[Unit 2] Study Unit 1

Which of the following potentially is (are) subject to the internal auditors' evaluations? 1. The human resources function. 2. The purchasing process. 3. The manufacturing and production database system. - None of the answers are correct. - 2 only. - 1, 2, and 3. - 1 only.

1, 2, and 3. (Internal auditing is an organizationally independent and individually objective assurance and consulting activity that adds value and improves operations. It evaluates and contributes to the improvement of the organization's governance, risk management, and control processes. When performing the assurance function, internal auditing evaluates the adequacy and effectiveness of controls. For example, it evaluates the effectiveness and efficiency of operations and programs.)

Which of the following are responsibilities of the chief audit executive (CAE)? 1. Coordinating activities with other providers of assurance and consulting services. 2. Understanding the work of external auditors. 3. Providing sufficient information to the external auditors to permit them to understand the internal auditors' work. - 1 and 2 only - 1, 2, and 3 - 2 and 3 only - 1 and 3 only

1, 2, and 3. (Organizations may use the work of external auditors to provide assurance related to activities within the scope of internal auditing. In these cases, the CAE takes the steps necessary to understand the work performed by the external auditors. Moreover, the external auditor may rely on the work of the internal audit activity in performing their work. In this case, the CAE needs to provide sufficient information to enable external auditors to understand the internal auditor's techniques, methods, and terminology to facilitate reliance by external auditors on work performed.)

Staff members of the internal audit activity should be assigned to engagements and training projects that will enable them to develop their potential. Which of the following should be the most important consideration in making assignments that will allow staff members to develop properly? - Specific training requirements imposed by the Standards. - The skills and experience levels of individual auditors. - Special interests of individual staff members. - The importance of giving all staff members extensive supervisory experience.

The skills and experience levels of individual auditors. (The program for selecting and developing the human resources of the internal audit activity should provide for written job descriptions for each level of the staff, selection of qualified and competent individuals, training and continuing educational opportunities, performance appraisals at least annually, and counsel on performance and professional development. Obviously, work assignments inconsistent with an internal auditor's abilities will defeat the purposes of human resource development.)

According to the International Professional Practices Framework, internal audit resources are effectively deployed when - There are more opportunities to achieve operating benefits for the engagement client. - The internal audit staff has the necessary attributes for the planned activities. - The resources needed to accomplish the plan are adequate. - They are used in a way that optimized the achievement of the approved plan.

They are used in a way that optimizes the achievement of the approved plan. (According to the Interpretation of Standard 2030, "Resources are effectively deployed when they are used in a way that optimizes the achievement of the approved plan." The CAE is primarily responsible for the sufficiency and management of resources, including communication of needs and status to senior management and the board. Resources are effectively deployed by assigning qualified auditors and developing an appropriate resourcing approach and organizational structure.)

The internal audit activity (IAA) is effectively managed when - Senior management creates its operating budget. - The board establishes policies and procedures for the IAA. - Trends and emerging issues are considered. - The organization's human resources department hires the IAA's associates.

Trends and emerging issues are considered. (The IAA is effectively managed when (1) it achieves the purpose and responsibility included in the internal audit charter, (2) it conforms with the Standards, (3) its individual members conform with the Code of Ethics and the Standards, and (4) it considers trends and emerging issues that could affect the organization (Inter. Std. 2000).)

To improve their efficiency, internal auditors may rely upon the work of external auditors if it is - Conducted in accordance with the Code of Ethics. - Coordinated with internal auditing work. - Primarily concerned with operational objectives and activities. - Performed after the internal auditing work.

Coordinated with internal auditing work. (Organizations may use the work of external auditors to provide assurance related to activities within the scope of internal auditing. Coordination of internal and external audit work is the responsibility of the CAE (Perf. Std. 2050).)

The advantage attributed to the establishment of internal auditing field offices for work at foreign locations is best described as - The possibility of increased objectivity of personnel assigned to a field office. - A reduction of travel time and related travel expense. - More contract with senior personnel leading to an increase in control. - The increased ease of maintaining uniform organization-wide standards.

A reduction of travel time and related travel expense. (The advantage of field offices compared with sending internal auditors from the home office include (1) reduced travel time and expense, (2) improved service in the operating location served by the field offices, (3) better morale of internal auditors as a result of increased authority, and (4) the possibility of employing persons who do not wish to travel.)

The key factor in the success of an internal audit activity's human resources program is - A well-developed set of selection criteria. - A compensation plan based on years of experience. - An informal program for developing and counseling staff. - A program for recognizing the special interests of individual staff members.

A well-developed set of selection criteria. (Internal auditors should be qualified and competent. Because the selection of a superior staff is dependent on the ability to evaluate applicants, selection criteria must be well-developed. Appropriate questions and forms should be prepared in advance to evaluate, among other things, the applicant's technical qualifications, educational background, personal appearance, ability to communicate, maturity, persuasiveness, self-confidence, intelligence, motivation, and potential to contribute to the organization.)

Use of external service providers with expertise in healthcare benefits is appropriate when the internal audit activity is - Training its staff to conduct an audit of healthcare costs in a major division of the organization. - Comparing the cost of the organization's healthcare program with other programs offered in the industry. - Evaluating the organization's estimate of its liability for postretirement benefits, which include healthcare benefits. - All of the answers are correct.

All of the answers are correct. (The competencies of the internal audit staff should be appropriate for the planned activities. Thus, the chief audit executive addresses resourcing needs, including whether those skills are present. Other ways to meet needs include external service providers, specialized consultants, or other employees of the organization. Thus, external service providers may provide assistance in (1) estimating the liability for postretirement benefits, (2) developing a comparative analysis of healthcare costs, and (3) training the staff to audit healthcare costs.)

In managing internal audit resources, the CAE considers all of the following except - Staff evaluation and development. - Succession planning. - Resourcing needs. - Benchmarking.

Benchmarking. (Benchmarking is a continuous evaluation of the practices of the best organizations in their class and the adaption of processes to reflect the best of these practices. It is not used in managing internal audit resources. In managing internal audit resources, the CAE considers succession planning, staff evaluation and development, and other human resource disciplines. The CAE also addresses resourcing needs, including whether those skills are present in the internal audit staff.)

If a department outside of the internal audit activity is responsible for reviewing a function of process, the internal auditors should - Consider the work of the other department when assessing the function or process. - Ignore the work of the other department and proceed with an independent audit. - Yield the responsibility for assessing the function or process to the other department. - Reduce the scope of the audit since the work has already been performed by the other department.

Consider the work of the other department when assessing the function or process. (The chief audit executive should share information and coordinate activities with other internal and external providers of relevant assurance and consulting services to ensure proper coverage and minimize duplication of efforts (Perf. Std. 2050). This standard applies not only to external auditors but also to other "providers," such as regulatory bodies (e.g., governmental auditors) and certain of the organization's other subunits (e.g., a health and safety department). Review and testing of the other department's work may reduce necessary audit coverage of the function or process.)

The internal audit activity has recently experienced the departure of two internal auditors who cannot be immediately replaced due to budget constraints. Which of. the following is the least desirable option for efficiently completing future engagements, given this reduction in resources? - Eliminating consulting engagements from the engagement work schedule. - Using self-assessment questionnaires to address audit objectives. - Filling vacancies with personnel from operating departments that are not being audited. - Employing information technology in audit planning, sampling, and documentation.

Eliminating consulting engagements from the engagement work schedule. (The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan (Perf. Std. 2030). The audit schedule is reduced as a last resort once all other alternatives have been explored, including the request for additional resources.)

The IIA's Three Lines Model states that the roles of an organization's governing body most likely include - Ensuring that organizational objectives align with stakeholders' interest. - Delivering products to clients. - Providing assurance and advice that instills confidence and clarity. - Assisting with risk management.

Ensuring that organizational objectives align with stakeholders' interests. (Governing body roles include (1) ensuring structures and processes exist for effective governance; (2) ensuring objectives and activities align with stakeholder interests; (3) giving management the responsibility and resources to achieve objectives and compliance with laws, regulations, and ethics; and (4) establishing and overseeing the internal audit function.)

After using the same public accounting firm for several years, the board of directors retained another public accounting firm to perform the annual financial audit in order to reduce the annual audit fee. The new firm has now proposed a one-time engagement relating to the cost-effectiveness of the various operations of the business. The chief audit executive has been asked to advise management in making a decision on the proposal. An argument can be made that the internal audit activity is better able t perform such an engagement because - Engagement procedures used by internal auditors are different from those used by external auditors. - External auditors may not possess the same depth of understanding of the organization as the internal auditors. - Internal auditors will not be vitally concerned with fraud and waste. - Internal auditors are required to be objective in performing engagements.

External auditors may not possess the same depth of understanding of the organization as the internal auditors. (Internal auditing evaluates and contributes to the improvement of the organization's governance, risk management, and control processes. Accordingly, its scope of work is far broader than that of the external auditors.)

What is the most accurate term for the procedures used by the board to oversee activities performed to achieve organizational objectives? - Governance. - Risk management. - Control. - Monitoring.

Governance (Governance is the "combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives" (The IIA Glossary).)

Several members of an organization's senior management have questioned whether the internal audit activity should report to the newly established quality audit function as part of the total quality management process within the organization. The chief audit executive (CAE) has reviewed the quality audit standards and the programs that the quality audit manager has proposed. The CAE's response to senior management should include which of the following? - Changing the applicable standards for internal auditing within the organization to provide compliance with quality audit standards. - Changing the qualification requirements for new staff members to include quality audit experience. - Estimating departmental cost savings that would result from the elimination of the internal audit activity. - Identifying appropriate liaison activities with the quality audit function to ensure coordination of audit schedules and overall audit responsibilities.

Identifying appropriate liaison activities with the quality audit function to ensure coordination of audit schedules and overall audit responsibilities. (The CAE should share information, coordinate activities, and consider relying upon the work of other internal and external assurance and consulting providers to ensure proper coverage and minimize duplication of efforts (Perf. Std. 2050). The quality audit function is an internal assurance and consulting provider. Thus, whether reporting administratively to the quality audit function or to senior management, the CAE should identify appropriate liaison activities with the quality audit function to ensure coordination of audit schedules and overall audit responsibilities.)

In addressing internal audit resource needs for a complex engagement, the CAE may include all of the following except - Specialized consultants. - Members of the audit committee. - Other employees of the organization. - External service providers.

Members of the audit committee. (Resources must be effectively deployed by assigning qualified auditors and developing an appropriate resourcing approach and organizational structure. Additionally, resources need to be sufficient for audit activities to be performed in accordance with the expectations of senior management and the board. Members of the audit committee may not be employees of the organization except in their capacity as a board member. Therefore, an audit committee member should not be included in addressing internal audit resource needs. The CAE may meet these needs through external service providers, specialized consultants, or other employees of the organization.)

According to the International Professional Practices Framework, the internal audit activity is effectively managed when - It has the skill set and knowledge to help the organization achieve its objectives. - its individual members conform with the Code of Ethics and the Standards. - Policies and responsbililities of the internal audit activity are included in the organization's operations. - Management oversees the day-to-day operations of the internal audit activity.

Its individual members conform with the Code of Ethics and the Standards. (According to the Interpretation of Standard 2000, the internal audit activity is effectively managed when - It achieves the purpose and responsibility included in the internal audit charter. - It conforms with the Standards. - Its individual members conform with the Code of Ethics and the Standards. - It considers trends and emerging issues that could impact the organization. The internal audit activity adds value to the organization and its stakeholders when it considers strategies, objectives, and risks; strives to offer ways to enhance governance, risk management, and control processes; and objectively provides relevant assurance.)

Although all the current members of an internal audit activity have good records of performance, the manager is not sure if any of the members are ready to assume a management role. Which of the following is an advantage of bringing in an outsider rather than promoting from within? - Bringing in an outsider is a less expensive alternative than promoting from within. - The "modeling" effect is strengthened by bringing in a new role model. - Management training costs are reduced when a qualified outsider is hired. - The manager can be sure that the new position will be filled by a competent employee.

Management training costs are reduced when a qualified outsider is hired. (Hiring an experienced manager reduces management training costs because the person has already been trained.)

You are the chief audit executive of a parent organization that has foreign subsidiaries. Independent external audits performed for the parent are not conducted by the same firm that conducts the foreign subsidiary audits. Because the internal audit activity occasionally provides direct assistance to both external firms, you have copies of audit programs and selected working papers produced by each firm. The foreign subsidiary's auditors would like to rely on some of the work performed by the parent organization's audit firm, but they need to review the working papers first. They have asked you for copies of the working papers of the parent organization's audit firm. What is the most appropriate response to the foreign subsidiary's auditors? - Provide copies of the working papers and notify the parent's audit firm that you have done so. - Provide copies of the working papers without notifying the parent's audit firm. - Refuse to provide the working papers under any circumstances. - Notify the parent's auditors of the situation and request that they either provide the working papers or authorized you to do so.

Notify the parent's auditors of the situation and request that they either provide the working papers or authorize you to do so. (Organizations may use the work of external auditors to provide assurance related to activities within the scope of internal auditing. In these cases, the CAE takes the steps necessary to understand the work performed by the external auditors, including access to the external auditors' programs and working papers. Internal auditors are responsible for respecting the confidentiality of those programs and working papers.)

In selecting an instructional strategy for developing internal audit staff, a chief audit executive begins be reviewing - Learning content. - Organizational objectives. - Learners' readiness. - Budget constraints

Organizational objectives. (The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan (Perf. Std. 2030). The approved plan must be consistent with the goals of the organization.)

The chief audit executive (CAE) is best defined as the - Person responsible for overseeing the contract with the outside provider of internal audit services. - Outside provider of internal audit services. - Person responsible for the internal audit functions. - Inspector general

Person responsible for the internal audit function. (The CAE is a person in a senior position responsible for effectively managing the internal audit activity (IAA) in accordance with the internal audit charter and the mandatory elements of the IPPF (The IIA Glossary). The CAE must effectively manage the IAA to ensure it adds value to the organization (Inter. Std. 2000).)

Which of the following is most essential for guiding the internal audit staff? - Position descriptions. - Performance appraisals. - Quality program assessments. - Policies and Procedures.

Policies and Procedures. (The chief audit executive must establish policies and procedures to guide the internal audit activity.)

You are the chief audit executive of a parent organization that has foreign subsidiaries. Independent external audits performed for the parent are not conducted by the same firm that conducts the foreign subsidiary audits. Because the internal audit activity occasionally provides direct assistance to both external firms, you have copies of audit programs and selected working papers produced by each firm. The foreign subsidiary's external audit firm wants to rely on an audit of a function at the parent organization. The audit was conducted by the internal audit activity. To place reliance on the work performed, the foreign subsidiary's auditors have requested copies of the working papers. What is the most appropriate response to the foreign subsidiary's auditors? - Provide copies of the working papers. - Ask the board for permission to release the working papers. - Refuse to provide the working papers under any circumstances. - Ask the parent's audit firm if it is appropriate to release the working papers.

Provide copies of the working papers. (Coordination involves access to each other's work programs, working papers, and reports (IG 2050). Access is provided to external auditors for them to be satisfied as to the acceptability, for external audit purposes, of relying on the internal auditors' work.)

The chief audit executive for a large decentralized organization has developed a manual containing comprehensive detailed written procedures as a guide for the decentralized engagement work groups, each of which has 20 to 30 internal auditors. The organization recently acquired a small organization that has an internal audit activity consisting of a supervisor and two staff personnel. Which of the following actions is the most practical in providing administrative guidance for this new internal audit activity? - Use the already developed manual. - Adopt the administrative procedures being followed by the internal auditors of the acquired organization. - Use informal supervisory direction for engagement management issues. - Select key procedures from the manual and use informal supervisory direction for other engagement management issues.

Select key procedures from the manual and use informal supervisory direction for other engagement management issues. (Orientation to acquaint the acquired organization's staff with the established environment should be through exposure to selected key procedures from the formal manual. The form and content of policies and procedures are dependent upon the size and structure of the internal audit activity and the complexity of its work (Inter. Std. 2040). Thus, a small internal audit activity may be managed informally, for example, through daily close supervision and written memoranda.)

All of the following are true regarding the process and methods of coordinating assurance activities except - The formality of assurance activity coordination may vary with the size of the entity and any regulatory requirements. - Sharing results with other providers violates the coordinating services agreement. - Assurance mapping connects significant risk categories and sources of assurance. - In the combined assurance model, the internal audit activity coordinates with compliance activities.

Sharing results with other providers violates the coordinating services agreement. (The CAE should share information, coordinate activities, and consider relying upon the work of other internal and external assurance and consulting service providers to ensure proper coverage and minimize duplication of efforts (Perf. Std. 2050). Coordinating activities include (1) simultaneity of the nature, extent and timing of scheduled work; (2) mutual understanding of methods and vocabulary; (3) the parties' access to each other's programs, workpapers, and communications of results; (4) reliance on others' work to avoid overlap; and (5) meeting to adjust the timing of scheduled work given results to date.)

Which of the following statements most accurately reflects the chief audit executive's responsibilities for internal audit resources? - The CAE is responsible for evaluating the detailed summary of audit resources presented by management to the board. - The CAE is responsible for communicating resource needs to the board but has no explicit responsibility for administering the organization's compensation program. - The CAE is responsible for ensuring that audit coverage is based on the periodic skills assessment. - The CAE is not responsible for such human resource functions as evaluation and development.

The CAE is responsible for communicating resource needs to the board but has no explicit responsibility for administering the organization's compensation program. ( The CAE must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan. This includes the effective communication of resource needs and reporting of status to senior management and the board. Responsibility for administering the organization's compensation program normally resides in the human resources (personnel) area.)

Which of the following statements about the chief audit executive's responsibilities for internal audit resources is most accurate? - The CAE is responsible for ensuring that audit coverage is based on the skills of the internal audit activity. - The CAE is responsible for presenting a detailed summary of audit resources to management. - The CAE is responsible for the effective deployment of resources to achieve the approved audit plan. - The CAE is responsible for administering the organization's compensation program.

The CAE is responsible for the effective deployment of resources to achieve the approved audit plan. (The CAE must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved audit plan. This responsibility includes the effective communication of resource needs and reporting of status to senior management and the board.)

Which of the following statements is true regarding coordination of internal and external auditing efforts? - The chief audit executive should determine that appropriate follow-up and corrective action was taken by management when required regarding matters discussed in the external auditor's management letter. - If internal auditors provide assistance to the external auditors in connection with the annual audit, such assistance is not subject to the Standards. - Ownership and the confidentiality of the external auditor's working papers prohibit their review by internal auditors. - The chief audit executive should not give information about illegal acts to an external auditor because external auditors may be required to report the matter to the board or regulatory agencies.

The chief audit executive should determine that appropriate follow-up and corrective action was taken by management when required regarding matters discussed in the external auditor's management letter. (Internal auditors need access to the external auditors' presentation materials and management letters. Matters discussed in presentation materials and included in management letters need to be understood by the CAE and used as input to internal auditors in planning the areas to emphasize in future internal audit work. After review of management letters and initiation of any needed corrective action by appropriate members of senior management and the board, the CAE should ensure that appropriate follow-up and corrective actions have been taken.)

Internal audit resources should be appropriate, sufficient, and effectively deployed. Consequently - Resource planning should be limited to expected activites. - The chief audit executive should perform a periodic skills assessment. - Only members of the internal audit staff should perform internal audit activities. - The chief audit executive ultimately must ensure the adequacy of resources.

The chief audit executive should perform a periodic skills assessment. (The skills, technical knowledge, and capabilities of the internal audit staff should be appropriate for the planned work. Thus, the chief audit executive should perform a periodic skills assessment based on the needs identified in the risk assessment and the audit plan.)

Which of the following statements regarding the external auditor is true? - Review of the external auditor's internal control and audit reports during each engagement is done by a different accounting firm. - The external auditor's work is overseen and reviewed by the audit committee. - Disputes between the external auditor and management are resolved through an arbitrator. - Negotiation of the external auditor's fee is the responsibility of the corporate officers.

The external auditor's work is overseen and reviewed by the audit committee. (The most important function of the audit committee is to promote the independence of the internal and external auditors by protecting them from the management's influence. The audit committee (1) selects the external auditing firm and negotiates its fee, (2) oversees and reviews the work of the external auditor, (3) resolves disputes between the external auditor and management and (4) reviews the external auditor's internal control and audit reports.)

Which of the following is not an appropriate member of an audit committee? - The organization's vice president of operations. - An academic specializing in business administration. - The vice president of the local bank used by the organization. - A retired executive of a firm that had been associated with the organization.

The organization's vice president of operations. (The audit committee consists of outside directors who are independent of management. Its purpose is to help keep external and internal auditors independent of management and to assure that the directors are exercising due care. The organization's vice president is not an outside director. The vice president of the local bank used by the organization, an academic specializing in business administration, and a retired executive of a firm that had been associated with the organization are all external parties who are usually independent of the organization's internal operations.)

Numerous environmental laws and regulations have recently changed. Senior management has asked the chief audit executive to perform an environmental audit to be completed as soon as possible. The internal audit activity currently is performing an operational audit. As a result, the chief audit executive must make difficult decisions about resource allocation. Which of the following is the least significant issue in determining whether to reallocate audit resources? - The potential fraud discovered during the operational audit. - The knowledge, skills, and competencies of the internal audit staff. - The results from the prior financial audits. - Potential cost to the organization for noncompliance with the new environmental laws and regulations.

The results from the prior financial audits. (When determining resource allocation under time constraints, the auditor must consider all relevant factors. Relevant factors include (1) information about both the ongoing and new engagement; (2) the consequences of not completing either engagement in a timely manner, and (3) the knowledge, skills, and competencies of the internal audit staff. Information about other unrelated engagements, such as prior financial audits, is irrelevant.)

When are governance, risk management, and control processes considered adequate? - When management has planned and designed them to provide reasonable assurance of achieving the organization's objectives efficiently and economically. - When the internal audit activity has planned and designed them to provide reasonable assurance of achieving the organization's objectives efficiently and economically. - When management has planned and designed them to provide absolute assurance of achieving the organization's objectives efficiently and economically. - When the company is profitable.

When management has planned and designed them to provide reasonable assurance of achieving the organization's objectives efficiently and economically. (Governance, risk management, and control processes are adequate if management has planned and designed the processes to provide reasonable assurance of achieving the organization's objectives efficiently and economically. Reasonable assurance is provided if the most cost-effective measures are taken in the design and implementation of controls to reduce risks and restrict expected deviations to a tolerable level. Efficient performance accomplished objectives in an accurate, timely, and economical fashion while economical performance accomplishes objective with minimal use of resources (i.e., cost) proportionate to the risk exposure.)