I85PREP
⌘ K
PECB Certified Management Systems Internal Auditor study materials
PECB Certified Management Systems Internal Auditor study resources

PECB Certified Management Systems Internal Auditor practice questions

One question at a time. Build your PECB Certified Management Systems Internal Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of management systems

In ISO management system standards, what does the 'Plan' element of the Plan-Do-Check-Act cycle primarily encompass?

  1. Correcting nonconformities and taking action to eliminate their root causes
  2. Establishing objectives, identifying risks and opportunities, and determining the processes needed to deliver results Correct answer.
  3. Deploying resources and operating the planned processes in accordance with documented arrangements
  4. Verifying that products and services meet acceptance criteria before release to the customer

Explanation

Plan covers setting objectives and establishing the processes and resources needed to deliver results consistent with requirements, including addressing risks and opportunities. Implementation of those plans is Do, verification is Check, and improvement is Act.

Question 2Fundamental concepts and principles of management systems

Which statement best describes the purpose of the 'context of the organization' clause in a management system standard?

  1. It requires the organization to benchmark against at least one competitor each year
  2. It requires a list of every supplier contract currently in force
  3. It requires the organization to publish its strategic plan to all interested parties
  4. It requires determination of external and internal issues relevant to purpose and strategic direction Correct answer.

Explanation

The context clause asks the organization to determine external and internal issues that are relevant to its purpose and strategic direction and that affect its ability to achieve intended outcomes. It is an analytical input to scope and risk determination, not a publication or benchmarking obligation.

Question 3Fundamental concepts and principles of management systems

An internal auditor is reviewing how top management assigns responsibilities. Which action best evidences fulfilment of the 'leadership and commitment' requirement?

  1. Ensuring that responsibilities for relevant roles are assigned, communicated and understood within the organization Correct answer.
  2. Allowing each department to define its own objectives without alignment to the organization's strategy
  3. Approving the audit programme only after the certification body has reviewed it
  4. Delegating all management system decisions to the external consultant who designed the system

Explanation

Leadership and commitment requires top management to ensure responsibilities and authorities for relevant roles are assigned, communicated and understood. It also requires promoting improvement and integrating requirements into business processes.

Question 4Fundamental concepts and principles of management systems

Which of the following is the best description of a 'process' as used in process approach thinking?

  1. A legal requirement imposed by a regulator on the organization
  2. A set of interrelated or interacting activities that uses inputs to deliver an intended result Correct answer.
  3. A department within the organizational structure with defined headcount
  4. A documented procedure that must be retained as a controlled record

Explanation

In management system standards a process is a set of interrelated or interacting activities that transforms inputs into intended outputs or results. Documented procedures are one possible support, not the definition of the process itself.

Question 5Fundamental concepts and principles of management systems

What distinguishes a 'nonconformity' from a 'correction' in management system terminology?

  1. A nonconformity is always a major finding; a correction is always a minor finding
  2. A nonconformity is raised by the certification body; a correction is raised by the auditor
  3. A nonconformity is a failure to meet a requirement; a correction is an action to eliminate the detected nonconformity Correct answer.
  4. A nonconformity applies only to products; a correction applies only to services

Explanation

A nonconformity is the non-fulfilment of a requirement, whereas a correction is the action taken to eliminate a detected nonconformity, for example rework or replacement. Corrective action goes further and addresses the cause so the nonconformity does not recur.

Question 6Fundamental concepts and principles of management systems

In the Plan-Do-Check-Act cycle, which activity is a clear example of 'Check'?

  1. Deciding to expand the management system scope to a second site
  2. Training new employees on the updated operating instructions
  3. Revising the risk register to add a newly identified regulatory change
  4. Monitoring and measuring process performance against defined objectives Correct answer.

Explanation

Check involves monitoring, measurement, analysis and evaluation of performance against planned arrangements and objectives. The other activities are planning, implementation or improvement actions rather than verification.

Question 7Fundamental concepts and principles of management systems

Which pair correctly matches a management system concept with its definition?

  1. Interested party - a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.
  2. Policy - a measurable result to be achieved
  3. Objective - a statement of the organization's commitment to satisfy applicable requirements
  4. Risk - the extent to which planned activities are realized and planned results achieved

Explanation

An interested party is a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. The other pairings swap definitions between policy, objective, risk and effectiveness.

Question 8Fundamental concepts and principles of management systems

Why do management system standards emphasize the 'process approach' rather than managing departments in isolation?

  1. It guarantees that no process will ever produce a nonconforming output
  2. It supports systematic management of interrelated processes and their interactions to achieve intended results Correct answer.
  3. It transfers accountability for process performance to the internal audit function
  4. It removes the need for any documented information in the organization

Explanation

The process approach promotes systematic management of interrelated processes and their interactions so that intended results are achieved consistently. It does not eliminate documentation or guarantee conformity, and accountability stays with process owners.

Question 9Fundamental concepts and principles of management systems

An auditor finds that a documented procedure states a review must occur monthly, but records show it happened only twice in six months. How should the auditor characterize this?

  1. A correction, because the missed reviews can simply be performed retrospectively
  2. An observation with no basis because internal documents are advisory only
  3. A nonconformity against the organization's own requirement for periodic review Correct answer.
  4. An opportunity for improvement that cannot be recorded as a finding

Explanation

The organization's own documented arrangements become requirements it must fulfil, so failing to perform the monthly review is a nonconformity. Internal procedures are binding on the organization until formally changed.

Question 10Fundamental concepts and principles of management systems

How should risk-based thinking influence the internal audit function of a management system?

  1. It permits audits to be cancelled whenever management considers risk to be low
  2. It requires every process to be audited with identical frequency and duration
  3. It allows audit effort and frequency to be prioritized according to the significance of processes and their risks Correct answer.
  4. It requires the auditor to eliminate all identified risks before issuing the report

Explanation

Risk-based thinking means audit planning should allocate more attention and frequency to higher-risk, more significant processes. Equal treatment of all processes ignores risk, and auditors do not eliminate organizational risks.

Question 11Fundamental concepts and principles of management systems

During an audit, a manager states that the process is performed 'the same way it has always been done' and no process owner has been assigned. Which underlying principle is most directly compromised?

  1. Relationship management
  2. Process approach and clear assignment of roles Correct answer.
  3. Impartiality of the certification body
  4. Evidence-based decision making

Explanation

The process approach expects processes to be defined, owned and managed with assigned responsibilities and authorities. Relying on habit without an owner undermines accountability for process performance and improvement.

Question 12Fundamental concepts and principles of management systems

Which statement correctly describes the relationship between 'policy' and 'objectives' in a management system?

  1. Policy provides the framework for setting objectives, which are consistent with it Correct answer.
  2. Policy and objectives are synonyms and must be documented in the same file
  3. Objectives are optional where a policy has been established
  4. Objectives set the overall direction and the policy lists the measurable targets

Explanation

The policy provides the framework for setting objectives, and objectives must be consistent with the policy and measurable where practicable. Policy expresses direction and commitment, while objectives translate that into results to be achieved.

Question 13Fundamental concepts and principles of management systems

An audit team is examining how the organization determines its management system scope. Which evidence best supports a sound scope determination?

  1. A verbal assurance from the site manager that the scope covers everything
  2. A list of the organization's products with no reference to processes or boundaries
  3. A statement of scope referencing external and internal issues and the interested parties' relevant requirements Correct answer.
  4. A copy of the certification body's marketing brochure listing all possible standards

Explanation

Scope determination should be based on external and internal issues, the requirements of relevant interested parties, and the products and services covered. The scope must be available as documented information.

Question 14Fundamental concepts and principles of management systems

An auditor is told that a process is 'fully compliant' because no customer complaints were received last year. Why is this reasoning weak from an audit perspective?

  1. Absence of complaints is not sufficient evidence that requirements are being met and risks controlled Correct answer.
  2. Complaint data may only be used by the sales department, not by auditors
  3. Complaints are irrelevant to management system performance and can be ignored
  4. Customer complaints are always resolved by the certification body

Explanation

Audit conclusions should rest on verifiable evidence that requirements are fulfilled, not on the absence of a negative indicator. Silence from customers does not demonstrate process control or conformity.

Question 15Fundamental concepts and principles of management systems

Which of the following best illustrates 'documented information' as used in management system standards?

  1. Information required to be controlled and maintained by the organization, in any medium and format Correct answer.
  2. Any email exchanged between employees, regardless of relevance
  3. The organization's informal knowledge held by long-serving staff
  4. Only paper records stored in a physical archive

Explanation

Documented information covers information the organization must control and maintain, together with the medium that contains it, whether paper, electronic or other format. It is not limited to paper records or to all incidental communication.

Question 16Fundamental concepts and principles of management systems

In management system terminology, what is the difference between 'monitoring' and 'measurement'?

  1. Monitoring applies only to legal requirements; measurement applies only to objectives
  2. Monitoring is performed by auditors; measurement is performed by top management
  3. Monitoring is determining the status of a system or process, while measurement is determining a value Correct answer.
  4. Monitoring is always quantitative; measurement is always qualitative

Explanation

Monitoring is determining the status of a system, process, product or activity, which may or may not involve numbers. Measurement is the process of determining a value, typically against a scale or unit.

Question 17Fundamental concepts and principles of management systems

An internal auditor notices that corrective actions repeatedly address symptoms such as re-training staff after each error. Which principle of improvement is being missed?

  1. Ensuring every nonconformity is graded as major to attract attention
  2. Restricting corrective action records to the quality department
  3. Replacing the process with a new procedure after each incident
  4. Eliminating the underlying cause so that the nonconformity does not recur elsewhere Correct answer.

Explanation

Corrective action requires evaluating the need to eliminate the cause of a nonconformity so that it does not recur or occur elsewhere. Repeatedly addressing symptoms such as retraining leaves the root cause in place.

Question 18Fundamental concepts and principles of management systems

Which statement correctly reflects how management system standards treat 'outsourced processes'?

  1. Outsourced processes must be controlled and the type and extent of control defined within the system Correct answer.
  2. Outsourced processes are excluded from the management system scope by definition
  3. Outsourced processes need no control if the supplier is large and well known
  4. Outsourced processes are controlled solely by the external provider's own certificate

Explanation

When processes are outsourced, the organization must ensure they are controlled, with the type and extent of control defined within the management system. Accountability for the outsourced process remains with the organization.

Question 19Fundamental concepts and principles of management systems

An auditor observes that process objectives are set but no data is collected to track them. Which principle is most clearly absent?

  1. Relationship management with external providers
  2. Leadership commitment to establishing a policy
  3. Control of documented information
  4. Evidence-based decision making supported by monitoring and analysis Correct answer.

Explanation

Evidence-based decision making depends on monitoring, measurement, analysis and evaluation of performance against objectives. Objectives without data cannot inform decisions or demonstrate achievement.

Question 20Fundamental concepts and principles of management systems

Which of the following best describes the principle of 'continual improvement' in a management system?

  1. A one-off project to achieve certification within a fixed deadline
  2. An activity performed exclusively by external auditors
  3. A requirement to change the entire management system every year
  4. Recurring activity to enhance performance, carried out at a pace set by the organization Correct answer.

Explanation

Continual improvement is a recurring activity to enhance performance, and the organization determines the pace and scope of improvement activities. It is not a single project or a forced annual overhaul.

Question 21Fundamental concepts and principles of management systems

An auditor is evaluating whether the organization has addressed risks and opportunities. Which evidence is most relevant?

  1. A copy of the organization's insurance policy for fire damage
  2. The number of meetings held by the management review team
  3. A list of all employees' job titles and reporting lines
  4. Documented determination of risks and opportunities and actions taken to address them, with evaluation of their effectiveness Correct answer.

Explanation

The organization must determine risks and opportunities that need to be addressed, plan actions, integrate them into processes, and evaluate their effectiveness. Relevant evidence is the determination and the follow-through, not unrelated administrative data.

Question 22Fundamental concepts and principles of management systems

A management system standard requires the organization to 'determine the boundaries and applicability of the management system'. What is the primary purpose of this requirement?

  1. To define which parts of the organization and which activities are covered by the system Correct answer.
  2. To specify the maximum number of employees who may be certified
  3. To determine the fee the certification body will charge
  4. To limit legal liability of the certification body

Explanation

Determining boundaries and applicability establishes the scope, clarifying which activities, products, services and locations the management system covers. It is a substantive statement about coverage, not a commercial or liability device.

Question 23Fundamental concepts and principles of management systems

An auditor finds two processes whose outputs feed each other, but neither process owner knows the input requirements of the other. Which conclusion is most defensible?

  1. The interaction between the processes is not effectively managed, weakening the process approach Correct answer.
  2. The organization should immediately outsource both processes
  3. The organization conforms because each process operates within its own department
  4. The finding is invalid because process interfaces are outside the audit scope

Explanation

The process approach requires managing processes and their interactions, including the flow of inputs and outputs between them. Unclear interface requirements indicate weak control of interaction rather than conformity.

Question 24Fundamental concepts and principles of management systems

Which situation best demonstrates that 'risk-based thinking' has been embedded rather than treated as a separate bureaucratic exercise?

  1. Process owners identify and address risks and opportunities within their normal planning and review activities Correct answer.
  2. Risk is considered only after a nonconformity has been raised
  3. A standalone risk register is completed once at the start of the year and never reviewed
  4. Risk assessment is delegated entirely to the internal audit team

Explanation

Embedding risk-based thinking means risks and opportunities are considered within routine planning and process management, not in an isolated document. It should influence how processes are designed, operated and improved.

Question 25Fundamental concepts and principles of management systems

An auditor concludes that a process is 'effective' because it produced the planned output on the day of the audit. Why is this conclusion insufficient?

  1. Effectiveness requires evidence that the process consistently achieves intended results over time, not a single observation Correct answer.
  2. Effectiveness is irrelevant when the output happened to meet specification
  3. Effectiveness can only be determined by the certification body, never by an internal auditor
  4. Effectiveness is measured only by the number of documents produced

Explanation

Effectiveness is the extent to which planned activities are realized and planned results achieved, which requires evidence of consistency over time. A single successful observation is a snapshot and may not represent normal performance.

Question 26Fundamental concepts and principles of management systems

In management system terminology, what does the term 'system' most precisely refer to?

  1. A set of interrelated or interacting elements, including processes, that the organization establishes to achieve objectives Correct answer.
  2. A group of departments that report to the same top manager
  3. A list of legal and regulatory requirements applicable to the organization
  4. A software platform used to store audit records and nonconformity reports

Explanation

Management system standards define a system as a set of interrelated or interacting elements, and the organization establishes these elements to convert inputs into outputs and pursue objectives. The elements typically include policy, objectives, processes, resources and documented information, not merely organizational charts or IT tools.

Question 27Fundamental concepts and principles of management systems

Which statement best captures the meaning of 'top management' in management system standards?

  1. Any manager who has completed internal auditor training
  2. The external certification body that issues the certificate
  3. The person or group of persons who directs and controls an organization at the highest level Correct answer.
  4. The employee representative elected by the workforce

Explanation

Standards define top management as the person or group that directs and controls an organization at the highest level. This definition matters for auditing because leadership commitment, policy approval and management review are assigned to this level, not to any manager or third party.

Question 28Fundamental concepts and principles of management systems

An auditor is examining how the organization's management system addresses interested parties. Which statement reflects the standards' intent?

  1. The organization determines which interested parties are relevant and which of their needs and expectations it will address Correct answer.
  2. Interested party requirements are addressed only after a nonconformity has been raised
  3. Every interested party's expectation must be converted into a mandatory system requirement
  4. Interested parties are limited to customers and regulators by definition

Explanation

Management system standards require the organization to determine the interested parties relevant to the system and the relevant requirements of those parties. Not every expectation becomes a requirement, because the organization must decide relevance in the context of its scope and objectives.

Question 29Fundamental concepts and principles of management systems

Which statement correctly describes 'documented information' as a concept in management system standards?

  1. It refers only to records retained for legal purposes
  2. It excludes electronic data held in enterprise systems
  3. It refers only to paper documents that carry an approval signature
  4. It covers both information that must be maintained and the medium that contains it, regardless of format Correct answer.

Explanation

Documented information is information required to be controlled and maintained by the organization, together with the medium on which it is contained. The concept deliberately covers any format and source, so electronic records and data are included alongside paper.

Question 30Fundamental concepts and principles of management systems

An auditor reads that a process owner is accountable for a process. What does accountability imply in management system terms?

  1. The person is consulted before any change but holds no decision rights
  2. The person holds the budget but not the performance targets
  3. The person personally performs every activity within the process
  4. The person answers for the process outcome and its performance, even where tasks are delegated Correct answer.

Explanation

Accountability means being answerable for the outcome and performance of the process; tasks and authority may be delegated, but the answerability remains. Auditors therefore look for a named owner who can explain performance, risks and changes.

Question 31Fundamental concepts and principles of management systems

An organization describes its management system as comprising only a policy manual and a set of procedures. Why is this description incomplete?

  1. A system is complete only when every procedure is held electronically
  2. A system must contain at least one certified external supplier
  3. A system also includes processes, resources, objectives, performance evaluation and improvement activities that interact to achieve results Correct answer.
  4. A system requires a separate document for each clause of the standard

Explanation

Documentation is only one element of a management system; the system also comprises processes, resources, objectives, monitoring and improvement activities that interact. Auditors test whether these elements function together to achieve intended results, not merely whether documents exist.

Question 32Fundamental concepts and principles of management systems

During an audit, an auditor maps how a customer complaint leads to design changes, production adjustments and updated training. Which concept does this mapping best demonstrate?

  1. Interaction of processes within the management system Correct answer.
  2. Outsourcing of a support function
  3. Segregation of duties between departments
  4. Hierarchy of documented information

Explanation

The process approach requires understanding not only individual processes but how they interact and feed one another to produce intended results. Tracing a complaint through several linked processes shows those interactions in practice.

Question 33Fundamental concepts and principles of management systems

An auditor wants to confirm whether the organization has established the boundaries of its management system. Which evidence is most directly relevant?

  1. A list of all employees who have completed awareness training
  2. A copy of the most recent internal audit schedule
  3. A defined scope statement identifying the activities, products or services and sites covered, with justification for exclusions Correct answer.
  4. A summary of customer satisfaction survey results

Explanation

Determining the scope requires the organization to define the boundaries and applicability of the system and to keep this as documented information. The scope statement, including justification for any exclusion, is therefore the primary evidence.

Question 34Fundamental concepts and principles of management systems

An organization has a policy committing to reduce energy use, but its objectives are written only in terms of production volume. What is the most significant weakness in management system terms?

  1. The objectives should have been set by an external consultant
  2. Production volume cannot be measured
  3. The objectives are not consistent with the policy commitment, weakening the coherence of the system Correct answer.
  4. The policy was not signed by the entire workforce

Explanation

Objectives must be consistent with the policy and be relevant to the purpose of the system. Where a policy commitment is not reflected in any objective or measurable target, the link between direction-setting and planning is broken.

Question 35Fundamental concepts and principles of management systems

Which situation best shows that a process is being managed rather than merely performed?

  1. Operators follow a checklist that has not changed in five years
  2. The process is documented in a flowchart displayed in the work area
  3. Outputs are handed to the next department without feedback
  4. The process owner reviews performance data against defined criteria and acts on adverse trends Correct answer.

Explanation

Managing a process involves defining criteria, monitoring performance and taking action on the results. Reviewing data against criteria and responding to adverse trends shows control and feedback, which distinguishes management from routine execution.

Question 36Fundamental concepts and principles of management systems

An auditor observes that the organization sets improvement targets for one year and then stops monitoring them. Which principle of management systems is most directly undermined?

  1. Continual improvement supported by performance evaluation Correct answer.
  2. Document control
  3. Outsourcing control
  4. Competence of external providers

Explanation

Continual improvement depends on recurring performance evaluation and action on the findings. Setting targets and abandoning monitoring breaks the feedback loop that sustains improvement.

Question 37Fundamental concepts and principles of management systems

An auditor finds that risk registers exist for each department, but decisions in management review never refer to them. How should the auditor interpret this?

  1. The registers prove that risk-based thinking is fully embedded in the system
  2. Risk-based thinking is not integrated into decision-making, so the registers function as an isolated administrative exercise Correct answer.
  3. The absence of risk discussion in management review is acceptable because registers exist elsewhere
  4. Risk management is outside the scope of a management system audit

Explanation

Risk-based thinking is expected to inform planning, operation and review, not to exist as a parallel record-keeping activity. Where decisions are taken without reference to identified risks, the integration required by the standards is absent.

Question 38Fundamental concepts and principles of management systems

Two processes exchange outputs, but neither owner knows the acceptance criteria applied by the other. Which audit conclusion is most defensible?

  1. Each process is effective because each meets its own internal targets
  2. The interface between the processes is not adequately controlled, creating a risk to the consistency of outputs Correct answer.
  3. The gap is irrelevant because the two processes belong to different departments
  4. The organization has correctly applied the process approach by separating responsibilities

Explanation

The process approach requires that interfaces and their acceptance criteria be defined so that interacting processes produce consistent results. Unclear criteria at the boundary is a control weakness regardless of departmental structure.

Question 39Fundamental concepts and principles of management systems

An organization claims its management system is effective because an external certification audit found no major nonconformities. Why is this reasoning unsound?

  1. Major nonconformities are not part of certification audits
  2. Effectiveness is determined solely by the number of documents produced
  3. Certification audits always last longer than internal audits and therefore replace internal evidence
  4. Effectiveness concerns the extent to which planned results are achieved, which a point-in-time conformity sample cannot establish Correct answer.

Explanation

Effectiveness is the extent to which planned activities are realized and planned results achieved, which requires performance evidence over time. A conformity audit samples evidence at a point in time and cannot by itself demonstrate sustained achievement of results.

Question 40Fundamental concepts and principles of management systems

An auditor finds that corrective action for a recurring defect always ends with retraining the operator. Which analysis best explains why this response is inadequate?

  1. It should have been recorded as an opportunity rather than a nonconformity
  2. It treats a symptom without determining the underlying cause, so the condition is likely to recur Correct answer.
  3. It exceeds the requirements of the standard by adding unnecessary training
  4. It is adequate because operator error is always the root cause

Explanation

Corrective action must address the cause of a nonconformity so that it does not recur, which requires analysis rather than an automatic remedy. Repeated retraining after each occurrence indicates that the systemic cause has not been identified or eliminated.

Question 41Fundamental concepts and principles of auditing

Which statement best describes the purpose of an internal audit of a management system?

  1. To verify that every employee has signed the organization's code of conduct
  2. To confirm that the financial statements give a true and fair view
  3. To replace the certification body's surveillance audit with an internal review
  4. To provide independent assurance that the management system conforms to requirements and is effectively implemented and maintained Correct answer.

Explanation

An internal audit is an independent, systematic evaluation whose purpose is to provide assurance about conformity to requirements and the effectiveness of the management system. It supports improvement and management review rather than substituting for external certification or financial audit.

Question 42Fundamental concepts and principles of auditing

Which term describes the combination of processes and interactions that an organization uses to achieve its objectives?

  1. Management system Correct answer.
  2. Scope statement
  3. Audit criteria
  4. Audit programme

Explanation

A management system is the set of interrelated or interacting elements, including processes, used by an organization to achieve its objectives. The other terms describe audit arrangements or boundaries rather than the system itself.

Question 43Fundamental concepts and principles of auditing

An auditor collects evidence of conformity. According to auditing principles, which characteristic must that evidence have to be relied upon?

  1. It must be verifiable Correct answer.
  2. It must be stored in electronic form
  3. It must be provided by the auditee's manager
  4. It must be quantitative rather than qualitative

Explanation

Audit evidence must be verifiable, meaning it can be traced back to a reliable source and confirmed by others. Verifiability underpins the reliability of findings and conclusions regardless of format or who supplied it.

Question 44Fundamental concepts and principles of auditing

Which pair correctly distinguishes audit criteria from audit evidence?

  1. Criteria are the auditor's opinions; evidence is the auditee's corrective action
  2. Criteria are the findings recorded in the report; evidence is the audit plan
  3. Criteria are the requirements used as a reference; evidence is the records and facts found that relate to those requirements Correct answer.
  4. Criteria are the audit objectives; evidence is the audit programme

Explanation

Audit criteria are the set of requirements, policies, or standards against which conformity is judged, while audit evidence consists of records, statements, or observations relevant to those criteria. Findings are produced by evaluating evidence against criteria.

Question 45Fundamental concepts and principles of auditing

Which principle requires auditors to be honest, truthful, and to report findings accurately even when the result is uncomfortable?

  1. Independence
  2. Confidentiality
  3. Integrity Correct answer.
  4. Evidence-based approach

Explanation

Integrity is the principle of being honest and truthful in reporting, including disclosing inconvenient findings. Confidentiality concerns information security, independence concerns freedom from bias or influence, and the evidence-based approach concerns how conclusions are reached.

Question 46Fundamental concepts and principles of auditing

An auditor discovers that the auditee's documented procedure differs from the practice actually observed. What is the auditor's most appropriate action?

  1. Immediately rewrite the procedure to match observed practice
  2. Ignore the difference because practice is more important than documentation
  3. Record the discrepancy as a finding and gather further evidence to determine its significance Correct answer.
  4. Report the auditee to the certification body before completing the audit

Explanation

Auditors evaluate conformity by comparing evidence against criteria; a mismatch between documented procedure and practice is potential nonconformity. The auditor should document it and gather enough evidence to judge its significance and extent.

Question 47Fundamental concepts and principles of auditing

In audit terminology, what is a 'finding'?

  1. The auditor's personal opinion about the auditee's culture
  2. The result of evaluating collected evidence against the audit criteria Correct answer.
  3. The schedule of audit interviews agreed with the auditee
  4. The list of documents requested before the audit

Explanation

Findings are the outcome of comparing evidence with criteria; they may indicate conformity or nonconformity. They must be based on verifiable evidence, not personal opinion or administrative arrangements.

Question 48Fundamental concepts and principles of auditing

Which statement reflects the principle of independence in internal auditing?

  1. Auditors should not audit work for which they have direct responsibility Correct answer.
  2. Auditors should accept the auditee's conclusions without verification
  3. Auditors should report only to the auditee's line manager
  4. Auditors should always be external contractors

Explanation

Independence in internal audit means auditors avoid auditing their own work, which would compromise objectivity. Being external is not required, and accepting conclusions unverified undermines the evidence-based approach.

Question 49Fundamental concepts and principles of auditing

An audit team leader is selecting auditors for an audit of the production department. Which choice best preserves objectivity?

  1. Assign an auditor from another department who has no operational responsibility for production Correct answer.
  2. Assign the production supervisor, who knows the processes best
  3. Assign the auditor who designed the production procedures last year
  4. Assign the auditor who is due to be transferred into production next month

Explanation

Objectivity is best preserved when auditors are independent of the activity being audited. Auditing one's own work or work one is about to take responsibility for creates a self-review conflict.

Question 50Fundamental concepts and principles of auditing

What does the principle of a 'risk-based approach' mean for an internal audit programme?

  1. Audit effort and frequency are prioritized according to the significance of risks and the results of previous audits Correct answer.
  2. Audits are scheduled at equal intervals for every process regardless of risk
  3. Only high-severity nonconformities are ever audited
  4. Risks are assessed only after the audit report is issued

Explanation

A risk-based audit programme allocates resources and sets frequency according to the importance of processes, associated risks, and prior audit results. This focuses audit effort where it matters most rather than applying uniform coverage.