1. Case: A retail corporation reorganizes its corporate structure. The CEO proposes that the CAE report functionally to the Chief Financial Officer (CFO) to streamline administrative reporting.
- Question: The internal audit activity fails to maintain proper independence when which of the following reporting structures is implemented?
- a) Functional reporting directly to the board of directors or audit committee.
- b) Administrative reporting to the Chief Executive Officer for routine operational matters.
- c) Functional reporting and direct accountability assigned to the corporate Chief Financial Officer.
d) Unrestricted direct access between the CAE and the chair of the board's audit committee
2. Case: An internal auditor was transferred from the IT infrastructure department to the internal audit team three months ago. The CAE assigns this auditor to lead an assurance engagement reviewing the security controls of that exact same IT infrastructure.
- Question: The assigned internal auditor exhibits an impairment of individual objectivity in which of the following scenarios?
- a) Evaluating operations for which they held operational authority within the prior twelve-month window.
- b) Utilizing generalized risk assessment tools originally designed by an external consulting firm.
- c) Testing physical access logs of a branch office they have never previously visited or managed.
d) Reviewing compliance metrics compiled by an independent department outside their prior scope.
Answer:
3. Case: An internal auditor is assigned to evaluate a complex financial derivative trading model without prior training or experience in quantitative finance. The auditor signs off on the model's accuracy after a brief visual scan of the inputs.
- Question: The auditor breached the requirements of due professional care by doing which of the following?
- a) Relying exclusively on high-level representations without performing adequate analytical testing or acquiring necessary proficiency.
- b) Documenting the extent and boundaries of the testing procedures performed within the working papers.
- c) Requesting technical assistance from an external valuation specialist to verify complex calculations.
- d) Applying standardized verification steps consistent with contemporary internal audit guidelines.
Answer:
4. Case: Management identifies a major operational disruption risk tied to a single primary supplier. Instead of diversifying, management decides to absorb the potential loss because the probability of occurrence is extremely low.
- Question: Management has selected which type of inappropriate risk response if the exposure exceeds the established risk appetite and no controls are added?
- a) Risk retention without conscious evaluation or formal authorization of residual exposure.
- b) Risk sharing through a co-branded contractual partnership agreement.
- c) Risk avoidance by terminating the operational activity entirely.
d) Risk reduction via the deployment of preventive system redundancies
5. Case: An internal auditor is testing whether IT passwords are changed every 90 days. They interview the IT Director, who states, "Yes, our system forces a reset automatically." The auditor documents this statement and concludes the control is fully effective without looking at system configurations or password logs.
- Question: The auditor’s testing methodology is fundamentally flawed because of which evidence concept?
- a) System configurations are classified as highly confidential and are closed to internal audit inspection.
- b) Verbal inquiry alone is insufficient to support a conclusion regarding the operating effectiveness of a control without corroborating evidence.
- c) The IT Director is structurally prohibited from giving testimonies to internal audit staff.
- d) Inquiry evidence must be gathered exclusively via anonymous handwritten letters to be considered valid.
Answer:
6. Case: An internal audit department finishes an audit of an international subsidiary. To free up storage space on the corporate cloud server, the CAE orders the immediate deletion of all digital working papers, emails, and evidence files two weeks after the final report is issued.
- Question: This action violates professional internal audit standards because the function has failed to do which of the following?
- a) Retain engagement records for a period consistent with organizational policies, legal frameworks, and regulatory mandates.
- b) Transmit all raw testing spreadsheets directly to public cloud repositories for civic access.
- c) Store all historical working papers exclusively on physical, off-line magnetic tapes.
- d) Delete the records only after securing a written clearance certificate from the external financial auditor.
Answer:
7. Case: An internal auditor conducts a surprise physical observation of a manufacturing facility to confirm that workers are wearing mandated safety gear. They observe perfect compliance during their 1-hour scheduled walkthrough. However, standard operating logs show high injury rates during night shifts.
- Question: The auditor fails to reach a valid conclusion because they ignored which limitation of physical observation evidence?
- a) Physical observation provides highly reliable evidence for asset existence but only reflects conditions at the exact moment the observation occurs. b) Observation evidence is legally invalid unless it is recorded using high-definition thermal imaging cameras. c) The Standards state that physical observation cannot be used to evaluate operational safety controls.d) Observing a process requires the auditor to physically operate the machinery themselves to verify performance
- Answer:
8 Case: While testing a sample of 25 shipping logs for proper manager approval, an auditor finds 4 logs completely missing a signature. The warehouse manager tells them, "Those were just hectic days, don't worry about it." The auditor decides to drop those 4 items and select 4 new ones that have signatures so the sample looks clean.
- Question: The auditor's action is highly inappropriate because it represents a failure to execute which professional obligation?
- a) Modifying the sample arbitrarily to hide deviations violates objectivity and prevents the accurate evaluation of control failures.
- b) Auditors are required to immediately terminate the entire engagement whenever a single signature is missing.
- c) The auditor should have asked the manager to physically forge the signatures during the interview.
- d) Sampling methodologies dictate that missing documents should be replaced automatically by the accounts payable clerk.
- Answer:
9. Case: An internal audit supervisor is facing a tight deadline. To save time, they sign off on all junior auditor working papers as "Reviewed" without opening the files, checking the cross-references, or verifying if the evidence actually supports the final audit report's findings.
- Question: The supervisor has failed to fulfill their core quality assurance responsibility under the Standards because of which factor?
- a) Working paper reviews must be performed by external regulatory bodies rather than internal supervisors.
- b) Operational policies require that working papers be reviewed exclusively by the Chief Executive Officer.
- c) Supervision must include actual evaluation of the evidence, logic, and completeness to ensure engagement quality.
- d) Reviewers are mandated to spend at least 4 hours analyzing every individual page of documentation.
Answer:
- 10 Case: The board of a multinational shipping company meets quarterly. To expedite meetings, the board reviews summary financial statements but allocates no time to discuss risk appetites, compliance violations, or whistleblower reports, stating that "management handles operations."
- Question: This governance structure is fundamentally weak because the board has neglected which primary responsibility?
- a) Maintaining ultimate oversight accountability over the organization's governance, risk management, and internal control environment.
- b) Directing the physical day-to-day operations and picking specific logistics vendors for regional branches.
- c) Writing the step-by-step standard operating procedures for the accounting departments.
- d) Approving the individual expense reports of middle-management warehouse supervisors.
Answer:
- 11 Case: An internal auditor conducting an operational review of a regional sales office observes that while written policies are pristine, local managers verbally abuse employees who fail to meet unrealistic targets and actively mock the corporate ethics helpline.
- Question: How should the auditor evaluate and report the control environment of this office?
- a) Document that the control environment is weak because the informal "tone at the bottom/middle" contradicts and undermines the formal policies.
- b) Report the control environment as fully effective because the written policies meet all compliance checklists.
- c) Ignore the behavior since employee morale and management style fall strictly under Human Resources' jurisdiction.
- d) Adjust the audit scope to focus exclusively on financial calculations, as culture cannot be verified with numeric data.
Answer
12 Second Line vs. Third Line Coordination • Case: A bank establishes a dedicated Risk Management Compliance Department that independently tests loan files for regulatory compliance every month. The CAE wants to utilize their work to optimize internal audit resources. •
Question: According to the IIA's Three Lines Model, how should the internal audit function interact with this compliance department?
o a) Refuse to communicate with them to prevent any potential contamination of internal audit’s mental objectivity o b) Absorb the compliance team into the internal audit structure to eliminate the second line of defense entirely. o c) Blindly copy the compliance department’s reports into the audit files without performing any independent verification or evaluation. o d)Coordinate efforts and evaluate the compliance department's scope and objectivity to minimize duplication while maintaining independent third-line assurance
A
- 13 Case: During an interview, a procurement clerk suspected of taking kickbacks states: "Everyone here takes minor gifts from vendors, and senior executives fly first-class on corporate money anyway. I am just balancing out my underpaid salary."
- Question: In the context of the classic Fraud Triangle framework, this statement represents which element?
- a) Perceived Opportunityb) Situational Pressurec) Rationalization
- d) Financial Incentive
AN
- 14 Case: An auditor is reviewing accounts payable data and notices several payments made to a vendor whose name matches an employee’s initials, uses a residential address as the business location, and lacks a corporate website or telephone number.
- Question: These attributes are classic behavioral and data red flags pointing to what specific fraud scheme?
- a) A shell company scheme designed to siphon corporate funds through fake or inflated invoices.b) A skimming scheme where cash is stolen before it is recorded in the accounting system.c) A check tampering scheme involving the physical forgery of executive signatures on blank stock.d) A corrupt bribery scheme involving foreign government officials to secure licensing.
AN
- 15 Case: While testing high-value inventory discrepancies, the warehouse manager informs the auditor that the missing $50,000 worth of microchips was simply "scrapped due to water damage" and provides a handwritten note as proof. No formal scrap log or insurance claim exists.
- Question: To demonstrate proper professional skepticism, how should the auditor respond?
- a) Refuse to accept the handwritten note as sufficient appropriate evidence, and expand testing to look for physical disposal records or security footage.
- b) Accept the manager's explanation at face value to maintain a collaborative and positive audit relationship.
- c) Conclude the audit immediately and file a police report without verifying any additional documentation.
- d) Archive the handwritten note in the working papers as absolute proof that the control operated effectively.
A
- 16 Case: An internal audit training manager is explaining why the 2024 Global Internal Audit Standards emphasize the "public interest." A student asks how this impacts a private corporation's internal audit charter.
- Question: According to the 2024 Global Internal Audit Standards logic, why is serving the public interest considered an inherent part of internal auditing across all sectors?
- a) Effective internal auditing enhances organizational governance and control, which protects stakeholders, preserves market integrity, and builds societal trust.
- b) The Institute of Internal Auditors (IIA) requires private internal audit teams to report all proprietary financial findings directly to public civic forums.
- c) Serving the public interest grants internal auditors immediate statutory immunity from local criminal prosecution under international law.
- d) The mandate legally reclassifies all private internal corporate auditors as public government compliance officers.
- ANSWER
- 17 Core Logic Behind Advisory Independence Boundaries • Case: A compliance officer asks an internal auditor why they can provide advice during a new software deployment project but cannot formally "approve" the final control architecture before deployment. • Question: What is the underlying syllabus logic regarding why an auditor must refuse to issue formal management sign-offs on operational controls?
- o a) Internal auditors lack the baseline computational intelligence to understand modern automated enterprise architectures. o b)Issuing a formal sign-off creates a management responsibility, which destroys the auditor’s ability to provide independent assurance on that system in the future. o c) The IIA Code of Ethics forbids internal auditors from speaking to system engineers during active design cycles. o d) Formal approvals require a specialized external licensing fee that internal audit budgets are prohibited from covering
- ANSWER B
- 18 Case: A senior executive argues that since the board delegates daily risk management execution to management, the board cannot be held responsible when a major operational control failure occurs.
- Question: Which statement correctly reflects the governance logic of the 2024 syllabus regarding the board's role?
- a) Responsibility for daily execution can be delegated to management, but ultimate oversight accountability for governance, risk, and control integrity remains permanently with the board.
- b) The board is entirely exonerated from operational failure once a written delegation memorandum is signed by the CEO.
- c) Corporate governance principles dictate that the board must physically step in and run the departments if management fails a control test.
d) The board's only legal governance obligation is to choose the external financial statement auditing firm
19 Case: An internal audit supervisor is facing a tight deadline. To save time, they sign off on all junior auditor working papers as "Reviewed" without opening the files, checking the cross-references, or verifying if the evidence actually supports the final audit report's findings.
- Question: The supervisor has failed to fulfill their core quality assurance responsibility under the Standards because of which factor?
- a) Working paper reviews must be performed by external regulatory bodies rather than internal supervisors.
- b) Operational policies require that working papers be reviewed exclusively by the Chief Executive Officer.
- c) Supervision must include actual evaluation of the evidence, logic, and completeness to ensure engagement quality.
- d) Reviewers are mandated to spend at least 4 hours analyzing every individual page of documentation.
ANSWER
20Case: A newly hired internal auditor is asked to evaluate how effectively the company’s risk appetite has been operationalized across different business segments.
- Question: The auditor would perform an inappropriate or ineffective audit procedure by doing which of the following?
- a) Checking whether specific operational tolerances align logically with the overall board-approved risk appetite.
- b) Reviewing management reports to see if actions are taken when risk exposures cross established thresholds.
- c) Assessing whether the risk appetite statement was written entirely by the internal audit team rather than by management and the board.
d) Verifying that staff members making high-risk decisions are aware of the organization's risk boundaries
ANSWER
21 Case: An airline faces a sudden, unprecedented global fuel price shock. The board realizes that their existing risk appetite statement completely prevents them from buying necessary fuel reserves under current market prices.
- Question: According to COSO ERM principles, how should the board react to this macro-economic shift?
- a) Formally review, adjust, and re-align their risk appetite to reflect the new economic realities while maintaining oversight.
- b) Instruct management to break the policy silently without modifying the official board-approved document.
- c) Shut down all flight operations permanently to achieve an immediate, absolute risk avoidance state.
- d) Dissolve the internal audit department to prevent the policy breach from being officially documented.
ANSWER
22 Case: During an internal audit of a trading desk, the auditor discovers that an aggressive portfolio manager has consistently generated record-breaking profits by taking speculative positions that double the board-approved risk appetite limits.
- Question: How should the internal auditor evaluate this situation under COSO ERM logic?
- a) Report this as a critical control failure because operating outside the approved risk appetite is unacceptable, regardless of short-term profitability.
- b) Praise the manager in the final report for successfully maximizing organizational value through unauthorized exposure.
- c) Ignore the exposure entirely since no actual financial loss has occurred during the audited period.
- d) Recommend that the board automatically increase its risk appetite whenever a trader wants to make a profit.
ANSWER
23 Case: A manufacturing company moves its production facilities from a stable domestic environment to an international zone experiencing extreme hyperinflation and shifting customs laws. The risk team decides to keep their existing risk criteria exactly the same to save time.
- Question: This decision violates ISO 31000 guidelines because the framework dictates that risk criteria must do which of the following?
- a) Remain completely static and identical across all geographical boundaries regardless of local laws.
- b) Dynamically reflect and align with both the external and internal context of the organization as it changes.
- c) Be designed exclusively by external legal counsel rather than the internal management team.
- d) Prioritize accounting software preferences over actual operational and environmental variables.
ANSWER
Section B...
STUDENTS ASSIGNMENT :Solve & Submit your answers today.
1. Foundations of Internal Auditing
Case: Apex Corp. is revising its internal audit charter to align with the latest IIA Standards. The Chief Audit Executive (CAE) presents a draft to the audit committee. The draft defines the scope, functional reporting lines, and access restrictions to sensitive payroll files.Question: Which of the following elements included in the draft is neither required nor permitted by the IIA Standards regarding the internal audit charter?A. Strict limitation restricting internal audit's access to executive payroll data without prior CEO approval.B. Requirement to review and update the charter on a periodic basis.C. Standard stating that internal audit provides absolute assurance over the design of internal controls.D. Provision allowing the CAE to determine the frequency of external quality assessments.
2. Foundations of Internal Auditing
Case: Stellar Financials has established an internal audit activity (IAA) that provides both assurance and consulting services. The board wants to ensure that the definition and purpose of internal auditing are respected across all engagements.Question: When executing a consulting engagement, which of the following is at most a secondary objective, rather than a primary purpose, of the internal audit activity?A. Providing independent assurance to third-party regulators regarding financial statement accuracy.B. Improving the organization's governance, risk management, and control processes.C. Subserviently adopting management’s operational responsibilities to maintain workplace harmony.D. Adding tangible value and improving the operational efficiency of the reviewed business unit.
3. Independence and Objectivity
Case: Marcus, a senior internal auditor at a manufacturing firm, was a logistics manager for the same firm 10 months ago. Due to staffing shortages, the CAE assigns Marcus to lead an assurance review of the logistics department's inventory control system.Question: Under the IIA Standards, which of the following is least likely to be an acceptable course of action to address this situation?A. Marcus proceeds with the audit without disclosure because he feels he can remain entirely impartial.B. The CAE reassigns Marcus to a different audit outside of the logistics department.C. Marcus performs the audit but his work is subjected to strict, independent supervisory review.D. The engagement is changed from an assurance review to a consulting service with appropriate disclosure.
4. Independence and Objectivity
Case: The Chief Audit Executive of a global retail chain reports administratively to the Chief Financial Officer (CFO) and functionally to the Audit Committee. The CFO suggests modifying the final audit report to omit an issue concerning a material inventory write-down.Question: Which of the following organizational reporting scenarios demonstrates that none of the necessary independence requirements have been compromised?A. The CAE complies with the CFO's request but documents the disagreement in the working papers.B. The CAE completely ignores the Audit Committee and yields solely to the CFO's reporting mandates.C. The CAE presents the unmodified report directly to the Audit Committee despite the CFO's objections.D. The CAE allows the operations manager to rewrite the audit findings to preserve department morale.
5. Proficiency and Due Professional Care
Case: A technology company is rapidly expanding into blockchain-based smart contracts. The internal audit team consists of traditional financial auditors who have never audited distributed ledger technologies. The CAE schedules an audit of the blockchain infrastructure for the next month.Question: In order to avoid violating the standard of proficiency, the internal audit activity must meet at least which of the following criteria before executing the engagement?A. Each individual auditor on the team must possess an advanced certification in blockchain technology.B. The team must collectively possess or acquire the knowledge, skills, and other competencies needed to perform the engagement.C. The audit must be delayed for a minimum of two fiscal years until staff are fully trained.D. The CAE must perform all fieldwork personally without utilizing external experts.
6. Proficiency and Due Professional Care
Case: An internal auditor is conducting a routine expense report audit. She notices two transactions that lack proper receipt documentation, but they fall well below the established materiality threshold for financial misstatements.Question: Exercising due professional care means the auditor should neither ignore these findings nor do which of the following?A. Automatically assume widespread fraud exists and report it directly to local law enforcement.B. Consider the potential for cumulative non-compliance and expand testing if necessary.C. Document the exceptions in the working papers and evaluate the cost-benefit of further investigation.D. Alert the engagement supervisor to determine if control deficiencies are systemic.
7. Quality Assurance and Improvement Program (QAIP)
Case: The internal audit activity of Orbit Tech has been in operation for six years. The CAE conducts regular supervisory reviews of working papers and issues annual self-assessments. However, the department has never undergone an external quality assessment.Question: Which of the following is not a valid statement regarding Orbit Tech’s compliance with the QAIP standards?A. The IAA is fully compliant because internal assessments and supervisory reviews are conducted annually.B. The IAA is deficient because an external assessment must be conducted at least once every five years.C. The IAA cannot claim conformance with the IIA Standards in its audit reports due to the lack of an external review.D. The CAE must communicate the non-conformance and its impact to the board and senior management
8. Quality Assurance and Improvement Program (QAIP)
Case: An external quality assessment team is reviewing the internal audit activity of a major bank. They notice that while the CAE tracks productive audit hours and budget variances, there are no metrics evaluating whether the audits actually improve organizational risk management.Question: To establish a comprehensive QAIP, the performance metrics should measure at least which of the following dimensions?A. The absolute number of findings generated per audit hour, regardless of risk severity.B. Only the financial cost savings directly generated by audit recommendations.C. Efficiency, effectiveness, and conformance with the Standards and Code of Ethics.D. The level of satisfaction expressed by the audited managers during exit interviews
9. Governance, Risk Management, and Control
Case: The board of directors at Vertex Corp. wants to clarify the boundaries between operational management, risk oversight functions, and internal audit. They decide to adopt the IIA's Three Lines Model.Question: According to the Three Lines Model, which of the following responsibilities belongs to neither the first-line nor the second-line roles?A. Establishing and maintaining internal control systems over daily plant operations.B. Providing independent and objective assurance on the adequacy and effectiveness of governance.C. Monitoring compliance with environmental laws and corporate health policies.D. Developing risk management frameworks and training operational staff on risk metrics.
10. Governance, Risk Management, and Control
Case: A multinational corporation is designing its enterprise risk management (ERM) framework. The executive committee wants to define its "risk appetite" and "risk tolerance" to guide divisional managers.Question: Which of the following statements represents none of the correct applications of risk concepts?A. Risk appetite is the broad amount of risk an organization is willing to accept in pursuit of value.B. Risk tolerance is the acceptable level of variation relative to the achievement of a specific objective.C. Risk tolerance must always be set significantly higher than risk appetite to allow operational freedom.D. Inherent risk is the risk to an organization in the absence of any actions management might take to alter it.
11. Governance, Risk Management, and Control
Case: During a review of the procurement department, an auditor finds that purchase orders above $50,000 require two signatures, but there is no automated system block preventing a user from splitting a single $80,000 order into two $40,000 orders.Question: This scenario describes a vulnerability that is at most characterized as which type of control failure?A. A complete absence of any preventive control design in the procurement cycle.B. A failure in the operating effectiveness of a control due to external collusion.C. A control deficiency related to the circumvention of transaction limits (split-purchasing).D. An inherent limitation of internal control that cannot be mitigated by any software logic.
12. Fraud Risks
Case: An internal auditor discovers that a senior accountant has sole access to the vendor master file, enters invoices, and approves payments. The auditor suspects that fictitious vendors may have been created.Question: Which of the following fraud elements from the Fraud Triangle is least likely to be mitigated by implementing segregation of duties in this scenario?A. Rationalization.B. Opportunity.C. Pressure.D. Incentive..
13. Fraud Risks
Case: The CAE of an insurance firm is establishing a fraud risk management program. Management suggests that because the company has an extensive external audit review every year, internal audit does not need to focus on fraud detection during regular audits.Question: Which of the following choices represents a position that satisfies neither the IIA Standards nor professional expectations regarding fraud?A. Internal auditors must have sufficient knowledge to evaluate the risk of fraud but are not expected to have the expertise of a primary fraud investigator.B. The primary responsibility for the prevention and detection of fraud rests with management.C. Internal audit has zero responsibility for detecting fraud if the company uses external auditors.D. Internal audit should evaluate the likelihood of fraud occurring and how the organization manages fraud risk.
14. Foundations of Internal Auditing
Case: The internal audit activity of an organization is evaluating its alignment with the Global Internal Audit Standards. The CAE wants to communicate the role of internal audit in strategic decision-making.Question: Which of the following is not an appropriate function of the internal audit activity when supporting organizational governance?A. Actively participating in strategic management decisions and voting on corporate mergers.B. Evaluating the design and effectiveness of the organization's ethics-related objectives.C. Assessing whether organizational performance management supports accountability.D. Coordinating activities with external auditors to ensure proper coverage of key risks.
15. Independence and Objectivity
Case: A large retail organization is expanding its digital storefront. The IT department asks the internal audit activity to participate in the project steering committee to provide real-time feedback on automated control designs before the system goes live.Question: To ensure objectivity is neither impaired during the project nor in future audits, the CAE should ensure which of the following?A. Internal auditors refrain from giving any feedback until after the system is fully operational.B. Auditors act strictly in an advisory/consulting capacity and do not make operational design decisions.C. The audit team takes full ownership of configuring the security access parameters.D. The steering committee minutes explicitly state that internal audit approves the final launch.
16. Proficiency and Due Professional Care
Case: During a compliance audit of environmental regulations, an internal auditor discovers a minor documentation error in a disposal log. The auditor decides to expand the sample size significantly, spending three weeks verifying low-risk logs while ignoring a high-risk hazardous waste disposal process due to time constraints.Question: The auditor's actions are at most a violation of due professional care because they failed to consider which of the following?A. The cost of the expanded audit work relative to the potential benefits and risk severity.B. The personal opinions of the plant operations manager regarding compliance.C. The absolute certainty required to issue an unreserved audit opinion.D. The exact statistical formulas required to establish a 100% confidence interval.
17. Quality Assurance and Improvement Program (QAIP)
Case: A newly appointed CAE finds that the internal audit department conducts self-assessments every three years but does not perform ongoing monitoring of performance, such as tracking project timelines or supervisor sign-offs.Question: Under the QAIP standards, ongoing monitoring must include at least which of the following components?A. External validation by an accredited third-party agency every six months.B. Routine feedback loops, engagement supervision, and performance metrics integrated into daily operations.C. Peer reviews conducted by internal auditors from competing organizations.D. Annual mandatory exams testing the technical skills of every staff auditor.
18. Governance, Risk Management, and Control
Case: An organization faces volatile regulatory shifts in its international markets. Management implements a decentralized compliance monitoring framework where each regional office tracks its own rules without central aggregation.Question: Which of the following control or governance deficiencies is none of the regional offices addressing in this setup?A. The specific local regulatory changes impacting their immediate geographic operations.B. The training of regional operational staff on local compliance processes.C. The enterprise-wide consolidation and oversight of systemic cross-border compliance risks.D. The immediate correction of minor localized processing deviations.
19. Governance, Risk Management, and Control
Case: An internal auditor is reviewing the corporate governance framework of a publicly traded financial institution. The auditor is examining the relationships between shareholders, the board, and senior management.Question: Which of the following governance practices is neither effective nor aligned with standard corporate governance frameworks?A. The CEO serves as the sole chair of the audit committee to ensure management is fully represented.B. The board reviews and guides corporate strategy, major plans of action, and risk policies.C. Senior management designs and implements operational risk management controls under board oversight.D. The audit committee consists entirely of independent, non-executive directors.
20. Fraud Risks
Case: An internal auditor notices that an accounts payable clerk has bought a luxury vehicle and taken several expensive vacations, despite earning an entry-level salary. Additionally, the clerk aggressively resists taking mandatory consecutive annual leave.Question: In the context of fraud indicators, these observations are least likely to be categorized as which of the following?A. Transactional data anomalies generated by automated continuous auditing scripts.B. Behavioral red flags indicating potential lifestyle changes funded by unauthorized activities.C. Control circumvention indicators, such as avoiding mandatory vacation to hide ongoing fraud schemes.D. Red flags that justify expanding the audit scope to check for irregularities in cash disbursements.
To help you master these concepts and prepare effectively for exam day, here is a strategic breakdown of how to tackle these tricky questions, along with an interactive practice quiz to test your skills in real time.
🧠 Exam Strategy: Tackling Negative & Constrained Questions
When you encounter negative questions (containing "not," "neither," "least," or "at most") on the CIA Part 1 exam, use these three steps to avoid traps:
1. Flip the Question: Convert the negative question into a positive one. For example, if the question asks, "Which of the following is LEAST likely to be a responsibility...", rephrase it in your mind to: "Which three of these ARE standard responsibilities?" The one left out is your answer.
2. Watch the Extent Modifiers: Words like "At most" or "At least" establish ceilings and floors.
o At most a secondary objective means you are looking for something that is either not an objective at all, or a very minor one.
o At least meet this criterion means you are looking for the absolute minimum baseline requirement.
3. Use True/False Labels: Next to each option, mentally assign a "True" or "False" label based on standard IIA guidance. For a negative question, you are explicitly hunting for the outlier label
Key Concepts Covered in This Quiz:
· Risk Universe: The total compilation of all potential risks that could affect an entity, which must be comprehensively identified before prioritizing.
· Risk Appetite: The broad, high-level amount of risk that an organization is willing to accept in pursuit of its strategic objectives, set by the board.
· Risk Tolerance: The tactical, measurable, and operational boundaries of variance around specific objectives, set by management to keep activities aligned with the overall risk appetite.
· ERM Framework (COSO): The structural alignment of governance, strategy, execution, and review to manage uncertainty effectively.
