Ch5. Business Processes and Risks

A. Developing audit programs.

1. Which of the following activities is not included in determining the master audit schedule? A. Developing audit programs. B. Understanding the firm's business model. C. Defining audit priorities. D. Reviewing risk profiles.

A. Process understanding, assessed risk, and audit objectives.

10. The purpose of the preliminary survey is to document which of the following A. Process understanding, assessed risk, and audit objectives. B. Process understanding, assessed risk, and control effectiveness. C. Assessed risk and achievement of management objectives. D. Assessed risk, control effectiveness, and achievement of management objectives.

C. Audit expertise of one of the functions is presently available.

2. In deciding whether to include the payroll function or the HR function in the annual audit plan, which of the following would be the least important factor? A. Variability in the operations of one of the functions. B. Expressed senior management concerns about one of the functions. C. Audit expertise of one of the functions is presently available. D. Elapsed time since an internal audit of one of the functions.

C. Monthly budgeting process will be established to preclude operational surprises on new development program.

3. The CAE has learned of several high-level strategies to consider in developing the master audit schedule. Which of the following would not represent a strategic issue for this purpose? A. Joint venture candidates will be sought to improve sales/marketing overseas. B. Centralized personnel and payroll system will be implemented to lower overhead costs and to support consistent HR administration. C. Monthly budgeting process will be established to preclude operational surprises on new development program. D. Manufacturing of certain product lines will be moved to right-to-work states to avoid labor strikes.

C. Audit committee agendas.

4. The first phase of an annual audit risk assessment is to determine the audit universe and its auditable activities or units? Which of the following would normally not be considered an auditable activity? A. Financial statement disclosures. B. Pension trust funds. C. Audit committee agendas. D. Construction contract management.

B. II only.

5. Which of the following represent appropriate internal audit actions in response to its annual audit risk assessment process? I. Delegate lower priority risks to external auditor or to entity compliance groups. II. Integrate auditable units into annual audit plan based on risk. III. Keep audit plan and schedule as is throughout the year. A. I only. B. II only. C. II and III only. D. III only.

B. Using subjective group consensus to finalize the risk assessment is valid.

6. The CAE proposes to simplify the annual risk assessment of auditable processes within a business unit using a heat map. Selected risk factors include dollar materiality, variability, prior audit findings, management concerns and cycle time, each factor to be weighted evenly. The CAE brainstormed risk with internal audit managers and process leaders, reaching consensus on risk ratings using a scale of "high, medium, or low" for impact and "probable, possible and remote" for likelihood. Which of the following statements is true for this risk assessment process? A. The risk assessment is invalid because it mixes quantitative and qualitative factors. B. Using subjective group consensus to finalize the risk assessment is valid. C. Including process leaders in the risk assessment process renders the result invalid. D. The weighting is subjective and should have been based on a quantitative methodology.

D. Control effectiveness.

7. In planning an audit, a properly performed preliminary audit survey would support the identification of all the following, except A. Performance criteria. B. Risk exposures. C. Audit priorities. D. Control effectiveness.

C. Develop the audit program.

8. An internal auditor has completed a preliminary audit survey to become familiar with the Quality Control department, a relatively high risk function based on the master audit schedule. Which of the following should be performed next? A. Assign internal audit staff to project. B. Establish final audit objectives. C. Develop the audit program. D. Conduct audit fieldwork.

C. Preliminary survey.

9. During which phase of the audit process are inquiries and observations predominant audit techniques? A. Audit program preparation. B. Fieldwork. C. Preliminary survey. D. Follow-up.

A. Focusing on process effectiveness.

According to IIA Standard 2010, the Chief Audit Executive must perform all of the following when preparing a master audit plan and schedule except for: A. Focusing on process effectiveness. B. Documenting assessed risk. C. Adjusting the plan based on changed circumstances. D. Considering the risk appetite.

B. Audits of processes on the which the entity is most reliant. NOTE: C is wrong b/c of the large differential between inherent risk and residual risk

According to IIA Standard 2010-2, which of the following will the master audit plan normally include? A. Audit sampling plans to test internal controls. B. Audits of processes on the which the entity is most reliant. C. Audits of processes that show large differential between inherent risk and control risk. D. Standard audit programs with which to use in executing the audit.

B. Assessed risk that is fully documented.

According to IIA Standard 2210, the internal auditor must establish the final objectives for each audit engagement based on A. Elapsed time since the last audit of the subject. B. Assessed risk that is fully documented. C. Available audit resources for the project. D. Time constraints limiting the audit work to be performed.

D. Strategic initiatives and priorities.

Audit inquiries in annual audit planning address all of the following subjects of a process except: A. Key performance indicators. B. Flows of activities and documents. C. Process objectives and initiatives. D. Strategic initiatives and priorities.

C. Inherent and residual risk of key processes.

IIA Standard 2010 requires a risk-based master audit plan that focuses on: A. All areas of high risk. B. Results of brainstorming sessions between internal audit and senior management. C. Inherent and residual risk of key processes. D. Alignment of risk to ERM components.

B. Scope, timing, resources to be assigned, and risks to be addressed.

It is standard audit practice for the CAE to include in the master audit plan/schedule the initial audit objectives for each planned audit project, along with which of the following additional factors? A. Scope, timing, constraints on the audit work to be performed, resources to be assigned, and risks to be addressed. B. Scope, timing, resources to be assigned, and risks to be addressed. C. Scope, timing, constraints on the audit work to be performed, specific auditors to be assigned, and risks/controls to be addressed. D. Scope, timing, constraints on the audit work to be performed, resource limitations, and risk/controls to be addressed.

A. An audit sampling plan for tests of controls.

Standard work products from a preliminary survey would include which of the following? A. An audit sampling plan for tests of controls. B. Design effectiveness of the ICS. C. Initial audit objectives. D. Re-performance of controls for effectiveness.

A. Create or reconfirm the audit universe.

The first step in the annual audit planning process is to A. Create or reconfirm the audit universe. B. Gain an understanding of key processes. C. Confirm key performance indicators. D. Determine the strategic objectives of the BOD/senior management.

C. Identifies key processes based on strategic objectives and corresponding risk.

The top-down approach to audit planning A. Identifies key processes at the activity level. B. Identifies key processes based on the risks at a specific location. C. Identifies key processes based on strategic objectives and corresponding risk. D. Identifies key processes based on all considerations of risk.

B. Understand the company's business model.

To ensure a competent master audit plan and schedule, the internal audit organization must A. Understand all company processes and functions. B. Understand the company's business model. C. Develop the final audit objectives for all planned projects. D. Develop an audit cycle-time for key processes and functions.

C. Use of a heat map to prioritize audit risks.

Which audit procedure is performed or audit technique is used in the preliminary survey phase of an engagement? A. Audit sampling of controls. B. Reviews of the design effectiveness of the ICS. C. Use of a heat map to prioritize audit risks. D. Resolution of senior management acceptance of risk.

D. To resolve process issues for management (all they can do is direct management attention to problem areas in organization).

Which of the following is not a function of key performance indicators? A. To show whether a process is working as intended. B. To serve as a measure of accomplishment. C. To form a basis for audit planning inquiries. D. To resolve process issues for management

D. Proposed audits of organizational segments based on risk considerations.

Which of the following is the primary purpose of the master audit plan and schedule? A. Propose audits of organizational segments whose objectives and risks lack assurance. B. Propose audits of organizational segments based on senior management expectations. C. Proposed audits of organizational segments based on cycle-time considerations. D. Proposed audits of organizational segments based on risk considerations.