing attributes and performance. Both are mandatory components of the IPPF.

Question 12Professional Practices Framework and Standards

An internal auditor is assigned to review a process in which the auditor's close relative is the department manager. What is the most appropriate course of action?

  1. Proceed with the assignment because family relationships are personal matters outside the Code
  2. Disclose the relationship and decline or reassign the assignment to preserve objectivity Correct answer.
  3. Delegate the engagement to a subordinate without informing the chief audit executive
  4. Proceed but omit the relationship from the working papers to avoid bias concerns

Explanation

Objectivity requires internal auditors to avoid conflicts of interest and to disclose any impairment that could bias judgment. A close relative managing the audited area creates a personal conflict, so the auditor should disclose it and be reassigned. Concealing the relationship would itself violate the Code.

Question 13Professional Practices Framework and Standards

Which of the following is the most accurate description of the Standards' requirement regarding continuing professional development?

  1. Internal auditors must pursue development only when requested by management
  2. Internal auditors must maintain and enhance their knowledge and skills through ongoing professional development Correct answer.
  3. Internal auditors must complete development only in the year they are first certified
  4. Internal auditors may rely solely on experience without formal development

Explanation

The Competency principle requires internal auditors to continually improve their proficiency through ongoing professional development. This is a continuing obligation rather than a one-time requirement, and it is not contingent on management requests.

Question 14Professional Practices Framework and Standards

An engagement auditor is uncertain whether a proposed sampling approach is sufficient. To which standard does this concern most directly relate?

  1. Individual objectivity, which requires avoidance of conflicts
  2. Independence, which requires freedom from management influence
  3. Confidentiality, which restricts disclosure of information
  4. Engagement planning, which requires consideration of the engagement objectives, scope, and approach Correct answer.

Explanation

Decisions about the nature, timing, and extent of work, including sampling, are part of engagement planning and supervision. The auditor should consult supervisors or use professional judgment to ensure the approach is sufficient. Independence, confidentiality, and objectivity address different attributes.

Question 15Professional Practices Framework and Standards

Which of the following best describes how the Standards address the internal audit activity's role in risk management?

  1. Internal audit may provide assurance and consulting on risk management, provided it does not assume management responsibility for risk decisions Correct answer.
  2. Internal audit should delegate all risk management work to the external auditor
  3. Internal audit is prohibited from any involvement in risk management activities
  4. Internal audit must take ownership of the organization's risk register and update it quarterly

Explanation

The Standards allow internal audit to evaluate and contribute to risk management through assurance and consulting work. However, assuming management responsibility for risk decisions, such as owning the risk register, would impair objectivity. The internal audit activity therefore advises and assures rather than manages.

Question 16Professional Practices Framework and Standards

The Standards require the chief audit executive to periodically report to senior management and the board. Which content is most appropriate for such reporting?

  1. The internal audit activity's purpose, authority, responsibility, and performance relative to its plan Correct answer.
  2. The compensation of the external audit partner
  3. The confidential details of every engagement work paper
  4. The personal performance ratings of individual audit staff

Explanation

Periodic reporting should address the internal audit activity's purpose, authority, and responsibility, and its performance relative to its plan, including significant risk exposures and control issues. Reporting should be timely and relevant to governance. Personal ratings, raw work papers, and external partner pay are not appropriate content.

Question 17Professional Practices Framework and Standards

An internal auditor identifies that a recommended control, if implemented, would cost more than the risk it addresses. How should the auditor respond under the Standards?

  1. Suppress the finding because implementation would be uneconomical
  2. Document the cost-benefit consideration while still communicating the risk and recommendation to management Correct answer.
  3. Implement the control personally to ensure the risk is addressed
  4. Escalate directly to regulators without informing management

Explanation

Internal auditors communicate risks and recommendations while recognizing that management decides on the balance of cost and benefit. The auditor should document the consideration and still report the risk so management can make an informed decision. Suppressing the finding or taking action personally would overstep the role.

Question 18Professional Practices Framework and Standards

Which statement about the independence of the internal audit activity is most consistent with the Standards?

  1. The chief audit executive should have direct and unrestricted access to the board and its audit committee Correct answer.
  2. Independence requires that internal auditors never communicate with management
  3. The internal audit activity should report administratively to the controller to align with finance priorities
  4. Independence is achieved once and does not require ongoing review

Explanation

Independence is supported when the chief audit executive has direct access to the board and audit committee, allowing unfettered communication of audit matters. Independence is an ongoing condition that must be monitored, and internal auditors routinely interact with management while remaining objective.

Question 19Professional Practices Framework and Standards

An internal auditor is preparing to use a complex statistical model in an engagement but has limited experience with it. What does the proficiency standard require?

  1. The auditor should abandon all quantitative analysis permanently
  2. The auditor should ask management to perform the analysis and accept the results without review
  3. The auditor should proceed and rely on the model vendor's assurances
  4. The auditor should obtain the necessary competence through training or consultation, or decline the assignment Correct answer.

Explanation

The proficiency standard requires internal auditors to possess or obtain the knowledge and skills needed for the engagement. When a technique exceeds current competence, the auditor should seek training, consult a qualified colleague, or decline the work. Relying on vendor assurances or unreviewed management analysis does not satisfy the standard.

Question 20Professional Practices Framework and Standards

Which of the following is a distinguishing characteristic of the Definition of Internal Auditing in the IPPF?

  1. It identifies internal auditing as a temporary project team formed for special investigations
  2. It describes internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations Correct answer.
  3. It limits internal auditing to financial statement verification
  4. It defines internal auditing as a compliance function reporting to the external auditor

Explanation

The Definition describes internal auditing as an independent, objective assurance and consulting activity designed to add value and improve operations, helping the organization accomplish its objectives through a systematic approach to evaluating governance, risk management, and control. It is not limited to financial verification or compliance.

Question 21Professional Practices Framework and Standards

During an engagement, an internal auditor finds evidence that the organization may have violated environmental regulations. The auditor's engagement objective concerned operational efficiency. What is the most appropriate action?

  1. Report the potential violation to appropriate levels of management and the board as a significant matter Correct answer.
  2. Disclose the matter only to the external auditor and take no further action
  3. Ignore the finding because it falls outside the stated engagement objective
  4. Investigate the violation personally and issue a legal opinion

Explanation

Internal auditors should report significant matters that come to their attention even if outside the original engagement objective, because governance relies on timely awareness of material risks. The auditor communicates the matter rather than conducting a legal investigation or issuing legal conclusions.

Question 22Professional Practices Framework and Standards

A chief audit executive is considering outsourcing the entire internal audit function to an external firm. Which consideration is most relevant under the Standards?

  1. Outsourcing guarantees independence and removes the need for board oversight
  2. The organization remains responsible for maintaining an effective internal audit activity, and the provider must conform with the Code of Ethics and Standards Correct answer.
  3. The external provider is exempt from the Standards because it is not an employee
  4. Outsourcing automatically eliminates the need for a quality assurance and improvement program

Explanation

When internal audit services are provided by an external party, the organization still must ensure an effective internal audit activity that conforms with the Code of Ethics and the Standards. The quality assurance program and board oversight continue to apply. Outsourcing does not create exemptions.

Question 23Professional Practices Framework and Standards

An internal auditor is asked to review the adequacy of the organization's governance processes. Which area would fall within that review?

  1. The accuracy of the auditor's own personal tax return
  2. The pricing strategy of a major competitor
  3. The design of the external auditor's audit software
  4. The organization's ethical climate and how the board obtains assurance over risk and control Correct answer.

Explanation

Reviews of governance assess whether the organization promotes appropriate ethics and values, ensures effective performance management and accountability, and communicates risk and control information to the board. Competitor pricing, personal tax matters, and external audit tools fall outside this scope.

Question 24Professional Practices Framework and Standards

Which situation most clearly requires the chief audit executive to disclose an impairment of independence to the board?

  1. A former chief financial officer of the organization is appointed to lead the internal audit activity within one year of leaving the finance role Correct answer.
  2. An internal auditor takes approved annual leave during an engagement
  3. An internal auditor attends a professional conference on fraud detection
  4. An internal auditor rotates to a different engagement team within the same year

Explanation

Placing a former senior finance executive in charge of internal audit shortly after leaving that role creates a significant independence concern because the individual may audit areas they recently managed. The chief audit executive should disclose such situations and appropriate safeguards should be considered. Routine training, rotation, and leave do not impair independence.

Question 25Professional Practices Framework and Standards

An internal audit activity operates with a small staff and limited budget. How do the Standards address the need for periodic external quality assessments in this situation?

  1. External assessments may be replaced indefinitely by self-assessment alone
  2. Small activities are permanently exempt from external quality assessments
  3. The requirement applies only if the board specifically requests an external assessment
  4. The external assessment must still occur at least once every five years, though the form may be tailored to the activity's size Correct answer.

Explanation

The requirement for an external quality assessment at least once every five years applies to all internal audit activities. The Standards allow a self-assessment with independent external validation as an acceptable form, which can suit smaller activities, but the obligation itself is not waived.

Question 26Professional Practices Framework and Standards

Under the IPPF, which element sits directly above the Standards and expresses the fundamental expectations an internal audit activity must meet to be considered effective?

  1. The mission of internal audit
  2. The Code of Ethics
  3. The Definition of Internal Auditing
  4. The Core Principles for the Professional Practice of Internal Auditing Correct answer.

Explanation

The IPPF places the Core Principles above the Standards as the high-level statements describing what an effective internal audit activity demonstrates. The Standards then provide the mandatory requirements that operationalize those principles. The mission and Definition sit at the top of the framework, not between the principles and the Standards.

Question 27Professional Practices Framework and Standards

Which statement describes the applicability of the mandatory elements of the IPPF to an internal audit activity?

  1. They apply only when the board formally adopts them by resolution
  2. They apply to all internal audit activities, with conformance assessed against the Standards and Code of Ethics Correct answer.
  3. They apply only to activities in public companies subject to securities regulation
  4. They apply only to activities that have completed an external quality assessment

Explanation

The mandatory elements of the IPPF, principally the Core Principles, Code of Ethics, Standards, and Definition, apply to the internal audit profession globally and to every internal audit activity. Conformance is measured against the Standards and the Code of Ethics, and the chief audit executive reports on that conformance. Adoption by the board or prior external assessment is not a precondition.

Question 28Professional Practices Framework and Standards

An internal auditor is deciding whether a particular engagement falls within the scope of internal auditing. Which activity is included in the Definition of Internal Auditing?

  1. Executing management's corrective action plans once deficiencies are reported
  2. Preparing the organization's financial statements for external audit
  3. Evaluating and improving the effectiveness of risk management, control, and governance processes Correct answer.
  4. Designing and installing the internal control system for a new business line

Explanation

The Definition of Internal Auditing describes an independent, objective assurance and consulting activity designed to add value and improve operations by evaluating and improving the effectiveness of risk management, control, and governance processes. Performing management functions or preparing financial statements would impair objectivity. Designing and installing controls is a management responsibility, not an internal audit one.

Question 29Professional Practices Framework and Standards

Which statement correctly describes the status of the Code of Ethics within the IPPF?

  1. It is mandatory and applies to individuals and entities that provide internal audit services Correct answer.
  2. It is superseded by national law wherever local regulation exists
  3. It is guidance that internal auditors may adopt voluntarily depending on local practice
  4. It applies only to the chief audit executive and managers of the internal audit activity

Explanation

The Code of Ethics is a mandatory element of the IPPF and applies to individuals and entities that provide internal audit services. It sets expectations for integrity, objectivity, confidentiality, and competency. It is not optional guidance, is not limited to the CAE, and is not displaced by local law, though legal restrictions may affect how it is applied.

Question 30Professional Practices Framework and Standards

A chief audit executive wants to strengthen the internal audit activity's conformance with the Standards on engagement planning. Which action best aligns with the Standards' requirement for planning?

  1. Preparing a plan only when the engagement exceeds a fixed hour threshold
  2. Delegating planning entirely to the audit client's process owner
  3. Documenting engagement objectives, scope, timing, and resource allocation before the engagement begins Correct answer.
  4. Waiting until fieldwork is complete so the plan reflects actual findings

Explanation

The Standards require the engagement plan to document objectives, scope, timing, and resource allocation, and planning should occur before the engagement begins. Planning after fieldwork defeats the purpose of directing the work toward defined objectives. Clients should not control the audit plan, and no fixed hour threshold governs whether planning is required.

Question 31Professional Practices Framework and Standards

During an engagement, an internal auditor must decide how much evidence is sufficient. Which factor should most directly guide that judgment?

  1. The preferences of the process owner regarding sampling
  2. The number of prior engagements the auditor has performed in the area
  3. The length of the engagement report
  4. The risk exposure of the area and the persuasiveness of the evidence Correct answer.

Explanation

Sufficiency and appropriateness of evidence depend on the risk associated with the area under review and the persuasiveness of available information. Higher risk generally requires more or better evidence. The auditor's experience, client preferences, and report length are not the criteria the Standards apply to evidence decisions.

Question 32Professional Practices Framework and Standards

An internal auditor is preparing working papers for an engagement. Which practice best conforms to the Standards on documenting information?

  1. Limiting documentation to items the client has reviewed and approved
  2. Recording the work performed, conclusions reached, and supporting evidence in a retrievable form Correct answer.
  3. Retaining only final reports and discarding notes once the report is issued
  4. Storing documentation only on the auditor's personal device for convenience

Explanation

The Standards require internal auditors to document sufficient information to support conclusions and engagement results. Documentation should record work performed, evidence gathered, and conclusions reached, and it must be retained and retrievable. Client approval is not a condition for documentation, and personal storage creates access and retention problems.

Question 33Professional Practices Framework and Standards

An engagement team concludes that a significant control deficiency exists. According to the Standards, how should the conclusion be characterized in the engagement results?

  1. As a recommendation only if the client requests one
  2. As a personal opinion of the engagement auditor
  3. As an observation that requires no rating if management disagrees
  4. As a finding supported by criteria, condition, cause, and effect Correct answer.

Explanation

Engagement results should present findings that link the criteria, condition, cause, and effect so the reader understands what was expected, what occurred, why it happened, and why it matters. Findings do not depend on management agreement for their validity. Conclusions must be supported by evidence rather than personal opinion, and recommendations should not be contingent on client request.

Question 34Professional Practices Framework and Standards

A chief audit executive is developing the annual risk-based audit plan. Which input is most consistent with the Standards' expectations for the plan?

  1. The personal preferences of individual engagement auditors
  2. The organization's risk management framework and input from senior management and the board Correct answer.
  3. Only requests submitted by the external auditor
  4. A fixed rotation that revisits every process on a three-year cycle regardless of risk

Explanation

The risk-based plan should consider the organization's risk management framework and reflect input from senior management and the board. It should prioritize areas of higher risk rather than follow a mechanical rotation. External auditor requests and individual auditor preferences may inform but cannot drive the plan alone.

Question 35Professional Practices Framework and Standards

An internal auditor is asked to perform a consulting engagement for a business unit that the auditor will later audit in an assurance capacity. What is the most appropriate course of action under the Standards?

  1. Accept the work and allow the business unit to set the assurance scope later
  2. Decline all consulting work permanently to avoid any appearance of conflict
  3. Accept the consulting work and omit it from future assurance planning
  4. Accept the work only if safeguards are established and the auditor's objectivity is preserved Correct answer.

Explanation

The Standards permit consulting engagements when objectivity can be preserved, but the auditor must consider whether the work will later impair assurance and establish safeguards where needed. Concealing the consulting work or letting the client set assurance scope would undermine objectivity. An outright permanent ban is broader than the Standards require.

Question 36Professional Practices Framework and Standards

An internal auditor is preparing to communicate engagement results to senior management. Which practice best reflects the Standards on communication quality?

  1. Ensuring communications are accurate, objective, clear, concise, constructive, complete, and timely Correct answer.
  2. Including only favorable results to maintain constructive relationships
  3. Using technical jargon to demonstrate expertise
  4. Delaying communication until all findings are fully remediated

Explanation

The Standards describe the qualities of effective engagement communication as accurate, objective, clear, concise, constructive, complete, and timely. Omitting unfavorable results, using unnecessary jargon, or waiting for remediation undermines those qualities. Communication should occur when results are ready, not after corrective action is complete.

Question 37Professional Practices Framework and Standards

An internal auditor identifies a potential fraud indicator while reviewing procurement records. According to the Standards, what is the most appropriate initial action?

  1. Include the allegation in the next routine engagement report without escalation
  2. Ignore the indicator because fraud detection is solely management's responsibility
  3. Confront the suspected employee directly to obtain a confession
  4. Report the matter through established channels and consider whether further investigation is warranted Correct answer.

Explanation

When fraud indicators arise, the auditor should exercise due professional care by escalating through established channels and determining whether additional investigation is appropriate. The auditor should not confront suspects, which can compromise an investigation, nor ignore indicators. Routine reporting without escalation may delay an appropriate response.

Question 38Professional Practices Framework and Standards

A chief audit executive is evaluating whether the internal audit activity's quality assurance and improvement program is adequately designed. Which element is essential to that program under the Standards?

  1. An external assessment conducted only when a significant deficiency is found
  2. Ongoing internal assessments and periodic internal assessments, plus an external assessment at least every five years Correct answer.
  3. Only an annual self-assessment by the CAE
  4. A review performed exclusively by the external auditor during the financial statement audit

Explanation

The quality assurance and improvement program must include ongoing and periodic internal assessments and an external assessment conducted at least every five years by a qualified, independent assessor or assessment team. Self-assessment alone is insufficient, and external assessment is not triggered only by deficiencies. The external financial statement auditor does not substitute for the required quality assessment.

Question 39Professional Practices Framework and Standards

An internal auditor is assessing whether the organization's governance processes are adequate. Which consideration is most consistent with the Standards' treatment of governance?

  1. Evaluating only whether board meetings were held on schedule
  2. Reviewing how the organization makes strategic and ethical decisions and how it holds itself accountable Correct answer.
  3. Assessing governance only when management requests it
  4. Limiting the review to the accuracy of financial reporting

Explanation

Governance encompasses the processes by which the organization makes strategic decisions, manages risk, promotes ethics, and holds itself accountable, and internal audit evaluates those processes. Restricting the review to financial reporting accuracy or meeting schedules captures only fragments of governance. Governance assurance is part of the audit universe and is not dependent on a management request.

Question 40Professional Practices Framework and Standards

An internal auditor is preparing to use a data analytics technique that the auditor has not previously applied. Which action best reflects the Standards on competence and due professional care?

  1. Obtaining appropriate training, supervision, or expert support before relying on the results Correct answer.
  2. Proceeding with the technique and disclosing the limitation only if a finding is challenged
  3. Abandoning the technique and relying solely on manual sampling
  4. Delegating the analysis to the client's staff without oversight

Explanation

Internal auditors must possess or obtain the knowledge, skills, and competencies needed for the engagement and exercise due professional care. When using unfamiliar techniques, they should seek training, supervision, or expert assistance before relying on results. Proceeding without competence and disclosing later, or delegating without oversight, fails to meet that expectation.

Question 41Governance, Risk, and Internal Control

Under the COSO internal control framework, which component is primarily concerned with establishing policies and procedures that help ensure management directives are carried out?

  1. Monitoring activities
  2. Control activities Correct answer.
  3. Risk assessment
  4. Information and communication

Explanation

Control activities are the policies and procedures that help ensure management's risk responses and directives are executed, such as approvals, reconciliations, and segregation of duties. The other components address identifying risks, sharing information, and evaluating control performance rather than executing directives.

Question 42Governance, Risk, and Internal Control

In the COSO framework, which component provides the foundation by setting the tone of the organization, including integrity, ethical values, and board oversight?

  1. Control environment Correct answer.
  2. Control activities
  3. Monitoring activities
  4. Risk assessment

Explanation

The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control, encompassing integrity, ethical values, and governance oversight. It sets the tone at the top on which the other components depend.

Question 43Governance, Risk, and Internal Control

An internal auditor finds that the same employee both approves vendor payments and reconciles the bank account. Which control concept is most directly violated?

  1. Authorization of transactions
  2. Segregation of duties Correct answer.
  3. Independent verification
  4. Physical safeguarding

Explanation

Segregation of duties requires that incompatible functions such as authorization, custody, and recordkeeping be assigned to different people to reduce error and fraud risk. Combining payment approval with reconciliation concentrates incompatible duties in one person.

Question 44Governance, Risk, and Internal Control

Which risk response involves accepting the likelihood and impact of a risk and taking no action to change it?

  1. Risk acceptance Correct answer.
  2. Risk sharing
  3. Risk reduction
  4. Risk avoidance

Explanation

Risk acceptance means management decides to retain a risk without action because the cost of mitigation exceeds the benefit or the exposure is within tolerance. Avoidance, sharing, and reduction all involve changing the risk profile.

Question 45Governance, Risk, and Internal Control

What is the primary purpose of a control self-assessment (CSA) program?

  1. To transfer residual risk to an insurance provider
  2. To replace the external audit opinion on financial statements
  3. To have process owners evaluate the effectiveness of controls in their areas Correct answer.
  4. To document the organizational chart for governance purposes

Explanation

Control self-assessment engages process owners in evaluating and reporting on the design and operation of controls in their own areas, promoting ownership and earlier detection of gaps. It supplements but does not replace independent audit or transfer risk.

Question 46Governance, Risk, and Internal Control

Inherent risk is best described as which of the following?

  1. The risk that an audit procedure fails to detect a misstatement
  2. The risk remaining after controls have been applied
  3. The risk exposure before considering the effect of controls Correct answer.
  4. The risk that a control is designed but not operating

Explanation

Inherent risk is the exposure that exists absent any controls, providing the baseline against which control effectiveness is measured. Residual risk is what remains after controls, and detection risk relates to audit procedures.

Question 47Governance, Risk, and Internal Control

Which document typically defines the authority, reporting lines, and responsibilities of the internal audit function?

  1. The internal audit charter Correct answer.
  2. The code of conduct
  3. The delegation of authority matrix
  4. The risk register

Explanation

The internal audit charter is the formal document approved by the board that establishes the function's purpose, authority, and responsibilities, including reporting lines and independence. Other documents address risk tracking, ethics, or approval limits.

Question 48Governance, Risk, and Internal Control

The three lines model of governance assigns which role to the internal audit function?

  1. Design of the organization's risk appetite statement
  2. First-line ownership and management of operational risk
  3. Independent assurance and challenge across the organization Correct answer.
  4. Execution of day-to-day compliance monitoring in business units

Explanation

In the three lines model, internal audit provides independent assurance and objective challenge to the first and second lines. Operational risk ownership and day-to-day compliance sit with management, and risk appetite is set by the governing body with management input.

Question 49Governance, Risk, and Internal Control

A company's risk register shows a control rated as well designed but operating inconsistently across periods. What type of deficiency does this most likely represent?

  1. Material weakness in financial reporting
  2. Scope limitation
  3. Design deficiency
  4. Operating deficiency Correct answer.

Explanation

A control that is appropriately designed but fails to operate consistently is an operating (or operating effectiveness) deficiency. A design deficiency would mean the control as constructed cannot achieve its objective even if performed.

Question 50Governance, Risk, and Internal Control

Management decides to purchase cybersecurity insurance to cover potential breach costs. Which risk response has been applied?

  1. Risk reduction
  2. Risk sharing Correct answer.
  3. Risk avoidance
  4. Risk acceptance

Explanation

Buying insurance transfers a portion of the financial consequence of a risk to a third party, which is classified as risk sharing or transfer. Avoidance would eliminate the activity, acceptance would retain the exposure, and reduction would add preventive controls.