Practice Questions for Test 2 Internal Audit

Which of the following statements regarding corporate governance is not correct?

The internal auditor of a company has more responsibility than the board for the company's corporate governance.

Personal information may include 1. Medical status 2. Social status 3. Credit records 4. Disciplinary actions

1, 2, 3, and 4.

Which of the following are responsibilities of the chief audit executive (CAE)? 1. Coordinating activities with other providers of assurance and consulting services. 2. Understanding the work of external auditors. 3. Providing sufficient information to the external auditors to permit them to understand the internal auditors' work

1, 2, and 3.

The work of the internal audit activity includes evaluating and contributing to the improvement of risk management systems. Risk is 1. The negative effect of events certain to occur 2. Measured in terms of impact 3. Measured in terms of likelihood

2 and 3 only.

Which of the following represent(s) appropriate internal audit action in response to the risk assessment process? 1. The low-risk areas may be delegated to the external auditor, but the high-risk areas should be performed by the internal audit activity. 2. The high-risk areas should be integrated into an audit work schedule along with the high-priority requests of senior management and the audit committee. 3. The risk analysis should be used in determining an annual audit work schedule. Thus, the risk analysis should be performed only on an annual basis.

2 only.

An operational assurance engagement may include an assessment of all of the following except

Accuracy of financial reporting.

Risk management is critical to the sound governance of which of the following?

All organizational activities, regardless of revenue.

The term "risk" is best defined as the possibility that

An event could occur affecting the achievement of objectives.

Before an assurance engagement can be performed, the auditor must identify appropriate criteria. The sources of such criteria are least likely to include

Best practices for another industry.

The primary reason that a bank would maintain a separate compliance function is to

Better manage perceived high risks.

For the chief audit executive (CAE), the financial reporting process encompasses the steps to

Create information to help prepare the financial statements and related notes.

Following an external assessment of the internal audit activity, who is (are) responsible for communicating the results to the board?

Chief audit executive.

Fact Pattern: A certified internal auditor is the chief audit executive for a large city and is planning the engagement work schedule for the next year. The city has a number of different funds, some that are restricted in use by government grants and some that require compliance reports to the government. One of the programs for which the city has received a grant is job retraining and placement. The grant specifies certain conditions a participant in the program must meet to be eligible for the funding. The internal auditors randomly select participants in the job retraining program for the past year to verify that they had met all the eligibility requirements. This type of engagement is concerned with

Compliance.

Managerial performance may be measured in many ways. For example, an internal nonfinancial measure is

Manufacturing lead time.

Which of the following statements is an engagement objective?

Evaluate whether cash receipts are adequately safeguarded.

An internal auditor for a large service organization is performing an engagement to review the organization's cash balance. The internal auditor is considering the most appropriate engagement procedure to use to ensure that the amount of cash is accurately recorded on the financial statements. The most appropriate engagement procedures for the objective are

Examine bank reconciliations, confirm bank balances, and verify cutoff of receipts and disbursements; foot totals of reconciliations and compare to cash account balances.

Which of the following threatens the independence of an internal auditor who had participated in the initial establishment of a risk management process?

Managing the identified risks.

Fact Pattern: You are the chief audit executive of a parent organization that has foreign subsidiaries. Independent external audits performed for the parent are not conducted by the same firm that conducts the foreign subsidiary audits. Because the internal audit activity occasionally provides direct assistance to both external firms, you have copies of audit programs and selected working papers produced by each firm. The foreign subsidiary's auditors would like to rely on some of the work performed by the parent organization's audit firm, but they need to review the working papers first. They have asked you for copies of the working papers of the parent organization's audit firm. What is the most appropriate response to the foreign subsidiary's auditors?

Notify the parent's auditors of the situation and request that they either provide the working papers or authorize you to do so.

The internal auditor wishes to test the assertion that all claims paid by a medical insurer contain proper authorization and documentation, including but not limited to the validity of the claim from an approved physician and an indication that the claim complies with the claimant's policy. The most appropriate engagement procedure is to select a sample of

Paid claims from the claims (cash) disbursement file and trace to documentary information about authorization and other supporting documentation.

An approved audit plan for the internal audit activity is an essential part of

Planning for the internal audit activity.

Data-gathering activities such as interviewing operating personnel, identifying standards to be used to evaluate performance, and assessing risks inherent in a department's operations are typically performed in which phase of an audit engagement?

Preliminary survey.

Which type of engagement attempts to measure the accomplishment and relative success of the undertaking?

Program-results engagement.

Fact Pattern: An organization has two manufacturing facilities. Each facility has two manufacturing processes and a separate packaging process. The processes are similar at both facilities. Raw materials used include aluminum, materials to make plastic, various chemicals, and solvents. Pollution occurs at several operational stages, including raw materials handling and storage, process chemical use, finished goods handling, and disposal. Waste products produced during the manufacturing processes include several that are considered hazardous. The nonhazardous waste is transported to the local landfill. An outside waste vendor is used for the treatment, storage, and disposal of all hazardous waste. Management is aware of the need for compliance with environmental laws. The organization recently developed an environmental policy including a statement that each employee is responsible for compliance with environmental laws. If the internal audit activity is assigned the responsibility of conducting an environmental audit, which of the following actions should be performed first?

Provide the assigned staff with technical training.

Of the following reasons for employees to resist a major change in organizational processes, which is least likely?

Required attendance at training classes.

An audit found that the cost of some material installed on capital projects had been transferred to the inventory account because the capital budget had been exceeded. Which of the following would be an appropriate technique for the internal audit activity to use to monitor this situation?

Review all journal entries that transferred costs from capital to inventory accounts.

What is the best description of information technology (IT) assurance?

Review and testing of IT to assure the integrity of information.

Which type of facilitated approach format begins by listing all possible barriers, obstacles, threats, and exposures that might prevent achieving an objective?

Risk-based format.

Risk assessment is a systematic process for assessing and integrating professional judgments about probable adverse conditions or events. Which of the following statements reflects the appropriate action for the chief audit executive to take?

The CAE should generally assign engagement priorities to activities with higher risks.

The internal audit activity's quality assurance and improvement program is the responsibility of

The chief audit executive.

An operational engagement communication that concerns the scrap disposal function in a manufacturer should address

The efficiency and effectiveness of the scrap disposal function and include any observations requiring corrective action.

An organization is considering purchasing a commercial property. Because of the location of the property and the known recent history of activities on the property, management has asked the internal audit activity, in cooperation with legal counsel, to provide a preliminary identification of any environmental liability. The strongest reason supporting management's decision to request such an investigation is

The potential for future liability may outweigh any advantages achieved by obtaining the property.

Which of the following is an appropriate statement of an engagement objective?

To determine whether inventory stocks are sufficient to meet projected sales.

Levels of production stoppages over the past year at a large laminating business were abnormally high due to machine malfunctions. Would it be appropriate for the internal auditing function to develop a survey examining attitudes toward line operations, rotation of work zones, training, maintenance schedule, etc., for the machine operators to complete?

Yes, the examined areas are relevant to the malfunctions.

Coordinating internal and external audit activity can increase efficiency by using which of the following? 1. Similar techniques 2. Similar methods 3. Similar terminology

1, 2, and 3.

Internal auditors need to determine the extent to which management has established adequate control criteria. For this purpose, which of the following actions may be appropriate? 1. Determining whether objectives have been accomplished 2. Using management's adequate control criteria in their evaluation 3. Working with management to develop appropriate control evaluation criteria

1, 2, and 3.

Which of the following potentially are subject to the internal auditors' evaluations? 1. The human resources function. 2. The purchasing process. 3. The manufacturing and production database system.

1, 2, and 3.

A specific objective of an audit of a company's expenditure cycle is to determine whether all goods paid for have been received and charged to the correct account. This objective addresses which of the following primary objectives identified in the Standards? 1. Reliability and integrity of financial and operational information. 2. Compliance with laws, regulations, policies, procedures, and contracts. 3. Effectiveness and efficiency of operations and programs. 4. Safeguarding of assets.

1 and 4 only.

Which of the following represent(s) appropriate internal audit action in response to the risk assessment process? 1. The high-priority requests of senior management and the audit committee should be given little weight with regard to the audit work schedule. 2. Engagements for the low-risk areas may be delegated to the external auditor, but engagements for the high-risk areas should be performed by the internal audit activity. 3. The chief audit executive should develop a risk-based plan, making adjustments as necessary in response to organizational changes. 4. The risk analysis should be used in determining an annual audit work schedule. Thus, the risk analysis should be performed only on an annual basis.

3 only.

One operating department of an organization does not have adequate procedures for inspecting and verifying the quantities of goods received. To evaluate the materiality of this control deficiency, the internal auditor should review the department's

Annual inventory purchases.

At what minimal required frequency does the chief audit executive report the results of internal assessments in the form of ongoing monitoring to senior management and the board?

Annually.

An audit committee of the board of directors of an organization is being established. Which of the following is normally a responsibility of the committee with regard to the internal audit activity?

Approval of the selection and dismissal of the chief audit executive.

Which of the following represents the best risk assessment technique?

Assessment of the risk levels of current and future events, their effect on achievement of the organization's objectives, and their underlying causes.

As a particular engagement is being planned in a high-risk area, the chief audit executive determines that the available staff does not have the requisite skills to perform the assignment. The best course of action consistent with engagement planning principles is to

Consider using external resources to supplement the needed knowledge, skills, and other competencies and complete the assignment.

Exchange of engagement communications and management letters by internal and external auditors is

Consistent with the coordination responsibilities of the chief audit executive.

An organization has no formal risk management framework. In developing a risk-based plan to determine the priorities of the internal audit activity, the chief audit executive (CAE) should

Consult with senior management and the board and use the best judgment of risks.

In which format of the facilitated approach does the facilitator identify the key controls before the beginning of the workshop?

Control-based format.

To improve their efficiency, internal auditors may rely upon the work of external auditors if it is

Coordinated with internal auditing work.

The most important reason for the chief audit executive to ensure that the internal audit department has adequate and sufficient resources is to

Demonstrate sufficient capability to meet the audit plan requirements.

Directors, management, external auditors, and internal auditors all play important roles in creating proper control processes. Senior management is primarily responsible for

Establishing and maintaining an organizational culture.

The internal audit activity most directly contributes to an organization's governance process by

Evaluating the design of ethics-related activities.

Which of the following engagement procedures provides the best information about the collectibility of notes receivable?

Examination of cash receipts records to determine promptness of interest and principal payments.

The interpretation related to quality assurance given by the Standards is that

External assessments can provide senior management and the board with independent assurance about the quality of the internal audit activity.

After using the same public accounting firm for several years, the board of directors retained another public accounting firm to perform the annual financial audit in order to reduce the annual audit fee. The new firm has now proposed a one-time engagement relating to the cost-effectiveness of the various operations of the business. The chief audit executive has been asked to advise management in making a decision on the proposal. An argument can be made that the internal audit activity is better able to perform such an engagement because

External auditors may not possess the same depth of understanding of the organization as the internal auditors.

What is the most accurate term for the procedures used by the board to oversee activities performed to achieve organizational objectives?

Governance

During a preliminary survey of the accounts receivable function, an internal auditor discovered a potentially major control deficiency while preparing a flowchart. What immediate action should the internal auditor take regarding the weakness?

Highlight the weakness to ensure that procedures to test it are included in the engagement work program

A privacy audit focuses on an organization's ability to

Implement controls for the management of private information.

Senior management has requested a compliance audit of the organization's employee benefits package. Which of the following is considered the primary engagement objective by both the chief audit executive and senior management?

Individual programs are operating in accordance with contractual requirements and government regulations.

To determine the competence of the personnel in the purchasing department, an internal auditor most likely should perform

Inquiries of the staff.

When a risk assessment process has been used to construct an audit engagement schedule, which of the following should receive attention first?

Management has requested an investigation of possible lapping in receivables.

The reliability and integrity of all critical information of an organization, regardless of the media in which the information is stored, is the responsibility of

Management.

As a part of a quality program, internal assessment teams most likely will examine which of the following to evaluate the quality of engagement planning and documentation for individual engagements?

Measures of project budgets and audit plan completion.

What is the role of a chief audit executive (CAE) with regard to an inspection by a regulator?

Meet with the regulator before and after the inspection to provide relevant information or receive advice on necessary compliance.

The internal audit activity is responsible for implementing 1. Risk management 2. Governance 3. Control

None of the answers are correct.

Controls should be designed to ensure that

Operations are performed efficiently.

Controls should be designed to provide reasonable assurance that

Organizational objectives will be achieved economically and efficiently.

In selecting an instructional strategy for developing internal audit staff, a chief audit executive begins by reviewing

Organizational objectives.

Which outcome can be derived from self-assessment methodologies?

People are motivated to take ownership of the control processes in their units and corrective actions taken by work teams are often more effective and timely.

A manufacturer has been expanding rapidly and is considering adding a new production line. Employees are currently working double shifts and receiving large amounts of overtime pay. Demand for all of the organization's products is currently high, but management worries about demand fluctuations with changes in the economy and technological developments by competitors. Management is concerned with such issues as whether it is efficiently using its resources, whether it is expanding too rapidly or not rapidly enough, whether employee morale is decreasing, and whether future expansion should be financed internally or through debt. Of the following management requests, which is within the normal scope of work of the internal audit activity as stated in the Standards?

Perform an independent evaluation of management's planning process as a basis for making recommendations.

All of the following would be part of a factory's control system to prevent release of wastewater that does not meet discharge standards except

Periodically flushing sinks and floor drains with a large volume of clean water to ensure pollutants are sufficiently diluted

Control by management is the result of

Planning, organizing, and directing of organizational activities.

Which of the following is most essential for guiding the internal audit staff?

Policies and procedures.

The established scope of the engagement must be sufficient to satisfy the objectives of the engagement. When developing the objectives of the engagement, the internal auditor considers the

Probability of significant noncompliance.

An auditor is reviewing an organization's plan for developing a performance scorecard. Which of the following potential performance measures should the auditor recommend excluding from the performance scorecard?

Product innovation.

TQM is the continuous pursuit of quality in every aspect of organizational activities through a number of goals. Which of the following is not one of those goals?

Promotion of individual work.

The audit committee may serve several important purposes, some of which directly benefit the internal audit activity. The most significant benefit provided by the audit committee to the internal audit activity is

Protecting the independence of the internal audit activity from undue management influence.

Fact Pattern: You are the chief audit executive of a parent organization that has foreign subsidiaries. Independent external audits performed for the parent are not conducted by the same firm that conducts the foreign subsidiary audits. Because the internal audit activity occasionally provides direct assistance to both external firms, you have copies of audit programs and selected working papers produced by each firm. The foreign subsidiary's external audit firm wants to rely on an audit of a function at the parent organization. The audit was conducted by the internal audit activity. To place reliance on the work performed, the foreign subsidiary's auditors have requested copies of the working papers. What is the most appropriate response to the foreign subsidiary's auditors?

Provide copies of the working papers.

An engagement objective is to verify that the correct goods or services are received on time, at the right price, and in the right quantity. Based on this objective, the function to be reviewed is the

Purchasing department.

Lack of skills, threats to job status or security, and fear of failure all have been identified as reasons that employees often

Resist organizational change.

Documentation required to plan an internal audit engagement includes information that

Resources needed to complete the engagement were considered.

Staff members should be afforded an appropriate means through which they can discuss problems and receive updates regarding the internal audit activity's policies. The most appropriate forum for this objective is

Staff meetings.

Which of the following statements about the chief audit executive's responsibilities for internal audit resources is most accurate?

The CAE is responsible for the effective deployment of resources to achieve the approved audit plan.

Which of the following is true about the interaction of the internal audit function and the environmental audit function?

The CAE should evaluate whether the environmental auditors are conforming to recognized professional auditing standards and a recognized code of ethics.

What should the CAE do if the scope of the internal audit plan is insufficient to permit expression of an opinion about risk management and control?

The CAE should inform senior management and the board about gaps in audit coverage.

Why should an organization use the survey form of control self-assessment (CSA)?

The organizational culture does not encourage openness.

Which of the following is a valid reason for an internal auditing engagement involving a payroll department to receive priority over a purchasing department engagement?

The payroll department's relative risk and exposure are greater.

Which of the following statements is true with respect to a time budget for an internal audit engagement?

Time budgets should normally be prepared in terms of hours or days.

Which of the following possible engagement objectives would lead to a test of the efficiency of an organization's use of labor resources?

To determine that employees are assigned to work situations equivalent to their training and skill level.

Which of the following is the best reason for the chief audit executive to consider the strategic plan in developing the annual audit plan?

To ensure that the internal audit plan supports the overall business objectives.

Under a total quality management (TQM) approach,

Value-added activities are performed in all processes under constant management supervision.

Which procedure should be performed to determine whether shipments were properly authorized?

Vouching bills of lading to computer-generated sales invoices and purchase orders.

The key factor in the success of an internal audit activity's human resources program is

A well-developed set of selection criteria.

Internal auditors are often called upon to either perform or assist the external auditor in performing a due diligence review. A due diligence review may be a(n)

Review of financial statements and related disclosures in conjunction with a potential acquisition.

Which of the following are elements of a retail chain's strategic plan that the chief audit executive may incorporate into a risk-based audit plan? 1. Senior management's intent to shift from a niche market strategy to a market leader strategy. 2. Changes in operations managers' hiring and retention strategies. 3. Specific outlets targeted for expansion. 4. Management's assessment of the difficulties likely to be encountered in entering a new national market.

1 and 4 only.

A performance audit engagement typically involves

A strategic analysis of the organization's key components that are essential to the organization's success

A chief audit executive most likely uses risk assessment for audit planning because it provides

A systematic process for assessing and integrating professional judgment about probable adverse conditions.

Which of the following suggestions for the CAE related to EHS auditing is false?

At least once every three years, the CAE should schedule a quality assurance review of the environmental audit function if it is organizationally independent of the internal audit function.

Management is evaluating the need for an environmental audit program. Which one of the following should not be included as an overall program objective?

Conduct site assessments at all waste-producing facilities.

An external assessment of an internal audit activity contains an expressed opinion. The opinion may apply to

Conformance with the Standards and an assessment for each standard.

An internal auditor is testing the assertion that all claims paid by an insurer are properly authorized and documented. Testing addresses, among other things, whether claims are valid and consistent with claimants' policies. The most appropriate engagement procedure is to select a sample of

Claims paid and vouch to supporting documents.

Which of the following activities represents the greatest risk to a post-merger manufacturing organization and is therefore most likely to be the subject of an internal audit engagement?

Combining purchasing functions.

An organization makes a practice of investing excess short-term cash in marketable equity securities. A reliable test of the valuation of those securities is a

Comparison of cost data with current market quotations.

An airline is preparing for an inspection of its operations by a government agency. The agency emphasizes inspecting whether safety modifications required by the government have been made on aircraft. Penalties for violations are severe. The chief audit executive has been asked to audit the modification records and inspect the fleet of aircraft to determine whether required modifications have been made and properly documented. The auditors will be performing a(n)

Compliance audit.

Internal auditing is an assurance and consulting activity. An example of an assurance service is a(n)

Compliance engagement.

In an engagement to review a not-for-profit organization's special revenue fund, the primary engagement objective is to determine whether the organization

Complied with existing fund requirements and performed specified activities.

An engagement to evaluate a transportation department is being conducted. Review procedures include an analysis of "rush shipment" requests. The engagement objective in this case is the

Determination of the need for rush shipment services.

Internal auditors are increasingly called on to perform audits related to an organization's environmental stewardship. Which of the following does not describe the objectives of a type of environmental audit?

Determine whether environmental issues are considered as part of economic decisions.

Which of the following is not a true statement about the relationship between internal auditors and external auditors?

External auditors must assess the competence and objectivity of internal auditors.

The chief audit executive of a manufacturer is updating the long-range engagement work schedule. There are several possible assignments that can fill a given time spot. Information on potential monetary exposure and key internal controls has been gathered. Based on perceived risk, select the assignment of greatest merit.

Precious metals inventory -- carrying amount, US $1,000,000; separately stored, but access not restricted.

A review of an organization's code of conduct revealed that it contained comprehensive guidelines designed to inspire high levels of ethical behavior. The review also revealed that employees were knowledgeable of its provisions. However, some employees still did not comply with the code. What element should a code of conduct contain to enhance its effectiveness?

Provisions for disciplinary action in the event of violations.

An auditor is scheduled to audit payroll controls for an organization that has recently outsourced its information processing to an external service provider (ESP). What action should the auditor take, considering the outsourcing decision?

Review the controls over payroll in both the organization and the ESP.

A chief audit executive is reviewing the following enterprise-wide risk map: I M P A C T LIKELIHOOD Remote Possible Likely Critical Risk A Risk B Major Risk D Minor Risk C Which of the following is the correct prioritization of risks, considering limited resources in the internal audit activity?

Risk D, Risk B, Risk C, Risk A.

Which of the following statements is false regarding risk assessment as the term is used in internal auditing?

Risk assessment is a judgmental process of assigning monetary amounts to the perceived level of risk found in an activity being evaluated. These amounts allow a chief audit executive to select the engagement clients most likely to result in identifiable savings.

While planning an engagement, an internal auditor establishes engagement objectives to describe what is to be accomplished. Which of the following is a key issue to consider in developing engagement objectives?

Risks associated with the activities to be reviewed.

If an engagement client's operating standards are vague and thus subject to interpretation, the internal auditor must

Seek agreement with management as to the criteria to be used to measure operating performance.

An engagement objective is to determine if a company's accounts payable contain all outstanding liabilities. Which of the following audit procedures would not be relevant for this objective?

Select a sample of accounts payable from the accounts payable listing and verify the supporting receiving reports, purchase orders, and invoices.

An engagement objective is to determine whether an organization's liabilities for accounts payable are complete. Which audit procedure is not relevant to this objective?

Select a sample of accounts payable transactions from the accounts payable listing dated near the end of the current period and the beginning of the following period.

Shipments are made from the warehouse based on customer purchase orders. The matched shipping documents and purchase orders are then forwarded to the billing department for sales invoice preparation. The shipping documents are neither accounted for nor prenumbered. Which of the following substantive tests should be extended as a result of this control weakness?

Select bills of lading from the warehouse and trace the shipments to the related sales invoices.

Which group is charged with overseeing the establishment, administration, and evaluation of the processes of risk management and control?

Senior management.

Management has just implemented a policy that every department must downsize by immediately cutting 10% of each department's staff and budget. The chief audit executive has reacted to the organization's recent plans for "downsizing" (reducing the size of staff across the board) by notifying the internal audit managers that the time allocated for all jobs must be cut by 10%. Which of the following statements regarding the CAE's action and potential internal audit manager's action is true?

The CAE should have re-prioritized risks and eliminated specific engagements rather than cutting 10% across the board.

Which of the following features of a large manufacturer's organizational structure is a control weakness?

The audit committee of the board consists of the chief executive officer, the chief financial officer, and a major shareholder.

Which of the following statements is true regarding coordination of internal and external auditing efforts?

The chief audit executive should determine that appropriate follow-up and corrective action was taken by management when required regarding matters discussed in the external auditor's management letter.

The internal audit activity's audit plan is based on all of the following except

The cost of the engagement.

Which of the following is an effective tool for uncovering unethical or illegal activity in an organization?

The ethics questionnaire.

In an assurance engagement of treasury operations, an internal auditor is required to consider all of the following issues except

The external auditors have indicated some difficulties in obtaining account confirmations

The previous year's audited financial statements had higher debt-to-equity than was expected. In their work on this year's interim financial statements, internal auditors are most likely to emphasize

Whether payables were accrued properly at the end of the interim period.