Which of the following procedures would provide the best evidence of the effectiveness of a credit-granting function?
A. Observe the process.
B. Review the trend in receivables write-offs.
C. Ask the credit manager about the effectiveness of the function.
D. Check for evidence of credit approval on a sample of customer orders.
An internal auditor is reviewing a new automated human resources system. The system contains a table of pay rates which are matched to the employee job classifications. The best control to ensure that the table is updated correctly for only valid pay changes would be to:
A. Limit access to the data table to management and line supervisors who have the authority to determine pay rates.
B. Require a supervisor in the department, who does not have the ability to change the table, to compare the changes to a signed management authorization.
C. Ensure that adequate edit and reasonableness checks are built into the automated system.
D. Require that all pay changes be signed by the employee to verify that the change goes to a bona fide employee.
Which of the following would not be an appropriate step for an internal auditor to perform during an assessment of compliance with an organization's privacy policy?
A. Determine who can access databases containing confidential information.
B. Evaluate the organization's privacy policy to determine if appropriate information is covered.
C. Analyze access to permanent files and reports containing confidential information.
D. Evaluate the government's security measures related to confidential information received from the organization.
The chief audit executive (CAE) decided that based on management's oral response, the action taken on an audit observation for a minor improvement in the client's process is sufficient and no further follow-up is
necessary. Which of the following would be the best statement regarding the action of the CAE?
A. The CAE action is not acceptable, as a follow-up audit is needed to ensure that action is really taken by management.
B. The CAE action is not acceptable, as follow-up on the issue is critical until a written response is obtained from management.
C. The CAE action is acceptable as long as the follow-up is sufficient when weighed against the relative importance of the recommendation.
D. The CAE action is acceptable as long as the issue has been escalated to the board to get their position on the issue.
Due to a recent system upgrade, an audit is planned to test the payroll process. Which of the following audit objectives would be most important to prevent fraud?
A. Verify that amounts are correct.
B. Verify that payments are on time.
C. Verify that recipients are valid employees.
D. Verify that benefits deductions are accurate.
An organization is expanding into a new line of business, selling natural gas. The internal auditor is planning an engagement and wants to obtain a general understanding of the natural gas market, the market share that the organization wants to win, and the competitive advantage that the organization may have. Which of the following would be the best source of such information?
A. Interview responsible managers and read strategic documents.
B. Conduct internet searches on gas sales and analyze market players.
C. Review gas clients' portfolio and compile statistics on sales margins.
D. Analyze the organization's revenues and calculate the proportion of gas.
Some time after the final audit report was issued, the engagement supervisor learned that several internal control deficiencies were not remedied, despite management's previous agreement to remedy them. According to IIA guidance, which of the following is the most appropriate response?
A. The engagement supervisor must notify the chief audit executive (CAE) that the deficiencies have not been rectified.
B. The engagement supervisor should rely on professional judgment as to whether the CAE should be informed, or the management action plan should be adjusted.
C. The engagement supervisor should rely on his negotiation skills and issue an ultimatum to management to remedy the control deficiencies.
D. Ensure that these deficiencies are captured in the documentation as high-priority areas to be reviewed during the next audit.
Which of the following would present the most critical external risk to an organization?
A. The organization experiences a merger, and the management team is reorganized and redistributed globally.
B. The organization launches a product into new global markets.
C. After minimal testing, the organization implements a new system to replace a legacy system.
D. Regulators announce broad legislative reforms applicable to the industry within which the organization operates.
According to IIA guidance, which of the following statements regarding audit workpapers is true?
A. Audit reports should include the workpapers as a reference for the audit conclusions.
B. The internal auditor's workpapers are the primary reference for reported control deficiencies.
C. Ad-hoc communications with management of the area under review should be excluded from the workpapers.
D. Both draft and final versions of workpapers should be saved at the end of the engagement.
A chief audit executive's report to the board showed a significant trend of recent audits going over planned budgeted hours. Which of the following factors could cause this trend?
A. Poor engagement supervision.
B. Ineffective board reporting.
C. Untimely observation follow up and closure.
D. Limited staff resources.
