Prelim Review

Part 2 (3-Part) : 08/17/23 19:45:12
Question 1 - CIA 598 1.49 - Types of Engagements
A determination of cost savings is most likely to be an objective of
A. Program audits.
B. Financial audits.
C. Compliance audits.
D. Operational audits.
A. Program audits address accomplishment of program objectives.
B. Financial auditing addresses accuracy of financial records.
C. Compliance auditing addresses compliance with requirements, including legal and regulatory requirements.
D. Operational auditing is most likely to address a determination of cost savings by focusing on economy
and efficiency.
Question 2 - CIA 588 II.20 - Planning
An engagement work schedule for the internal audit activity (IAA) is an essential part of
A. Establishing standards for employee performance.

B. Scheduling support for the external audit.
C. Providing senior management with information about the quality of the internal audit activity's performance.
D. Planning for the internal audit activity.
A. Management sets establishing standards for employee performance.
B. The engagement work schedule is not an essential part to support the external audit.
C. The activity report would provide better information on the quality of the IAA's performance, not the engagement
work schedule.
D. The planning process involves establishing goals, engagement work schedules, staffing plans and
financial budgets, and activity reports. Engagement work schedules should include what activities are to
be performed; when they will be performed; and the estimated time required, taking into account the scope
of the engagement work planned and the nature and extent of related work performed by others.
Question 3 - CIA 592 II.2 - Report to Senior Management & Board
To avoid being the apparent cause of conflict between an organization's senior management and the audit
committee, the chief audit executive (CAE) should
A. Request board approval of policies that include internal audit activity relationships with the audit committee.
B. Communicate all engagement results to both senior management and the audit committee.
C. Discuss all reports to senior management with the audit committee first.
D. Strengthen the independence of the internal audit activity through organizational status.
A. The purpose, authority and responsibility of the internal audit activity should be defined in the charter.
The charter should establish the internal audit activity's position within the organization.
B. Communicating all engagement results to both senior management and the audit committee is not necessary
and would be inefficient.
C. The audit committee provides an oversight role, not an operational.
(c) HOCK international, page 1

Part 2 (3-Part) : 08/17/23 19:45:12
D. Strengthening the independence of the internal audit activity would not necessarily eliminate a conflict between
senior management and audit committee.
Question 4 - CIA 1190 II.5 - Strategic Role of Internal Auditing
Coordination of internal and external auditing can reduce the overall costs. Who is responsible for actual
coordination of internal and external auditing efforts?
A. Management.
B. Chief Audit Executive.
C. The board.
D. External auditor.
A. Management is not responsible for coordinating internal and external auditing efforts.
B. The CAE should share information and coordinate activities with other internal and external provides of
relevant assurance and consulting services to ensure proper coverage and minimize duplication of efforts
(Standard 2050). Thus, proper coordination of internal and external auditing functions can help to reduce
costs.
C. The board has oversight authority, but is not directly responsible for coordinating internal and external auditing
efforts.
D. The external auditor is not responsible for coordinating internal and external auditing efforts.
Question 5 - CIA QZP2B.21 - Types of Engagements
An engagement objective is to determine if a company's accounts payable contain all outstanding liabilities. Which
of the following audit procedures would not be relevant for this objective?
A. Trace receiving reports issued before the period end to the related vendor invoices and accounts payable listing.
B. Examine supporting documentation of subsequent (after-period) cash disbursements and verify period of liability.
C. Send confirmations, including zero-balance accounts, to vendors with whom the company normally does
business.
D. Select a sample of accounts payable from the accounts payable listing and verify the supporting receiving
reports, purchase orders, and invoices.
A. This procedure would meet the objective because tracing receiving reports from before the end of the period to
invoices and the payables listing assures that liabilities for these shipments are included in the accounts payable.
B. This procedure would meet the objective by identifying payments for liabilities not included in the prior period, but
paid in the subsequent period.
C. This procedure would meet the objective by identifying amounts not included in accounts payable.
D. The primary credit risk for accounts payable is understatement of the liability. Thus, the auditor's
procedures must address the completeness assertion. However, vouching a sample of payables to
supporting documentation will not detect unrecorded liabilities.
The existence of audit risk is recognized by the statement in the auditor's report that the
A. Financial statements are presented fairly, in all material respects, in conformity with GAAP.

Part 2 (3-Part) : 08/17/23 19:45:12
B. Auditor obtains reasonable assurance about whether the financial statements are free of material misstatements.
C. Audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial
statements.
D. Auditor is responsible for expressing an opinion on the financial statements, which are the responsibility of
management.
A. This statement indicates that the auditor believes that the statements as whole are not materially misstated.
B. Audit risk is the risk that an auditor may give an unqualified opinion when, in fact, there is one or more
material misstatements in the area being audited. The auditor is only required to exercise due professional
care during the course of an audit. This means that the auditor can provide only reasonable, not absolute,
assurance that the financial statements are free of material misstatements.
C. This statement would be part of the scope paragraph of the auditor's report.
D. The introductory paragraph of the auditor's standard report states that the auditor is responsible for only
expressing an opinion on the financial statements.
Question 7 - CIA 594 I.55 - Planning
The term "risk" is best defined as the uncertainty that
A. Management will, either knowingly or unknowingly, make decisions that increase the potential liability of the
organization.
B. An internal auditor will fail to detect a material misstatement that causes financial statements or internal reports
to be misstated or misleading.
C. An event could occur affecting the achievement of objectives.
D. Financial statements or internal records will contain material misstatements.
A. Risk is not just limited to the potential increase in the organization's liability based on management's decision
making.
B. This is the definition of detection risk that is a component of risk.
C. Risk is the probability that some event will have an impact on the achievement of the organization's
objectives. Risk is measured in terms of impact and likelihood.
D. Risk is not just limited to the uncertainty that the financial statements or internal records will contain material
misstatements.
Question 8 - CIA QZP1B.19 - Report to Senior Management & Board
Today there is expected to be a high level of open and candid communication between the CAE and the audit
committee. Which of the following communication activities should the CAE provide to the audit committee?
I. Keep the audit committee informed of emerging trends and successful practices in internal auditing.
II. Issue periodic reports to the audit committee and management summarizing results of audit activities.
III. Review information submitted to the audit committee for completeness and accuracy.
IV. The safeguarding of assets.
A. I, II and III only.

B. I only.
C. I, II, III and IV.
D. II, III and IV only.

Part 2 (3-Part) : 08/17/23 19:45:12
A. If the CAE is to be viewed as a trusted advisor by the committee, communications is the key element.
The CAE should consider providing communications to the audit committee in the following areas,
including keeping the audit committee informed of emerging trends and successful practices in internal
auditing; issuing periodic reports to the audit committee and management summarizing results of audit
activities; and reviewing information submitted to the audit committee for completeness and accuracy.
B. The CAE should also issue periodic reports to the audit committee and management, and review information
submitted to the audit committee for completeness and accuracy.
C. Safeguarding of assets is management’s responsibility, not the CAE’s or audit committees.
D. Safeguarding of assets is management’s responsibility, not the CAE’s or audit committees.
Question 9 - CIA 591 II.9 - Managing Resources
Which of the following statements most accurately reflects the chief audit executive's responsibilities for human
resources management and development?
A. The CAE is responsible for selecting qualified individuals but has no explicit responsibility for providing ongoing
educational opportunities for the internal auditor.
B. The CAE is responsible for performing an annual review of each internal auditor's performance but has no
explicit responsibility for counseling internal auditors on their performance and professional development.
C. The CAE is responsible for selecting qualified individuals but has no explicit responsibility for the preparation of
job descriptions.
D. The CAE is responsible for developing formal job descriptions for the staff but has no explicit responsibility for
administering the organization's compensation program.
A. The CAE would also be responsible for providing ongoing educational opportunities for the internal auditors.
B. The CAE would be responsible for performing the annual review, and should be also responsible for counseling
internal auditors on their performance and professional development.
C. The CAE would also be responsible for preparing the job (position) description.
D. The CAE would be responsible for developing formal job descriptions for the staff, but the
responsibility for administering the compensation program would reside with the human resource
department.
Question 10 - CIA QZP1C.2 - Risk Management
Which of the following would be considered risk factors to an organization?
I. A significant improvement in the competitor's product.
II. The purchase of new equipment that will improve profitability.
III. A planned audit engagement that was not completed on a timely basis.
IV. No organizational commitment to develop employees' technical skills.
A. I, III and IV only.

B. II only.
A. A significant improvement in the product of a competitor will make the competitor more competitive, so

Part 2 (3-Part) : 08/17/23 19:45:12
therefore adversely affecting the organization. In addition, a planned audit engagement that was not
completed on a timely basis and no organizational commitment to further develop employee technical
skills are factors that can also adversely affect the organization.
B. The purchase of new equipment that will improve profitability is not a risk factor.
C. The purchase of new equipment that will improve profitability is not a risk factor. The other items (I, III and IV)
are risk factors.
D. The purchase of new equipment that will improve profitability is not a risk factor. The other items (I, III and IV)
are risk factors.
Question 11 - CIA 1194 I.64 - Report to Senior Management & Board
During an engagement to review payments under a construction contract with a local firm, the internal auditor
found a recurring monthly reimbursement for rent at a local apartment complex. Each reimbursement was
authorized by the same project engineer. The internal auditor found no provision for payment of temporary living
expenses in the construction contract. Discussion with the project engineer could not resolve the matter. The
internal auditor should
A. Inform the chief audit executive.

B. Call the engineer into a private meeting to confront the situation.
C. Wait until the engineer is surrounded by plenty of witnesses and then inquire about the payments.
D. Complete the engagement as scheduled, noting the recurring reimbursement in the working papers.
A. When an internal auditor suspects wrongdoing, the appropriate authorities within the organization
should be informed. The CAE has the responsibility to report immediately any incident of significant fraud
to senior management and the board.
B. Discussion with the project engineer did not resolve the matter.
C. Publicly raising the issue could subject the internal auditor or organization to a defamation suit.
D. The internal auditor found no provision for payment, so this could be an indication of fraud. Thus, the
appropriate authorities within the organization should be informed.
Question 12 - CIA 1196 I.53 - Types of Engagements
An internal auditor has been requested to perform a review of an organization's process for developing accruals for
its liability to clean up toxic waste sites. The audit should determine whether
A. Clean-up costs are reasonably estimated.

B. The organization monitors governmental investigations to identify locations where it may be potentially
responsible for a waste site clean-up.
C. The organization has identified the situations in which it is potentially responsible for cleaning up a waste site.
D. All of the answers are correct.
A. The audit should determine whether clean-up costs are reasonably estimated.
B. The audit should determine whether the organization has identified locations where it may be potentially
responsible for a waste-site clean up.
C. The audit should determine whether the organization has identified situations in which it may be responsible for
waste-site cleanup.
D. All answers are correct. The internal auditor should perform an environmental liability accrual audit in
order to determine when an environmental liability needs to be accrued on the balance sheet and a

Part 2 (3-Part) : 08/17/23 19:45:12
corresponding expense on the income statement.
The primary difference between operational engagements and financial engagements is that in the former the
internal auditors
A. Can use analytical skills and tools that are not necessary in financial engagements.
B. Are not concerned with whether the client entity is generating information in compliance with financial accounting
standards.
C. Start with the financial statements of the client entity and works backward to the basic processes involved in
producing them.
D. Are seeking to help management use resources in the most effective manner possible.
A. Analytical skills and tools are necessary in financial engagements.
B. Internal auditors are concerned with the integrity and reliability of presented financial reports. Making sure the
presented financial statements are in accordance with accounting standards is important in operational
engagements.
C. Internal auditors start with the financial statements and work back when conducting a financial engagement.
D. The primary difference between financial and operational engagements is that in the former the internal
auditor is seeking to form an opinion on the fairness of the financial statements, whereas, operational
engagements involves evaluating the efficiency and economical use of the organization's resources.
Question 14 - CIA 1193 I.44 - Strategic Role of Internal Auditing
A code of conduct was developed several years ago and distributed by a large financial institution to all its officers
and employees. Identify the internal auditor’s best approach to provide the board with the highest level of comfort
about the code of conduct.
A. Review employee activities for compliance with provisions of the code, and report to the board.
B. Fully evaluate organizational practices for compliance with the code, and report to the board.
C. Fully evaluate the comprehensiveness of the code and compliance therewith, and report the results to the board.
D. Perform tests on various employee transactions to detect potential violations of the code of conduct.
A. The internal auditor should also evaluate the comprehensiveness of the code as well.
B. The internal auditor should also evaluate the comprehensiveness of the code as well.
C. The best approach for the internal auditor to take is to fully evaluate the code’s comprehensiveness and
compliance, and report the results to the board. A code is considered comprehensive if it addresses that
the ethical issues that might arise and provides guidance. A code is considered to be in compliance if the
employees are actually complying with the established standards.
D. Performing tests on various employee transactions is not the best approach for the internal auditor to take.
Question 15 - CIA 596 3.38 - Risk Management
In the annual review of the data center of a nationwide mortgage servicing company, the internal audit manager
was concerned about the data center not having an adequate contingency plan. The audit manager was especially
concerned because the data center was located close to a river that occasionally flooded and in the vicinity of a
major railroad and a major highway.

Part 2 (3-Part) : 08/17/23 19:45:12
Management acted on the internal auditor's recommendation to prepare a contingency plan. The most critical
aspect of the plan would be to provide for
A. Monitoring for fraud or abuse during recovery.

B. Minimizing expenses during recovery periods.
C. Continuation of mortgage servicing.
D. Security and control over information assets.
A. Deterring and detecting fraud or abuse while processing in recovery mode is important, but that is not the most
critical aspect to consider.
B. Of course, the company would want to minimize expenses during recovery periods but not at the expense of
continuing to service mortgages.
C. The most critical aspect of the planning would be to provide for continuation of mortgage servicing
because without mortgage servicing, the company would be out of business.
D. There should be control over information assets at all times, but that is not the most critical aspect
Question 16 - CIA QZP1B.1 - Managing Resources
The following are good techniques for providing feedback:
I. Focusing on specific behaviors.
II. Keeping feedback personal.
III. Directing negative feedback toward behavior, which is controllable by the recipient.
IV. Making feedback well timed.
A. I, III and IV only.

B. I and II only.
C. II, III and IV only.
D. I, II, III and IV.
A. Items I, III and IV are good feedback techniques. Feedback should be specific rather than general.
Feedback is useful if negative feedback is directed toward behaviour, which is controllable by the
recipient. There is little value in reminding a person of some shortcoming over which he or she has not
control.
B. Item I is a good technique for providing feedback. Item II is not a good feedback technique because feedback
should be impersonal. It should be descriptive rather than judgmental or evaluative.
C. Item III and IV are good techniques for providing feedback. Item II is not a good feedback technique because
feedback should be impersonal. It should be descriptive rather than judgmental or evaluative.
D. Items I, III and IV are good feedback techniques. Item II is not a good feedback technique because feedback
should be impersonal. It should be descriptive rather than judgmental or evaluative.
Question 17 - CIA QZP1B.12 - Policies & Procedures
The written policies of an internal audit activity (IAA) should:
I. Define the scope and status of internal auditing.

Part 2 (3-Part) : 08/17/23 19:45:12
II. Contain the authority to carry out engagements.
III. Be appropriate for the size and complexity of the internal audit activity.
IV. Help the internal auditing staff comply with the IAA’s standards of performance.
A. I and II only.
B. III and IV only.
C. I, III and IV only.
A. Items I and II are contained in the IAA's charter.
B. Items III and IV are true. The IAA’s policies should be appropriate for the size and complexity of the IAA
and they should help the internal auditing staff comply with the IAA’s standards of performance.
C. Item I is contained in the IAA’s charter.
D. Items I and II are contained in the IAA’s charter.
The capabilities of individual staff members are key features in the effectiveness of an internal audit activity. What
is the primary consideration used when staffing an internal audit activity?
A. Organizational orientation.
B. Job descriptions.
C. Background checks.
D. Continuing education.
A. Organizational orientation will help new employees adapt quicker to the organization, but it is not the primary
consideration when staffing the IAA.
B. The job (position) descriptions describe the needed job qualifications for specific staff positions. Thus,
they are a primary consideration when staffing the IAA.
C. Background checks are used to verify the accuracy of potential employees information. But, they are not a
primary consideration when staffing the IAA.
D. Continuing education is an important consideration for the current staff, but is not a primary consideration when
staffing the IAA.
The internal auditor for a diversified organization is performing a preliminary analytical review of the home building
division. The division accounts for approximately 15% of the organization's revenues and profits. It operates in the
Southwest region of the country and has been growing rapidly. New management took over the division during the
early part of 2009 and has been very aggressive in pushing market share and growth. Management is considering
expanding operations to new regions because of (1) demonstrated growth and profitability potential; and (2) a
potential slowing of growth in the Southwest region. The division views itself as the efficient home builder in the
region. The following data have been compiled for our review.
Southwest Housing Division Selected Financial and Building Data
Year End Year End Year End Year End
Attribute
Sept. 2010 (Unaudited) Sept. 2009 Sept. 2008 Sept. 2007
No. of New Housing Starts in Region 62,500 57,500 52,800 47,500
Division Revenue $156.3 million $119.0 million $110.4 million $83.2 million
Net Income as Percent of Revenue 11.52% 11.34% 9.96% 9.37%

Part 2 (3-Part) : 08/17/23 19:45:12
Net Income $18 million $13.5 million $11.0 million $7.8 million
Relative Market Share 20% 18% 19% 17%
No. of Houses Built 1,250 1,035 1,003 808
Average Revenue Generated per Home Built. $125,000 $115,000 $110,000 $103,000
Housing Price Index for Areaa 1.2 1.15 1.1 1.03
No. of Employees 233 180 167 150
Home Building Materials Price Index 1.25 1.2 1.05 1.0
Jobs in Progress at Year-End 80 40 25 18
Accrued Revenue per Job in Progress $100,000 $43,750 $52,500 $48,000
Goodwill per Balance Sheet $11.3 million $0 $0 $0
Long Term Debt $50 million $10 million $10 million $5 million
Debt/Equity Ratio 1.25 0.26 0.25 0.15
In which year did the division have the highest productivity in terms of numbers of homes built?
A. 2010.
B. 2009.
C. 2007.
D. 2008.
A. 2010 shows a decrease to 2007 levels with 5.36 houses built per full-time employee.
B. 2000 shows that 5.75 houses were built per full-time employee.
C. 2007 shows that 5.38 houses were built per full-time employee.
D. 2008 was the most productive year with 6.00 houses built per full-time employee.
Question 20 - HOCK CIA P2B H8 - Control Self-Assessment (CSA)
There are three primary Control Self-Assessment (CSA) approaches. Which one of the approaches does
management produced a staff of business processes, which can then be used by the internal auditor to combine
the results with information gathered from sources such as other mangers and key personnel?
A. Facilitated team workshop.

B. Survey.
C. Controlled-based analysis.
D. Management-produced analysis.
A. Facilitated team workshop is the process of gathering information from work teams that represent different
levels in the business unit or function. The primary format of the workshop may be based on objectives, risks,
controls or processes.
B. Surveys or questionnaires tend to ask simple "Yes or No" questions.
C. Controlled-based analysis is not one of the three approaches used in CSA.
D. The form of self-assessment called "management –produced analysis" covers most approaches by
management groups to produce information about selected business processes, risk management
activities, and control procedures. The internal auditor may synthesize this analysis with other information
to enhance the understanding about controls and to share the knowledge with managers in business or
functional units as part of the organization’s CSA program.
Question 21 - CIA 591 I.10 - Managing Resources
The key factor in the success of an internal audit activity's human resources program is

Part 2 (3-Part) : 08/17/23 19:45:12
A. A well-developed set of selection criteria.

B. An informal program for developing and counseling staff.
C. A program for recognizing the special interests of individual staff members.
D. A compensation plan based on years of experience.
A. The key factor to hiring well-qualified staff is the development of selection criteria.
B. The program for developing and counseling staff should be formal, not informal.
C. The quality of the employees is a more important factor than the special interests of the staff members.
D. The quality of the employees is a more important factor than a compensation plan.
Question 22 - CIA 587 II.22 - Types of Engagements
During an engagement involving the production cycle, you noted a control procedure requiring the accounting clerk
to look up the materials invoice and match the materials unit costs with the unit cost of materials shown on the job
cost sheet for all government contract work. This procedure is designed to meet the control objective of
A. Classification.
B. Validity.
C. Valuation.
D. Authorization.
A. Classification seeks to ensure that the transaction is properly recorded in the proper amounts.
B. Validity seeks to obtain assurance that the transactions are valid.
C. Valuation seeks to show that the transactions are recorded in the proper amount. Therefore, the
accounting clerk is seeking to meet the objective of valuation.
D. Authorization seeks to ensure that transactions have proper approval by management.
There are three primary Control Self-Assessment (CSA) approaches. Which one of these approaches entails
gathering information from work teams that represent different levels in the business unit or function?
A. Management-produced analysis.
B. Facilitated team workshops.
C. Controller-produced analysis.
D. Questionnaires/Surveys.
A. Management-produced analysis covers the other approaches by management groups to produce information
about business processes, risk management activities and control procedures.
B. Facilitated team workshop is the process of gathering information from work teams that represent
different levels in the business unit or function. The primary format of the workshop may be based on
objectives, risks, controls or processes.
C. Controller-produced analysis is not designed to gather information from work teams.
D. Surveys or questionnaires tend to ask simple "Yes or No" questions.

Part 2 (3-Part) : 08/17/23 19:45:12
Question 24 - CIA 598 2.64 - Report to Senior Management & Board
Which of the following describes the most appropriate action to be taken concerning a repeat finding of violations of
company policy pertaining to competitive bidding policies?
A. During the exit interview, management should be made aware that a finding from the prior report had not been
corrected.
B. The chief audit executive should determine whether this condition should be reported to the external auditor and
any regulatory agency.
C. The audit report should note that this same condition had been reported in the prior audit.
D. The chief audit executive should determine whether management or the board has assumed the risk of not
taking corrective action.
A. This action is insufficient.
B. This action would be inappropriate. The CAE has to decide whether management or the board has assumed the
risk of not taking corrective action.
C. This action is insufficient.
D. Management may decide to assume the risk of not correcting a reported condition because of the cost
or other considerations.
Question 25 - CIA 594 H3 - Managing Resources
Which of the following is not a good example of how to evaluate the quality of someone's work?
A. Evaluate the task outcome to determine if the job gets done.

B. Use multiple evaluators to increase reliability.
C. Evaluate the worker's traits such as, attitude, intelligence, or reliability.
D. Use multiple criteria because every employee is expected to do a number of things well.
A. This is a good example of how to evaluate employees.
B. This is a good example of how to evaluate employees.
C. Evaluating traits is one of the weakest methods of evaluating people. Many traits have little or no
relation to performance. Additionally, the evaluation of a trait is a judgment with weak interrater agreement
(e.g., when is an employee "reliable"?).
D. This is a good example of how to evaluate employees.
Question 26 - CIA QZP1B.2 - Strategic Role of Internal Auditing
Coordination between internal and external auditors can reduce the overall costs of the external audit. Who is
actually responsible for coordinating the internal and external auditing efforts?
A. Management.
B. The Chief Audit Executive.
C. The external auditor.
D. The board.
A. Management is not responsible for coordinating internal and external auditing efforts.
B. The CAE should share information and coordinate activities with other internal and external providers
of relevant assurance and consulting services to ensure proper coverage and minimize duplication of

Part 2 (3-Part) : 08/17/23 19:45:12
efforts (Standard 2050). Thus, proper coordination of internal and external auditing functions can help to
reduce costs.
C. The external auditor is not responsible for coordinating internal and external auditing efforts.
D. The board has oversight authority, but is not directly responsible for coordinating internal and external auditing
efforts.
Question 27 - CIA QZP1B.7 - Risk Management
Which of the following statements are true concerning risk assessment?
I. Risk assessments may be revised based on new information.
II. The engagement work schedule will be based on risk assessment.
III. Risk assessment is based on internal auditor’s professional judgment about events that could affect the
achievement of organizational objectives.
IV. The primary purpose of risk assessment is to help management identify areas of costs savings.
A. I and III only.

B. I, II, III and IV.
C. I, II and III only.
A. Item II is also true concerning risk assessment.
B. Item IV is not true concerning risk assessment. Risk assessment cannot always be put into quantitative terms.
C. Items I, II and III are true concerning risk assessment. Based on new information the CAE may revise the
work schedule. Also, the engagement work schedule will be based on a risk assessment, undertaken at
least once a year. And finally, risk assessment is based on internal auditor's professional judgment about
events that could affect the achievement of organizational objectives.
D. Item IV is not true concerning risk assessment. Risk assessment cannot always be put into quantitative terms.
During discussions with senior management, the chief audit executive (CAE) identified several strategic business
issues to consider in preparing the annual engagement work schedule. Which of the following does not represent a
strategic issue for this purpose?
A. A monthly budgeting process will be implemented.

B. Joint venture candidates will be sought to provide manufacturing and sourcing capabilities in European and
Asian markets.
C. A human resources database will be established to ensure consistent administration of policies and to improve
data retention.
D. An international marketing campaign will be started to develop product recognition and also to leverage the new
organization-based advertising department.
A. A monthly budgeting process is part of the short-term operating decision making process, so therefore
would not be considered by the CAE.
B. Seeking joint venture candidates would be part of the long-term strategic issues that would be considered by the
CAE.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Establishing a human resource database is a long-term strategic issue that would be considered by the CAE.
D. An international marketing campaign would be a long-term strategic issue for the CAE.
Inherent risk and control risk differ from detection risk in that they
A. Can be changed at the auditor's discretion.

B. Arise from the misapplication of auditing procedures.
C. May be assessed in either quantitative or nonquantitative terms.
D. Exist independently of the financial statement audit.
A. Inherent and control risk cannot be changed at the auditor's discretion.
B. Misapplication of auditing procedures affects detection risk, but not inherent or control risk.
C. All three types of risk can be assessed either quantitatively or nonquantitatively.
D. Inherent risk is the risk that there is an error in the first place. Control risk is the risk that the internal
controls will fail to detect the error. Detection risk is the risk that the auditor will not detect the error. The
auditor assesses inherent and control risk, but the auditor is not able to do anything to influence (change)
these risks. Detection risk is the only risk that can be changed at the auditor’s discretion by altering the
nature, timing, or extent of the audit procedures.
Question 30 - CIA 591 II.2 - Risk Management
Which of the following activities is outside the scope of internal auditing?
A. Evaluating controls over compliance with laws and regulations.

B. Ascertaining the extent to which objectives and goals have been established.
C. Assessing an operating department's effectiveness in achieving stated organizational goals.
D. Safeguarding of assets.
A. Evaluating controls over compliance with laws and regulations is an internal auditing activity.
B. Ascertaining the extent to which objectives and goals have been established is an internal audit activity.
C. Assessing an operating department's effectiveness in achieving stated organizational goals is an internal

auditing activity.
D. The specific safeguarding of assets is the responsibility of management. However, from an internal
auditing standpoint, internal auditors should evaluate and assess whether assets are safeguarded.
Internal auditing engagements vary in their degree of objectivity. Of the following, which is likely to be the most
objective?
A. Compliance engagement relating to an organization’s overtime policy.

B. Performance engagement relating to the marketing department.
C. Financial control engagement relating to payroll procedures.
D. Operational engagement relating to the personnel function’s hiring and firing procedures.

Part 2 (3-Part) : 08/17/23 19:45:12
A. A compliance engagement relating to overtime policy is likely to be more objective because the internal
auditor can determine whether actual operations are conforming to the organization’s stated policies and
procedures.
B. A performance engagement relating to the marketing department would involve quite a bit of subjectivity.
C. There are different ways of achieving control, thus, an engagement relating to payroll procedures would be
somewhat subjective.
D. An operational engagement relating to the organization’s hiring and firing procedures would involve quite a bit of
subjectivity.
An operational engagement relating to the production function includes a procedure to compare actual costs with
standard costs. The purpose of this engagement procedure is to
A. Determine the accuracy of the system used to record actual costs.

B. Assess the reasonableness of standard costs.
C. Measure the effectiveness of the standard cost system.
D. Assist management in its evaluation of effectiveness and efficiency.
A. An operational engagement is concerned with examining and evaluating systems of internal control, overall
company operations, and the quality of performance in carrying out assigned responsibilities. The purpose of an
operational engagement is to assist management in its evaluation of effectiveness and efficiency. A comparison
between actual costs and standard costs will not necessarily fulfill that purpose.
B. An operational engagement is concerned with examining and evaluating systems of internal control, overall
C. An operational engagement is concerned with examining and evaluating systems of internal control, overall
D. An operational engagement is concerned with examining and evaluating systems of internal control,
overall company operations, and the quality of performance in carrying out assigned responsibilities. The
purpose of an operational engagement is to assist management in its evaluation of effectiveness and
efficiency. A comparison between actual costs and standard costs can be used to fulfill that purpose.
An internal auditor is assigned to perform an engagement involving the organization's insurance program, including
the appropriateness of the approach to risk management. The organization self-insures against large casualty
losses and health benefits provided for all its employees. The organization is a large national firm with over 15,000
employees located in various parts of the country. It uses an outside claims processor to administer its health care
program. The organization's medical costs have been rising by approximately 8% per year for the past 5 years and
management is concerned with controlling these costs.
When the audit was assigned, management asked the auditor to evaluate the appropriateness of using
self-insurance to minimize risk to the organization. Given the scope of the audit requested by management, should
the auditor engage an actuarial consultant to assist in the audit if these skills do not exist on staff?
A. Yes. The actuary has skills, not usually found in auditors, to identify and quantify self-insurance risks.
B. No. The audit department is skilled in assessing controls, and the insurance control concepts are not distinctly

Part 2 (3-Part) : 08/17/23 19:45:12
different from other control concepts.

C. No. It is a normal audit function to assess risk; this audit engagement is therefore not unique.
D. Yes. An actuary is essential to determine whether the health care costs are reasonable.
A. Management explicitly asked the auditor to assess the risks that the organization had incurred by
moving to self-insurance. Auditors normally do not have these abilities. If necessary, the audit staffing
should be expanded to include the expertise of an actuary.
B. An actuary should be used.
C. An actuary should be used.
D. An auditor can determine whether costs are reasonable.
Question 34 - CIA 591 III.12 - Managing Resources
Which of the following items would not be an appropriate staffing issue?
A. Appraising each internal auditor's performance at least annually.

B. Providing a competitive selection of employee benefits.
C. Providing continuing educational opportunities for each internal auditor.
D. Selecting qualified and competent individuals.
A. The appraisal of a staff members work is a staffing issue.
B. Providing employee benefits that are competitive is an HR decision that the company makes and it is
not relating to the staffing of the internal audit function.
C. The provision of continuing professional education opportunities for each staff member is a staffing issue.
Therefore, this is the correct answer.
D. Selecting qualified and competent individuals is a staffing issue.
A determination of cost savings is most likely to be an objective of a(n)
A. Compliance engagement.
B. Financial engagement.
C. Program-results engagement.
D. Operational engagement.
A. A compliance engagement is concerned with determining to what degree an organization is operating in an

orderly way, effectively and visibly conforming to certain specific requirements of its policies, procedures,
standards, or laws and governmental regulations. Thus a determination of cost savings would not be an objective
of a compliance engagement.
B. A financial engagement focuses on the safeguarding of assets and the reliability and integrity of the financial
statements. Thus a determination of cost savings would not be an objective of a financial engagement.
C. A program-results engagement is concerned with evaluating the accomplishment of objectives for a specific
program. Thus a determination of cost savings would not be an objective of a program-results engagement.
D. An operational engagement focuses on examining and evaluating systems of internal control, overall
company operations, and the quality of performance in carrying out assigned responsibilities. Thus a
determination of cost savings will most likely be an objective of an operational engagement.

Part 2 (3-Part) : 08/17/23 19:45:12
A certified internal auditor (CIA) is the chief audit executive (CAE) for a large city and is planning the engagement
work schedule for the next year. The city has a number of different funds, some that are restricted in use by
government grants and some that require compliance reports to the government. One of the programs for which
the city has received a grant is job retraining and placement. The grant specifies certain conditions a participant in
the program must meet to be eligible for the funding.
The internal auditors must determine the applicable laws and regulations. Which of the following procedures would
be the least effective in learning about the applicable laws and regulations?
A. Discuss the matter with the audit committee and make inquiries as to the nature of the requirements and the
audit committee's objectives for the engagement.
B. Make inquiries of the city's chief financial officer, legal counsel, or grant administrators.
C. Review prior-year working papers and inquire of officials as to changes.
D. Review applicable grant agreements.
A. Discussing the matter with the audit committee is not likely to be useful. Audit committee members
generally are not fluent in the applicability of laws and regulations.
B. Making inquiries of the city's CFO, legal counsel, or grant administrators would be an effective method to learn
about the applicable laws and regulations.
C. Reviewing prior-year working papers would be an effective method to learn about the applicable laws and
regulations.
D. Reviewing applicable grant agreements would be an effective method to learn about the applicable laws and
regulations.
An internal audit activity (IAA) uses the pool concept to assign all staff and most senior internal auditors to
engagements. Which of the following would most likely ensure effective staff use?
A. Annual activity reports for the internal audit activity.

B. Results of the last external assessment of the internal audit activity.
C. Permanent files of the activities to be reviewed.
D. Monthly engagement work schedules.
A. Annual activity reports should be periodically submitted to management and the board with comparison of actual
performance with stated IAA goals. But, these reports would not provide control over future usage of staff.
B. Results of external assessments of the IAA provide good feedback information but would not directly contribute
to the effective use of the IAA staff.
C. Maintenance of files will not directly contribute to the effective use of IAA staff.
D. Monthly engagement work schedules would be the best method of ensuring an effective use of staff.
Staffing plan and financial budgets, including the number of auditors and the knowledge, skills, and other
competencies required to perform their work, should be determined from engagement work schedules,
administrative activities, education and training requirements, and audit research and development efforts.

Part 2 (3-Part) : 08/17/23 19:45:12
A performance audit engagement typically involves
A. Appraisal of the environment and comparison against established criteria.

B. Review of financial statement information, including the appropriateness of various accounting treatments.
C. Evaluation of organizational and departmental structures, including assessments of process flows.
D. Tests of compliance with policies, procedures, laws, and regulations.
A. A performance audit engagement involves the appraisal of the environment and comparison against
established criteria. A research report prepared for the IIA Research Foundation stated "an environmental
audit is an integral part of an environmental management system whereby management determines
whether the organization's environmental control systems are adequate to ensure compliance with
regulatory requirements and internal policies." Thus, environment audits should measure performance
against criteria, policies and targets.
B. A financial statement engagement involves the review of financial statement information.
C. A performance engagement audit specifically measures "what is" against some criteria "what should be." On the
other hand, when evaluating organizational and departmental structures you are not evaluating the structures
against any established criteria, you are evaluating the structures to determine whether changes/improvements can
be made.
D. A compliance engagement involves the examination of policies, procedures, laws, and regulations.
The best reason for establishing a code of conduct within an organization is that such codes
A. Have tremendous public relations potential.

B. Are typically required by governments.
C. Provide a quantifiable basis for personnel evaluations.
D. Express standards of individual behavior for members of the organization.
A. The purpose of a code of conduct goes beyond just having tremendous public relations potential.
B. Codes of conduct are not required by governments.
C. Code of conduct provides qualitative basis for personnel evaluations, not quantitative.
D. A code of conduct establishes high standards of ethical behavior that members of the organization are
supposed to follow. In addition, it also provides the means of detecting and disciplining members for
violations through formal review panels and group pressure (informal).
Question 40 - CIA 594 III.94 - Planning
In which of the following duties would the chief audit executive (CAE) least likely have a primary role?
A. Review the summary observations sheet.

B. Select or approve team members.
C. Organize and draft the final engagement communication.
D. Determine the need for expanded testing.
A. The CAE will review the summary observations sheet.
B. The CAE will select or approve the members of the IAA.
C. Organizing and drafting the final engagement communication will probably be done by one of the more
senior members of the engagement team. The CAE will almost certainly review this final communication,

Part 2 (3-Part) : 08/17/23 19:45:12
but he/she will not draft it.
D. The CAE may be involved in the determination of whether additional testing needs to be done.
Question 41 - CIA QZP1B.14 - Planning
You have just been hired as the CAE of your organization. You now have the responsibility to develop a plan that
outlines the engagements to be performed for the upcoming year. Which of the following are matters to be
considered when establishing the engagement work schedule?
I. The dates and results of the last engagement.
II. Major changes in the business, operations, programs, systems, and controls.
III. Updated assessments of risks and effectiveness of risk management and control processes.
IV. Changes to and capabilities of the audit staff.
A. I and III only.

B. I, II and III only.
D. II and IV only.
A. All of the items should be considered when doing the annual engagement work schedule.
B. All of the items should be considered when doing the annual engagement work schedule.
C.
Matters to be considered when establishing engagement work schedule priorities should include:
The dates and results of the last engagement;
Requests from senior management, the audit committee or other governing bodies;
An engagement's relation to the external audit;
Changing circumstances in the business, operations, programs, systems or controls;
Changes in the risk environment or control procedures in the department;
The potential benefit that could be achieved from the engagement; and
Changes in the skills of the available staff because new skills may enable conducting different types
of engagements.
D. All of the items should be considered when doing the annual engagement work schedule.
Question 42 - CIA 595 III.23 - Report to Senior Management & Board
The chief audit executive (CAE) routinely presents an activity report to the board as part of the board meeting
agenda each quarter. Senior management has asked to review this presentation before each board meeting so
that any issues or questions can be discussed beforehand. The CAE should
A. Withhold disclosure of the activity report to senior management because such matters are the sole province of
the board.
B. Disclose to the board only those matters in the activity report that pertain to expenditures and financial budgets
of the internal audit activity.
C. Provide information to senior management that pertains only to completed engagements and observations
available in published engagement communications.
D. Provide the activity report to senior management as requested and discuss any issues that may require action to

Part 2 (3-Part) : 08/17/23 19:45:12
be taken.
A. Senior management should review the activity report.
B. The board should also be advised of any significant deviations from the engagement.
C. Information submitted to senior management should not be limited to only completed engagements and
observations available in published engagement communications.
D. The CAE must report periodically to senior management and the board on the IAA's purpose, authority,
responsibility, and performance relative to its plan. Reporting must also include significant risk exposures
and control issues, including fraud risks, governance issues, and other matters needed or requested by
senior management and the board (Standard 2060).
When hiring entry-level internal auditing staff, which of the following will most likely predict the applicant's success
as an internal auditor?
A. Grade point average on college accounting courses.

B. Ability to organize and express thoughts well.
C. Ability to fit well socially into a group.
D. Level of detailed knowledge of the organization.
A. How a person did in college is not the best indicator of success as an internal auditor.
B. Because so much of what an internal auditor does is communicate, the ability of a person to organize
their thoughts and express them well is probably the most important factor in assessing whether someone
will be successful as an internal auditor. While it is possible that a person with good communicating skills
may not be a good internal auditor, it is unlikely that someone with poor communication skills would be a
good internal auditor.
C. While it is beneficial if the individual is able to fit well socially into a group, it is not the most important factor in
predicting the effectiveness of someone as an internal auditor.
D. The level of their detailed knowledge of the organization is not the best indicator of success as an internal
auditor.
In testing the existence assertion for an asset, an auditor ordinarily works from the
A. Financial statements to the potentially unrecorded items.

B. Accounting records to the supporting evidence.
C. Potentially unrecorded items to the financial statements.
D. Supporting evidence to the accounting records.
A. Working from the financial statements to the potentially unrecorded items relate to the completeness assertion.
B. The existence assertion has to do whether assets or liabilities of an entity actually exist at a specific
period of time. In testing the existence assertion for an asset, an auditor works from the accounting
records to the supporting evidence.
C. Working from the potentially unrecorded items to the financial statements relate to the completeness assertion.
D. Working from the supporting evidence to the accounting records might detect unrecorded assets, which relate to
the completeness assertion.

Part 2 (3-Part) : 08/17/23 19:45:12
An organization has two manufacturing facilities. Each facility has two manufacturing processes and a separate
packaging process. The processes are similar at both facilities. Raw materials used include aluminum, materials to
make plastic, various chemicals, and solvents. Pollution occurs at several operational stages, including raw
materials handling and storage, process chemical use, finished goods handling, and disposal. Waste products
produced during the manufacturing processes include several that are considered hazardous. The nonhazardous
waste is transported to the local landfill. An outside waste vendor is used for the treatment, storage, and disposal of
all hazardous waste.
Management is aware of the need for compliance with environmental laws. The organization recently developed an
environmental policy including a statement that each employee is responsible for compliance with environmental
laws.
If the internal audit activity (IAA) is assigned the responsibility of conducting an environmental audit, which of the
following actions should be performed first?
A. Conduct risk assessments for each site.

B. Review the environmental management system.
C. Provide the assigned staff with technical training.
D. Review organizational policies and procedures and verify compliance.
A. Assigning staff and providing technical training would be performed first when conducting an environmental audit.
B. Reviewing the environmental management system could only occur after staff has been assigned and trained.
C. When conducting an environmental auditing the first step is to make sure that staff has been assigned
and adequate trained. If staff is not qualified then outside consulting services may need to be employed.
D. Assigning staff and providing technical training would be performed first when conducting an environmental
audit.
An internal auditor has uncovered illegal acts committed by a member of senior management. According to the
Standards, such information
A. Must be immediately reported to the appropriate local authorities.

B. Should be excluded from the internal auditor's report and discussed orally with the senior manager.
C. May be disclosed in a separate report and distributed to the company's audit committee of the board of directors.
D. May be disclosed in a separate report and distributed to all senior management.
A. Internal auditors are responsible to report illegal acts and other matters to their management and board of
directors, but not to local authorities. If the company is publicly held, the matter will need to be reported to
appropriate regulatory authorities.
B. Illegal acts by a member of senior management should be reported immediately to the manager's superior and
to the company's audit committee of the board of directors. The auditor should not discuss the matter with the
senior manager who has committed the illegal acts.
C. Information about illegal acts committed by a member of senior management should be reported
immediately to the senior manager's superior and to the audit committee of the board of directors.
D. Information about illegal acts committed by a member of senior management should be reported to the senior
manager's superior and to the board of directors, but not distributed to all senior management.

Part 2 (3-Part) : 08/17/23 19:45:12
The chief audit executive (CAE) meets with the members of the internal audit activity (IAA) at scheduled staff
meetings. Which of the following is the most appropriate function of such a staff meeting?
A. Developing the engagement work schedule.

B. Developing long-range training programs that will meet the staff's needs.
C. Explaining administrative policies and obtaining suggestions from the staff.
D. Revising travel, promotion, and compensation policies.
A. The engagement schedule will be developed by the CAE or the leadership of the IAA, not by the staff at staff
meetings.
B. The development of long-range training programs will be done by management and not by the staff in a staff
meeting.
C. Staff meetings are probably the best venue to explain administrative policies and to get feedback from
the staff. This is because all of the staff are together in one place and in one communication all staff will
receive the necessary information from the correct source.
D. These policies will be done by management and not revised by staff at staff meetings.
The chief audit executive of a manufacturer is updating the long-range engagement work schedule. There are
several possible assignments that can fill a given time spot. Information on potential dollar exposure and key
internal controls has been gathered. Based on perceived risk, select the assignment of greatest merit.
A. Sales force travel expenses -- budget, $1,000,000; 50 sales people; all expenditures over $25 must be receipted.
B. Branch office petty cash -- ledger amount, $50,000; ten branch offices, equal amounts; replenishment of
accounts requires three separate approvals.
C. Expendable tools inventory -- carrying amount, $500,000; issued by tool crib attendant upon receipt of
authorization form.
D. Precious metals inventory -- carrying amount, $1,000,000; separately stored, but access not restricted.
A. Because of the requirement for receipts for expenses over $25, there is not the highest level of risk among the
options provided.
B. Because of the separate approvals that are required, there is not the highest level of risk among the options
provided.
C. Because of the authorization form that is required and the monitoring of the tools by someone, this is not the
highest level of risk among the options provided.
D. Of these choices, the precious metals inventory would be the most important. This is because access to
the metals is not restricted. All of the other items have significant controls associated with them and
therefore would not have the same amount of risk associated with them.
Which of the following audit committee activities is of the greatest benefit to the internal audit activity?
A. Review and endorsement of all internal auditing engagement communications prior to their release.
B. Support for appropriate monitoring of the disposition of recommendations made by the internal audit activity.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Review and approval of engagement work programs.

D. Assurance that the external auditor will rely on the work of the internal audit activity whenever possible.
A. The audit committee would generally receive the final summary engagement communications. It is the
responsibility of the CAE to review and endorse the engagement communications prior to their release.
B. The organizational status of the IAA is to enhance when the audit committee and board support it.
C. The review and approval of specific engagement work programs is the responsibility of the internal auditing
supervisors. These plans would then be included in the overall annual IAA plan that is reviewed and approved by
the audit committee.
D. The audit committee will not decide whether the external auditor is to use the work of the internal auditors.
The function of job description is to:
I. Provide guidance in hiring.
II. Determine which employees should be promoted.
III. Forecast future personnel needs.
IV. Determine whether the organization is appropriately staffed.
A. I and II only.
B. I and IV only.
C. I and III only.
A. Job descriptions do provide guidance for hiring, but they do not determine which employees are to be promoted.
B. Job descriptions should be established for all positions, listing the necessary skills and requirements
for the position. Job descriptions do provide guidance for hiring, and they help to determine whether the
organization is appropriately staffed.
C. Job descriptions do provide guidance for hiring, but they do no help in forecasting future personnel needs.
D. Job descriptions do provide guidance for hiring, and they help to determine whether the organization is
appropriately staffed. But, they do not determine which employees are to be promoted, and they do not help in
forecasting future personnel needs.
The internal auditors randomly select participants in the job retraining program for the past year to verify that they
had met all the eligibility requirements. This type of engagement is concerned with
A. Economy and efficiency.

B. Operational effectiveness.
C. Program results.

Part 2 (3-Part) : 08/17/23 19:45:12
D. Compliance.
A. The engagement is to verify that the organization has met all the eligibility requirements, not whether the
program is performing economically and efficiently.
B. The engagement is to verify that the organization has met all the eligibility requirements, not a review of the
program's effectiveness.
C. The engagement is to verify that the organization has met all the eligibility requirements, not whether to measure
the program results.
D. The grant specifies certain conditions that must be meant in order to be eligible for funding. A
compliance engagement would indicate whether the activities are in compliance with the requirements.
In most organizations, the rapidly expanding scope of internal auditing responsibilities requires continual training.
What is the main purpose of such a training program?
A. To use slack periods in engagement scheduling.

B. To help individuals to achieve personal career goals.
C. To achieve both individual and organizational goals.
D. To comply with continuing education requirements of professional organizations.
A. Training courses can be scheduled during slack time, but this is not the primary purpose.
B. Both personal and the goals of the IAA should be achieved, not just the individual's.
C. The primary purpose of training is so both individual and organizational goals can be achieved.
D. The primary purpose of continuing education is so both individual and organizational goals can be achieved, not
to meet the education requirements of the professional organizations.
Which one of the facilitated team workshops starts by listing all possible barriers, obstacle, threats and exposures
that might prevent achieving the objectives?
A. Control-based format.
B. Risk-based format.
C. Objective-based format.
D. Process-based format.
A. The control-based format focuses on how well the controls are in place and working. The purpose of this format
is to produce an analysis of the gap between how controls are actually working and how well management expects
the controls to work.
B. The risk-based format begins by listing all possible barriers, obstacles, threats and exposures that
might prevent achieving an objective. The purpose of the workshop is to determine significant residual
risk.
C. The objective-based format focuses on the best way to accomplish a business objective. The purpose of this
format is to understand whether control procedures are working effectively and are resulting in residual risks within
an acceptable level.
D. The process-based format focuses on selecting activities that are elements of a chain of processes. The
purpose of this format is to evaluate, update, validated, improve and even streamline the whole process and its

Part 2 (3-Part) : 08/17/23 19:45:12
component activities.
What is a primary reason for planning?
A. Reacting to competition.
B. Environmental uncertainty.
C. Reacting to employee needs.
D. Organizational policy.
A. Planning helps managers avoid having to react to competitors.
B. Planning is greatly influenced by external (environmental) factors, which are factors that cannot be
determined with certainty. Environmental factors include governmental regulations, competition, social
issues, technology changes, etc.
C. Planning helps managers avoid having to react to employee needs.
D. Organizational policy helps in the planning process, but it is not the primary reason for planning. Organizational
policy will not force managers to implement plans.
An auditor, experienced in air-quality issues, discovered a significant lack of knowledge about legal requirements
for controlling air emissions while interviewing the manager of the environmental, safety, and health (ESH)
department. The auditor should
A. Report potential violations in this area to the appropriate regulatory agency.

B. Take note of the weakness and direct additional questions to determine the potential effect of the lack of
knowledge.
C. Alter the scope of the audit to focus on activities associated with air emissions.
D. Share extensive personal knowledge with the ESH manager.
A. It is never appropriate for an auditor to report violations or potential violations to regulatory agencies. Such
matters are the responsibility of company counsel.
B. The auditor should ensure that the fieldwork is designed to identify potential instances of
noncompliance and, in the closing conference, should recommend additional training for the ESH
manager.
C. It is important to maintain a broad scope and not reduce scope prematurely.
D. While the auditor may be able to contribute to the ESH manager's knowledge of pertinent air-quality matters, it is
much more important during this phase of the audit to learn what the manager does.
Which of the following is the best source of a chief audit executive's information for planning staffing requirements?
A. Review internal audit staff size and composition of similarly sized organizations in the same industry.
B. Review of internal audit staff education and training records.
C. Interviews with existing internal audit staff.
D. Discussions of internal audit needs with senior management and the board.

Part 2 (3-Part) : 08/17/23 19:45:12
A. The staffing plan is unique to every company.
B. The first consideration would be the work schedule to determine the number and skills of the required staff.
C. The work schedule would be the first consideration to determine the number and skills of the required staff.
Interviews with staff would probably occur later.
D. It will be the CAE's responsibility to establish risk-based plans to determine the priorities of the IAA. In
order to establish these risk based plans, input from senior management is critical.
laws.
In many countries, the organization generating hazardous waste is responsible for the waste from "cradle to grave"
(creation to destruction). A potential risk to the organization is the use of an outside vendor to process hazardous
waste. Which of the following steps should be performed during a review of the waste vendor?
A. Review the financial solvency of the vendor.

B. Review the vendor's emergency response planning.
C. Review the vendor's documentation on hazardous material.
D. All of these steps should be performed during a review of the waste vendor.
A. Reviewing the financial solvency of the vendor should be performed. This is important since the vendor could be
cutting corners to save costs.
B. Reviewing the vendor's emergency response planning should be performed.
C. Reviewing the vendor's documentation should be performed.
D. All of answers are correct. When conducting an audit of the vendor the internal auditor would review all
the vendor's documentation on hazardous material, review the vendor's financial solvency, and review the
vendor's emergency response planning.
As part of a manufacturing company's environmental, health, and safety (EHS) self-inspection program,
inspections are conducted by a member of the EHS staff and the operational manager for a given work area or
building. If a deficiency cannot be immediately corrected, the EHS staff member enters it into a tracking database
that is accessible to all departments via a local area network. The EHS manager uses the database to provide
senior management with quarterly activity reports regarding corrective action. During review of the self-inspection
program, an auditor notes that the operational manager enters the closure information and affirms that corrective
action is complete. What change in the control system would compensate for this potential conflict of interest?
A. No additional control is needed because those implementing a corrective action are in the best position to
evaluate the adequacy and completion of that action.

Part 2 (3-Part) : 08/17/23 19:45:12
B. After closure is entered into the system, review by the EHS staff member of the original inspection team should
be required in order to verify closure.
C. No additional control is needed because the quarterly report is reviewed by senior management, providing
adequate oversight in this situation.
D. The EHS department secretary should be responsible for entering all information in the tracking system based
on memos from the operational manager.
A. It is possible that operating managers would be in the best position to evaluate the adequacy and completion of
correction action, but there should still be an independent review.
B. Any control system should have some kind-of independent review and verification. In this situation the
best control system to compensate for the potential conflict of interest is after closure is entered into the
system, an EHS staff member of the original inspection team should required to verify that corrective
action was, in fact, completed.
C. This situation does not provide adequate oversight since senior management would not know whether the
corrective actions were actually completed.
D. Having the secretary enter closure data is not the same as an independent review.
An organization is considering purchasing a commercial property. Because of the location of the property and the
known recent history of activities on the property, management has asked the internal audit activity (IAA), in
cooperation with legal counsel, to provide a preliminary identification of any environmental liability. The strongest
reason supporting management's decision to request such an investigation is
A. The potential for future liability may outweigh any advantages achieved by obtaining the property.
B. Regulatory agencies require a purchaser to identify and disclose all actual and potential instances of
contamination.
C. The current owner would be required by law to clean up all identified contamination before the sale is closed.
D. Management will be able to pay a lower price for the property if environmental contamination can be identified.
A. The management of the company would want to know if there are potential environment issues with
purchasing the land because if so, then the potential for future liability may outweigh the advantages.
B. Purchasers are not obligated to identify and disclose instances of contamination.
C. The current owner may not be obligated to clean up the site.
D. Even with a lower price management may still not be willing to purchase the land because of potential future
liabilities.
Question 60 - CIA 1185 II.2 - Policies & Procedures
You are the chief audit executive (CAE) for a large decentralized organization. You have developed a manual
containing comprehensive detailed written procedures as a guide for your decentralized engagement work groups,
each of which has 20 to 30 internal auditors. The organization recently acquired a small entity that has an internal
audit activity consisting of a supervisor and two staff personnel. Which of the following actions is the most practical
in providing administrative guidance for this new internal audit activity?
A. Adopt the administrative procedures being followed by the internal auditors of the acquired entity.
B. Use informal supervisory direction for engagement management issues.
C. Select key procedures from the manual and use informal supervisory direction for other engagement
management issues.
D. Use the already developed manual.

Part 2 (3-Part) : 08/17/23 19:45:12
A. Simply adopting the procedures used by the acquired company's IAA will not allow for the proper integration into
the new company. There must be a combination of using what already exists in the acquired IAA and
supplementing it with the critical elements of the larger company's IAA and reporting requirements.
B. Using only informal supervision will most likely not be successful in merging the new staff into the organization.
C. Using the key procedures from the parent company' manual and informal supervision will probably be
the best method of integrating the two IAAs. Because the acquired company is much smaller and has an
existing IAA, the blanket adoption of the parent company's policies would most likely be excessive and
would not create the best working relationship between the two IAAs.
D. Simply using the already developed manual for a newly acquired company that has a small and functioning IAA
would be too formal and would very likely cause excess and unnecessary work to be done. This would happen
because the manual was written for IAA that are of a completely different scope than the one that has been
acquired.
Question 61 - HOCK CIA P1C H4 - Risk Management
Depending on the size and complexity of the organization's business activities, risk management processes can be
all of the following except
A. Quantitative or subjective.
B. Embedded in the business units or centralized at the corporate level.
C. Formal or informal.
D. All of the above.
A. This is part of the risk management process.
B. This is part of the risk management process.
C. This is part of the risk management process.
D. Risk management processes can be formal or informal, or they can be quantitative or subjective; or
they can be embedded in the business units or centralized at the corporate level. Therefore, all of the
above are part of the risk management process.
Management has requested the internal audit function to conduct an audit of the implementation of its recently
developed company code of conduct. In preparing for the audit, the internal auditor reviews the newly developed
code and compares it with several others for comparable companies and concludes that the newly developed code
has severe deficiencies. Based on this conclusion, the internal auditor should
A. Inform management of the problems with the existing code and report that it would be inappropriate to conduct
an audit until the code is revised to incorporate the "best practices" from industry.
B. Report the nature of the deficiencies in a formal report to management.
C. Conduct the audit as requested by management, reporting only noncompliance with the code.
D. Plan an audit for the implementation of management's code of conduct and also for compliance with the "best
practices" from the other codes since this represents the best available criteria.
A. It would be appropriate to conduct the audit if management is interested to receive feedback on the
implementation of the code.
B. If the internal auditors believe that the established criteria are inadequate, they should report such
deficiencies to the appropriate level of management.
C. The internal auditor has a responsibility to report deficiencies in the code to management.

Part 2 (3-Part) : 08/17/23 19:45:12
D. The internal auditor should not conduct a compliance audit with criteria that have not yet been communicated
with the auditees.
Internal auditors are often called upon to either perform, or assist the external auditor, in performing a due diligence
review. A due diligence review may be
A. A review of interim financial statements as directed by an underwriting firm.

B. An operational audit of a division of an organization to determine if divisional management is complying with
laws and regulations.
C. A review of financial statements and related disclosures in conjunction with a potential acquisition.
D. A review of operations as requested by the audit committee to determine whether the operations comply with
audit committee and organizational policies.
A. A review of interim financial statements as directed by an underwriting firm is not a due diligence review.
B. An operational audit of a division of an organization to determine if divisional management is complying with

laws and regulations is not a due diligence review.
C. A due diligence engagement is an investigative analysis of the financial and operating activities of an
entity in connection with a proposed major transaction, such as a business combination. A due diligence
engagement includes review of the company's strategic overview, business overview, accounting and
information systems, sales, risk management, tax issues, and any other matters of importance in
determining whether there is justification for the transaction.
D. A review of operations as requested by the audit committee to determine whether the operations comply with
audit committee and organizational policies is not a due diligence review.
Question 64 - CIA 591 I.12 - Policies & Procedures
Which of the following is most essential for guiding the internal audit staff in maintaining daily compliance with the
internal audit activity's standards of performance?
A. Quality program assessments.

B. Policies and procedures.
C. Performance appraisals.
D. Position descriptions.
A. Specific daily guidance of the IAA staff is not provided by quality program assessments.
B. The CAE must establish policies and procedures to guide the internal audit activity (Standard 2040). The
form and content of written policies and procedures should be appropriate to the size and structure of the
IAA and the complexity of its work.
C. Specific daily guidance of the IAA staff in not provided by performance appraisals.
D. Specific daily guidance of the IAA staff is not provided by job (position) descriptions.
Staff members should be afforded an appropriate means through which they can discuss problems and receive
updates regarding internal audit activity's policies. The most appropriate forum for this objective is

Part 2 (3-Part) : 08/17/23 19:45:12
A. Employee evaluation conferences.

B. Internal memoranda.
C. Staff meetings.
D. The internal audit activity's informal communication lines.
A. The evaluation conference is not the best time to receive updates about the IAA policies. This should be done
throughout the year as things change.
B. Internal memoranda are not a good way to discuss problems as they are slow and very formal.
C. Staff meetings are the best place for there to be discussion of problems and updates about the policies
of the IAA. Staff meetings are formal meetings and by the use of the staff meeting everyone will receive the
same information and the same message about changes in policies. Also, by having all staff in one place,
new solutions to problems may be discovered.
D. Informal communication channels are not appropriate for the discussion of problems or the communication
relating to changes in IAA policies.
When assigning individual staff members to actual engagements, internal auditing managers are faced with a
number of important considerations related to needs, abilities, and skills. Which of the following is the least
appropriate criterion for assigning a staff internal auditor to a specific engagement?
A. Special skills possessed by the staff internal auditor.

B. The complexity of the engagement.
C. The experience level of the internal auditor.
D. The staff internal auditor's desire for training in the area.
A. The skills that are possessed by the staff internal auditor is an important criterion for assigning auditors to an
engagement. The CAE needs to make certain that the staff on a specific engagement have the necessary skills
and experience to complete that engagement.
B. The complexity of the engagement is an important criterion for assigning auditors to an engagement. If the
engagement is more complex, the team may need more senior or experienced members on it.
C. The experience level of the auditor is an important criterion for assigning auditors to an engagement.
D. The desires of the staff member for areas of training is not an important criteria for the assignment of
staff to engagements. This may be used in longer-term planning or staff development, but will not be a
significant factor in the short-term assignment of staff to engagements.
The engagement team leader is least likely to have a primary role in
A. Reviewing the working papers.

B. Preparing the critique sheet for the engagement.
C. Allocating budgeted engagement hours among assigned staff.
D. Updating the permanent files.
A. The engagement team leader will review the work papers.
B. The engagement team leader likely will prepare the critique sheet for the engagement.
C. The engagement team leader likely will allocate the budgeted engagement hours to the assigned staff.

Part 2 (3-Part) : 08/17/23 19:45:12
D. The updating of the permanent files will most likely not be done by the engagement team leader. This
assignment will most likely be given to a junior staff member.
The internal auditing process is one of critical thinking, analysis, and careful evaluation. All mechanical procedures
are integrated into a larger context of thoughtful inquiry. All engagements include a description and analysis of
internal controls. Engagement clients are selected in a number of ways, with risk being the primary basis for
selection. The departments being considered for possible review in the coming year and attributes of those
departments are as follows:
Annual Probability
Department Assets Costs of Loss
Production A $50,000 $700,000 10%
Production B $5,000,000 $10,000,000 1%
Production C $1,000,000 $1,000,000 1%
Purchasing $50,000 $150,000 10%
Marketing $50,000 $500,000 10%
Shipping $60,000 $100,000 50%
Security $10,000 $100,000 90%
Travel $6,000 $30,000 50%
All of these departments, except two, are on the potential list of engagement clients because of a risk analysis
performed by the chief audit executive. Production department A is on the list because the president thinks too
many bottlenecks occur in that department. The marketing department is on the list because the chief of security
received an anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks
from a media outlet. Internal controls seem adequate in all departments, with the possible exception of marketing.
Which department would most likely need a pure operational (nonfinancial) engagement?
A. Production A
B. Marketing
C. Purchasing
D. Production C
A. An operation engagement would evaluate the efficiency and effectiveness of the department. If
production A is having too many bottlenecks then an operational audit would be needed.
B. The anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks from a
media outlet would not relevant to the operating efficiency of the department.
C. The Purchasing department seems to operating efficiently and effectively.
D. Production C seems to be operating efficiently and effectively.
Which internal audit planning tool is general in nature and is used to ensure adequate engagement coverage over
time?
A. The long-range (strategic) plan.

B. The engagement work program.
C. The internal audit activity's budget.
D. The internal audit activity's charter.
A. The long-term or strategic plan is general in design, but should ensure that all areas of the business are
audited at least periodically.

Part 2 (3-Part) : 08/17/23 19:45:12
B. The engagement work program is limited in scope to a particularly assignment.
C. A budget is used to allocate resources, but is not used to ensure engagement coverage over the long run.
D. The Charter is not an internal auditor's planning tool.
Question 70 - CIA 594 I.56 - Risk Management
Which of the following statements is false regarding risk assessment as the term is used in internal auditing?
A. The chief audit executive should incorporate information from a variety of sources into the risk assessment
process, including discussions with the board, management, external auditors, review of regulations, and analysis
of financial/operating data.
B. Risk assessment is a systematic process of assessing and integrating professional judgments about events that
could affect the achievement of organizational objectives. It provides a means of organizing an engagement work
schedule.
C. Risk assessment is a judgmental process of assigning monetary amounts to the perceived level of risk found in
an activity being evaluated. These amounts allow a chief audit executive to select the engagement clients most
likely to result in identifiable savings.
D. As a result of an engagement or preliminary survey, the chief audit executive may revise the level of assessed
risk of an engagement client at any time, making appropriate adjustments to the work schedule.
A. This is a true statement because the CAE should incorporate information from a variety of sources into the risk
assessment process, including discussions with the board, management, external auditors, review of regulations,
and analysis of financial/operating data.
B. This is a true statement because risk assessment is a systematic process of assessing and integrating
professional judgments about events that could affect the achievement of organizational objectives. The
engagement work schedule should be undertaken at least annually.
C. The IAA must evaluate the effectiveness and contribute to the improvement of risk management
processes (Standard 2120). Depending on the size and complexity of the organization's business
activities, risk management processes can be formal or informal; quantitative or subjective; embedded in
the business units or centralized at a corporate level (PA 2120-1). Consequently, the organization's risk
assessment processes is going to incorporate from a variety of sources, not just a rigid process that can
be measured in specific financial terms.
D. This is a true statement because the CAE may revise the level of assessed risk of an engagement client based
on new information.
Which of the following would be the least effective control procedure to address the proper use of funds donated to
a nonprofit organization?
A. Requirement that the board of directors review and approve all expenditures in excess of a specified dollar
amount.
B. Periodic payroll audits by the internal auditor to determine compliance with authorized pay rates.
C. Periodic internal audit of expenditures to determine compliance with stated objectives, with the results reported
to the audit committee.
D. Periodic presentation of audited financial statements for review by the public and major donors.
A. Board of directors’ approvals in a nonprofit organization provide an effective control against unauthorized
administrative actions.
B. This is the least effective control because it only addresses whether payroll is made at the correct rates.

Part 2 (3-Part) : 08/17/23 19:45:12
Problems with the use of funds could relate to inappropriate payments other than payroll.
C. This audit procedure provides direct assurance that expenditures are used for designated purposes.
D. This is an effective control because it provides accountability to the public at large. It provides detail on the
amount of expenditures for administrative purposes. Donors and sponsors can utilize this information to determine
whether the appropriate amounts are used for designated purposes.
Assume that an auditor's findings are so serious that, in the auditor's view, they require immediate action by
management. Which of the following statements regarding the auditor's responsibility with respect to reporting and
follow-up are correct?
I. The conditions should be actively monitored by the internal auditor until corrected.
II. The initial findings should be communicated to senior management and the audit committee even if the
audit of the activities is not complete.
III. The auditor should test the actions implemented by management to determine if they remedy the problem.
A. II and III only.

B. II only.
C. I only.
D. I, II, and III.
A. See the correct answer for the explanation.
B. See the correct answer for the explanation.
C. See the correct answer for the explanation.
D. All three responses are correct and are consistent with the Standards.
A specific objective of an audit of a company's expenditure cycle is to determine whether all goods paid for have
been received and charged to the correct account. This objective addresses which of the following primary
objectives identified in the Standards?
I. Reliability and integrity of financial and operational information.
II. Compliance with laws, regulations, and contracts.
III. Effectiveness and efficiency of operations.
IV. Safeguarding of assets.
A. I and II only.
B. I, II and IV only.
C. I and IV only.
A. Complying with laws, regulations, and contracts is not part of the engagement objective.
B. Complying with laws, regulations, and contracts is not part of the engagement objective.

Part 2 (3-Part) : 08/17/23 19:45:12
C. The engagement objective of determining whether all goods paid for have been received and charged to
the correct account have to do with the objective regarding the reliability and integrity of financial and
operational information, and the objective regarding the safeguarding of assets.
D. Complying with laws, regulations, and contracts and addressing effectiveness and efficiency of operations are
not part of the engagement objective.
Assume your company is considering purchasing a small toxic waste disposal company. As an internal auditor, you
are part of the team doing a due diligence review for the acquisition. The scope of the assignment would most likely
not include
A. An evaluation of the merit of lawsuits currently filed against the waste company.
B. A review of the purchased company's procedures for acceptance of waste material and comparison with legal
requirements.
C. Analysis of the company's compliance with, and disclosure of, loan covenants.
D. Assessment of the efficiency of the waste company's operations and profitability.
A. A due diligence engagement is an engagement to confirm company records, both financial and those of
ownership of property, utilized especially when a unit is being acquired, merged or sold. An auditor would
not have the legal expertise to evaluate the merit of lawsuits currently filed against the target company.
B. A due diligence engagement is an engagement to confirm company records, both financial and those of
ownership of property, utilized especially when a unit is being acquired, merged or sold. A review of the target
company's compliance with legal requirements for acceptance of waste material is appropriate in a due diligence
review by auditors.
C. A due diligence engagement is an engagement to confirm company records, both financial and those of
ownership of property, utilized especially when a unit is being acquired, merged or sold. Analysis of the target
company's compliance with, and disclosure of, loan covenants is appropriate in a due diligence review by auditors.
D. A due diligence engagement is an engagement to confirm company records, both financial and those of
ownership of property, utilized especially when a unit is being acquired, merged or sold. Assessment of the
efficiency of the waste company's operations and profitability is appropriate in a due diligence review by auditors.
laws.
Management is evaluating the need for an environmental audit program. Which one of the following should not be
included as an overall program objective?
A. Evaluate waste minimization opportunities.

B. Verify organizational compliance with all environmental laws.
C. Ensure management systems are adequate to minimize future environmental risks.
D. Conduct site assessments at both facilities.

Part 2 (3-Part) : 08/17/23 19:45:12
A. Evaluating waste minimization opportunities should be a program objective.
B. Verifying organizational compliance with all environmental laws should be a program objective.
C. Ensuring management systems are adequate to minimize future environmental risks should be a program
objective.
D. Conducting site assessments at both facilities would not be included as an overall program objective.
This is a specific engagement that would be conducted during compliance or transactional audits.
Question 76 - HOCK CIA P1C H1 - Strategic Role of Internal Auditing
Which of the following are the key responsibilities that make up the governance process?
I. Complies with society's legal and regulatory rules.

II. Satisfies the generally accepted business norms, ethical precepts, and social expectations of society.
III. Provides overall benefit to society and enhances the interests of the specific stakeholders in both the long
and short-term.
IV. Provides additional assistance in the consolidation of financial reports.
A. I, II and IV.
B. I and II only
C. I, II, III.
A. Part III would also be included as a key responsibility that makes up the governance process, but part IV is not
included.
B. Besides parts I and II, part III would also be included as a key responsibility that makes up the governance
process.
C. The four key responsibilities include (1) complies with society's legal and regulatory rules, (2) satisfies
the generally accepted business norms, ethical precepts, and social expectations of society, (3) provides
overall benefit to society and enhances the interests of the specific stakeholders in both the long -and
short-term, and (4) Reports fully and truthfully to its owners, regulators, other stakeholders, and general
public to ensure accountability for its decisions, actions, conduct, and performance.
D. Providing additional assistance in the consolidation of financial reports is not part of the governance process.
laws.
An advantage of conducting environmental audits under the direction of the internal audit activity (IAA) is that
A. The financial aspects are de-emphasized.

Part 2 (3-Part) : 08/17/23 19:45:12
B. Technical expertise is more readily available.

C. Independence and authority are already in place.
D. Internal auditing work products are confidential.
A. Financial aspects are emphasized, not de-emphasized.
B. Environmental audits take specific specialization, so it is very possible that the IAA will not have the technical
expertise to conduct an environmental audit.
C. When conducting any kind-of audit independence and authority is of major importance. An established
IAA should have the advantage that its status is already in place.
D. Internal auditing work products should be disseminated to appropriate personnel.
The internal audit activity's goals should specify
A. Engagement work schedules and activities to be reviewed.

B. Staffing plans and financial budgets.
C. Policies and procedures to guide the internal audit staff.
D. Measurement criteria and target dates for completion.
A. Goals are statements of activities that are to be accomplished. Engagement work schedules are a means to
achieve goals.
B. Staffing plans and financial budgets are a means of accomplishing specified goals.
C. Goals are statements of activities that are to be accomplished. Policies and procedures are the means in which
the goals are achieved.
D. The goals of the IAA should be capable of being accomplished within specified operating plans and
budgets and, to the extent possible, should be measurable. They should be accompanied by measurement
criteria and targeted dates of accomplishment.
Which of the following should be considered by the staff auditor when deciding whether or not to report the
situation?
A. The mistake in signing off work that was not done.

B. The correction of the control weakness.
C. Securities were used improperly as collateral.
D. The repayment of loans and return of the securities.
A. A mistake was made in signing off work that was not done, but since it was a mistake and not done with intent,
this fact would probably not be reported by the internal auditor.
B. Since the correction has been made, it probably does not need to be reported by the internal auditor.
C. The internal auditor would report the situation to ensure that the situation could not occur again.
D. This is a situation that would not be reported by the internal auditor.

Part 2 (3-Part) : 08/17/23 19:45:12
Which of the following statements best describes an internal auditor's responsibility for follow-up activities related to
a previous audit?
A. The auditor should determine if corrective action has been taken and is achieving the desired results or if
management or the board has assumed the risk of not taking the corrective action.
B. The auditor should determine if management has initiated corrective action, but the auditor has no responsibility
to determine if the action is achieving the desired results. That determination is management's responsibility.
C. The chief audit executive is responsible for scheduling follow-up activities only if directed to do so by senior
management or the audit committee. Otherwise, follow-up is entirely discretionary.
D. None of the above.
A. Senior management and the board make decisions on the appropriate action to be taken regarding
significant issues. They may decide to assume the risk of not correcting the reported condition because of
cost or other considerations. Senior management should inform the board of decisions about all
significant issues raised by internal auditing (PA 2060-1.4).
B. The internal auditor has the responsibility to determine that corrective action was taken and is achieving the
desired results.
C. Standard 2500.A1 requires that follow-up action takes place. It is not dependent on directives of either
management or the audit committee.
D. One of the answers is correct.
As part of cash management procedures, the treasurer of a nonprofit organization has decided to invest in a variety
of new financial instruments. The audit committee has asked the internal audit activity (IAA) to conduct an audit of
the adequacy of controls over the new investing techniques. Which of the following would not be required as part of
such an audit?
A. Determine if policies exist which describe the risks the treasurer may take and the types of instruments in which
the treasurer may make investments.
B. Determine whether the treasurer is getting higher or lower rates of return on investments than are treasurers in
comparable organizations.
C. Determine the nature of controls established by the treasurer to monitor the risks in the investments.
D. Determine the extent of management oversight over investments in sophisticated instruments.
A. Part of the audit is to determine compliance with company policies. Since new financial instruments are very
risky, the first step of such an audit should be to determine the nature of policies established for the investments.
B. Although this might be informational, there is no need to develop a comparison of investment returns
with other organizations. Indeed, recent financial investment scandals show that such comparisons can be
highly misleading because high returns were due to taking on a high level of risk. Also, this is not a test of
the adequacy of the controls.
C. A fundamental control concept over cash is that someone establishes a mechanism to monitor the risks.
D. Oversight by a management committee is an important control. Therefore, the auditor should determine the
nature of the oversight set up to monitor and authorize such investments.

Part 2 (3-Part) : 08/17/23 19:45:12
The CAE plans an engagement to verify that the job retraining program complies with applicable grant provisions.
One of the provisions is that the city adopt a budget for the program and subsequently follow procedures to ensure
that the budget is adhered to and that only allowable costs are charged to the program. In performing an
engagement concerning compliance with this provision, the internal auditors should perform all of the following
procedures except
A. Determine that the budget was reviewed and approved by supervisory personnel within the granting agency.
B. Select a sample of expenditures to determine that the expenditures are (1) properly classified as to type, (2)
appropriate to the program, and (3) designed to meet the program's objectives.
C. Compare actual results with budgeted results and determine the reason for deviations. Determine if such
deviations have been approved by appropriate officials.
D. Determine that the budget was reviewed and approved by supervisory personnel within the city.
A. The city's internal auditors are responsible for determining whether the city is in compliance with the
grant requirements. Whether the budget was reviewed and approved by supervisory personnel within the
granting agency is outside the scope of the audit and therefore should not be performed.
B. Examining a sample of expenditures should be performed because it can determine whether the city is following
procedures to ensure that only allowable costs are charged to the program, as required by the grant.
C. Comparing actual results with budgeted results, determining deviations and whether such deviations have been
approved by appropriate officials should be performed because it can determine whether the city is following
procedures to ensure that the budget is adhered to, as required by the grant.
D. One of the requirements of the grant is that the city adopt a budget for the program. In order to determine
whether the city is in compliance with the grant requirements, the internal auditor should verify whether the budget
was reviewed and approved by supervisory personnel within the city.
As a particular engagement is being planned in a high-risk area, the chief audit executive (CAE) determines that
the available staff does not have the requisite skills to perform the assignment. The best course of action
consistent with engagement planning principles is to
A. Use the engagement as a training opportunity and let the internal auditors learn as the engagement is performed.
B. Consider using external resources to supplement the needed knowledge, skills, and other competencies and
complete the assignment.
C. Perform the engagement but limit the scope in light of the skill deficiency.
D. Not perform the engagement because the requisite skills are not available.
A. The engagement should be properly conducted and supervised. Using the engagement as a training opportunity
and let the internal auditors learn as the engagement is performed would not be acceptable.
B. The knowledge, skills, and other competencies of the IAA should be considered in selecting internal
auditors for the engagement. The CAE should consider the use of external resources when additional
knowledge, skills, and other competencies are needed.
C. Limiting the scope of the engagement would be done only if external resources are not available. With a scope
limitation management would have to be informed.
D. Not performing the engagement is not an acceptable alternative.

Part 2 (3-Part) : 08/17/23 19:45:12
A primary purpose for establishing a code of conduct within a professional organization is to
A. Require members of the profession to exhibit loyalty in all matters pertaining to the affairs of their organization.
B. Promote an ethical culture among professionals who serve others.
C. Reduce the likelihood that members of the profession will be sued for substandard work.
D. Ensure that all members of the profession perform at approximately the same level of competence.
A. Responsibility to the public takes precedence over the loyal to one’s organization.
B. The purpose of the internal auditing activity is to be an independent, objective assurance and
consulting activity designed to add value and improve operations. The IIA Code of Ethics is intended to be
the ethical guide of conduct for internal auditors.
C. Although, reduced lawsuits might result from establishing a code of conduct, this is not its primary purpose.
D. There are different levels of competence, and thus, it would be impossible for all members of the profession to
have approximately the same level of competence.
The chief executive officer wants to know whether the purchasing function is properly meeting its charge to
"purchase the right materials at the right time in the right quantities." Which of the following types of engagements
addresses this request?
A. An operational engagement relating to the purchasing function.

B. A financial engagement relating to the purchasing department.
C. A compliance engagement relating to the purchasing function.
D. A full-scope engagement relating to the manufacturing operation.
A. An operational audit involves examining and evaluating systems of internal control, overall company
operations, and the quality of performance in carrying out assigned responsibilities.
B. The purpose of a financial statement audit is to evaluate the assertions made by management on the
organization's financial statements and to issue an opinion on the fairness of the statements. A financial
engagement would not be able to determine whether the purchasing function is properly meeting its charge to
"purchase the right materials at the right time in the right quantities."
C. A compliance engagement determines to what degree an organization is operating in an orderly way, effectively
and visibly conforming to certain specific requirements of its policies, procedures, standards, or laws and
governmental regulations. A compliance engagement relating to the purchasing function would not be able to
determine whether the purchasing function is properly meeting its charge to "purchase the right materials at the
right time in the right quantities."
D. While a full-scope engagement relating to the manufacturing operation would include determining whether the
purchasing function is properly meeting its charge to "purchase the right materials at the right time in the right
quantities," it would encompass much more than that.
During an operational audit, an auditor compared the inventory turnover rate of a subsidiary with established
industry standards in order to
A. Assess performance and indicate where additional audit work may be needed.
B. Determine compliance with corporate procedures regarding inventory levels.
C. Test controls designed to safeguard assets.
D. Evaluate the accuracy of internal financial reports.

Part 2 (3-Part) : 08/17/23 19:45:12
A. Such an analytical procedure will provide an indication of the efficiency and effectiveness of the
subsidiary's management of the inventory.
B. Comparison with industry standards will not test compliance.
C. Comparison with industry standards will not test the controls designed to safeguard the inventory.
D. Comparison with industry standards will not test the accuracy of internal reporting.
The internal auditing process is one of critical thinking, analysis, and careful evaluation. All mechanical procedures
are integrated into a larger context of thoughtful inquiry. All engagements include a description and analysis of
internal controls. Engagement clients are selected in a number of ways, with risk being the primary basis for
selection. The departments being considered for possible review in the coming year and attributes of those
departments are as follows:
Annual Probability
Department Assets Costs of Loss
Production A $50,000 $700,000 10%
Production B $5,000,000 $10,000,000 1%
Production C $1,000,000 $1,000,000 1%
Purchasing $50,000 $150,000 10%
Marketing $50,000 $500,000 10%
Shipping $60,000 $100,000 50%
Security $10,000 $100,000 90%
Travel $6,000 $30,000 50%
All of these departments, except two, are on the potential list of engagement clients because of a risk analysis
performed by the chief audit executive. Production department A is on the list because the president thinks too
many bottlenecks occur in that department. The marketing department is on the list because the chief of security
received an anonymous phone call accusing a marketing manager of accepting substantial financial kickbacks
from a media outlet. Internal controls seem adequate in all departments, with the possible exception of marketing.
What is the chief audit executive's most logical definition of risk of loss to be used in selecting engagement clients?
A. Amount of assets in a department.

B. Amount of risk exposure times the probability of loss.
C. Probability of loss.
D. Amount of annual costs in a department.
A. The value of a department's assets is not necessarily related to the amount of possible risk exposure.
B. Risk is the probability that some event will have an impact on the achievement of the organization's
objectives. Risk is measured in terms of impact and likelihood. Thus, the most logical method to measure
risk of loss is to multiple the amount of risk exposure times the probability of loss.
C. The probability of loss is only one side of the equation. The equation would be the amount of risk exposure
times the probability of loss.
D. The amount of a department's annual cost is not necessarily related to the amount of possible risk exposure.
Which of the following is a necessary part of a program for selecting and developing internal audit activity (IAA)
staff?

Part 2 (3-Part) : 08/17/23 19:45:12
A. Developing a written job description for each level of the staff.

B. Requiring a written examination prior to employment.
C. Counseling each member of the staff on career opportunities.
D. Specifying that an accounting degree is necessary for employment.
A. Job (position) descriptions facilitate recruiting by: (a) stating explicit job requirements; (b) providing
objective promotion criteria; (c) used to justify adequate salaries; (d) express organizational expectations
of employees; and (e) compel the IAA to engage in personnel planning.
B. Written examinations are not part of the program of selecting and developing IAA staff.
C. Counseling should be done in regards to enhancing the internal auditors job performance, not career
opportunities.
D. Accounting degrees are necessary if the internal auditor is engaged in analyzing financial and accounting data.
But, in some cases the IAA may need a different type of specialist.
The function of internal auditing, as related to internal financial reports, would be to
A. Determine if there are any employees expending funds without authorization.

B. Ensure compliance with reporting procedures.
C. Review the expenditure items and match each item with the expenses incurred.
D. Identify inadequate controls that increase the likelihood of unauthorized expenditures.
A. This would be a function of the personnel and/or finance departments.
B. The Standards does not require internal auditors to ensure compliance with reporting procedures.
C. There is no expected match of funds flows with expense items in a single time period.
D. Internal auditors are responsible for identifying inadequate controls, for appraising managerial
effectiveness, and for pinpointing common risks.
Written policies and procedures relative to managing the internal audit activity (IAA) should
A. Prescribe the format and distribution of engagement communications and the classification of observations.
B. Result in consistent job performance.
C. Ensure compliance with its performance standards.
D. Give consideration to its structure and the complexity of the work performed.
A. The format and distribution of engagement communications will be different from job to job as each job will have
had its own objectives and goals. Therefore, the policies and procedures of the company cannot prescribe the
format and distribution of the engagement communications.
B. The policies and procedures by themselves will not be able to ensure consistent job performance.
C. The policies and procedures by themselves will not be able to ensure compliance with the performance
standards.
D. The structure and complexity of the work performed will influence the written policies and procedures
of the IAA.

Part 2 (3-Part) : 08/17/23 19:45:12
Question 91 - CIA QZP1C.11 - Strategic Role of Internal Auditing
Internal auditors are periodically assigned to assess the state of the governance process and make appropriate
recommendations for improvement. Which of the following is not an objective of this process?
A. Effectively coordinating the activities of and communicating information among the board, external and internal
auditors, and management.
B. Promoting appropriate ethics and values within the organization.
C. Ensuring effective organizational performance management and accountability.
D. Promoting the effective consolidation of financial reports.
A. An objective of the governance process is to effectively coordinate the activities of and communicate information
among the board, external and internal auditors, and management.
B. An objective of the governance process is to promote appropriate ethics and values within the organization.
C. An objective of the governance process is to ensure effective organizational performance management and
accountability.
D. Promoting the effective consolidation of financial reports is not an objective of the governance process.
A chief audit executive's (CAE) activity report should not
A. Report the weekly activities of the individual internal auditors.

B. List uncorrected reported conditions.
C. Compare engagements completed with engagements planned.
D. List the material engagement observations of major engagements.
A. Reporting the weekly activities of the individual internal auditors would not be included in the activity
report submitted to the board and senior management. This type of information is too detailed for either
the board or senior management.
B. The CAE should consider whether it is appropriate to inform the board regarding previously reported, significant
observations and recommendations in those instances when senior management and board assumed the risk of
not correcting the reported condition. This may be necessary when there have been significant changes that affect
the risk profile (PA 2060-1).
C. Activity reports should be submitted periodically to senior management and the board. These reports should
compare actual performance with the internal audit activity's goals and audit work schedules.
D. Activity reports should highlight significant engagement observations and recommendations and should inform
senior management and the board of any significant deviations from approved engagement work schedules,
staffing plans, and financial budgets; the reasons for the deviations; and action taken or needed (PA 2060-1).
Reporting to senior management and the board is an important part of the auditor's obligation. Which of the
following items is not required to be reported to senior management and/or the board?
A. An audit plan was approved by senior management and the board. Subsequent to the approval, senior
management informed the chief audit executive not to perform an audit of a division because the division's
activities were very sensitive.
B. An annual report summary of the department's audit work schedule and financial budget.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Subsequent to the completion of an audit, but prior to the issuance of an audit report, the audit senior in charge
of the audit was offered a permanent position in the auditee's department.
D. Significant interim changes to the approved audit work schedule and financial budget.
A. The audit plan had been approved by both senior management and the board. The change dictated by senior
management should be reported to the board.
B. This is a standard part of the required reporting to senior management and the board.
C. This would not have to be communicated. The audit work was done. The CAE would have to determine
that there was no impairment of the independence of the senior's work. If there was none, the report could
be issued without reporting the personnel change.
D. This is a standard part of the required reporting to senior management and the board.
Which of the following would be true concerning the internal audit activity relationship with management and audit
committee?
I. Management has the responsibility to review and forward engagement communications to the audit
committee.
II. The accuracy of the engagement information should be verified with management.
III. Final engagement communications should be distributed to those members of the organization who are
able to ensure that the engagement results are given due consideration.
A. I only.
B. I, II and III.
C. I and II only.
D. II and III only.
A. Item I is not true. All engagement communications should go directly from the internal audit activity to the audit
committee.
B. Item I is not true. All engagement communications should go directly from the internal audit activity to the audit
committee.
C. Item I is not true. All engagement communications should go directly from the internal audit activity to the audit
committee. The accuracy of the engagement information should be verified with management.
D. Items II and III are true. Internal auditors discuss conclusions and recommendations with appropriate
levels of management before the CAE issues the final engagement communications. The CAE distributes
the final engagement communication to the management of the audited activity and to those members of
the organization who can ensure engagement results are given due consideration and take corrective
action or ensure that corrective action is taken (PA 2440-1).
You are an internal auditing supervisor reviewing the working papers of a staff internal auditor's overall examination
of the firm's sales function. The pages are not numbered or cross-referenced. Further, the working papers were
dropped and reassembled at random before they were brought to you. You decide to put the working papers in the
proper order according to the Standards. The first stage of this activity is to identify each page as a part of: (A) the
preliminary survey, (B) the review of the adequacy of control processes, (C) the review for effectiveness of control
processes, or (D) the review of results.

Part 2 (3-Part) : 08/17/23 19:45:12
The first page you select documents a test of controls performed during the course of the engagement. This page
belongs with which activity?
A. Review for adequacy of control processes.

B. Review of results.
C. Review for effectiveness of control processes.
D. Preliminary survey.
A. The adequacy of control processes will be present if management has planned in a manner that will provide a
reasonable assurance that the organization's goals and objectives will be achieved efficiently and economically.
The testing of controls is performed in reviews for effectiveness of control systems.
B. The test of controls is not performed in the review of results.
C.
The IAA must evaluate the adequacy and effectiveness of controls in responding to risks within the
organization's governance, operations, and information systems regarding the:
Reliability and integrity of financial and operational information;
Effectiveness and efficiency of operations;
Safeguarding of assets; and
Compliance with laws, regulations, and contracts (Standard 2130.A1).
The testing of controls is performed in reviews for effectiveness of control systems.
D. The preliminary survey might include a review of tests from a prior engagement as background material. But, a
current test would not have yet been performed.
A company controller is concerned that parts may be stolen because there is no formal receiving function (that is,
receiving slips are not filled out). Production raw materials are moved from rail cars directly to the production line,
and vendors are paid based on actual production. Which of the following comments correctly portrays the current
process?
A. There is less handling of goods received, thereby decreasing the cost associated with processing goods
received as well as decreasing the opportunities for errors to enter the system.
B. Shortages of materials in the system will be brought to a supervisor’s attention because of production shutdowns.
C. Goods can be paid for only if they have been used in production. Stolen goods or goods not shipped will not be
paid for.
C. See the correct answer for the explanation.
D. All of the statements are correct. The advantage of the production-based control procedure is that all
significant discrepancies between records become known because production will be shut
down.Supervisors are then in position to take corrective action. A side benefit is that goods cannot be
paid for unless they are used in production. Significant discrepancies with a vendor would, however, have
to be investigated.

Part 2 (3-Part) : 08/17/23 19:45:12
During an engagement to perform an assurance service related to purchasing, the internal auditors found several
violations of organizational policy concerning competitive bidding. The same condition had been reported in an
engagement communication last year and corrective action had not been taken. Which of the following best
describes the appropriate action concerning these repeat observations?
A. The chief audit executive (CAE) should determine whether management or the board has assumed the risk of
not taking corrective action.
B. The engagement communication should note that the same condition was reported in the prior engagement.
C. The chief audit executive (CAE) should determine whether this condition should be reported to the independent
external auditor and any regulatory agency.
D. During the exit interview, management should be informed that observations from the prior engagement
communication have not been resolved.
A. The CAE must establish a follow-up process to monitor and ensure that management actions have been
effectively implemented or that senior management has accepted the risk of not taking action.
B. This action does not satisfy the internal auditor's full responsibly.
C. The CAE has to be very prudent in the use of internal information. No reason is given to indicate that either the
external auditor or regulatory agency has to be informed.
D. This action does not satisfy the internal auditor's full responsibility.
An internal audit activity's staff development program will be deficient if individual employees are
A. Given a large variety of tasks to perform.

B. Assigned to a different supervisor on each job.
C. Expected to study current events on an independent basis.
D. Formally evaluated once every 2 years.
A. Given a large variety of tasks is a method to expand the internal auditors training and experience.
B. The rotation of supervisors would be a chance to expand the internal auditors training and experience.
C. Studying a variety of events is a method to expand the internal auditors training and experience.
D. Each internal auditor's performance should be appraised at least annually. The CAE should also provide
counseling to internal auditors on their performance and professional development.
Question 99 - CIA 595 1.25 - Strategic Role of Internal Auditing
Several members of senior management have questioned whether the internal audit activity (IAA) should report to
the newly established, quality audit function as part of the total quality management process within the company.
The chief audit executive (CAE) has reviewed the quality standards and the programs that the quality audit
manager has proposed. The CAE's response to senior management should include
A. Changing the qualification requirements for new staff members to include quality audit experience.
B. Changing the applicable standards for internal auditing within the company to provide compliance with quality
audit standards.
C. Estimating departmental cost savings from eliminating the internal auditing function.
D. Identifying appropriate liaison activities with the quality audit function to ensure coordination of audit schedules
and overall audit responsibilities.
A. The issue is the reporting relationship of internal auditing, not the qualifications of audit staff.

Part 2 (3-Part) : 08/17/23 19:45:12
B. Adopting the full set of quality auditing standards for the IAA would duplicate functions within the organization.
C. Sufficient information is not given to conclude that the internal audit function should be eliminated.
D. Coordination of audit efforts and the efficiency of audit activities should be a primary responsibility of
the CAE.
The internal auditor of a company has been assigned to perform an audit of the company's investment activities
with particular emphasis on the company's use of new financial instruments referred to as derivatives.
Assume that the chief audit executive (CAE) determines that the department does not have the requisite skills to
conduct an audit of the financial derivatives area. Which of the following actions would be the least acceptable?
A. Notify the audit committee of the problem and assign the most competent auditors to the job.
B. Employ the skills of a financial derivatives expert to consult on the project, and supplement the consulting with a
local seminar on financial derivatives.
C. Determine the requisite knowledge needed and obtain the proper training for auditors if such training is available
within the appropriate time framework outlined by the audit committee.
D. Notify the audit committee of the problem and consult with them regarding outsourcing the audit to a qualified
external auditing firm.
A. The auditor must have the requisite skills and knowledge. Learning about complex financial
instruments "on the job" is not an acceptable substitute for having the necessary skills.
B. Bringing in an outside consultant would be an acceptable alternative as long as the auditors had enough
knowledge to understand the consultant's advice and relationship to the audit.
C. Training staff, if it can be done in a timely fashion, is a reasonable response consistent with the Standards.
D. This is a perfect example of a situation where outsourcing makes sense and should be investigated by the
auditor. See the Standards, Sec. 200 and 210, for a discussion of the skill requirements.
Although all the current members of an internal audit activity (IAA) have good records of performance, the manager
is not sure if any of them is ready to assume a management role. Which of the following is an advantage of
bringing in an outsider rather than promoting from within?
A. The manager can be sure that the new position will be filled by a competent employee.
B. The "modeling" effect is strengthened by bringing in a new role model.
C. Management training costs are reduced when a qualified outsider is hired.
D. Bringing in an outsider is a less expensive alternative than promoting from within.
A. It is assumed that the new hire would be competent, but all information related to the person came from the
outside. The person's competency cannot be evaluated until the person actually starts work.
B. The "modeling" effect occurs when employees see that deserving co-workers receive proper compensation,
including salary increase, job promotion, bonus compensation, etc.
C. If an outside manager is hired then it is assumed that this person is already highly qualified and will not
require additional training.
D. It is generally more expensive to bring in an outsider than promoting from within.

Part 2 (3-Part) : 08/17/23 19:45:12
Which of the following represent(s) appropriate internal audit action in response to the risk assessment process?
I. The low-risk areas may be delegated to the external auditor, but the high-risk areas should be performed by
the internal audit activity.
II. The high-risk areas should be integrated into an engagement work schedule along with the high-priority
requests of senior management and the audit committee.
III. The risk analysis should be used in determining an annual engagement work schedule; therefore, the risk
analysis should be performed only on an annual basis.
A. II only.
B. III only.
C. I and III only.
D. I only.
A. Risk assessment is part of the planning process. Higher perceived risk areas are generally given higher
priority than lower perceived risk areas. Requests by senior management, the audit committee, and the
governing are also considered in establishing engagement work schedule priorities.
B. Risk analysis should be performed anytime there is a change in the work environment.
C. Risk analysis should be performed anytime there is a change in the work environment, and work with the
external auditor should be coordinated in order to minimize duplication of the work effort.
D. Work with the external auditor should be coordinated in order to minimize duplication of work effort.
There are three primary Control Self-Assessment (CSA) approaches. Which one of these approaches should be
used if management desires to minimize the time spent and costs incurred in gathering information?
A. Facilitated team workshops.

B. Controller-produced analysis.
C. Management-produced analysis.
D. Questionnaire (Surveys).
A. Facilitated team workshop is the process of gathering information from work teams that represent different
levels in the business unit or function. The primary format of the workshop may be based on objectives, risks,
controls or processes.
B. Controller-produced analysis is not one of the three CSA approaches.
C. Management-produced analysis covers the other approaches by management groups to produce information
about business processes, risk management activities and control procedures.
D. Surveys or questionnaires tend to ask simple "Yes or No" or "Have-Have Not" questions that are
carefully written to be understood by the target recipients. Surveys are often used if the desired
respondents are too numerous or widely dispersed to participate in a workshop. They are also preferred if
the culture in the organization may hinder open, candid discussions in workshop settings, or if
management desires to minimize the time spent and costs incurred in gathering the information.

Part 2 (3-Part) : 08/17/23 19:45:12
The advantage attributed to the establishment of internal auditing field offices for work at foreign locations is best
described as
A. The possibility of increased objectivity of personnel assigned to a field office.

B. More contact with senior personnel leading to an increase in control.
C. The increased ease of maintaining uniform organization-wide standards.
D. A reduction of travel time and related travel expense.
A. It's possible that the internal auditors objectivity could be diminished because of the closer contact with the
engagement clients.
B. The establishment of an internal auditing office in a foreign country would lead to reduced contact and control,
not more.
C. It's more likely that maintaining the organization's wide standards is more difficult because of decentralization.
D. A reduction of travel time and related expenses would be a primary advantage to establishing a field
office.
The first phase of the risk assessment process is to identify and catalog the auditable activities of the organization.
Which of the following would not be considered an auditable activity?
A. The agenda established by the audit committee for one of its quarterly meetings.
B. Statutory laws and regulations as they affect the organization.
C. Computerized information systems.
D. General ledger account balances.
A. The audit committee's agenda for an audit committee meeting would not be an auditable activity, but
may contain audit activities conducted by the internal auditing activity (IAA) .
B. This is an auditable activity specifically identified in the Standards (2120.A1).
C. This is an auditable activity specifically identified in the Standards (2120.A1).
D. This is an auditable activity specificially identified in the Standards (2120.A1).
Question 106 - CIA 597 III.35 - Control Self-Assessment (CSA)
Control self-assessment is a process that involves employees in assessing the adequacy of controls and identifying
opportunities for improvement within an organization. Which of the following are reasons to involve employees in
this process?
I. Employees become more motivated to do their jobs right.
II. Employees are objective about their jobs.
III. Employees can provide an independent assessment of internal controls.
IV.Managers want feedback from their employees.
A. I and IV.
B. I and II.
C. III and IV.
D. II and IV.
A. Involving employees in assessing internal controls can serve as a motivator to them to seek continuous
improvement in their jobs. Furthermore, since employees are often closer to the actual work being done
than managers, their feedback can provide management with insights into control weaknesses.

Part 2 (3-Part) : 08/17/23 19:45:12
B. Employees are not generally objective about their jobs.
C. While it is true that managers want feedback from their employees, it is not true that employees can provide an
independent assessment of internal controls. The fact that they are employees makes them not independent.
D. Employees are not generally objective about their jobs.
A large bank developed a new integrated customer information system to replace formerly separate systems for
deposits, credit reporting, and account management. Customer service representatives liked the new system until
they discovered that its account management system did not cover all types of accounts. As a result of this flaw,
several customers were initially denied loans for which they were actually qualified and threatened to move their
business to another bank.
After the system was changed so the account management functions included all the account types, the customer
service representatives noticed that occasionally the consolidated customer profiles had inflated balances. This
flaw in the system could have most likely been prevented by better
A. Software mapping analysis

B. Testing procedures.
C. User specifications.
D. Application control reviews.
A. Software mapping analysis is used to detect non-executed code in software.
B. The flaw should have been detected by the examination of test data.
C. Data errors are not generally addressed by user specifications.
D. Application control review is the identification, analysis, testing, and evaluation of controls in application systems,
usually performed on systems already in use.
Question 108 - 1.B - Strategic Role of Internal Auditing
When assessing a function or a process, the internal audit activity (IAA) should consider the work of the other
departments that are responsible for reviewing that function or process because
A. The internal auditor would be able to produce better forecasting models for management.
B. Reviewing and testing of the other department's procedures may reduce necessary audit coverage of the
function or process.
C. The internal auditor would be able to give assurance that the function or process has proper control without
doing any further review work.
D. The internal auditor would be able to provide additional technical assistance to the department.
A. This is not correct since the internal auditor would still have to do some review work nevertheless.
B. By reviewing and testing the other departments' procedures the internal auditor may be able to reduce
the necessary audit coverage of the function or process.
C. This is not correct since the internal auditor would still have to do some review work nevertheless.
D. It is possible that the IAA might be able to provide some additional technical knowledge to the other
departments; however, this does not explain the reason why the IAA should consider the work of the other
departments.

Part 2 (3-Part) : 08/17/23 19:45:12
You are the chief audit executive (CAE) of a parent organization that has foreign subsidiaries. Independent external
audits performed for the parent are not conducted by the same firm that conducts the foreign subsidiary audits.
Because the internal audit activity occasionally provides direct assistance to both external firms, you have copies of
audit programs and selected working papers produced by each firm.
The foreign subsidiary's external audit firm wants to rely on an audit of a function at the parent organization. The
audit was conducted by the internal audit activity (IAA). To place reliance on the work performed, the foreign
subsidiary's auditors have requested copies of the working papers. What is the most appropriate response to the
foreign subsidiary's auditors?
A. Provide copies of the working papers.

B. Ask the board for permission to release the working papers.
C. Ask the parent's audit firm if it is appropriate to release the working papers.
D. Refuse to provide the working papers under any circumstances.
A. Since the audit was conducted by the IAA it would be permissible to provide copies of the working
papers, without having to ask the permission of the external auditors.
B. It would be permissible to provide the working papers without board permission.
C. It would be permissible to provide the working papers without having to ask the permission of the parent's audit
firm. The working papers are the property of the organization.
D. It would be permissible to provide the working papers. The working papers are the property of the organization.
Exchange of engagement communications and management letters by internal and external auditors is
A. Consistent with the coordination responsibilities of the chief audit executive.

B. Not consistent with the independence guidelines of the Standards.
C. A violation of the Code of Ethics.
D. Not addressed by the Standards.
A. The CAE should share information and coordinate activities with other internal and external provides of
assurance and consulting services to ensure proper coverage and minimize duplication of efforts
(Standard 2050). Thus, the CAE is responsible to ensure that there is a proper exchange of engagement
communications and management letters by internal and external auditors.
B. The independence guidelines of the Standards are not relevant to the exchange of engagement
communications and management letters by internal and external auditors.
C. Exchanging engagement communications and management letters is not a violation of the Code of Ethics.
D. The Standards do address the exchange of engagement communications and management letters.
The requirements for staffing level, education and training, and research should be included in
A. The annual plan for the internal audit activity.

B. The internal audit activity's policies and procedures manual.
C. Job descriptions for the various staff positions.

Part 2 (3-Part) : 08/17/23 19:45:12
D. The internal audit activity's charter.
A. The annual plan for the IAA would involve establishing staffing and financial budgets.
B. Policies and procedures would describe the overall organization and its relationship to employees, but would not
contain any information on research matters.
C. Job (position) descriptions would not contain any research requirements.
D. The charter describes the overall purpose, authority and responsibility of the IAA.
Question 112 - CIA 594 III.57 - Types of Engagements
Which of the following is an example of an efficiency measure?
A. The number of insurance claims processed per day.

B. The goal of becoming a leading manufacturer.
C. The goal of increasing market share.
D. The rate of absenteeism.
A. An efficiency measure compares input to output, and the number of insurance claims processed per
day compares output, or process claims, to input, or a day's work. When a company has an efficient
organizational structure, it facilitates accomplishing goals and objectives using minimum resources along
with minimum unsought consequences.
B. The goal of becoming a leading manufacturer relates to effectiveness rather than efficiency.
C. Increasing market share relates to effectiveness, not efficiency.
D. With the rate of absenteeism, we do not compare input and output.
The chief audit executive (CAE) can best ensure that staff internal auditors are prepared to meet their existing
responsibilities by
A. Having experienced internal auditors supervise their work closely.

B. Counseling them on their performance and providing appropriate training opportunities.
C. Conducting formal evaluations of their performance on each assignment.
D. Enforcing established recruiting and selection criteria.
A. Having supervisors monitor the work of the junior staff does nothing to ensure that the staff are prepared to
perform their duties. All this does identify very quickly when the staff do not perform their jobs.
B. Through training and counseling (or feedback) the CAE can best assure that staff have the skills and
competencies necessary to perform their jobs.
C. Conducting formal evaluations after each assignment only identifies whether the staff member was or was not
prepared. It does nothing to make certain that they will be prepared for the next engagement.
D. While this is the starting point of making sure that the staff are prepared to perform their jobs, it is only the start.
Training and other professional development tools need to be provided on an ongoing basis to ensure staff are
able to perform their duties.

Part 2 (3-Part) : 08/17/23 19:45:12
Question 114 - CIA 594 III.90 - Strategic Role of Internal Auditing
In recent years, which two factors have changed the relationship between internal auditors and external auditors so
that internal auditors are partners rather than subordinates?
A. The use of computerized accounting systems and the evolving economics of external auditing.
B. The globalization of audit entities and the increased reliance on computerized accounting systems.
C. The increasing liability of external auditors and the increasing professionalism of internal auditors.
D. The increasing professionalism of internal auditors and the evolving economics of external auditing.
A. The use of computerized accounting systems would have no effect on the relationship between internal and
external auditors.
B. The globalization of the audit entities would have no effect on the relationship between internal and external
auditors.
C. The increasing liability of external auditors has not led to a change in the relationship between internal auditors
and external auditors so that they are partners rather than subordinates.
D. The two primary factors that have changed the relationship between internal and external auditors are:
(1) The internal auditing profession has become more and more professional with more internal auditors
being professional auditors. This has increased the quality level of work done by the internal auditors and
also increased the scope of the work that is done by them. (2) The cost of the external audit has grown so
much in recent years that the companies are looking for any way to reduce that cost. This can be
accomplished by having a strong, objective, competent internal auditor function that the external auditor
can reply on to some extent.
Question 115 - CIA QZP1B.20 - Strategic Role of Internal Auditing
The internal and external auditing work should be coordinated to
A. Minimize duplication of efforts.

B. All the answers presented are correct.
C. Ensure adequate audit coverage.
D. Potentially reduce the cost of the external audit.
A. All the answers are correct.
B. All of the answers are correct. Coordination with the external auditor is important for the company.
There is potential for increased efficiency of both audits areas and reduced cost of the external audit. Also,
the internal and external auditors should coordinate together to ensure adequate audit coverage and to
minimize duplicate efforts.
C. All the answers are correct.
D. All the answers are correct.
Which of the following is not a key objective of the risk management process?
A. Risk is periodically reassessed on an ongoing basis.

B. Risks that arise from business strategies are identified and prioritized.
C. Risk mitigation (reduction) activities are designed and implemented to reduce, or manage, risk at levels that are
acceptable.
D. Review of previous risk evaluation reports by management, external auditors, and other sources.

Part 2 (3-Part) : 08/17/23 19:45:12
A. This is a key objective of the risk management process.
B. This is a key objective of the risk management process.
C. This is a key objective of the risk management process.
D. The review of past risk evaluation reports is not a key objective of the risk management process. The
internal auditor must determine that the organization's risk management processes address the five key
objectives in order to formulate an opinion on the overall adequacy of the risk management processes.
The internal auditor found that the purchasing department has a policy of setting all purchasing lead times to the
highest number of days experienced within each product subassembly, even though some subassemblies required
3 or more months to complete. To address the objective of reducing inventory holding costs related to this policy,
the internal auditor should focus on
A. Evaluating whether product-line assignments were rotated among the members of the purchasing department.
B. Testing those products having the highest sales to determine the average number of days that the completed
products were held in inventory.
C. Identifying signature approval authority among members of the purchasing department in relation to any
computer system controls.
D. Reviewing production requirements for a sample of products to determine at which point in the production
process materials and subassemblies are needed.
A. The rotation of job assignments is not related to the reduction of inventory storage costs.
B. Testing products with the highest sales to determine days in inventory will not impact the inventory storage costs.
C. The signature approval process is not related to the reduction of inventory storage costs.
D. By investigating when in the production process the materials need to be ordered, the internal auditor
will be able to reduce the number of days that parts are held in inventory and this will reduce the inventory
storage costs.
Policies and procedures relative to managing the internal audit activity should
A. Ensure compliance with its performance standards.

B. Give consideration to its structure and the complexity of the work performed.
C. Prescribe the format and distribution of engagement communications and the classification of engagement
observations.
D. Result in consistent job performance.
A. Complying with performance standards is a quality issue, and policies and procedures will not necessarily
ensure compliance with performance standards.
B. The form and content of written policies and procedures should be appropriate to the size and structure
of the IAA and the complexity of its work.
C. Policies and procedures provide general guidelines whereas prescribing the format and distribution of
engagement communications and classification of engagement observations are discretionary measures that will
depend on the size and structure of the IAA.
D. Policies and procedures in themselves will not result in consistent job performance.

Part 2 (3-Part) : 08/17/23 19:45:12
The advantages of implementing a Control Self-Assessment (CSA) program are:
I. Employee understanding of the company’s risk and controls is enhanced.
II. There is enhanced accountability.
III. It encourages more open communication, teamwork and continuous improvement.
IV. It is a good technique for uncovering organizational fraud.
A. I and II only.
B. II and III only.
A. CSA enhances employee understanding and accountability. In addition, it encourages more open
communication, teamwork and continuous improvement.
B. CSA enhances employee understanding and accountability. In addition, it encourages more open
communication, teamwork and continuous improvement.
C. There are several advantages of implementing a CSA program. These advantages are: (1) Enhanced
employee understanding of risk and controls; (2) Empowers the employees and enhances accountability;
(3) Enhances employee consciousness; (4) Provides mechanism for early risk detection; and (5)
Encourages more open communication, teamwork and continuous improvement.
D. CSA is not a technique used to uncover fraud. At best, it can be used to show were control weaknesses are in
the organization.
Question 120 - CMA 1286 3.26 - Types of Engagements
Some account balances, such as those for pensions or leases, are the results of complex calculations. The
susceptibility to material misstatements in these types of accounts is defined as
A. Sampling risk.
B. Audit risk.
C. Inherent risk.
D. Detection risk.
A. The definition of sampling risk is the risk that a particular sample will not be representative of the entire
population.
B. The definition of audit risk is the risk that the auditor may unknowingly fail to appropriately modify his or her
opinion on financial statements that are materially misstated.
C. The definition of inherent risk is the susceptibility of an assertion to a material misstatement, assuming
that there are no related internal control structure policies or procedures. Complex calculations are
subject to inherent risk just because they are complex and there are many opportunities for errors.
D. The definition of detection risk is the risk that the auditor will not detect a material misstatement that exists in an
assertion.

Part 2 (3-Part) : 08/17/23 19:45:12
In regards to resource management the CAE has the responsibility for establishing a program for selecting and
developing the internal auditing staff. All of the following should be part of that program except
A. Establishing annual performance objectives for internal auditors.

B. Appraising each internal auditor’s performance at least annually.
C. Developing a job description for each member of the auditing staff.
D. Developing a compensation plan for the internal auditing staff.
A. Part of the CAE's responsibility for selecting and developing the internal auditing staff is to make sure that
annual performance objectives for internal auditors are established.
B. Appraising each internal auditor's performance at least annually would be part of the CAE’s program for
selecting and developing the internal auditing staff.
C. Part of the CAE's program for selecting and developing the internal auditing staff is to make sure each staff
member has a written job description.
D. Developing a compensation plan for the internal auditing staff would not be part of the CAE's program
for selecting and developing the IAA. This program would be developed by the human resource
department.
A consulting activity appropriately performed by the internal audit activity (IAA) is
A. Drafting procedures for systems of control.

B. Designing systems of control.
C. Installing systems of control.
D. Reviewing systems of control before implementation.
A. Drafting procedures for systems of control is presumed to impair independence.
B. Designing a system of control is presumed to impair objectivity.
C. Installing systems of control is presumed to impair independence.
D. Reviewing systems of control before implementation is not presumed to impair objectivity.
Which of the following is true concerning the internal audit’s investment in a Control Self-Assessment (CSA)
program?
I. Its role may be quite significant. It may sponsor, design, implement, and in effect, own the process,
conducting the training, supplying the facilitators, scribes, and reporters, and orchestrating the participation
of management and work teams.
II. Its role may be minimal, serving as interested party and consultant of the whole process and as ultimate
verifier of the evaluations produced by the teams.
A. Somewhere between I and II.

B. II only.
C. I only.
D. None of the above.

Part 2 (3-Part) : 08/17/23 19:45:12
A. In most programs, internal audit's investment in the organization’s CSA effort is somewhere between
the two extremes. Its role may be quite significant. It may sponsor, design, implement, and in effect, own
the process, conducting the training, supplying the facilitators, scribes, and reporters, and orchestrating
the participation of management and work teams. In other CSA programs, its role may be minimal, serving
as interested party and consultant of the whole process and as ultimate verifier of the evaluations
produced by the teams. In most programs, internal audit’s investment in the organization’s CSA efforts is
somewhere between the two extremes.
B. This describes the smallest role that the IAA may have in the organization's CSA effort. But, it is possible that
the IAA's role may be quite significant.
C. This describes the most significant role that the IAA may have in the organization's CSA effort. But, it is possible
that the IAA’s role may be minimal.
D. It's most likely the internal auditor will have some role to play in the organization's CSA effort.
Risk modeling or risk analysis is often used in conjunction with development of long-range engagement work
schedules. The key input in the evaluation of risk is
A. Management concerns and preferences.

B. Previous engagement results.
C. Specific requirements of professional standards.
D. Judgment of the internal auditors.
A. In order to assess the risk posed by management, judgment on part of the internal auditor is required.
B. Previous engagement results are not the key input in the evaluation of risk.
C. The professional standards are not the key input in the evaluation of risk.
D. Matters to be considered in establishing engagement work schedule priorities include an updated

assessment of risks and effectiveness of risk management and control processes. Risk is the probability
of an event occurring that will have an impact on the achievement of objectives. Thus, in assessing the
probability of risk of a long-range engagement work the judgment of the internal auditor is required.
To avoid creating conflict between the chief executive officer (CEO) and the audit committee, the chief audit
executive (CAE) should
A. Submit copies of all engagement communications to the CEO and audit committee.
B. Strengthen independence through organizational status.
C. Discuss all pending engagement communications to the CEO with the audit committee.
D. Request board establishment of policies covering the internal audit activity's relationships with the audit
committee.
A. It is more likely that the CEO and audit committee would receive only summary reports. Also, submitting copies
of all engagement communications might not necessarily help avoid a conflict between the parties (CEO and audit
committee).
B. Strengthening the CAE's independence through organizational status might not necessarily help avoid a conflict
between the parties (CEO and audit committee).
C. It is more likely that the CEO and audit committee would receive only summary reports. Also, discussing
engagement communications with both the CEO and audit committee might not necessarily help avoid a conflict

Part 2 (3-Part) : 08/17/23 19:45:12
between the parties (CEO and audit committee).
D. The best method to help avoid a conflict between the CEO and audit committee is to have specific
policies and procedures that cover the IAA relationship with the audit committee.
The chief audit executive (CAE) should establish goals as part of the planning process for the internal audit activity
(IAA). What are the traits of internal auditing goals?
A. Budgeted and approved.

B. Planned and attainable.
C. Requested and approved.
D. Measurable and attainable.
A. Goals have to be measurable and attainable. Goals should be attainable within the budget.
B. Goals have to be measurable and attainable.
C. Goals are generally not requested. Goals are established by the CAE.
D. The goals of the IAA should be capable of being accomplished within the specified operating plans and
budgets and, to the extent possible, should be measurable.
It is the function of executive management and the audit committee to determine the role of internal audit in the risk
management process. The internal auditors role is likely to be determined by such factors as
A. Ability of the internal auditing staff.

B. Culture of the organization.
C. Local conditions and customs of the country.
A. The ability of the internal auditing staff is a factor that will determine the role the internal audit will play in the risk
management process.
B. The culture of the country is a factor that will determine the role the internal audit will play in the risk
management process.
C. Local conditions and customs of the country are also factors in determining the role the internal audit will play in
the risk management process
D. Factors that would determine the role of the internal audit in the risk management process include the
culture of the organization, ability of the internal auditing staff, local conditions, and customs of the
country.
Question 128 - CIA R98 I.73 - Planning
The internal audit activity (IAA) of a large organization has established its operating plan and budget for the coming
year. The operating plan is restricted to the following categories: a prioritized listing of all engagements, staffing, a
detailed expense budget, and the commencement date of each engagement. Which of the following best describes
the major deficiency of this operating plan?

Part 2 (3-Part) : 08/17/23 19:45:12
A. Requests by management for special projects are not considered.

B. Measurability criteria and targeted dates of completion are not provided.
C. Knowledge, skills, and other competencies required to perform work are ignored.
D. Opportunities to achieve operating benefits are ignored.
A. The requests of management would have been included in the stage of determining which engagements will be
performed.
B. Any plan should have in it dates for completion and a way of measuring the success of the engagement
or performance. This plan does not have this element within it and that the major deficiency of this plan.
C. While these are not specifically listed in the plan, they would have been considered when the plan was being
made as it is part of the process of determining which engagements will be performed, and who will staff and
perform the individual engagements.
D. While these are not specifically listed in the plan, they would have been considered when the plan was being
made as it is part of the process of determining which engagements should be performed, and the priority of the
individual engagements.
Having been given the task of developing a performance appraisal system for evaluating the performance of a
large internal auditing staff, you should
A. Provide primarily for the evaluation of criteria such as diligence, initiative, and tact.
B. Provide for an explanation of the appraisal criteria and methods at the time the appraisal results are discussed
with the internal auditor.
C. Provide primarily for the evaluation of specific accomplishments directly related to the performance of the
engagement work program.
D. Provide general information concerning the frequency of evaluations and the way evaluations will be performed
without specifying their timing and uses.
A. The listings are traits and not specific accomplishments performed by the internal auditing staff.
B. An explanation of the appraisal criteria and methods should be communicated to the employees at the beginning
employment, not at the time of the appraisal.
C.
The CAE should establish a program for selecting and developing the human resouces of the IAA. The
program should provide for:
Developing written job descriptions for each level of the audit staff.
Selecting individuals who are qualified and competent regarding the areas being audited and in
applying internal auditing skills.
Training and providing continuing educational opportunities for each internal auditor.
Establishing annual performance objectives for internal auditors.
Appraising each internal auditor's performance at least annually.
Providing councel to internal auditors on their performance and professional development.
D. General information on the timing and method of the evaluations has to be clearly communicated to the staff.
But, this type of information does not provide specifics on the staff's performance.
A service organization is currently experiencing a significant downsizing and process reengineering. Its board of

Part 2 (3-Part) : 08/17/23 19:45:12
directors has redefined the business goals and established initiatives using in-house developed technology to meet
these goals. As a result, a more decentralized approach has been adopted to run the business functions by
empowering the business branch managers to make decisions and perform functions traditionally done at a higher
level. The internal auditing staff is made up of the chief audit executive (CAE), two managers, and five staff
auditors, all with financial background. In the past, the primary focus of successful internal audit activities (IAA) has
been the service branches and the six regional division headquarters, which support the branches. These division
headquarters are the primary targets for possible elimination. The support functions such as human resources,
accounting, and purchasing will be brought into the national headquarters, and technology will be enhanced to
enable and augment these operations.
Assuming that total available resources remain the same, what activities should the IAA perform to best serve the
organization?
A. Increase engagement time in functions being centralized.

B. Increase engagement time in service branches.
C. Continue the allocation of engagement time as before.
D. Decrease engagement time in systems development.
A. In this problem the support functions are being centralized and the business functions being
decentralized. These changes are occurring concurrently. Thus, the IAA effort in assessing the systems
development activities should be increased.
B. Increasing the engagement time in service branches would only give minimal benefit. More benefit would be
realized by devoting effort in assessing the systems development activities.
C. Since there have been changes in the organization's goals this would require changes by the IAA.
D. The engagement time in systems development should be increased, not decreased.
The consultative approach to internal auditing emphasizes
A. Participation with engagement clients to improve methods.

B. Fraud investigation.
C. Implementation of policies and procedures.
D. Imposition of corrective measures.
A. Consultation with the engagement client helps to facilitate good relations. This is important because the
engagement client will then be more likely to accept the recommendations of the internal auditor.
B. Consultation is not likely if it involves a fraud investigation.
C. Internal auditors are not considered independent if they implement policies and procedures for the engagement
client.
D. This could lead to an adversarial relationship.
As the acceptable level of detection risk decreases, an auditor may
A. Reduce substantive testing by relying on the assessment of inherent and control risk.
B. Lower the assessed level of control risk from the maximum level to below the maximum.
C. Postpone the planned timing of substantive tests from interim dates to the year-end.
D. Eliminate the assessed level of inherent risk from consideration as a planning factor.

Part 2 (3-Part) : 08/17/23 19:45:12
A. As the acceptable level of detection risk decreases, substantive testing would be increased.
B. Control risk is assessed prior to determining the level of detection risk.
C. If the acceptable level of detection risk decreases, the auditor will have to modify the audit program in
order to obtain greater assurance from substantive testing. Greater assurance can be obtained by (1)
selecting a more effective audit procedure, (2) applying procedures nearer to year-end, or (3) increasing
the extent of particular tests.
D. An auditor should always consider the assessed level of inherent risk when planning an audit.
Internal auditors can be considered as leading agents for change within an organization. Which of the following is
not a good way to promote this concept?
A. A directive from top management, stating that internal auditors will be used for all process-improvement projects.
B. Bulletins that highlight widespread or universal applications of engagement observations.
C. A brochure describing what internal auditing can do and the qualifications of the internal auditors.
D. Postengagement questionnaires to obtain information on how engagement clients perceive the internal audit
activity.
A. Directives are not a good method of promoting. There may be resentment towards the internal auditors.
B. Bulletins are a good method to promote ideas, concepts, etc.
C. Brochures are a good method to promote ideas, concepts, etc.
D. A postengagement questionnaire is a good method to get the engagement client to make change.
When determining the number and experience level of an internal audit staff to be assigned to an engagement, the
chief audit executive (CAE) should consider all of the following except the
A. Available internal audit activity resources.

B. Lapsed time since the last engagement.
C. Complexity of the engagement.
D. Training needs of internal auditors.
A. The available internal audit activity resources will be considered in the determination of the number and
experience level of internal audit staff needed on an engagement.
B. The amount of time that has passed since the last engagement will not effect the decision regarding the
number and experience level of internal audit staff to be engaged in an assignment. All of the other
choices are factors that will be considered in this decision. Even if the last engagement was only a short
time ago, the fact that the engagement is being performed indicates that it should be treated as a full
engagement and thereby receive all of the same staffing resources as if the last engagement had been
years before.
C. The complexity of the engagement will be considered in the determination of the number and experience level of
internal audit staff needed on an engagement.
D. The training needs of internal auditors will be considered in the determination of the number and experience
level of internal audit staff needed on an engagement.

Part 2 (3-Part) : 08/17/23 19:45:12
Which of the following abilities is not important in marketing internal auditing to management?
A. Knowing what executive management wants the internal auditors to do.

B. Preparing engagement communications competently and professionally.
C. Knowing whom the internal auditors serve as customers.
D. Explaining the current use of internal auditing software to executive management.
A. Knowing the specific requirements of executive management would be a good marketing tool.
B. The ability of the IAA to prepare engagement communications competently and professionally would be a good
marketing tool.
C. Identifying their customers would be a good marketing tool.
D. It is likely that executive management would not have an interest in knowing the details of the internal
auditing software.
You are the chief audit executive (CAE) of a parent organization that has foreign subsidiaries. Independent external
audits performed for the parent are not conducted by the same firm that conducts the foreign subsidiary audits.
Because the internal audit activity (IAA) occasionally provides direct assistance to both external firms, you have
copies of audit programs and selected working papers produced by each firm.
The foreign subsidiary's auditors would like to rely on some of the work performed by the parent organization's
audit firm, but they need to review the working papers first. They have asked you for copies of the working papers
of the parent organization's audit firm. What is the most appropriate response to the foreign subsidiary's auditors?
A. Provide copies of the working papers and notify the parent's audit firm that you have done so.
B. Provide copies of the working papers without notifying the parent's audit firm.
C. Notify the parent's auditors of the situation and request that they either provide the working papers or authorize
you to do so.
D. Refuse to provide the working papers under any circumstances.
A. The external auditors' working papers is confidential information, so the parent's audit firm will need to provide
authorization before releasing the working papers.
B. The external auditors' working papers is confidential information, and this confidentiality needs to be respected.
C. Access to the external auditors' programs and working papers may be important in order for the internal
auditors to be satisfied as to the propriety for internal audit purposes of relying on the external auditors'
work. Such access carries with it the responsibility for internal auditors to respect the confidentially of
those programs and working papers. In this case, the internal auditor should notify the parent's auditors
and request that they either provide the working papers or authorize the internal auditor to do so.
D. The CAE has the responsibility to coordinate the activities of the internal and external auditors.
An advisable strategy for a participant in a meeting of the employees would be to
A. Present views as trial balloons that can be researched later.

B. Consider the opinions and information needs of other participants before speaking.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Present strong opinions on one side of a proposal right away.

D. Read the agenda and supporting materials for the meeting during the early part of the meeting to prepare for
later discussion.
A. Ideas should be researched before the meeting in order to be prepared and productive.
B. Understanding and analyzing the employees' opinions and needs before speaking enables the speaker
to express his/her ideas in the most persuasive manner.
C. Unless the speaker thoroughly understands the participants' opinions and/or the speaker is the most powerful
person in the organization, it is better to not present strong opinions on one side of a proposal until the degree of
support for that view is clear.
D. If the agenda and supporting materials are reviewed in advance, it will enable participants to come to the
meeting prepared.
An important part of an internal audit activity's personnel development plan should be on-the-job training. Which of
the following activities is the most important in broadening a staff internal auditor's knowledge?
A. Rotating staff internal auditors through a variety of assignments.

B. Developing expertise in a few particular areas by continuously assigning the same internal auditor to those areas.
C. Assigning staff internal auditors to particular supervisor-trainers for extended periods.
D. Allowing staff internal auditors to participate in choosing the projects assigned.
A. Rotating staff through a variety of assignments is the best way to assure that the staff gain the
necessary knowledge and experience to develop profressionally.
B. Professional development requires experience in a number of areas, not just a great deal of experience in one
area. Therefore, assigning staff to the same types of jobs all of the time will not broaden the staff's knowledge.
C. In order to develop as much as possible professionally, it is important that staff are exposed to different people
and different managers. This does not happen if they are assigned to the same supervisor-trainer for an extended
period of time.
D. Part of professional development is assuring that staff are assigned to jobs that will provide them the necessary
skills and experience to grow. If the staff choose the jobs themselves, this may not occur as it should.
Question 139 - CIA 595 III.22 - Types of Engagements
An example of an internal nonfinancial benchmark is
A. The percentage of customer orders delivered on time at the company's most efficient plant.
B. A $50,000 limit on the cost of employee training programs at each of the company's plants.
C. The average actual cost per pound of a specific product at the company's most efficient plant.
D. The labor rate of comparably skilled employees at a major competitor's plant.
A. Benchmarking is a continuous process that entails both quantitative and qualitative measurement of
the difference between the performance of an activity and the performance by the best (either within the
company or outside the company). The percentage of customer orders delivered on time at the company's
most efficient plant is an example of a nonfinancial benchmark.
B. A dollar limit on training programs is a financial benchmark.
C. A product's average actual cost per pound is a financial benchmark.

Part 2 (3-Part) : 08/17/23 19:45:12
D. The labor rate of comparably skilled employees at a major competitor's plant is a financial benchmark.
The best means for the internal audit activity (IAA) to determine whether its goal of implementing broader coverage
of functional activities has been met is through
A. Implementation of a quality assurance program.

B. Accumulation of engagement observations by engagement client.
C. Surveys of management satisfaction with the internal audit activity.
D. Comparison of the engagement work schedule with actual engagement activity.
A. One of the purposes of the quality assurance and improvement program (QAIP) is to know whether the IAA
adds value and improve operations. This means understanding whether the IAA has the right audit coverage.
However, comparing the engagement work schedule with actual enagement activity is the better technique in
determining whether the IAA's broader audit coverage is being met.
B. While this information may be useful for some purposes, it will not help the IAA assess whether it met its goal of
broader coverage of functional activities.
C. While this feedback from management is useful, it will not help the IAA assess whether it met its goal of broader
coverage of functional activities.
D. The IAA work schedule is a planning tool used to tell the CAE what engagements should be performed,
when they will be performed, and the estimated time required to conduct the engagements. Comparing the
engagement work schedule with actual activities performed is the best means of determining whether the
IAA's audit coverage goals are being met.
In the annual review of the data center of a nationwide mortgage servicing company, the internal audit manager
was concerned about the data center not having an adequate contingency plan. The audit manager was especially
concerned because the data center was located close to a river that occasionally flooded and in the vicinity of a
major railroad and a major highway.
Even though floodwaters might not reach the data center, being located adjacent to a river is associated with the
risk that in the event of a significant flood
A. Employees might be unable to report for work.

B. Customers might refuse to do business with the company.
C. Many customers might fail to make timely payments.
D. Expensive equipment might need to be replaced.
A. If the area floods, some employees may be unable to report for work due to flooded roads or to the
demands on them to care for injured loved ones or their own damaged property.
B. Customers are unlikely to refuse to do business with the company because mortgagee customers generally do
not have control over how mortgage servicing rights are assigned.
C. Because the company is a nationwide mortgage servicing company, most payments will be coming from places
other than the immediate vicinity, which would most likely not be affected by a flood in the local area. Mail
containing payments might be delayed, but large groups of customers are unlikely to fail to make payments.
D. As long as floodwaters do not reach the data center, there should be no special threat to the equipment.

Part 2 (3-Part) : 08/17/23 19:45:12
The purpose of a due diligence includes all of the following except
A. To validate the reasons for making the transaction.

B. To determine the buyer’s ability to purchase the company.
C. To determine the organization’s future consolidated structure.
A. A primary reason to conduct a due diligence engagement is to validate the reasons for making the transaction.
B. A seller might also conduct a due diligence analysis on the buyer to determine the buyer’s ability to conduct the
deal.
C. Determining the organization's future consolidated structure is not the reason a due diligence is
conducted.
D. Determining the organization's future consolidated structure is not the reason a due diligence is conducted.
An engagement performed at an organization's payroll department has revealed various control weaknesses.
These weaknesses along with recommendations for corrective actions were addressed in the final engagement
communication. This communication should be most useful to the organization's
A. Payroll manager.
B. Treasurer.
C. President.
D. Audit committee of the board of directors.
A. The full audit report should be distributed to everyone who has a direct interest in the audit. This
includes the executive or executives to whom internal audit reports, the person to whom people will reply
about the report, persons responsible for the activities or operations audited, and people who will need to
take corrective action as a result of the audit. The payroll manager has responsibility for the payroll
function and thus this communication should be most useful to that person.
B. The full audit report should be distributed to everyone who has a direct interest in the audit. This includes the
executive or executives to whom internal audit reports, the person to whom people will reply about the report,
persons responsible for the activities or operations audited, and people who will need to take corrective action as a
result of the audit. The treasurer is not responsible for the payroll function.
C. The full audit report should be distributed to everyone who has a direct interest in the audit. This includes the
result of the audit. The president is not responsible for the payroll function.
D. The full audit report should be distributed to everyone who has a direct interest in the audit. This includes the
result of the audit. The audit committee of the board of directors is not responsible for the payroll function.
Question 144 - CIA R98 I.2 - Planning
Which of the following factors is considered the least important in deciding whether existing internal audit resources
should be moved from an ongoing compliance engagement to a divisional-level engagement requested by
management?

Part 2 (3-Part) : 08/17/23 19:45:12
A. The potential for significant regulatory fines associated with the ongoing engagement.
B. A financial audit of the division performed by the external auditor a year ago.
C. The potential for fraud associated with the ongoing engagement.
D. An increase in the level of expenditures experienced by the division for the past year.
A. The potential of significant regulatory fines is likely to be a more important factor in the use of limited internal
audit resources than the results of an external audit that was performed a year ago.
B. The results of an external audit that was performed a year ago will likely be the least important factor in
the determination of priorities. It is highly likely that any adverse findings of the external audit have already
been acted upon.
C. The potential fraud is likely to be a more important factor in the use of limited internal audit resources than the
results of an external audit that was performed a year ago.
D. An increased level of expenditures is likely to be a more important factor in the use of limited internal audit
resources than the results of an external audit that was performed a year ago.
Staff members of the internal audit activity (IAA) should be assigned to engagements and training projects that will
enable them to develop their potential. Which of the following should be the most important consideration in making
assignments that will allow staff members to develop properly?
A. Specific training requirements imposed by the Standards.

B. The skills and experience levels of individual auditors.
C. The importance of giving all staff members extensive supervisory experience.
D. Special interests of individual staff members.
A. The Standards do not impose specific training requirements.
B. The skills and experience levels of the individual auditors are probably the most important
characteristics taken into account in the assignment of staff to individual engagements. The staff assigned
to the job must have the necessary skills and experience to be able to complete that engagement.
C. Not all staff will be able to have extensive supervisory experience as not all staff are in supervisory positions or
are ready to be supervisors.
D. The special interests of staff members may be a criteria in the assignment of staff to engagements, but it is not
the most important consideration. Staff need to be assigned to jobs that will provide them the necessary skills and
experience to grow professionally, even if these are not jobs that they have a special interest in.
Which of the following are true concerning workshop facilitators?
I. They should have excellent interpersonal skills.
II. They should show respect for others.
III. They should be an expert at using any software or hardware that is required for the workshop or reporting
process.
IV. They should have in-depth knowledge of systemic control.
A. II and III only.

B. I and II only.

Part 2 (3-Part) : 08/17/23 19:45:12

A. A successful facilitator should have all of these skills.
B. A successful facilitator should have all of these skills.
C. A successful facilitator should have all of these skills.
D. All four of these items are true concerning sill necessary for workshop facilitators. Workshop
facilitators should have excellent interpersonal skills. They must have genuine respect for others, must be
willing to listen carefully, and have a strong desire to provide value to the organization. In addition, they
need a deep knowledge of systemic control, a healthy skepticism, facilitation skill, organizational ability,
and be expert at using any software or hardware required for the workshop or the reporting process. Also,
they should have good analytical skills so they can understand the information they have gathered in
order to draw meaningful conclusions from it.
Which of the following is the best source for an audit team to use to identify common risks faced by a company?
A. Questionnaires.
B. Research reported in professional journals and textbooks.
C. Flowcharts.
D. Checklists or reminder lists.
A. Questions (questionnaires) are developed from permanent files, prior audit reports, and management's charter.
A questionnaire might be used to determine if risk is present, but is not suitable for determining a measure of audit
risk.
B. Magazines and textbooks are two of many sources of information available to the auditor for the
assessment of risks.
C. A flowchart is a portrait of a process. Flowcharts can also bring key controls into sharper focus. The flowchart,
however, is not suitable for identifying measures of audit risk.
D. A reminder list is used in planning an audit, not for data gathering. Reminder lists help organize working papers
more methodically and make subsequent audit steps easier.
Question 148 - CIA R98 I.1 H1 - Planning
Which of the following comments is (are) true regarding the assessment of risk associated with two projects that
are competing for limited internal audit resources?
I. Activities that are requested by the board should always be considered higher risk than those requested by
management.
II. Activities with higher financial budgets should always be considered higher risk than those with lower
financial budgets.
III. Risk should always be measured by the potential monetary or other adverse exposure to the organization.
A. I only.
B. III only.
C. II only.
D. I and III.

Part 2 (3-Part) : 08/17/23 19:45:12
A. Activities that are requested by the board should not necessarily be considered higher risk than those activities
requested by management.
B. Risk is the probability of an event occurring that will have an impact on the achievement of objectives.
Risk is measured in terms of impact and likelihood. The IAA plan should be designed based on an
assessment of risk and exposure that may affect the organization.
C. Activities with higher financial budgets should not necessarily be considered a greater risk than those activities
with lower financial budgets.
D. Comment is not true because an activity that is requested by the board should not necessarily be considered
higher risk than those activities requested by management. Comment III is true.
Question 149 - CIA 1192 II.5 - Risk Management
Internal auditors should review the means of physically safeguarding assets from losses arising from
A. Underusage of physical facilities.

B. Procedures that are not cost justified.
C. Misapplication of accounting principles.
D. Exposure to the elements.
A. Evaluating the underusage of physical facilities relates to efficiency of operations, not the physical safeguarding
of assets.
B. Reviewing procedures that are not cost justified relates to efficiency, and not to the effectiveness of
safeguarding assets.
C. The misapplication of accounting principles has to do with the reliability of financial information, not the physical
safeguarding of assets.
D. The IAA should evaluate the risk exposure relating to governance, operations, and information systems
regarding the safeguarding of assets (Standard 2120.A1). In regards to safeguarding assets, internal
auditors would assess the level of risk arising from theft, fire, and exposure to the elements.
The audit committee strengthens the control processes of an organization by
A. Using the chief audit executive as a major resource in selecting the external auditors.
B. Approving internal audit activity policies.
C. Following up on recommendations made by the chief audit executive.
D. Assigning the internal audit activity responsibility for interaction with governmental agencies.
A. According the Sarbanes-Oxley, the audit committee is to be directly responsible for the appointment,
compensation, and oversight of the registered public accounting firm employed to perform the audit.
B. Approving internal audit activity policies does not strengthen the control process.
C. The audit committee should provide support to the internal auditors. One way to do this is to follow up
on recommendations made by the chief audit executive.
D. Assigning the internal audit activity responsibility for interaction with governmental agencies does not strengthen
the control process.

Part 2 (3-Part) : 08/17/23 19:45:12
The chief audit executive (CAE) for a retail merchandise sales organization is considering engagement
assignments for inclusion in the work schedule for the upcoming year. The following areas have not been
evaluated recently and there are no known reasons that they should be given immediate attention. If resources are
scarce, which project should be given priority?
A. Corporate code of ethics and conflict of interest policy.

B. Employee time reporting system.
C. Budget preparation and forecasts.
D. Cash management and credit policy.
A. The corporate code of ethics and conflict of interest policy do not represent the most direct and financial risk to
the company of the choices given.
B. The employee time reporting system does not represent the most direct and financial risk to the company of the
choices given.
C. Budget preparation and forecasts do not represent the most direct and financial risk to the company of the
choices given.
D. Because of the risk inherent in cash management and credit policy, these areas would be given the
highest priority of the areas listed. The other areas do not represent such a direct and immediate risk to
the company as does the cash management especially and also credit policies.
Which of the following is the most appropriate objective for a compliance audit of the purchasing department?
Determining if
A. Employees in the department seem to have a good attitude toward their jobs, their supervisor, and the company.
B. Purchases are approved at the proper level of authorization on the basis of dollar amount, as designated by firm
policy.
C. The departmental working area is adequate from the standpoint of noise levels, lighting, and housekeeping.
D. Reorder points appear reasonable based on number of stockouts and level of inventory.
A. Company morale would not be relevant to a compliance audit.
B. Compliance engagements are audits of the company's conformance to procedures, standards,

regulations and laws.
C. Determining whether the working area is adequate from the standpoint of noise level, lighting, and
housekeeping would not be relevant to a compliance audit.
D. Analyzing inventory levels, reorder points, stockout rates, etc., would be part of an operational audit, not a
compliance audit. Operational audits are concerned with efficiency and effectiveness of operations.
At a meeting with engagement managers, the chief audit executive (CAE) is allocating the engagement work
schedule for next year's plan. Which of the following methods will ensure that each manager receives an
appropriate share of both the work schedule and internal audit activity resources?
A. The full list of scheduled engagements is published for the staff, and work assignments are made based on
career interests and travel requirements.
B. Work is assigned to each manager based on risk and skill analysis.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Each of the managers' selects the individual assignments desired, based on preferences for the area and the
management personnel involved.
D. Each manager chooses assignment preferences based on the total staff hours that are currently available to
each manager.
A. Assignments for engagements are not based on career interest and travel requirements, although they may be
staffing issues.
B. The matters to be considered in establishing engagement work schedule priorities should include
updated assessments of risks and effectiveness of risk management and control processes and changes
to and capabilities of the audit staff.
C. Personal preferences are not a basis for deciding assignments.
D. Available staff hours are not a basis for deciding risk or skill level necessary for assignments.
To improve their efficiency, internal auditors may rely upon the work of external auditors if it is
A. Performed after the internal auditing work.

B. Coordinated with internal auditing work.
C. Primarily concerned with operational objectives and activities.
D. Conducted in accordance with the Code of Ethics.
A. Internal and external auditing work should be coordinated to ensure adequate audit coverage and to minimize
duplicate efforts. It is possible that there could be some duplication of effect if the external audit is performed after
the internal auditing engagement.
B. The CAE has the responsibility to coordinate the activities of the internal and external auditors. Planned
audit activities of internal and external auditors need to be discussed to ensure that audit coverage is
coordinated and duplicate efforts are minimized where possible (PA 2050-1).
C. Internal auditing includes both financial and operational objectives and activities. So, it is possible that the
internal auditor may rely upon the work of the external auditor if it encompasses only financial objectives and
activities.
D. External audits are conducted in the accordance with accounting principles, not based on Code of Ethics.
An auditor is scheduled to audit payroll controls for a company that has recently outsourced its processing to an
information service bureau. What action should the auditor take, considering the outsourcing decision?
A. Review the controls over payroll in both the company and the service bureau.
B. Cancel the engagement, because the processing is being performed outside of the organization.
C. Review only the controls over payments to the service bureau based on the contract.
D. Review only the company’s controls over data sent to and received from the service bureau.
A. Engagements involving third parties may be necessary when vital controls affecting transactions exist
outside the organization, e.g., the outsourcing of the entity’s information processing function to a service
bureau. Control risk may be higher because the external organization's controls are part of the
organization's internal control structure. Thus, the internal auditor should review the controls over payroll
in both the company and the service bureau.
B. Controls should be evaluated regardless of their location.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Reviewing controls over payments based on the contract narrows the scope of the engagement.
D. There should be a review of both organizations' controls.
Which of the following is not a true statement about the relationship between internal auditors and external
auditors?
A. There may be an exchange of audit reports and management letters between internal and external auditors.
B. Oversight of the work of external auditors is the responsibility of the chief audit executive.
C. There may be periodic meetings between internal and external auditors to discuss matters of mutual interest.
D. Internal auditors may provide audit programs and working papers to external auditors.
A. Exchange of internal audit communications and external auditors' management letters is necessary as part of
the coordination between internal auditors and external auditors.
B. It is not the responsibility of the CAE to oversee the work of the external auditors. The audit committee
of the board has this oversight responsibility.
C. In order to assure timely and efficient completion of the work, sufficient meetings should be scheduled between
internal and external auditors.
D. Coordination between internal auditors and external auditors may require internal auditors to provide their
engagement work programs and working papers to external auditors.
Which of the following are true regarding internal auditors and the adequacy of an organization’s risk management
process?
I. Internal auditors must have must have an understanding of the risk assessment process and the tools used
to make the assessment.
II. Internal auditors should determine the level of risks acceptable to the organization.
III. Internal auditors need to be satisfied that the key objectives of risk management processes are being met
IV. Internal auditors should evaluate management’s risk processes the same way they analysis risk when
planning an engagement.
A. I, II and III only.

B. I and III only.
C. I and II only.
A. Item II is not true. Management, not internal auditors determine the level of risks acceptable to the organization.
B. Items I and III are true. Internal auditors must have an understanding of the risk assessment process
and the tools used to make the assessment, and they also need to be satisfied that the key objectives of
risk management processes are being met.
C. Item I is true. Internal auditors must have an understanding of the risk assessment process and the tools used
to make the assessment. Item II though is not true. Management, not internal auditors determine the level of risks
acceptable to the organization.
D. Item IV is also not true. Evaluating management’s risk processes is different than the requirement that auditors

Part 2 (3-Part) : 08/17/23 19:45:12
use risk analysis to plan audits. However, information from a comprehensive risk management process, including
the identification of management and the board concerns, can assist the internal auditor in planning audit activities.
In an operational audit of procurement procedures, the internal auditor identified a situation in which the purchasing
manager approved one purchase order without first obtaining competitive bids. The conclusion this information
would support is that
A. The organization probably paid more than necessary for the purchase.
B. This may not be the only purchase made without a competitive bid.
C. The purchasing manager did not follow organization policy.
D. This finding should be noted in the audit report.
A. An auditor may suspect that the company overpaid because it did not obtain competitive bids, but the auditor
cannot make that conclusion without investigating the facts pertaining to this particular purchase.
B. The sample does not allow the auditor to rule out the possibility that more than one purchase was made
without competitive bidding. If this discovery is significant, the auditor should explicitly consider the
possibility that the population contains other purchases made without competitive bidding.
C. You cannot conclude that the manager did not follow company policy because the problem does not state that
the company has a policy requiring competitive bids for all purchases and many companies that have such policies
also allow exceptions.
D. The information in the problem does not support a conclusion that the auditor should report this discovery in the
audit report because the problem does not state whether this discovery represents an error or any other significant
finding.
The engagement work most likely to yield relevant information for determining the adequacy of an organization's
"disaster-recovery plan" should focus on
A. The role of the internal audit activity in developing and testing the plan.
B. The sufficiency of the list of replacement equipment needed in event of a disaster.
C. The completeness of the plan as to facilities, operations, communications, security, and data processing.
D. Whether the plan is in the planning or developmental stage.
A. The role of the IAA in developing and testing the plan will not ensure that the plan is adequate.
B. Adequacy of the plan should focus on more than the sufficiency of the list of replacement equipment needed in
the event of a disaster.
C. The disaster recovery plan should focus on the completeness of the plan as to facilities, operations,
communications, security, and data processing.
D. The adequacy of the plan would entail more than knowing whether the plan is in the planning or development
stage.
Question 160 - CIA 594 H1 - Managing Resources
Which of the following is not a good technique in providing feedback?

Part 2 (3-Part) : 08/17/23 19:45:12
A. Focus on specific behaviors.

B. Direct negative feedback toward behavior, which is controllable by the recipient.
C. Make feedback well timed.
D. Keep feedback personal.
A. Feedback should be specific rather than general.
B. There is little value in reminding a person of some shortcoming over which he or she has no control.
C. Feedback is most meaningful to a recipient when there is a very short time interval between his or her behavior
and the receipt of feedback about that behavior.
D. Feedback, particularly negative feedback, should be impersonal. It should be descriptive rather than
judgmental or evaluative.
Management of a manufacturing company has requested the internal auditing activity (IAA) perform an audit of the
cash management system to (1) evaluate the adequacy of existing internal controls over cash management and (2)
identify opportunities to increase management control and operating efficiency. The company has four
manufacturing divisions located in diverse geographic areas. The company has delegated day-to-day cash
management to each local operating division. Excess cash is invested in short-term cash management programs
of local financial institutions. These short-term investments are the only source of interest income for the operating
divisions. Each division has a line of credit with a local financial institution, but must arrange long-term financing
needs through corporate headquarters.
In performing a review of cash management procedures in the divisions during the preliminary audit planning, the
internal auditor has noted that management is concerned that:
Some divisions have excess cash balances and might not be investing short-term balances in a manner to
maximize returns to the company.
One division has automated the processing of cash receipts, but has not implemented proper control
procedures to ensure that all cash will be recorded.
The divisions' cash management procedures may not be consistent with overall corporate objectives, i.e.,
there may not be proper coordination between corporate headquarters and divisions regarding cash
management.
If the treasurer took a customer's cash remittance and omitted it from the cash deposit and recorded a debit to
cash for the remaining receipts, the omission would best be detected by
A. Batching all receipts and turnaround documents and reconciling the posting of the batches to the receivables
and cash account.
B. Periodic confirmation of randomly selected accounts by the internal auditing department and follow-up of all
differences.
C. Monthly analytical review comparing accounts receivable balances with sales volume and cash receipts.
D. Customer inquiries to the customer services department
A. This would best detect the defalcation because the totals of the debits to cash would not reconcile with
the credits to accounts receivable for the batch from which the cash was taken.
B. Periodic confirmation of receivables is a good control, but auditing should not be viewed as a substitute for the
implementation of normal processing controls.
C. Analytical procedures can indicate large unusual fluctuations in an account balance but would not effectively
detect the embezzlement of a single receipt.
D. See the correct answer for the explanation.

Part 2 (3-Part) : 08/17/23 19:45:12
Question 162 - CIA 595 III.33 - Report to Senior Management & Board
Recent criticism of an internal audit activity (IAA) suggested that engagement coverage was not providing adequate
feedback to senior management on the processes used in the organization's key lines of business. The problem
was further defined as lack of feedback on the recent implementation of automated support systems. Which two
functions does the chief audit executive (CAE) need to improve?
A. Planning and organizing.

B. Planning and communicating.
C. Staffing and decision making.
D. Staffing and communicating.
A. The provided information does not indicate that there is structure problem in the organization.
B. The lack of feedback indicates that during the planning process the CAE did not adequately
communicate necessary information to management.
C. The provided information does not indicate that there are staffing and decision making problems.
D. The provided information does not indicate that there is a staffing problem.
Question 163 - CIA QZP1B.11 - Policies & Procedures
The form and content of written policies and procedures should be appropriate to the size and structure of the
internal audit activity and the complexity of its work. Which of the following is true?
A. Formal administrative and technical audit manuals are necessary by all internal auditing entities.
B. A small internal audit activity is managed more formally than a large internal activity.
C. In a large internal audit activity, more formal and comprehensive policies and procedures are essential to guide
the audit staff.
D. None of the answers are true.
A. Formal administrative and technical audit manuals may not be needed by all internal auditing entities
B. A small internal audit activity will probably be managed more informally.
C. In a large internal audit activity, more formal and comprehensive policies and procedures are essential
to guide the internal audit staff in the execution of the internal audit plan (PA 2040-1).
D. See the correct answer. In a large internal audit activity, more formal and comprehensive policies and
procedures are essential to guide the internal audit staff in the execution of the internal audit plan (PA 2040-1).
Risk assessment is a systematic process for assessing and integrating professional judgments about probable
adverse conditions or events. Which of the following statements reflects the appropriate action for the chief audit
executive (CAE) to take?
A. The CAE should restrict the number of sources of information used in the risk assessment process.
B. The CAE should generally assign engagement priorities to activities with higher risks.
C. Work schedule priorities should be established to lead the CAE in the risk assessment process.
D. The risk assessment process should be conducted at least every three to five years.
A. The risk assessment process should encompass as many sources of information as are relevant. This will
almost certainly include both financial and nonfinancial information.
B. The higher the risk that a specific activity has, the higher the priority that activity should receive from

Part 2 (3-Part) : 08/17/23 19:45:12
the internal audit function.
C. The risk assessment process should be used to lead the process of the development of the work schedules, not
vice versa.
D. The risk assessment should be undertaken every year.
Benchmarking is one of the primary tools used in the implementation of Total Quality Management (TQM).
Benchmarking is a means of helping organizations with productivity management and business process review.
What type of benchmark is it if an organization wanted to improve on its performance measures for a new business
line?
A. Functional benchmark.
B. Competitive benchmark.
C. Generic benchmark.
D. Consolidated benchmark.
A. The type of benchmarking most likely to help improve performance measures for a new business line is
functional benchmarking. This procedure also involves identifying the underlying key actions and causes
that contribute to the performance difference. Comparison with organizations that perform related
functions within the same technological area provides information about what is being achieved
elsewhere in the new business line.
B. Competitive benchmark is comparing against the best of the company's competitors.
C. Generic benchmark is where a company will compare processes that are virtually the same (generic) regardless
of the industry or production line such as document processing.
D. Consolidated benchmark is a nonsense term.
During an operational engagement, an internal auditor compares the inventory turnover rate of a subsidiary with
established industry standards in order to
A. Test the subsidiary's controls designed to safeguard assets.

B. Assess the performance of the subsidiary and indicate where additional engagement work may be needed.
C. Determine if the subsidiary is complying with organizational procedures regarding inventory levels.
D. Evaluate the accuracy of the subsidiary's internal financial reports.
A. Testing controls to safeguard assets would be a function of a financial audit.
B. The inventory turnover is cost of sales divided by average inventory (cost of sales / average inventory).
The ratio measures how many times during the year the company is selling the amount of inventory it
holds. A high turnover implies that the company does not hold excessive stocks of unproductive
inventory. An operational engagement would assess the performance of the subsidiary and indicate where
additional engagement work may be needed.
C. Determining if the subsidiary is complying with organizational procedures is a compliance audit, not an
operational audit.
D. Evaluating the accuracy of internal financial reports is a financial audit, not an operational audit.

Part 2 (3-Part) : 08/17/23 19:45:12
Which of the following is not a true statement about the relationship between internal auditors and external
auditors?
A. External auditors must assess the competence and objectivity of the internal auditors.
B. Internal auditors may provide engagement work programs and working papers to external auditors.
C. There may be periodic meetings between internal and external auditors to discuss matters of mutual interest.
D. There may be an exchange of engagement communications and management letters.
A. It is not explicitly stated that external auditors are required to assess the competence and objectivity of
internal auditors.
B. Internal auditors may provide engagement work programs and working papers to external auditors.
C. There should be sufficient number of meetings between internal and external auditors to discuss matters of
mutual interest.
D. The relationship should involve an exchange of audit reports and management letters.
laws.
Management is exploring different ways of reducing or preventing pollution in manufacturing operations. The
objective of a pollution prevention audit is to identify opportunities to minimize waste and eliminate pollution at the
source. In what order should the following opportunities to reduce waste be considered?
I. Recycling and reuse
II. Elimination at the source
III. Energy conservation
IV. Recovery as a usable product
V. Treatment
A. V, II, IV, I, and III.

B. III, IV, II, V, and I.
C. I, III, IV, II, and V.
D. IV, II, I, III, and V.
A. If the objective of the audit is to identify opportunities to minimize waste and eliminate pollution at the source
then the hierarchy should be usable products, source reduction, recycling, and reuse. Treatment would not be the
first item to be considered.
B. The hierarchy should be usable products, source reduction, recycling, and reuse.

Part 2 (3-Part) : 08/17/23 19:45:12
C. The hierarchy should be usable products, source reduction, recycling, and reuse.
D. The hierarchy should be usable products, source reduction, recycling, and reuse. Treatment in this
hierarchy would be last.
Which of the following would be considered a risk factor to an organization?
A. A planned audit engagement that will be completed on a timely basis.

B. A significant improvement in the product of a competitor.
C. The purchase of new equipment that will improve profitability.
D. A commitment to further develop an employee technical skills.
A. This would be considered a factor to minimize risk.
B. Risk is the probability of an event that will adversely affect an organization. The improvement in the
competitor's product will make the competitor more competitive, so therefore adversely affecting the
organization.
C. This would be considered a factor to minimize risk.
D. This would be considered a factor to minimize risk.
Question 170 - CIA 597 2.21 - Managing Resources
Following a negative performance evaluation by a supervisor, a staff auditor went to the chief audit executive (CAE)
to seek a change in the evaluation. The CAE was familiar with the auditor's performance and agreed with the
evaluation. The CAE agreed to meet and discuss the situation. Which of the following is the best course of action
for the CAE to take?
A. Have the supervisor participate in the meeting, so that there is no misunderstanding about the facts.
B. Have a human resources administrator present to ensure that improper statements are not made.
C. Meet privately with the employee. Encourage discussion by asking for the employee’s side of the issue and
disclaiming any agreement with the supervisor.
D. Meet privately with the employee. The CAE should tell the employee of his or her agreement with the
performance evaluation and express interest in any additional facts the employee may wish to present.
A. The supervisor, as author of a critical performance review, will only add to the element of management
intimidation.
B. Again, the presence of a third party would inhibit the director’s listening effectiveness. Unless the director thinks
the auditor's concerns are so serious that the human resources department must be informed, it is preferable to
meet with the employee privately.
C. It is never appropriate to mislead an employee in order to obtain information or to determine the employee’s
view on a matter.
D. A private conversation signals to the employee that the CAE is interested in what he or she has to say,
and will not be measuring his or her words against those of another. However, the CAE must establish a
position and show support for the supervisor. There may be more than one valid viewpoint, but that does
not necessarily mean that the employee's is valid.

Part 2 (3-Part) : 08/17/23 19:45:12
The chief audit executive (CAE) set up a computerized spreadsheet to facilitate the risk assessment process
involving a number of different divisions in the organization. The spreadsheet included the following factors:
Pressure on divisional management to meet profit goals.
Complexity of operations.
Competence of divisional personnel.
The monetary amount of subjectively influenced accounts in the division, such as accounts in which
management's judgment can affect the expense, e.g., postretirement benefits.
The CAE used a group meeting of internal audit managers to reach a consensus on the competence of divisional
personnel. Other factors were assessed as high, medium, or low by either the CAE or an internal audit manager
who had performed an engagement at the division. The CAE assigned a weight ranging from 0.5 to 1.0 to each
factor, and then computed a composite risk score. Which of the following statements is correct regarding the risk
assessment process?
A. The risk analysis is not appropriate because it mixes both quantitative and qualitative factors, thereby making
expected values calculation impossible.
B. Using a subjective group consensus to assess personnel competence is appropriate.
C. Assessing factors at discrete levels such as high, medium, and low is inappropriate for the risk assessment
process because the ratings are not quantifiable.
D. The weighting is subjective and should have been determined through a process such as multiple-regression
analysis.
A. Risk analysis will be based on both quantitative and qualitative factors.
B. Using a subjective group consensus would be considered appropriate because this method would tend
to eliminate any extreme judgment that might be made by a single assessor.
C. Assessing factors such as high, medium, and low would be appropriate, if other measures are not available.
D. Subjective analysis is considered to be appropriate, if other methods are not available.
By comparing job descriptions with the qualifications and duties of the individuals currently holding those jobs, a
manager can
A. Forecast future personnel needs.

B. Determine which employees should be promoted.
C. Determine whether the organization is appropriately staffed.
D. Complete the human resource planning cycle.
A. In order to forecast future personnel needs, the company will need to make projections about future projects,
programs, developments in the company and the needs for the future. The forecast should not focus on the
situation that currently exists in the company.
B. The comparison of job descriptions and the duties of the individuals in the jobs does not determine who should
be promoted. Job performance should also weight heavily in the promotion decision.
C. By comparing the current job descriptions with the people who hold those jobs and the duties that they
are performing, management is able to determine whether the organization is properly staffed, or not.
D. There also needs to be a needs assessment as part of the human resources cycle because if there is no
assessment of what is needed, the review of job descriptions and personnel will not provide valuable information to
the company since there is no standard against which the situation is measured.

Part 2 (3-Part) : 08/17/23 19:45:12
Internal auditors are increasingly called on to perform audits related to an organization's environmental
stewardship. Which of the following does not describe the objectives of a type of environmental audit?
A. Determine whether environmental management systems are in place and operating properly to manage future
environmental risks.
B. Determine whether the organization is focusing efforts on ensuring that its products are environmentally friendly,
and confirm that product and chemical restrictions are met.
C. Determine whether environmental issues are considered as part of economic decisions.
D. Determine whether the organization's current actions are in compliance with existing laws.
A. An objective of an environmental audit could be to determine whether environmental management systems are
in place and operating properly to manage future environmental risks.
B. An objective of an environmental audit could be to determine whether the organization focuses efforts on
ensuring that its products are environmentally friendly and confirms that product and chemical restrictions are met.
C. Determining whether environmental issues are considered part of economic decisions would not be an
objective of an environmental audit.
D. An objective of an environmental audit could be to determine whether the organization's current actions are in
compliance with existing laws.
Which one of the facilitated team workshops has a general aim of evaluating, updating, improving and even
streamlining the whole process and its component activities?
A. Process-based format.
B. Control-based format.
C. Objective-based format.
D. Risk-based format.
A. The process-based format focuses on selecting activities that are elements of a chain of processes. The
purpose of this format is to evaluate, update, validated, improve and even streamline the whole process
and its component activities.
B. The control-based format focuses on how well the controls are in place and working. The purpose of this format
is to produce an analysis of the gap between how controls are actually working and how well management expects
the controls to work.
C. The objective-based format focuses on the best way to accomplish a business objective. The purpose of this
format is to understand whether control procedures are working effectively and are resulting in residual risks within
an acceptable level.
D. The risk-based format begins by listing all possible barriers, obstacles, threats and exposures that might prevent
achieving an objective. The purpose of the workshop is to determine significant residual risk.
Any program for selecting and developing the human resources of the internal audit activity (IAA) will fail unless
compensation is adequate at all levels of responsibility. Policies concerning compensation should
A. Provide for cost-of-living, longevity, and merit increases annually.

B. Be informal and as flexible as possible to allow the chief audit executive to respond to unusual situations.
C. Be clearly stated and based on evaluations of position requirements and individual performance.

Part 2 (3-Part) : 08/17/23 19:45:12
D. Link internal auditors' compensation to the pay for comparable positions in the controller's department.
A. These increases do not need to be annual and would be required only if needed (in the case of cost-of-living and
longevity increases) and if earned (in the case of merit raises).
B. Compensation policies should be formal and well defined so as to prevent misunderstandings or

misinterpretations of the policy.
C. Compensation should be based on the evaluations of what the position requires and how the individual
performs. The more skill required in a position and the more successful an individual is in the job will lead
to a higher salary for that person.
D. There is not necessarily a link between the salaries in the IAA and the controller's department.
Question 176 - CIA 598 1.50 - Strategic Role of Internal Auditing
To improve audit efficiency, internal auditors can rely upon the work of external auditors if it is
A. Performed after the internal audit.

B. Primarily concerned with operational objectives and activities.
C. Conducted in accordance with The IIA’s Code of Ethics.
D. Coordinated with the internal audit.
A. This may lead to duplication in audit coverage.
B. Internal auditing encompasses both financial and operational objectives and activities. Therefore, internal
auditing coverage could also be provided by external audit work which included primarily financial objectives and
activities.
C. External auditing work is conducted in accordance with Generally Accepted Auditing Standards.
D. Coordinating internal and external audit work helps to prevent duplication in coverage, thereby
improving internal audit efficiency.
In reviewing a cost-plus construction contract for a new catalog showroom, the internal auditor should be cognizant
of the risk that
A. Payroll taxes may have been inappropriately omitted from billings.

B. Income taxes related to construction equipment depreciation may have been calculated erroneously.
C. The contractor could be charging for the use of equipment not used in the construction.
D. Contractor cash budgets could have been inappropriately compiled.
A. Whether or not payroll taxes were omitted does not impact the chances of being charged too much for the
contract.
B. Whether or not the income tax calculations related to depreciation were done correctly is not relevant to the
contract.
C. In a cost-plus contract, the supplier is charging for all of the costs that are incurred, plus some
additional amount. Therefore, the internal auditor will need to check to confirm that all costs for which the
company is being charged were actually related to the job.
D. Whether the contractor compiled their cash budgets correctly is irrelevant to the internal auditor as it will not
impact the amount that the company is charged.

Part 2 (3-Part) : 08/17/23 19:45:12
When the executive management of an organization decided to form a team to investigate the adoption of an
activity-based costing (ABC) system, an internal auditor was assigned to the team. The best reason for including an
internal auditor is the internal auditor's knowledge of
A. Risk management processes.

B. Current product cost structures.
C. Activities and cost drivers.
D. Information processing procedures.
A. The internal audit activity (IAA) must evaluate the effectiveness and contribute to the improvement of
risk management processes (Standard 2120).
B. It is more likely that an engineer will have more knowledge about the production cost structures.
C. It is more likely that an engineer will have more knowledge about the activities and cost drivers.
D. It is more likely that the information systems engineer will have more knowledge about the information
processing procedures.
The risk that an auditor's procedures will lead to the conclusion that a material misstatement does not exist in an
account balance when, in fact, such misstatement does exist is
A. Detection risk.
B. Inherent risk.
C. Audit risk.
D. Control risk.
A. Detection risk is the risk that the auditor will not detect a material misstatement. Detection risk is
affected by the auditor's procedures and can be changed at his or her discretion.
B. Inherent risk is the risk that there is an error in the first place.
C. Audit risk is the risk that the auditor will give an unqualified opinion, when in fact; there is a material
misstatement in the area being audited.
D. Control risk is the risk that the internal controls will not detect, or prevent the error.
The acceptable level of detection risk is inversely related to the
A. Assurance provided by substantive tests.

B. Preliminary judgment about materiality levels.
C. Risk of misapplying auditing procedures.
D. Risk of failing to discover material misstatements.
A. There is an inverse relationship between the amount of substantive testing the auditor will do and
detection risk. If detection risk is low, the auditor will need to detect all of the mistakes that may be in the
financial statements. Therefore, the auditor will need to perform many tests during the audit. However, if
the detection risk is high, this means that the auditor is accepting a high level of risk that he or she will not

Part 2 (3-Part) : 08/17/23 19:45:12
detect mistakes. In order to detect mistakes, the auditor does not need to perform as many tests.
B. The auditor uses judgment about materiality levels when determining the acceptable level of audit risk. Detection
risk is just one component of audit risk.
C. The risk of misapplying auditing procedures is related to the experience of the auditor.
D. The risk of failing to discover material misstatements is the level of audit risk the auditor is willing to accept.
Detection risk is just one component of audit risk.
An internal auditor is performing an operational engagement at a division and observes that an unusually large
quantity of goods is on hand in the shipping and materials rework areas. The items are labeled as re-ship items.
Upon inquiry the internal auditor is told that they are goods that have been returned by customers and have either
been repaired and shipped back to the original customer or repaired and shipped out as new products because
they are fully warranted.
Assume that subsequent investigation shows that previously issued financial statements were materially misstated
due to the improper recognition of sales. The internal auditor's next step should be to
A. Inform divisional management of the preliminary observation, but wait until a formal engagement communication
is issued to inform the board.
B. Inform the external auditor, senior management, and the board.
C. Inform senior management, the board, and the audit committee.
D. Immediately inform the external auditor and the divisional manager.
A. The auditor should inform senior management, the board, and the audit committee.
B. The auditor should inform senior management, the board, and the audit committee.
C. When the incidents of significant fraud, or erosion of trust, have been established to a reasonable
certainty, senior management and the board of directors should be notified immediately. The results of a
fraud investigation may indicate that fraud has had a previously undiscovered adverse effect on the
organization’s financial position and its operational results for one or more years on which financial
statements have already been issued. Senior management and the board of directors should be informed
of such a discovery.
D. The auditor should inform senior management, the board, and the audit committee.
Which of the following techniques is best for emphasizing a point in a written communication?
A. Use a passive rather than active voice.

B. Place the point in the middle rather than at the beginning or end of the paragraph.
C. Use a short sentence with one idea rather than a longer sentence with several ideas.
D. Highlight the point through the use of non-parallel structure.
A. Use of the active voice best emphasizes the point.
B. The point is best emphasized by placing it at the beginning or end of the paragraph.
C. Long sentences with several ideas will create information overload and disguise the important point.
D. Parallel structure will emphasize the point better. Non-parallel structure will usually detract from the point.

Part 2 (3-Part) : 08/17/23 19:45:12
Question 182 - CIA 597 II.1 - Communicate Engagement Results
Which of the following techniques is best for emphasizing a point in a written communication?
A. Use a passive rather than active voice.

B. Place the point in the middle rather than at the beginning or end of the paragraph.
C. Use a short sentence with one idea rather than a longer sentence with several ideas.
D. Highlight the point through the use of non-parallel structure.
A. Use of the active voice best emphasizes the point.
B. The point is best emphasized by placing it at the beginning or end of the paragraph.
C. Long sentences with several ideas will create information overload and disguise the important point.
D. Parallel structure will emphasize the point better. Non-parallel structure will usually detract from the point.
Question 183 - CIA 594 2.19 - Managing Resources
Which of the following is not a good technique in providing feedback?
A. Direct negative feedback toward behavior which is controllable by the recipient.

B. Focus on specific behaviors.
C. Make feedback well timed.
D. Keep feedback personal.
A. There is little value in reminding a person of some shortcoming over which he or she has no control.
B. Feedback should be specific rather than general.
C. Feedback is most meaningful to a recipient when there is a very short time interval between his or her behavior
and the receipt of feedback about that behavior.
D. Feedback, particularly negative feedback, should be impersonal. It should be descrip-tive rather than
judgmental or evaluative.
Successful consultative communication in an internal auditing engagement is partially based on feedback from
engagement clients about internal auditors' actions during the engagement. This feedback
A. Should go only to senior management as a means of reviewing the internal auditors.

B. Should go to both management and the internal auditors to ensure business value is being added.
C. Will keep clients on the defensive regarding the internal auditors.
D. Should go only to the internal auditors to help them improve their performance.
A. The feedback also needs to go to the internal auditors so that they know how they can improve their
performance.
B. Feedback needs to be communicated to both management and the internal auditors to insure that it is
as beneficial as possible to the company. If it is received by only one of these parties, its benefit will be
reduced as there will not be the level of accountability that there should be.
C. Because the client has the opportunity to provide feedback on the internal auditor, this should lead to a working

Part 2 (3-Part) : 08/17/23 19:45:12
relationship between the parties that is more open and professional.
D. The feedback on the internal auditors also needs to be provided to management so that management can
evaluate the IAA.
Question 185 - ICMA 10.P1.235 - Types of Engagements
Retail Partners Inc., which operates eight discount store chains, is seeking to reduce the costs of its purchasing
activities through reengineering and a heavier use of electronic data interchange (EDI). Which of the following
benchmarking techniques would be appropriate in this situation?
I.A comparison of the purchasing costs and practices of each of Retail Partners’ store chains to identify their
internal "best in class."
II.A comparison of the practices of Retail Partners to those of Discount City, another retailer, whose practices are
often considered "best in class."
III.A comparison of the practices of Retail Partners to those of Capital Airways, an international airline, whose
practices are often considered "best in class."
IV.An in-depth review of a retail trade association publication on successful electronic data interchange
applications.
A. I, II, III, and IV.

B. I and IV only.
C. II and IV only.
D. I and II only.
A.
A benchmark is a standard of performance, and benchmarking is the process of measuring the

organization against the products, practices and services of some of its most efficient global competitors.
The company can use these standards as a target or model for its own operations. This is called "best
practices," or "best in class." A benchmark can also be an internal "best practice." Through the application
of research and sophisticated software analysis tools, companies can do best practice analysis to cut
costs, boost output, and achieve their strategic business goals and objectives.
Benchmarking continuously strives to imitate the performance of the best performers, and by meeting
these high standards, the organization may be able to create a competitive advantage over its marketplace
competitors. The benchmarked company does not need to be in the same industry as the company that is
trying to improve its performance.
B. These are correct, but this is not the best answer. A review of the competition as well as successes in other
industries can provide ideas as well.
C. These are correct, but this is not the best answer. A review of in-house best practices as well as successes in
other industries can provide ideas as well.
D. These are correct, but this is not the best answer. A review of successes in other industries and research into
other companies’ experiences can provide ideas as well.
Which of the following directives would be most useful to a sales department manager in controlling and evaluating
the performance of the manager's customer service group?
A. Customer complaints should be processed promptly.

B. Employees should maintain a positive attitude when dealing with customers.
C. The customer is always right.
D. All customer inquiries should be answered within seven days of receipt.

Part 2 (3-Part) : 08/17/23 19:45:12
A. An inadequate measure has been specified to the employee.
B. No measure of positive attitude has been specified for the employee.
C. No standard has been set by which to measure employee perfection.
D. Performance can be measured against the "seven days" standard to see if the objective is being met.
Senior management of an entity has requested that the internal audit activity (IAA) provide ongoing internal control
training for all managerial personnel. This is best addressed by
A. An emergency consulting engagement agreement.

B. A special consulting engagement agreement.
C. An informal consulting engagement agreement.
D. A formal consulting engagement agreement.
A. Emergency consulting engagements apply more to unplanned engagements, such as participation on a team
established for recovery or maintenance of operations after a disaster or other extraordinary business event.
B. Special consulting engagements apply more to one-time special arrangements.
C. An informal consulting agreement is generally for routine activities, such as participation on steering committees,
etc.
D. Consulting services may be conducted as either part of the internal auditor's normal or routine activity,
or as a special request made by management. Because this consulting service is for on-going internal
control training it should be subject to a formal consulting agreement.
Which of the following factors would be considered the least important in deciding whether existing internal audit
resources should be moved from the ongoing legal compliance audit to the management requested division audit?
A. The increase in expenditures at the division for the past year.

B. The potential for significant regulatory fines associated with the legal compliance audit.
C. The potential of fraud associated with the legal compliance audit.
D. A financial audit of the division by the external auditor a year ago.
A. The increase in expenditures provides a benchmark for potential exposure or loss to the organization.
B. Fines imposed by regulatory agencies could represent a significant risk.
C. Fraud is one of the major factors to be considered in analyzing risk and identifying audit activities.
D. The results of a financial audit would be the least relevant factor in prioritizing the auditor's tasks
because the financial audit will not resolve the question asked by management. Also, the financial audit
was prior to the recent problems.
Policies and procedures should be established to guide the internal audit activity (IAA). Which of the following
statements is false with respect to this requirement?

Part 2 (3-Part) : 08/17/23 19:45:12
A. Formal administrative and technical manuals may not be needed by all internal auditing activities.
B. The form and content of written policies and procedures should be appropriate to the size of the internal audit
activity.
C. All internal audit activities should have a detailed policies and procedures manual.
D. A small internal audit activity may be managed informally through close supervision and written memos.
A. Formal administrative and technical manuals may not be needed by all IAA.
B. The form and content of written policies and procedures should be appropriate to the size of the IAA.
C. The form and content of written policies and procedures should be appropriate to the size and structure
D. A smaller IAA may be managed more informally through close supervision and written memos.
The chief audit executive (CAE) is responsible for establishing a program to develop the human resources of the
internal audit activity (IAA). This program should include
A. Continuing educational opportunities and performance appraisals.

B. Counseling and an established career path.
C. An established training plan and a charter.
D. Job descriptions and competitive salary increases.
A. Continuing education and performance appraisals are good methods of developing the IAA staff.
B. Counseling would be part of the human resource development plan, but establishing a career path is not.
C. Training would be part of the human resource development plan, but the charter is not specific.
D. Job (position) descriptions would be part of the human resource development plan, but competitive salary
increases are not.
A manager responsible for the supervision and review of other internal auditors needs the necessary skills,
knowledge, and other competencies. Which of the following does not describe a skill, knowledge, or other
competency necessary to supervise a particular engagement?
A. Determine that staff auditors have completed the engagement procedures and that engagement objectives have
been met.
B. The ability to review and analyze an engagement work program to determine whether the proposed engagement
procedures will result in information relevant to the engagement's objectives.
C. Assuring that an engagement communication is supported and accurate relative to the information documented
in the engagement working papers.
D. Use risk assessment and other judgmental processes to develop an engagement work schedule for the internal
audit activity and present the schedule to the board.
A. Supervision by the manager includes the approving the engagement work program; determining that the
engagement working papers support observations, conclusions, and recommendations; and making certain that
engagement objectives have been met.
B. The manager's responsibility includes the approving the engagement work program; determining that the

Part 2 (3-Part) : 08/17/23 19:45:12
C. Supervision by the manager includes the approving the engagement work program; determining that the
D. It will be the CAE's responsibility, not the manager's, to establish risk-based plans to determine the
priorities of the IAA, consistent with the organization's goals.
Which of the following is a valid reason for an internal auditing engagement involving a payroll department to
receive priority over a purchasing department engagement?
A. The payroll department's relative risk and exposure are greater.

B. The purchasing department engagement will require more time to perform.
C. The purchasing department recently restructured its major operations.
D. The director of the payroll department requested that her engagement be performed first.
A. The CAE must establish risk based plans to determine the priorities of the IAA, consistent with the
organization's goals (Standard 2010). The payroll department would receive priority over the purchasing
department if its relative risk and exposure were greater.
B. Time to perform the engagement might not correlate with the risk or other factors that help to set the IAA
priorities.
C. Restructuring would be a valid reason for the purchasing department to receive priority.
D. Request made by directors are less valid reasons for granting engagement priority than greater assessed risk
and exposure.
An annual summary report of completed engagement work submitted to senior management and the board by the
chief audit executive should
A. Emphasize the number of deficiency observations discovered by the internal auditors.

B. Describe the extent to which the internal audit activity has completed its engagement work schedule.
C. Discuss the administrative condition of the internal audit activity.
D. Inform management of the scope of proposed work for the following year.
A. In the activity report to management, the number of deficiencies will not be emphasized. More important for this
report than the number of deficiencies is the materiality of the deficiencies found. This report will focus on the more
material deficiencies that are found.
B. The activity report should focus on what was done in the past year and how that compares with what
was planned to be done in the past year.
C. This report addresses the work that was performed in the previous year. It should not discuss the administrative
condition of the IAA.
D. This report addresses the work that was performed in the previous year.
Which of the following is necessary to determine what would constitute a disaster for an organization?

Part 2 (3-Part) : 08/17/23 19:45:12
A. Contingent facility contract analysis.

B. Risk analysis.
C. File and equipment backup requirements analysis.
D. Vendor supply agreement analysis.
A. Contingent facility contract analysis is a contingency planning strategy to react to a disaster.
B. Risk analysis is necessary to determine an organization's definition of a disaster.
C. File and equipment backup requirements analysis is a contingency planning strategy to react to a disaster.
D. Vendor supply agreement analysis is a contingency planning strategy to react to a disaster.
Which of the items below most likely reflects differences between the policies of a relatively large and a relatively
small internal audit activity? The policies for the large activity should
A. Be specific as to activities to be carried out.

B. Be in considerable detail.
C. Define the scope and status of internal auditing.
D. Contain the authority to carry out engagements.
A. Specific functions should be defined whether the company is small or large.
B. The form and content of written policies and procedures should be appropriate to the size and structure
C. The scope and status of internal auditing is covered in the charter.
D. The authority to carry out engagements is covered in the charter, not in the policies and procedures.
Which of the following, though not appropriate for use with a large internal audit activity, is an acceptable approach
for managing a small internal audit activity?
A. Preparing comprehensive policies and procedures.

B. Writing detailed instructions and guidelines for each engagement area.
C. Developing technical manuals to guide performance.
D. Using only daily, close supervision and written memoranda.
A. Preparing comprehensive policies and procedures would be more appropriate for a large IAA.
B. Written detailed instructions would be more appropriate for a large IAA.
C. Technical manuals would be more appropriate for a large IAA.
D. Smaller IAA programs can be managed more informally. Its audit staff may be directed and controlled
through daily, close supervision and written memoranda that state policies and procedures to be followed
(PA 2040-1).

Part 2 (3-Part) : 08/17/23 19:45:12
Which of the following factors is not included in determining the engagement work schedule?
A. Engagement work programs.

B. Workload requirements.
C. Issues relating to organizational governance.
D. The effectiveness of risk management and control processes.
A. Engagement work schedules should include (1) what activities are to be performed, (2) when they will
be performed, and (3) the estimated time required, taking into account the scope of the engagement work
planned and the nature an extent of related work performed by others. Engagement work schedules are
developed during the planning phase of the engagement and will be part of the engagement work
program.
B. Workload requirements are factors in determining the engagement work schedule.
C. Issues relating to organizational governance are factors in determining the engagement work schedule.
D. The effectiveness of risk management and control processes are factors in determining the engagement work
schedule.
An organization is identifying engagements to be performed by the internal audit activity over the next 3 to 5 years.
The result is an example of
A. A planned engagement goal.

B. A strategic engagement plan.
C. An engagement planning objective.
D. A tactical engagement plan.
A. Goals are achieved by executing the plans.
B. Strategic engagement plans are prepared for more than a one-year period. The strategic plan is needed
to help ensure that all areas of the business are audited at least periodically. Some areas (those with the
most assessed risk) will need to be audited annually, or even more often, while other areas may be
addressed once every two or three years.
C. Objectives are achieved by executing the plans.
D. Tactical engagement plans are of shorter-term than strategic plans.
The chief audit executive (CAE) is preparing the engagement work schedule for the next budget year and has
limited resources. In deciding whether to schedule the purchasing or the personnel department for an engagement,
which of the following is the least important factor?
A. Major changes in operations have occurred in one of the departments.

B. More opportunities to achieve operating benefits are available in one of the departments than in the other.
C. Updated assessed risk is significantly greater in one department than the other.
D. The internal audit staff has recently added an individual with expertise in one of the areas.
A. Major changes in operations would be an important reason for the engagement.
B. More opportunities to achieve operating benefits would be an important reason for the engagement.

Part 2 (3-Part) : 08/17/23 19:45:12
C. Updated assessed of risks and effectiveness would be an important reason for the engagement.
D. Matter to be considered in establishing engagement work schedule priorities would include (1)
opportunities to achieve operating benefits, (2) updated assessments of risks and effectiveness of risk
management and control processes, and (3) major changes in the enterprise's business, operations,
programs, systems, and controls. The addition of staff is probably not as an important factor as those
mentioned above.

Part 2 (3-Part) : 08/17/23 19:53:16
When making a presentation to management, the internal auditor wants to report observations, conclusions, and
recommendations and to stimulate action. These objectives are best accomplished by
A. Delivering a lecture on the engagement results.

B. Handing out copies of the final engagement communication, asking the participants to read it, and asking for
questions.
C. Showing a series of slides or overheads, which graphically depict the engagement results; limit verbal
commentary.
D. Using slides/overheads to support a discussion of major points.
A. Verbal lectures tend not to be the most effective method of reporting and stimulating action.
B. Getting the participants to read the final engagement communication, and asking for questions would be the
least effective method to stimulate action.
C. Using slides or overheads is more effective than lecturing, but the internal auditor should not limit verbal
commentary.
D. Using slides/overheads to support a discussion of major points would be the most effective way for the
internal auditor to stimulate action.
Question 2 - CIA 1188 II.28 - Planning the Engagement
To determine the sufficiency of information regarding interpretation of a contract, an internal auditor uses
A. The best obtainable information.

B. Subjective judgments.
C. Objective evaluations.
D. Logical relationships between information and issues.
A. The best obtainable information might be reliable but it will not necessarily be sufficient.
B. An evaluation of the sufficiency of information will require objective judgments, not subjective.
C. Internal auditors must identify sufficient, reliable, relevant, and useful information to acheive the
engagement objectives (Standard 2310). Sufficient information is factual, adequate, and convincing so that
a prudent, informed person would reach the same conclusion. The judgment of the internal auditor should
therefore be objective.
D. Logical relationships between information and issues will not determine whether the information is sufficient.
Information must be relevant, but relevant information may not be sufficient.
Which of the following is the best explanation of the difference, if any, between engagement objectives and
procedures?
A. Procedures establish broad general goals; objectives specify the detailed work to be performed.
B. Objectives are tailor-made for each engagement; procedures are generic in application.
C. Objectives define specific desired accomplishments; procedures provide the means of achieving objectives.
D. Procedures and objectives are essentially the same.
A. Objectives are the goals to be achieved. Procedures specify the detailed work to be performed.
B. Both objectives and procedures must be specific in each engagement.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Engagement objectives are broad statements developed by internal auditors and define what the
engagement is intended to accomplish. Engagement procedures are the means to attain engagement
objectives.
D. Engagement procedures are the means to attain the engagement objectives. Engagement objectives and
procedures taken together, define the scope of the internal auditor's work.
Question 4 - CIA 588 I.28 - Planning the Engagement
The internal audit activity (IAA) is planning a 3-year effort to perform engagements at all branches of a large
international car rental agency. Management is especially concerned with standardized operation of the accounting,
car rental, and inventory functions. What type of work program is most appropriate for this project?
A. A pro forma program developed and tested by the internal audit activity.
B. Individual programs developed by the internal auditor-in-charge after a preliminary survey of each branch.
C. A checklist of branch standard operating procedures.
D. An industry-developed engagement guide.
A. A pro forma program would be the most appropriate program for this large international car rental
agency. Pro forma programs are developed for repeated engagements that have similar operations.
B. An individual program would conflict with the organization's desire to have a standardized program.
C. A checklist of branch standard operating procedures is one input that would go into the development of a work
program.
D. Industry-developed engagement guide might not be suited for this particular engagement.
Question 5 - CIA 597 2.7 - Communicate Engagement Results
A chief audit executive (CAE) has noticed that staff auditors are presenting more oral reports to supplement written
reports. The best reason for the increased use of oral reports by the auditors is that such reports
A. Reduce the amount of testing required to support audit findings.

B. Can be prepared using a flexible format thereby increasing overall audit efficiency.
C. Permit auditors to counter arguments and provide additional information that the audience may require.
D. Can be delivered in an informal manner without preparation.
A. The amount of testing required to support audit findings is unrelated to the use of oral reports.Whether findings
are reported through oral or written reports, they still must be adequately supported.
B. The format of the report will depend on the audience. Factors to consider in delivering reports may include the
background and expectations of the audience as well as the time available. This applies to both written and oral
reports. Since oral reports do not eliminate the need for a final report, overall audit efficiency is not affected.
C. Oral reports permit auditors to counter arguments and provide additional information that the audience
may require. Since oral reports evoke face-to-face responses, the auditors can provide an immediate
response to any auditee objections or provide additional information as appropriate.
D. Even though audit reports are delivered orally, they still should be prepared carefully. Poorly planned and
delivered oral reports will be difficult for the audience to follow and may create unnecessary misunderstandings.

Part 2 (3-Part) : 08/17/23 19:53:16
Which of the tests provides the least significant information when testing for suspected fraudulent sales?
A. Performing analysis of write-offs and sales returns, and comparing the amounts over the past several years.
B. Confirming sales transactions with customers and investigating nonresponses.
C. Tracing a sample of inventory removal slips from inventory through billing to the sales journal.
D. Performing analytical tests of sales by comparing sales and gross margins over time.
A. Performing analysis of write-offs and sales returns could be used to detect fraudulent activity. Write-offs could
be used as a cover to commit fraud.
B. Confirming sales transactions with customers could detect fictitious sales.
C. Tracing a sample of inventory removal slips from inventory is not likely to provide evidence to fraud. It's
possible that the inventory could have been used for display or for some other purpose.
D. Performing analytical tests of sales by comparing sales and gross margins over time could indicate fraudulent
activity.
In engagement planning, internal auditors should review all relevant information. Which of the following sources of
information would most likely help identify suspected violations of environmental regulations?
A. Discussions conducted with the external auditors in coordinating engagement efforts.

B. Review of trade publications.
C. Discussions with operating executives.
D. Review of correspondence the entity has conducted with governmental agencies.
A. It is unlikely the external auditors would have the needed information.
B. Trade publications will not likely offer any useful information.
C. Operating managers would not be the best source since they likely will be biased.
D. Review of correspondence with regulatory agencies would be the best source of information.
Question 8 - CIA 1186 I.29 - Communicate Engagement Results
Working papers often contain information of potential future value. A retention policy for working papers should be
devised after consultation with
A. The board.
B. Legal counsel.
C. Engagement clients.
D. The bonding organization.
A. The retention of working papers should be devised after consulting with legal counsel, not with the board.
B. In setting retention policy, the CAE should consult with legal counsel to ensure that all documents that
are required to be kept for a certain period by law or other contractual agreement are kept for the required
time.
C. The retention of working papers should be devised after consulting with legal counsel, not with the engagement
clients.
D. The retention of working papers should be devised after consulting with legal counsel, not with the bonding
organization.

Part 2 (3-Part) : 08/17/23 19:53:16
You are conducting an engagement to evaluate the organization's marketing effort. You agreed to keep the
marketing vice president informed of your progress on a regular basis. What method should be used for those
progress reports?
A. Written reports signed by the chief audit executive.

B. Copies of working paper summaries.
C. Oral or written interim reports.
D. Briefing by the appropriate marketing first-line supervisor.
A. Interim reports may be written or oral.
B. Engagement communications should be submitted to the engagement client, not working paper summaries.
C. Interim reports may be written or oral and may be transmitted formally or informally. Use Interim reports
to communicate information that requires immediate attention, to communicate a change in engagement
scope for the activity under review, or to keep management informed of engagement progress when
engagements extend over a long period. The use of interim reports does not diminish the need for a final
report (PA 2410-1).
D. The internal auditor would submit the engagement communications, not the marketing first-line supervisor.
Which of the following is not included in the statement of scope in an engagement final communication?
A. Period covered by the engagement.

B. Nature and extent of the work performed.
C. Engagement objectives.
D. Activities not reviewed.
A. The statement of scope specifies the period covered.
B. The statement of scope will contain the nature and extent of the work performed.
C. The statement of Scope should identify which activities have been reviewed and the time period
reviewed. If there have been related activities that have not been reviewed these should be identified to
give a clear understanding of the parameters of the engagement. The nature and extent of engagement
work performed will be clearly set out. The engagement objectives set out the purpose of the engagement,
not the scope.
D. The statement of scope will specify the related activities not reviewed.
Question 11 - CIA 590 II.39 - Monitor Engagement Outcomes
Recommendations in engagement communications may, or may not, actually be implemented. Which of the
following best describes internal auditing's role in follow-up on engagement recommendations? Internal auditing
A. Has no role; follow-up is management's responsibility.

B. Should follow up to ascertain that appropriate action is taken on engagement recommendations.
C. Should request that independent auditors follow up on engagement recommendations.
D. Should be charged with the responsibility for implementing engagement recommendations.

Part 2 (3-Part) : 08/17/23 19:53:16
A. The internal auditor has a responsibility to conduct follow-up.
B. The CAE must establish a follow-up process to monitor and ensure that management actions have been
effectively implemented or that senior management has accepted the risk of not taking action (Standard
2500.A1).
C. The external auditor should not assume follow-up.
D. Internal auditors do not have the authority to implement engagement recommendations, nor should they. This
action would impair the IAA's independence.
The chief audit executive (CAE) for a city has just completed a quarterly meeting with the audit committee. The
committee has expressed two major concerns they would like the internal audit activity (IAA) to examine as part of
its operational audits during the next year:
1. Is the "downsizing" that the city has been going through resulting in the "right-sizing" of staff for the city? The
audit committee has suggested that a review of a few areas might be appropriate and could provide some
preliminary evidence in addressing the committee's concerns.
2. Is the city making suboptimal long-run decisions in an effort to improve short-run cash flow? In particular, the
audit committee has suggested that the IAA perform an operational audit of the transportation department,
which is responsible for the operation of the city bus line.
During a meeting with staff auditors to discuss the possibility of doing such an audit, a staff member suggests that
the IAA ought to gather some statistics on employee morale and potential changes in employee absenteeism.
Another staff member asserts that such criteria are not important because (a) they are not measurable, and (b)
they are not relevant — only results are relevant. With respect to the debate, which of the following statements is
correct?
A. Employee morale cannot be objectively measured.

B. Because employee absenteeism is more readily measurable than employee morale, the auditor should only
gather evidence on absenteeism.
C. Job performance and results are more easily and accurately measured than is employee morale.
A. There are objective tests that are available to measure such personal feelings as morale. Such measures are
not left merely to subjective evaluation from observation.
B. Auditors should not gather only evidence which is easiest to collect. The ease of collection should not be the
sole criteria of evidence selection.
C. Performance and results are more easily identified and measured than a personal feeling such as
morale.
D. See the correct answer.
Question 13 - CIA 1196 1.47 - Planning the Engagement
Assume that the auditor wishes to test whether the health care processor is meeting contract requirements

Part 2 (3-Part) : 08/17/23 19:53:16
regarding the proper payment or denial of employee claims. The best audit approach would be to take a sample of
A. Employees and interview them regarding their health care experiences with proper and timely payment by the
health care processor.
B. Claims paid by the health care processor and determine whether all the payments were proper.
C. Claims filed with the health care processor and determine whether they were either appropriately paid or denied.
D. Claims paid by the health care processor and engage an outside expert to analyze whether the claims were
appropriately processed.
A. This procedure provides data regarding the satisfaction of the employees with the processor, but does not
provide unbiased information about the appropriateness of claim payments.
B. This is a good procedure and will provide evidence on the proper payment of claims that were paid. However, it
does not provide any information on claims that should have been paid, but were not paid.
C. This would provide evidence on the appropriateness of claim payments as well as on whether claims
are being denied as specified in the contract with the health care processor.
D. This procedure provides evidence only on the claims that were paid.
The internal audit activity (IAA) for a chain of retail stores recently concluded an engagement to evaluate sales
adjustments in all stores in the Southeast region. The engagement revealed that several stores are costing the
organization substantial sums in duplicate credits to customers' charge accounts. The final engagement
communication published 8 weeks after the engagement was concluded, incorporated the internal auditors'
recommendations to store management that should prevent duplicate credits to customers' accounts. Which of the
following standards has been disregarded in the above case?
A. The internal auditors should have implemented appropriate corrective action as soon as the duplicate credits
were discovered.
B. Internal auditor recommendations should not be included in the final engagement communication.
C. The final engagement communication was not timely.
D. The follow-up actions were not adequate.
A. Internal auditors make recommendations; they do not implement corrective action.
B. Internal auditor recommendations should be included in the final engagement communication.
C. An oral report or interim written report should have been issued immediately to management, alerting
them to the duplicate credit problem. Waiting until 8 weeks after the engagement to communicate
recommendations regarding the problem was unacceptable.
D. No information is given on follow-up actions, so the adequacy of follow-up actions cannot be evaluated.
An internal auditing department recently completed an operational audit of the accounts payable function. If a
summary report were issued in conjunction with the final report, who would most likely receive the summary report
only?
A. Controller.
B. Audit committee of the board of directors.
C. Accounts payable department manager.
D. External auditor.
A. The controller, like the accounts payable department manager, would need a copy of the full final report so that

Part 2 (3-Part) : 08/17/23 19:53:16
details of deficiencies are known and audit recommendations may be implemented.
B. Summary reports highlighting audit results may be appropri-ate for levels of management above the
head of the audited unit.
C. The accounts payable department manager would be best served by receiving a copy of the full final audit report.
D. The external auditor would receive a copy of the full report.
The following information is extracted from a draft of an engagement communication prepared upon the completion
of an engagement to review the inventory warehousing procedures for a division.
Observations and Recommendations
[#5]
We performed extensive tests of inventory record keeping and quantities on hand. Based on our tests, we have
concluded that the division carries a large quantity of excess inventory, particularly in the area of component parts.
We expect this is due to the conservatism of local management that does not want to risk shutting down production
if the goods are not on hand. However, as noted earlier in this engagement communication, the excess inventory
has led to a higher-than-average level of obsolete inventory write-downs at this division. We recommend that
production forecasts be established, along with lead times for various products, and used in conjunction with
economic order quantity concepts to order and maintain appropriate inventory levels.
[#6]
We noted that receiving reports were not filled out when the receiving department became busy. Instead, the
receiving manager would fill out the reports after work and forward them to accounts payable. There is a risk that
all items received might not be recorded, or that failing to record them initially might result in some items being
diverted to other places. During our tests, we discovered many instances in which accounts payable had to call
receiving to obtain a receiving report. We recommend that receiving reports be prepared.
[#7]
Inventory is messy. We recommend that management communicate the importance of orderly inventory
management techniques to warehouse personnel to avoid the problems noted earlier about (1) locating inventory
when needed for production and (2) incurring unusually large amounts of inventory write-offs because of
obsolescence.
[#8]
We appreciate the cooperation of divisional management. We intend to discuss our observations with them and
follow up by communicating your reaction to those recommendations included within this engagement
communication. Given additional time for analysis, we feel that substantial opportunities are available for significant
cost savings, and we are proud to be a part of the process.
A major writing problem in paragraph #5 is
A. The use of potentially emotional words such as "conservatism" of local management.

B. The presentation of observations before recommendations. The engagement communication would have more
impact if recommendations are made before the observations are discussed.
C. The reference to other parts of the engagement communication citing excessive inventory write-downs for
obsolescence is not appropriate. If there is a problem, it should all be discussed within the context of the specific
engagement observation.
D. The specific identification of "component parts" may be offensive to the personnel responsible for those parts
and may reflect negatively on them.
A. The internal auditor should try to avoid using emotional words such as "conservatism" used to describe
local management. This word could be considered offensive to the engagement client.
B. Since this is the observations and recommendations section of the engagement communications it is
appropriate to present the observations before presenting the recommendations.

Part 2 (3-Part) : 08/17/23 19:53:16
C. In this case, citing excessive inventory write-downs for obsolescence would be considered appropriate.
D. The term "component parts" is not considered to be offensive.
The audit committee of a charitable organization suspects that a senior manager may be taking major contributions
and depositing them in alternative accounts or soliciting contributions to be made in the name of another
organization. Which of the following audit procedures would be most effective in detecting the existence of such
improper activities?
A. Use generalized audit software to take a sample of pledged receipts not yet collected and confirm the amounts
due with the donors.
B. Use analytical review procedures to compare contributions generated with those of other comparable institutions
over the same period of time. If the amount is significantly less, take a detailed sample of cash receipts and trace
to the bank statements.
C. Select a sample, which includes all large donors for the past three years, and a statistical sample of others and
request a confirmation of total contributions made to the organization or to affiliated organizations.
D. Select a discovery sample of cash receipts and confirm the amounts of the receipts with the donors. Investigate
any differences.
A. This would provide some evidence, but it is not as thorough as the correct answer. This response only shows
the amounts that are listed as unpaid and would not account for any contributions previously paid or shifted to
another organization.
B. Analytical review of the nature described would be of limited use. The follow-up audit procedure only provides
evidence that those receipts which were recorded were also deposited and does not directly relate to the potential
fraud described.
C. This would be the best procedure because it covers all large donors who gave in prior years and
confirms all pledged and paid contributions to this organization or to any other organization that may have
been represented as an affiliate organization. Discrepancies would provide an area for the auditor to
investigate.
D. This procedure only deals with cash receipts that have been recorded by the organization and would not provide
any insight on receipts that were not recorded or were diverted elsewhere.
Question 18 - CIA 594 H13 - Planning the Engagement
Interviewing techniques are used frequently by internal auditors. When considering the potential use of interviewing
techniques to gather audit evidence, auditors should be aware that interviews:
A. Are more objective than questionnaires in gathering data.

B. Provide a systematic format to ensure audit coverage.
C. Should be corroborated by gathering objective data.
D. Are best suited to reaching audit conclusions.
A. Interviews are not more objective than questionnaires.
B. Interviews do not provide a systematic format.
C. Evidence obtained by interviews should be corroborated.
D. Evidence from interviews is not conclusive.

Part 2 (3-Part) : 08/17/23 19:53:16
A letter in response to an auditor’s inquiry is an example of
A. Testimonial evidence.
B. Physical evidence.
C. Analytical evidence.
D. Documentary evidence.
A. Testimonial evidence takes the form of letters or statements in response to inquiries or interviews.
B. Physical evidence is obtained by observing people, property, or events.
C. Analytical evidence stems from analysis and verification.
D. Documentary evidence includes letters received by the auditee (external) and documents originating within the
auditee's organization.
While performing an engagement relating to an organization's cash controls, the internal auditor observed that
cash deposits are not deposited intact daily. A comparison of a sample of cash receipts lists revealed that each
cash receipt list equaled cash journal entry amounts but not daily bank deposits amounts, and cash receipts list
totals equaled bank deposit totals in the long run. This information as support for the internal auditor's observations
is:
A. Sufficient but not reliable or relevant.

B. Sufficient, reliable, and relevant.
C. Not sufficient, reliable, or relevant.
D. Relevant but not sufficient or reliable.
A. The information would also be considered to be reliable and relevant.
B. The presented information has all the traits to be considered sufficient, reliable, and relevant. It is
sufficient because a reasonable person would judge a comparison the organization's records with the
bank records as persuasive proof that deposits where not made intact daily. It is reliable because the
auditor is able to verify information by an independent source (bank). The information is furthermore
deemed relevant because it is relevant to the issue of whether cash receipts are deposited intact daily.
C. The presented is considered to be sufficient, reliable, and relevant.
D. The information would also be considered to be sufficient and reliable.
Question 21 - CIA 596 I.3 - Monitor Engagement Outcomes
Internal auditors realize that at times corrective action is not taken even when agreed to by the appropriate parties.
This should lead an internal auditor to
A. Allow management to decide when to follow-up because it is management's ultimate responsibility.

B. Decide to conduct follow-up work only if management requests the internal auditor's assistance.
C. Decide the extent of necessary follow-up work.
D. Write a follow-up engagement communication with all observations and their significance for operations.
A. Follow-up is the responsibility of the internal auditor.
B. Follow-up is the responsibility of the internal auditor.

Part 2 (3-Part) : 08/17/23 19:53:16
C. The internal audit activity's charter should define the responsibility for follow-up. The CAE determines
the nature, timing, and extent of follow-up, considering the following factors: the significance of the
reported observation or recommendation, the degree of effort and cost needed to correct the reported
condition, the impacts that may result should the corrective action fail, the complexity of the corrective
action, and the time period involved (PA 2500.A1-1).
D. The follow-up engagement communication should not restate all observations.
An auditor plans to evaluate the adequacy of a company's insurance coverage. What is the most likely source of
information for a detailed schedule of insurance policies in force?
A. The corporate charter prescribing the insurance staff's objectives, authority, and responsibilities.
B. Original journal entries found in the cash disbursements journal and supported by canceled checks.
C. The files containing insurance policies with various carriers.
D. The current fiscal year's budget for prepaid insurance together with the beginning balance of the account.
A. The charter granted by management would be broad and general in scope, not detailed and procedural. This
would be delegated to the insurance staff.
B. It would be impractical to scan journal entries in order to construct a current list of insurance policies.
Furthermore, some premiums paid in prior periods carry over into this and possibly future periods while premiums
paid in this period probably extend coverage into future periods.
C. The files containing the insurance policies would be the source of information regarding type of
coverage, terms, premiums, and possible restrictive endorsements.
D. The budget for the current fiscal year is but a plan, which may or may not be achieved or fully meet the optimum
desired by the insurance staff. Furthermore, some premiums paid in prior periods would have carried over into this
period.
The internal audit activity (IAA) has recently completed an engagement to evaluate the organization's accounts
payable function. The chief audit executive (CAE) decided to issue a summary in conjunction with the final
engagement communication. Who is most likely to receive the summary only?
A. Accounts payable manager.

B. Controller.
C. External auditor.
D. Audit committee of the board.
A. The full audit report should be distributed to everyone who has a direct interest in the audit. This includes the
result of the audit. The accounts payable manager is the person responsible for the accounts payable operation
and the person who will need to take corrective action as a result of the audit.
B. The full audit report should be distributed to everyone who has a direct interest in the audit. This includes the
result of the audit. The controller is responsible for the accounting function and is therefore a person to whom the
accounts payable manager will respond about the report.
C. The full audit report should be distributed to everyone who has a direct interest in the audit. This includes the

Part 2 (3-Part) : 08/17/23 19:53:16
result of the audit. The accounts payable manager is the person responsible for the accounts payable operation
and the person who will need to take corrective action as a result of the audit. The external auditor is a person who
has a direct interest in the internal audit.
D. The full audit report should be distributed to everyone who has a direct interest in the audit. This
includes the executive or executives to whom internal audit reports, the person to whom people will reply
about the report, persons responsible for the activities or operations audited, and people who will need to
take corrective action as a result of the audit. The audit committee of the board can appropriately receive a
summary report.
Which technique is most appropriate for testing the quality of the preliminary survey of payment vouchers
described in an internal control questionnaire?
A. Verification.
B. Observation.
C. Analysis.
D. Evaluation.
A. Verification corroborates, compares, and confirms the existence of factual data.
B. Observation is used to identify the existence of physical assets.
C. Analysis compares relationships among data. This would not likely be useful for testing the quality of the
preliminary survey of payment vouchers.
D. Evaluation would not likely be useful for testing the quality of the preliminary survey of payment vouchers.
Which of the following is deductive reasoning?
A. Reasoning through the development of a carefully constructed hypothesis.

B. Reasoning from one or more particular facts to reach a general conclusion.
C. Reasoning from the general to the particular.
D. Reasoning on a post hoc basis.
A. Inductive reasoning is more closely associated with constructing hypotheses.
B. This is inductive reasoning.
C. Deductive reasoning is from the general to the specific answer.
D. This occurs when one incorrectly assumes causality just because one event follows another.
An internal auditor has set an engagement objective of determining whether mailroom staff is fully used. Which of
the following engagement techniques will best meet this objective?
A. Observation.

Part 2 (3-Part) : 08/17/23 19:53:16
B. Inspection of documents.
C. Analytical review.
D. Inquiry.
A. Observation will be the best method to help the internal auditor determine whether mailroom staff is
fully used. Just by observing the mailroom operations at various times of the day the internal auditor
should be able to get of better understanding whether the mailroom staff is being used effectively.
B. Inspection of documents will do little to help the internal auditor determine whether mailroom staff is fully used.
C. Analytical review will do little to help the internal auditor determine whether mailroom staff is fully used.
D. Inquiry will do little to help the internal auditor determine whether mailroom staff is fully used.
Which of the following is an appropriate statement of an engagement objective?
A. To determine whether inventory stocks are sufficient to meet projected sales.

B. To search for the existence of obsolete inventory by computing inventory turnover by product line.
C. To observe the physical inventory count.
D. To include information about stockouts in the final engagement communication.
A. Engagement objectives are broad statements developed by internal auditors and define what the
engagement is intended to accomplish. Internal auditors establish engagement objectives to address the
risks associated with the activities under review (Standard 2210). Thus, determining whether inventory
stocks are sufficient to meet projected sales would be an engagement objective.
B. Computing inventory turnover is an engagement procedure.
C. Observing physical inventory count is an engagement procedure.
D. Information about stockouts is not an appropriate engagement objective.
The purchasing manager of a manufacturing company was concerned with the rising prices of some direct
materials provided by a supplier. The purchasing manager told the supplier to either maintain the current prices or
withdraw as a supplier for the company's direct materials. The supplier devised a plan to circumvent the purchasing
manager's intent without actually violating the purchasing manager's mandate. Which one of the following is the
probable action taken by the supplier?
A. The supplier worked through the president of the manufacturing company to force the purchasing manager to
cancel the mandate.
B. The supplier decided to stop providing the direct materials to the manufacturing company, since holding the line
on prices would have a negative impact.
C. The supplier maintained prices but substituted a lower grade of direct materials.
D. The supplier maintained prices in the short-run but later returned to a pattern of increasing prices.
A. This action does not provide enough information to determine if the supplier violated the purchasing manager's
mandate.
B. This is not a way to circumvent the purchasing manager's mandate. It follows the choices enumerated by the
purchasing manager.
C. This would permit the supplier to increase profit without actually raising the price.

Part 2 (3-Part) : 08/17/23 19:53:16
D. This is a violation of the purchasing manager's mandate.
As an internal auditor for a multinational chemical producer, you have been assigned to an engagement at a local
plant. This plant is similar in age, siting, and construction to two other plants owned by the same organization that
have been recently cited for discharge of hazardous wastes. In addition, you are aware that chemicals
manufactured at the plant release toxic by-products. Assume that you have evidence that the plant is discharging
hazardous wastes. As a certified internal auditor (CIA), what is the appropriate communication requirement in this
situation?
A. Ignore the issue because the regulatory inspectors are better qualified to assess the danger.
B. Note the issue in your working papers but do not report it.
C. Issue an interim engagement communication to the appropriate levels of management.
D. Send a copy of your engagement communication to the appropriate regulatory agency.
A. An internal auditor should evaluate controls relating to compliance with laws, regulations, and contracts.
B. This is a violation of a law, and it needs to be reported immediately to management in either an oral report or an
interim report.
C. Whenever a problem that requires immediate attention is discovered in an internal audit, an oral report
or interim written report should be issued immediately to management, alerting them to the problem. In
this case, the problem is a violation of a law.
D. An internal auditor is not responsible for submitting a copy of the internal engagement communication to
regulatory authorities.
A banking organization has a centralized investment policy which requires that each bank invest no more than 15
percent of its portfolio in certain kinds of securities which are considered high risk. On separate audits of four
banks, the internal auditors found anywhere from 17 percent to 21 percent of the portfolio invested in these kinds of
securities. Each bank’s chief financial officer (CFO) argued that the policy was excessively restrictive, and that
investment in these securities brought significantly higher returns with a minimal increase in risk. The internal
auditors should
A. Include this finding in the audit reports as a minor finding. The amount in violation of policy was only two percent
to six percent of each portfolio.
B. Further analyze the investment policy before discussing its merit with senior management.
C. Include this finding in the audit reports as a major finding.
D. Notify senior management of the policy violation immediately. These securities may include derivatives.
B. The auditors should keep an open mind, question the adequacy of the policy, and base their ultimate
conclusion on their own analysis and discussions with all concerned parties.
C. Four successive CFOs questioning the policy is evidence that the policy may not be adequate to meet the needs
of the organization. A good internal auditor questions the adequacy as well as the effectiveness of organizational
policies.

Part 2 (3-Part) : 08/17/23 19:53:16
An organization manufacturing special-order products is experiencing excessive rates of rejection of finished

products. An engagement procedure to identify the source of the problem is
A. Evaluating communications from the production department to the sales department.

B. Evaluating communications from the sales department to the production department.
C. Testing whether supply of the product is sufficient to meet customer demand.
D. Analyzing customer demand for the product.
A. The sales departments are the ones in contact with the customers, so they would be more in a position to know
of any complaints.
B. The sales department should know of customer complaints for special orders, so evaluating
communications between the sales department and production department would be an appropriate
method to identify the source of the problem.
C. This is an issue of production quality, not product demand.
D. This is an issue of production quality, not product demand.
Data-gathering activities such as interviewing operating personnel, identifying standards to be used to evaluate
performance, and assessing risks inherent in a department’s operations are typically performed in which phase of
an audit?
A. Examining and evaluating evidence.

B. Fieldwork.
C. Preliminary survey.
D. Audit program development.
A. The activities described must be performed before the evidence can be examined or evaluated.
B. The activities described must be performed before the fieldwork can be undertaken.
C. These activities are normally accomplished during the preliminary survey phase.
D. The activities described must be performed before the audit program can be developed.
Word selection can have an impact on the recipient when presenting an engagement communication in either
written or oral form. In a written or oral presentation in which the internal auditor's objective is to persuade an
individual to accept the recommendations, using words with strong or emotional connotation rather than words with
low connotation
A. Will cause the recipient to accept the internal auditor's recommendations quickly with no reservations.
B. Will have no effect whatsoever on the recipient.
C. May move the recipient deliberately in the direction of the internal auditor's recommendation.
D. May misfire quickly, moving the recipient away from the internal auditor's recommendation.
A. The recipient may accept the internal auditor's recommendation, but not without reservations.
B. Words that are too strong or too emotional may cause the recipient to accept the recommendation, but not
without reservation.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Using words with strong or emotional connotation may have negative consequences.
D. Word selection is very important for the internal auditor. Using words with high connotation sometimes
can have a powerful, positive effect on people, but these words may move the recipient away from the
auditor's recommendation. The words that the internal auditor chooses have to be chosen careful in order
to appeal to the specific recipient.
Question 34 - CIA QZP2B.14 - Monitor Engagement Outcomes
An audit found that the cost of some material installed on capital projects had been transferred to the inventory
account because the capital budget had been exceeded. Which of the following would be an appropriate technique
for the internal audit activity (IAA) to use to monitor this situation?
A. Review all journal entries that transferred costs from capital to inventory accounts.
B. Analyze a sample of capital transactions each quarter to detect instances in which installed material was
transferred to inventory.
C. Identify variances between amounts capitalized each month and the capital budget.
D. Compare inventory receipts with debits to the inventory account and investigate discrepancies.
A. There may be some legitimate reasons for transferring some capital costs to the inventory account.
Thus, it is important for the internal auditor to review all journal entries that transferred costs from capital
to inventory accounts.
B. The internal auditor should review all journal entries, not just a sample. There may be some legitimate reasons
for transferring some capital cost to the inventory account.
C. Identifying variances between amounts capitalized each month and the capital budget does not consider the
affects on the inventory budget.
D. There would be no inventory receipts for the transfers.
An internal auditor would trace copies of sales invoices to shipping documents in order to determine that
A. Customer shipments were billed.

B. Shipments to customers were also recorded as receivables.
C. Sales that are billed were also shipped.
D. The subsidiary accounts receivable ledger was updated.
A. Since the tracing is starting with copies of sales invoices and then comparing them to shipping documents, this
procedure would not determine that all shipments to customers have been billed.
B. Tracing copies of sales invoices to shipping documents will not determine that all shipments to customers have
also been recorded as receivables.
C. If all the invoices in the sample can be correctly matched with shipping documents then there is some
assurance that all or most items billed are also shipped.
D. Tracing copies of sales invoices to shipping documents will not determine that the subsidiary accounts
receivable ledger was updated.

Part 2 (3-Part) : 08/17/23 19:53:16
The effectiveness of an audit assignment is related to the findings and the action taken on those findings. Which of
the following activities contributes to assignment effectiveness?
A. Preparing weekly time reports.

B. Conducting an exit interview with auditees.
C. Adhering to a time budget.
D. Having budget revisions approved by the project supervisor.
A. Preparing weekly time reports is important for audit efficiency, but it does not contribute to assignment
effectiveness.
B. It is a courtesy to review the report with the person or department being audited, so the auditee knows
what is being sent to his or her supervisors and will not be surprised by the report. This review may also
allow the auditee to identify any inaccuracies in the report. The internal auditor and the auditee are present
at this meeting, and one effect of the meeting should be to generate commitment from the auditee for
appropriate corrective action.
C. Adhering to a time budget is important for audit efficiency and economy, but it does not contribute to assignment
effectiveness.
D. Having budget revisions approved by the project supervisor is important for audit efficiency, but it does not
contribute to assignment effectiveness.
Which of the following is not ordinarily considered an essential criterion for developing engagement work programs?
A. Specificity as to procedures to be followed.

B. Specificity as to the controls to be tested.
C. Description of the objectives of the engagement client operation to be evaluated.
D. Specificity as to the methodology to be used for the engagement procedures.
A. The engagement work program should include the procedures that the internal auditor will used to conduct,
analyze, interpret and document information during the engagement.
B. The engagement work program should state the nature and extent of required testing.
C. Description of the objectives is an essential criterion for developing engagement work programs.
D. Engagement work program would not include the methodology to be used for the engagement
procedures. The engagement work program would include the scope, degree, and extent of testing
required, but not methodology.
Internal auditors often include summaries within their working papers. Which of the following best describes the
purpose of such summaries?
A. Summaries document that the internal auditor has considered all relevant information.
B. Summaries are usually required to complete each section of an engagement work program.
C. Summaries are prepared to conform with the Standards.
D. Summaries distill the most useful information from several working papers into a more usable form.
A. The purpose of the summaries is not to document that the internal auditor has considered all relevant
information. Summaries are done in order to assist the review process and to make sure the information that is
included is accurate and consistent.

Part 2 (3-Part) : 08/17/23 19:53:16
B. Summaries are not a requirement of the engagement work program.
C. Summaries are not a requirement of the Standards. Summaries are done in order to assist the review process
and to make sure the information that is included is accurate and consistent.
D. Summaries are a useful tool to use in the working papers in order to bring together significant
information that may be located in different parts of the working papers.
In which of the following situations have the internal auditors appropriately transmitted their engagement
communication?
Situation 1 - The engagement team is behind schedule so the in-charge internal auditor decides to present the
final engagement communication orally to the area's management in place of a written report.
Situation 2 - The area manager will be on vacation when the final engagement communication is expected to be
issued. The in-charge internal auditor presents orally several items that need immediate corrective action.
Situation 3 - During inspection of inventory, an internal auditor observes water from a leaking section of the roof
dripping on items stored beneath it. These items are susceptible to water damage. The internal auditor tells the
plant manager who has the items moved and the roof repaired. The internal auditor does not mention this item in
the final written engagement communication.
Situation 4 - The engagement team found only one minor problem during the engagement. This problem was
pointed out to the manager of the area who took steps to correct it before the engagement was finished. The
in-charge internal auditor decides that, because management need take no further corrective action, no written
engagement communication for this engagement is necessary.
A. Situations 2 and 3.
B. Situations 1 and 4.
C. Situations 1 and 3.
D. Situations 2 and 4.
A. In situations 2 & 3, engagement communications were appropriately transmitted. In the case of situation
2, oral communication plays an important role in the communication during the engagement. Oral
communication is appropriate if there are items that need immediate attention.
B. Situations 1 & 4 are not appropriate because no final written engagement communications were issued.
C. Situation 1 is not appropriate because no final written engagement communication was issued.
D. Situation 4 is not appropriate because no final written engagement communication was issued.
An auditor would most likely judge an error in an account balance to be material if the error involves
A. A large percentage of net income.

B. An unusual transaction for the organization.
C. An unverified routine transaction.
D. A clerical mistake which is unlikely to occur again.
A. Materiality is judged based on the significance of the error compared to other items, such as net income.
B. Again, this factor alone does not indicate materiality. However, the transaction may involve a large amount of
relative risk. If so, auditing procedures should be extended even if the error is judged to be immaterial when

Part 2 (3-Part) : 08/17/23 19:53:16
compared to other items.
C. This factor alone does not indicate materiality, but it does suggest high relative risk. Thus, the auditor may
extend auditing procedures for the transaction, even if the error is judged to be immaterial.
D. This factor alone does not suggest materiality, since the error is not compared to other items. It also suggests a
low amount of relative risk, since the error is not likely to occur again. It appears to be a random error.
The internal auditor of a construction enterprise that builds foundations for bridges and large buildings performed a
review of the expense accounts for equipment (augers) used to drill holes in rocks to set the foundation for the
buildings. During the review, the internal auditor noted that the expenses related to some of the auger accounts
had increased dramatically during the year. The internal auditor inquired of the construction manager who offered
the explanation that the augers last 2 to 3 years and are expensed when purchased. Thus, the internal auditor
should see a decrease in the expense accounts for these augers in the next year but would expect an increase in
the expenses of other augers. The internal auditor also found out that the construction manager is responsible for
the inventorying and receiving of the augers and is a part owner of a business that supplies augers to the
organization. The supplier was approved by the president to improve the quality of equipment.
Which of the following procedures would be the least appropriate engagement procedure to address these
analytical observations?
A. Note the explanation in the working papers for investigation during the next engagement and perform no further
work at this time.
B. Develop a comparative analysis of auger expense over the past few years to determine if the relationship held in
previous years.
C. Take a sample of debits to the auger expense account and trace to independent shipping documents and to
invoices for the augers.
D. Arrange to take an inventory of augers to determine if the augers purchased this year were on hand and would
be available for use in the next 2 years.
A. Just noting an explanation in the working papers would be the least appropriate engagement
procedure. The construction manager's obvious conflict of interest could be a motive for fraud. Thus,
additional work should be done.
B. Comparative analysis is an effective method of establishing whether the manager's explanation is reasonable.
C. This is a good method of testing whether the augers were actually received.
D. Taking an inventory count is a good method of verifying the existence of the augers.
The internal auditor prepares summaries of data in working papers to
A. Indicate the numerical arrangement of the working papers.

B. Focus on significant engagement observations.
C. Identify the irrelevant facts gathered during the engagement communication.
D. Explain the notes used throughout the working papers.
A. Summaries bring together significant information that may be located in different parts of the working papers.
Summaries may not be based on any particular numerical arrangement.
B. Summaries are a useful tool to use in the working papers in order to bring together significant
information that may be located in different parts of the working papers.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Summaries concentrate on relevant facts gathered during the engagement communication.
D. Explanations of notes used throughout the working papers should be on a separate sheet.
An internal auditor has just completed a survey to become familiar with the organization's payroll operations. Which
of the following should be performed next?
A. Conduct fieldwork.
B. Write the engagement work program.
C. Assign internal audit personnel.
D. Establish initial engagement objectives.
A. Conducting fieldwork is done after writing the engagement work program.
B. After completing the survey the next step is to write the engagement work program.
C. Internal audit personnel are generally assigned before the preliminary survey.
D. Establishing the initial engagement objectives is done at the beginning of the planning process.
The internal auditing activity (IAA) has been assigned to perform an audit of a division. Based on background
review, the auditor knows the following about management policies:
Company policy is to rapidly promote divisional managers who show significant success. Thus, successful
managers rarely stay at a division for more than three years.
A significant portion of division management's compensation comes in the form of bonuses based on the
division's profitability. The division was identified by senior management as a turnaround opportunity. The
division is growing, but is not scheduled for a full audit by the external auditors this year. The division has
been growing about 7 percent per year for the past three years and uses a standard cost system. During the
preliminary review, the auditor notes the following changes in financial data compared to the prior year:
Sales have increased by 10%.
Cost of Goods Sold has increased by 2%.
Inventory has increased by 15%.
Divisional net income has increased by 8%.
Assume the auditor found that there was a plan to overstate inventory and therefore increase reported profits for
the division. If reported correctly, the division would not have shown an increase in net income. The auditor has
substantial evidence that the divisional manager was aware of, and approved the plan to overstate inventory. There
is also some evidence that the manager may have been responsible for the implementation of the plan. The
appropriate audit action would be to
A. Continue to conduct interviews with subordinates until a clear cut case is made. Then report the case to the
audit committee.
B. Inform the divisional manager of the audit suspicions and obtain the manager's explanation of the findings
before pursuing the matter further.
C. Document the case thoroughly and report the suspicions to the external auditor for further review and external
reporting.
D. Inform management and the audit committee of the findings and discuss proper follow-up action and/or further
investigation with them.
A. The auditor has sufficient evidence to bring the matter to the attention of management and leave it to them to
decide the method of further investigation.

Part 2 (3-Part) : 08/17/23 19:53:16
B. There is no need to inform divisional management of the audit suspicions. It would be appropriate to interview
divisional management, but primarily as a fact finding chore.
C. The auditor's responsibility is for reporting inside the organization. There is no need to report the item to the
external auditor.
D. This is the correct response of the auditor.
Which of the following could contribute to discrepancies between receiving reports and the number of units in a
shipment?
A. Accepting improper authorization of purchases.

B. Showing quantities ordered on the receiving department’s copy of purchase orders.
C. Using inadequate vendor selection procedures.
D. Failing to compare the quality of goods received with specifications.
A. This would not lead to the difference in quantity. The number of units in the shipment should still agree with the
receiving report.
B. This may encourage receiving personnel to merely write the same quantity on the receiving report,
without honestly counting the shipment. Omitting the quantity on the copy of the purchase order would
force receiving personnel to count each shipment.
C. Inadequate procedures could lead to selecting a vendor with poor internal control who shipped the wrong
quantity. However, the receiving department should have noted the difference in quantity when the shipment was
counted.
D. Receiving personnel could inspect the quality of the goods without counting them.
The following information is to be included in a finding of an inventory control audit of a tent and awning
manufacturer. The issue relates to overstocked rope.
I. The quantity on hand at the time of the audit represented a 10-year supply based on normal usage.
II. The company had held an open house of its new factory two months prior to the audit and had used the
rope to provide safety corridors through the plant for visitors. This was not considered when placing the last
purchase order.
III. Rope is reordered when the inventory level reaches a one-month supply and is based on usage during the
previous twelve months.
IV. The quantity to be ordered should be adequate to cover expected usage for the next six months.
V. The purchasing department should review inventory usage and inquire about any unusual fluctuations
before placing an order.
VI. A public warehouse, costing $500 per month, was required to store the rope.
VII. The purchasing agent receives an annual salary of $59,000.
Which of these statements should be in the condition section of the finding?
A. VII only.

Part 2 (3-Part) : 08/17/23 19:53:16
B. I only.
C. VI only.
D. IV only.
A. This should not be included in the report.
B. This should be reported in the condition section.
C. This should be in the effect section.
D. This should be in the criteria section.
To assess the quality of a pre-audit of payroll vouchers, an auditor would most likely use
A. Evaluation.
B. Observation.
C. Analysis.
D. Verification.
A. Evaluation involves weighing what has been gathered.
B. Observation is a physical exploration process.
C. Analysis is directed toward a "why" objective.
D. Verification is the process of determining the validity of previously provided informa-tion.
An internal audit activity (IAA) is conducting an engagement to evaluate the payroll and accounts receivable
departments. Significant problems related to the approval of overtime have been noted. While the engagement is
still in process, which of the following engagement communications is appropriate?
A. An oral communication.
B. A final written communication.
C. A summary communication.
D. A questionnaire-type communication.
A. Interim reports are written or oral and may be transmitted formally or informally. Use interim reports to
communicate information that requires immediate attention, to communicate a change in engagement
engagements extend over a long period. The use of interim reports does not diminish the need for a final
report (PA 2410-1). Thus, an oral communication to the operating management outlining the significant
problems would be appropriate.
B. A final written communication would be submitted only when the engagement is completed.
C. Summary reports highlighting engagement results are appropriate for level of management above the
engagement client and they can be issued separately from or in conjunction with the final report (PA 2410-1).
D. A questionnaire-type report would be of little use in communicating significant problems.

Part 2 (3-Part) : 08/17/23 19:53:16
One of the objectives of an inventory system audit is to determine if merchandise levels are replenished on a timely
basis. An appropriate audit procedure for this objective would involve detailed testing of the
A. Update program that creates new purchase orders.

B. Update program that creates new part numbers.
C. Edit program that lists all quantities sold.
D. Edit program that lists batch totals for shipments.
A. New purchase orders produces evidence that inventory is to be replenished.
B. This audit procedure would indicate activity only for new inventory items, not if merchandise levels are
replenished on a timely basis.
C. Testing an edit program that lists all quantities sold will not determine if merchandise levels are replenished.
D. Testing edit program that lists batch totals for shipments would not determine if merchandise levels are
replenished on a timely basis.
An internal auditor observes that controls over the perpetual inventory system are weak. An appropriate
engagement response is to
A. Increase the testing of the inventory controls.

B. Perform turnover ratio tests.
C. Recommend that a physical inventory count be scheduled.
D. Apply gross profit analyses by product lines and compare the results with prior-years' information for
reasonableness.
A. If the internal auditor observes that controls are weak then increasing the testing of controls would probably be
inefficient.
B. Performing turnover ratio tests would not provide sufficient information.
C. The most appropriate response would be to recommend a physical inventory count. Observing a
physical inventory count would be the most persuasive form of information.
D. Applying gross profit analyses would not be sufficient.
The internal auditor has a recommendation to change operations which could potentially increase profits by
$50,000. The best way to sell this recommendation to management is to
A. Not discuss it with anyone until the exit conference, so the meeting can start with a pleasant surprise.
B. Discuss it with operating management who are directly affected by the change, and then with department
management.
C. Carefully work out the details of implementation before presenting it to auditee management.
D. Bring it to the audit manager, who should bring it immediately to senior management's attention.
A. Without the input of members of line management, there is a risk of the recommendation being impractical.
Also, the front line workers will not feel involved in the decision, so they may be resentful and not support
implementation enthusiastically.
B. This approach will lead to the best recommendation, because it includes input from the people directly

Part 2 (3-Part) : 08/17/23 19:53:16
involved in the activity. Also, working up the chain of command prevents anyone from feeling left out of
the decision. The resentment that might cause could diminish the chances of successful implementation.
C. Management is less likely to accept a recommendation if they did not participate in developing it. Also, the
auditor is unlikely to develop a practical recommendation without input from auditee workers and management.
D. Without the input of members of line management, there is a risk that they might resent not being involved in the
decision.
Question 52 - CIA R98 I.1 H2 - Planning the Engagement
An assurance engagement in the quality control department is being planned. Which of the following is least likely
to be used in the preparation of a preliminary survey questionnaire?
A. The prior engagement communications.

B. The permanent engagement file.
C. Management's charter for the quality control department.
D. An analysis of quality control documents.
A. Prior engagement communications would be helpful to the internal auditor in formulating the questionnaire.
B. The permanent engagement file would be useful in preparing a preliminary survey questionnaire. For example, it
could contain problems from past engagements that might be useful when conducting future engagements.
C. Reviewing management's charter for the quality control department would be helpful to the internal auditor in
formulating the questionnaire.
D. If appropriate, a preliminary survey should be conducted to become familiar with the engagement
client's activities, risks, and controls to identify areas for engagement emphasis, and to invite comments
and suggestions from engagement clients (PA 2210.A1-1). A survey would not entail an analysis of quality
control documents. This analysis would be included when conducting the fieldwork, which comes after
the preliminary survey.
The use of an analytical review to verify the correctness of various operating expenses would not be a preferred
approach if
A. An auditor would like to identify large, unusual, or non-recurring transactions during the year.
B. Operations are relatively stable and have not changed much over the past year.
C. Operating expenses vary in relation to other operating expenses, but not in relation to revenue.
D. An auditor notes strong indicators of a specific fraud involving these accounts.
A. Analytical review would be useful in identifying whether large, non-recurring, or unusual transactions occurred.
B. Relatively stable operating data is a good scenario for using analytical review.
C. Analytical review only needs to have accounts related to other accounts or other independent data. It does not
require that they be related to revenue.
D. If the auditor already suspects fraud, a more directed audit approach would be appropriate.

Part 2 (3-Part) : 08/17/23 19:53:16
An auditor is performing an operational audit of the shipping department. As a part of the audit, the auditor selected
a sample of 45 daily shipping logs from the shipping department files. On 44 of the days, the log contained a
sufficient number of shipments to meet its daily quota. Based on this test, the auditor concluded that the shipping
department was effective at meeting its quotas. Which of the following is probably true about the internal auditor's
conclusion?
A. This conclusion would negate any need to perform tests of efficiency.

B. From this conclusion the auditor could conclude that the shipping department is effective in meeting its
responsibilities.
C. The number of items selected for testing is inadequate to justify the conclusion.
D. None of the above are true.
A. Tests of efficiency should still be performed.
B. An overall conclusion of effectiveness would require that the auditor determine that the quotas were adequate,
and items were shipped to the appropriate customers.
C. The sample size is adequate to justify the conclusion.
D. None of the statements are true.
Competent evidence is best defined as evidence which
A. Is obtained by observing people, property, and events.

B. Is supplementary to other evidence already gathered and which tends to strengthen or confirm it.
C. Proves an intermediate fact, or group of facts, from which still other facts can be inferred.
D. Is reasonably free from error and bias and faithfully represents that which it purports to represent.
A. This is the definition of physical evidence. All physical evidence is not necessarily competent; in fact, the quality
of competence is more often associated with documentary evidence.
B. This is the definition of corroborative evidence. While corroborative evidence may be competent, much
competent evidence is primary rather than supplementary.
C. This is the definition of circumstantial evidence. Circumstantial evidence is not necessarily competent evidence.
D. Competent evidence is reliable evidence and the best attainable through the use of appropriate audit
techniques.
Question 56 - CIA QZP2A.10 - Communicate Engagement Results
The primary reason for having written formal audit reports is to
A. Document the corrective actions required of senior management.

B. Record observations and recommended courses of action.
C. Provide an opportunity for engagement client response.
D. Provide a formal means by which the external auditor assesses potential reliance on the internal audit activity.
A. Internal auditors make only recommendations.
B. Although the format and content of the engagement final communications may vary by organization or
type of engagement, they should contain, at a minimum, the purpose, scope, and results of the
engagement. Purpose statements describe the engagement objectives and may inform the reader why the
engagement was conducted and what it was expected to achieve. Scope statements identify the audited
activities and may include supportive information such as time period reviewed and related activities not

Part 2 (3-Part) : 08/17/23 19:53:16
reviewed to delineate the boundaries of the engagement. They may describe the nature and extent of
engagement work performed. Results include observations, conclusions, opinions, recommendations, and
action plans (PA 2410-1).
C. The engagement client should have an opportunity to respond before the report is written.
D. When appropriate, external auditors review the internal auditors' reports and working papers for this purpose.
However, external auditor assessment is at best a secondary reason for formal reporting.
A small city managed its own pension fund. According to the city charter, investments could be made only in bonds,
money market funds, or high-quality stocks. The internal auditor has already verified the existence of the pension
fund's assets. The fund balance was not very large and was managed by the city treasurer. The internal auditor
decided to estimate income from investments of the fund by multiplying the average fund balance by a
weighted-average rate based on the current portfolio mix. Upon doing so, the internal auditor found that recorded
return was substantially less than was expected. The internal auditor's next procedure should be to
A. Inform management and the board that fraud is suspected and suggest that legal counsel be called in to
complete the investigation.
B. Select a sample of entries to the pension fund income account and trace to the cash journal to determine if cash
was received.
C. Inquire of the treasurer as to the reason that income appears to be less than expected.
D. Prepare a more detailed estimate of income by consulting a dividend and reporting service that lists the interest
or dividends paid on specific stocks and bonds.
A. At this point the internal auditor does not have enough sufficient information to conclude that fraud has occurred.
B. This procedure would only provide information about the amount of cash received from the investments. This
would not explain the differences between the expectations and the results.
C. The next course of action for the internal auditor is to do more work, i.e., income estimating. Only then would the
internal auditor discuss the matter with the treasurer.
D. The internal auditor's next procedure would be to prepare more analytical procedures. The intent is to
evaluate the results in order to explain the differences between the expectations and the results. When
analytical auditing procedures identify unexpected results or relationships, internal auditors should
examine and evaluate such or relationships. The examination and evaluation of unexpected results or
relationships from applying analytical auditing procedures should include inquiries of management and
the application of other engagement procedures until internal auditors are satisfied that the results or
relationships are sufficiently explained.
The scope of an internal auditing engagement is initially defined by the
A. Scheduling and time estimates.

B. Preliminary survey.
C. Engagement objectives.
D. Engagement work program.
A. Scheduling and time estimates will be based on the engagement objectives and scope of work.
B. The preliminary survey is done before determining the engagement objectives.
C. The established scope must be sufficient to satisfy the objectives of the engagement (Standard 2220).

Part 2 (3-Part) : 08/17/23 19:53:16
D. The engagement work program is based on the engagement objectives.
During interviews with the inventory management personnel, an internal auditor learned that salespersons often
order inventory for stock without receiving the approval of the vice president of sales. Also, detail testing showed
that there are no written approvals on purchase orders for replacement parts. The detail testing is a good example
of
A. Corroborative evidence.
B. Circumstantial evidence.
C. Subjective evidence.
D. Indirect evidence.
A. Corroborative evidence is evidence that supports other evidence. In this case, the detailed testing
provided corroborative evidence.
B. Circumstantial evidence is evidence that indicates another event or item occurred or existed. The detailed
testing provided more than circumstantial evidence.
C. The detail testing of provided was more than subjective evidence. Subjective evidence is based on opinion. No
opinions were given in this situation.
D. Detailed testing provides direct evidence that inventory was ordered without the approval of the vice president.
In the preparation of an engagement work program, which of the following items is not essential?
A. The preparation of a budget identifying the costs of resources needed.

B. The performance of a preliminary survey.
C. A review of material from prior engagement communications.
D. A review of criteria established by management to determine whether operating goals and objectives have been
accomplished.
A. Preparing the budget is not an essential part of writing the engagement work program. The work
program, however, should state what resources would be necessary to carry out the engagement.
B. The performance of a preliminary survey is part of preparing the engagement work program.
C. Reviewing material from prior engagement communications is useful because it informs the internal auditor
about the prior engagement's observations and what corrective actions were taken, if any.
D. Internal auditors should conduct a review of criteria established by management to determine whether operating
goals and objectives have been accomplished.
Management of a telephone and cable television enterprise has requested an engagement to evaluate its service
department. The department is responsible for handling all customer inquiries regarding telephone or cable
performance and assigning staff personnel to fix the problem, installing new cable lines and hooking them up to the
customer's home, selling complementary products such as designer telephones, selling complementary services
such as premium cable television services, and additional telephone services such as call-waiting, three-line
hookup, etc.

Part 2 (3-Part) : 08/17/23 19:53:16
Management is very customer oriented and has a policy that 95% of customer complaints or inquiries must be fully
addressed to the customer's satisfaction within 24 hours of receiving the call. All customer service inquiries that
require a service technician must be logged in by the responding service agent. Although the department exists to
handle customer needs, it is also viewed by management as a profit center. All revenue is generated from the sale
of complementary services or equipment and from service revenue. The department has been in existence for only
three years and management has not developed a mechanism to evaluate the department's performance.
However, management is concerned that the department might not be meeting management's goals.
During the preliminary planning, the following information is gathered.

Current Year Prev. Year Prior Year
Preliminary Information (2010) (2009) (2008)
Number of complaints logged 37,500 35,000 34,000
Number of service calls at customer
10,080 10,000 8,640
locations
Number of customers 1,250,000 1,100,000 1,000,000
Service call revenue $510,000 $500,000 $432,000
Sales of complementary services or
$6,250,000 $4,400,000 $3,750,000
equipment
No. of Staff Supp. Staff-7 Supp. Staff-7 Supp. Staff-5
Technicians Technicians-7 Technicians-7 Technicians-6
Total Service Department Costs $1,344,000 $1,275,000 $1,056,000
The best engagement procedure to determine whether the organization is meeting its objective of satisfying 95% of
customer inquiries within 24 hours is to
A. Develop a customer satisfaction survey and send it to a statistically selected sample of customers based on
mean-per-unit sampling and ask them to identify the time it took for the service department to satisfactorily address
their problem. Calculate a mean and standard deviation.
B. Select a mean-per-unit statistical sample from the total population base and trace the sample to the customer
complaint log to determine whether or not 95% of the sample had their complaints addressed within 24 hours.
C. Select an attribute sample from the population of logged-in customer complaints and trace to records indicating
its disposition, noting time and nature of disposition.
D. Develop a customer satisfaction survey and send it to all customers, and include a question about the timeliness
of service.
A. Sending out a survey might not provide the necessary information: (1) the customer might not respond, and (2) it
is highly unlikely the customer is going to remember the timeliness of service unless the service was unusual;
either very fast, or very slow. Also, MPU is a variable sampling technique. Variable sampling is used to test account
balances and transactions, not to test controls.
B. Mean-per-unit (MPU) testing is not appropriate. MPU is a variable sampling technique and variable sampling is
used to test account balances and transactions, not to test controls.
C. The best engagement procedure to determine whether the organization is meeting its objective of
satisfying 95% of customer inquiries within 24 hours is to select an attribute sample from the population of
logged-in customer complaints and trace to records indicating its disposition, noting time and nature of
disposition. This procedure should provide evidence of when the customers were serviced.
D. Developing a customer satisfaction survey and sending to all customers would be costly and still might not
provide the necessary information: (1) the customer might not respond, and (2) is highly unlikely the customer is
going to remember the timeliness of service unless the service was unusual; either very fast, or very slow.
Which of the following is an essential factor in evaluating the sufficiency of evidence? The evidence must
A. Be based on references that are considered reliable.

B. Be well documented and cross-referenced in the working papers.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Be convincing enough for a prudent person to reach the same decision.

D. Bear a direct relationship to the finding and include all of the elements of a finding.
A. If evidence is sufficient, it means that enough information has been gathered to enable another person to come
to the same conclusions as the auditor. Information that is based on references that are considered reliable is
competent evidence, but that does not constitute sufficiency.
B. If evidence is sufficient, it means that enough information has been gathered to enable another person to come
to the same conclusions as the auditor. Documentation and cross-referencing, while important, do not constitute
sufficiency.
C. If evidence is sufficient, it means that enough information has been gathered to enable another person
to come to the same conclusions as the auditor.
D. If evidence is sufficient, it means that enough information has been gathered to enable another person to come
to the same conclusions as the auditor. Information that bears a direct relationship to the finding and includes all of
the elements of a finding is relevant evidence, but that does not constitute sufficiency.
Indicate whether the following statement is true or false regarding the first area of audit committee concern.
"Although the audit was requested by the audit committee, the audit results should still be formally communicated
to the affected departmental manager and the city executive."
A. -
B. This is a false statement.
C. This is a true statement.
D. -
A. -
B. Audit results are required by the Standards to be communicated to those members of the organization who can
ensure engagement results are given due consideration (Standard 2440.A1).
C. Audit results are required by the Standards to be communicated to those members of the organization
who can ensure engagement results are given due consideration (Standard 2440.A1).
D. -
If an auditor's preliminary evaluation of internal controls results in a finding that controls may be inadequate, the
next step would be to
A. Implement the desired controls.

B. Expand audit work prior to the preparation of an audit report.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Prepare a flowchart depicting the internal control system.

D. Note an exception in the audit report if losses have occurred.
A. Auditors do not implement controls; that is a function of management.
B. If the preliminary findings indicate control problems, the auditor usually decides to perform some
expanded testing.
C. If a flowchart were necessary, the auditor would have prepared one during the preliminary evaluation.
D. The auditor is not ready to make a report until more work has been performed.
A perpetual inventory system uses a minimum quantity on hand to initiate procedures for restocking. In reviewing
the appropriateness of the minimum quantity level established by the stores department, the auditor would be least
likely to consider
A. Seasonal variations in forecasting inventory demand.

B. Stockout costs, including lost customers.
C. The per-unit cost and potential obsolescence of the inventory.
D. Optimal order sizes determined by the economic order quantity model.
A. Seasonal demand directly affects the minimum quantity available.
B. Stockout costs are directly affected by the quantity on hand.
C. Cost and obsolescence directly affect stocking levels.
D. Economic order quantity does not affect minimum stocking levels.
Question 66 - CIA 589 I.42 - Monitor Engagement Outcomes
Management is beginning to take corrective action on personnel department deficiencies reported during the last
engagement performed by the internal audit activity (IAA). The internal auditor should
A. Refrain from judging whether the corrective action will remedy the deficiencies.
B. Oversee the corrective action.
C. Follow up to see that the corrective action satisfies the engagement recommendations.
D. Postpone the next engagement of the personnel department until the corrective action is completed.
A. Internal auditors determine whether management has taken action or implemented the recommendation. The
internal auditor determines whether the desired results were acheived or if senior management or the board has
assumed the risk of not taking action or implementing the recommendation (PA 2500.A1-1).
B. Internal auditors do not have the proper authority to oversee corrective action. This is the responsibility of
management.
C. The CAE must establish a follow-up process to monitor and ensure that management actions have been
2500.A1).
D. No reason is given to postpone the next engagement.

Part 2 (3-Part) : 08/17/23 19:53:16
The chief audit executive (CAE) is responsible for engagement supervision. The most important form of
supervision during the fieldwork phase of engagement involves
A. Appraising each internal auditor's performance at least annually.

B. Making sure that communications are accurate, objective, clear, concise, constructive, and timely.
C. Seeing that the approved engagement work program is carried out unless changes are both justified and
authorized.
D. Providing suitable instructions to subordinates at the outset of the engagement and approving the engagement
program.
A. Appraising each auditor's performance is a human resource function, not part of fieldwork.
B. Communications are made at the end of fieldwork.
C. Supervision is a process that begins with planning and continues throughout the engagement (PA
2340-1). During the fieldwork phase, supervision would entail seeing that the approved engagement work
program is properly executed.
D. Providing suitable instructions at the outset of the engagement is not part of the fieldwork phase.
hookup, etc.

10,080 10,000 8,640
locations
$6,250,000 $4,400,000 $3,750,000
equipment
If the data are correct, which of the following conclusions reached by the internal auditor is justified?
I. The rate of customer complaints logged is decreasing.
II. The number of service calls made at customer locations seems to be more closely related to the number
of technicians than the number of customer complaints.

Part 2 (3-Part) : 08/17/23 19:53:16
III. The average sale of complementary services has remained about the same per customer
A. II and III.
B. I and II.
C. I, II, and III.
D. II only.
A. Conclusion III is not correct. Sales per customer increased from $3.75 in 2008, to $5.00 in 2010. This represents
a 33.33% increase.
B. Both conclusions I and II are correct. The rate of customer complaints logged is decreasing from 3.4%
in 2008 to 3.0% in 2010. In addition, the number of service calls made at customer locations seems to be
more closely related to the number of technicians than the number of customer complaints. The number of
service calls made per technician remained the same, while the number of customer complaints per
technician increased.
C. Conclusion III is not correct. Sales per customer increased from $3.75 in 2008, to $5.00 in 2010. This represents
a 33.33% increase.
D. Conclusion I is also a true statement.
A sales department has been giving away expensive items in conjunction with new product sales to stimulate
demand. The promotion seems successful, but management believes the cost may be too high. Which of the
following audit procedures would be the least useful to determine the effectiveness of the promotion?
A. Comparing the unit cost of the products sold before and during the promotion period.
B. Performing a review of the sales department’s benchmarks used to determine the success of a promotion.
C. Comparing product sales during the promotion period with sales during a similar non-promotion period.
D. Performing an analysis of marginal revenue and marginal cost for the promotion period, compared to the period
before the promotion.
A. There is no indication that cost of the products sold has changed. The challenge is to address the
effectiveness of the promotion.
B. This would be helpful because the sales department may have useful information on new customers and repeat
purchases.
C. This comparison would help highlight the effectiveness of the promotion in increasing sales.
D. This is the key analysis as it would show the extent of additional revenue versus cost.
Question 70 - CIA QZP1E.2 - Planning the Engagement
An internal auditor is planning to conduct an engagement of the accounts receivable department. Who would the
engagement work program be most likely shared with?
I. The CEO.
II. The department manager.
III. The CAE.
IV. The chairman of the audit committee.

Part 2 (3-Part) : 08/17/23 19:53:16
A. II and III only.

B. II, III and IV only.
A. The work program should be written and developed for each engagement that the internal auditor
performs. The work program needs to be shared with those individuals who are responsible for the area
being examined. The work program also needs to be approved by the CAE. Thus, the work program would
most likely be shared with the department manager and CAE.
B. It is not likely the chairman of the audit committee will review the work program.
C. It is not likely the CEO will review the work program.
D. It is not likely the CEO and chairman of the audit committee will review the work program.
Given the current dispute with an auditee regarding audit scope, which of the following internal auditing actions are
not appropriate?
A. Report the dispute, if it remains unresolved, to the board.

B. Review the approved work plan with the CEO and controller and ask for immediate guidance in dealing with the
auditee.
C. Indicate to the auditee that if the resistance continues, the auditing activity will not be available to perform
cost/benefit audits for the department in the future.
D. Meet with the board to obtain approval of the audit charter to mitigate the existence of this problem and similar
problems that may occur in the future.
A. This would be an appropriate action since the Standards require significant scope limitations be reported to the
board.
B. This would be an appropriate short-term response since management would have approved the audit program
and should be in a position to secure auditee cooperation.
C. This would not be an appropriate action. Future audits should be based on the risk analysis performed
by the internal audit activity (IAA) and the audit plan approved by the board.
D. This would be an appropriate action since approval of a charter by the board explicitly defines the scope of
activities by the audit department and expected cooperation from the auditees.
An internal auditor conducts a preliminary survey and identifies a number of significant engagement issues and
reasons for pursuing them in more depth. The engagement client informally communicates concurrence with the
preliminary survey results and asks that the internal auditor not report on the areas of significant concern until she
has an opportunity to respond to the problem areas. Which of the following engagement responses is not
appropriate?
A. Consider the risk involved in the areas involved, and, if the risk is high, proceed with the engagement.
B. Keep the engagement on schedule and discuss with management the need for completing the engagement on a
timely basis.
C. Work with the engagement client to keep the engagement on schedule and address the significant issues in
more depth, as well as the client's responses, during the course of the engagement.
D. Consider the engagement to be terminated with no communication of results needed because the engagement
client has already agreed to take constructive action.

Part 2 (3-Part) : 08/17/23 19:53:16
A. This would be an appropriate response.
B. This would be an appropriate response.
C. This would be an appropriate response.
D. This would not be an appropriate action to take on the part of the internal auditor. The internal auditor
would not be exercising due professional care if the engagement were terminated. For example, the
engagement client could be trying to delay the engagement in order to cover up a more serious problem.
The internal auditor uncovered serious issues and there was no basis for not continuing with the
engagement.
A final communication issued by an internal auditor following an assurance engagement should contain an
expression of opinion when
A. An opinion will improve communications with the readers of the communication.

B. The area of the engagement is the financial statements.
C. A full-scope engagement has been conducted in an area.
D. The internal auditors' work is to be used by external auditors.
A. Final communication of engagement results must, where appropriate, contain internal auditors' overall
opinion and/or conclusions (Standard 2410.A1). If the expression of an opinion would help to improve
communication then it should be given.
B. The area of the engagement is irrelevant as regards determining whether or no an expression of opinion is
required.
C. An overall opinion is not required in all circumstances.
D. The use or otherwise of the internal auditor's work by external auditors is also irrelevant as regards determining
whether or not an expression of opinion is required. It is the responsibility of external auditors to form their own
opinion.
To emphasize information in a memorandum, it is best to place the information
A. At the beginning of the memorandum and use active voice.

B. At the beginning of the memorandum and use passive voice.
C. In the middle of the memorandum and use passive voice.
D. In the middle of the memorandum and use active voice.
A. Both initial placement and active voice are strong ways to emphasize information.
B. Passive voice subordinates information.
C. Both middle placement and passive voice subordinate information.
D. Middle placement subordinates information.

Part 2 (3-Part) : 08/17/23 19:53:16
When engagements are performed for the internal audit activity (IAA) by non-staff members, the chief audit
executive (CAE) is responsible for
A. Ensuring that the engagement communications are accurate, objective, clear, concise, constructive, and timely.
B. Reviewing the engagement work programs for approval.
C. Providing appropriate supervision from the beginning to the conclusion of the engagement.
D. None of the work performed by those outside the internal audit activity.
A. Supervision entails more than ensuring that the engagement communications are accurate, objective, clear,
concise, constructive, and timely. Supervision is a process that begins with planning and continues throughout the
examination (PA 2340-1).
B. Supervision entails more than reviewing the engagement work programs for approval. Supervision is a process
that begins with planning and continues throughout the examination (PA 2340-1).
C. The CAE is responsible for assuring that appropriate engagement supervision is provided. The CAE or
designee provides appropriate engagement supervision. Supervision is a process that begins with
planning and continues throughout the engagement (PA 2340-1).
D. The CAE or designee provides appropriate engagement supervision. Supervision is a process that begins with
planning and continues throughout the engagement (PA 2340-1). The CAE's responsibility for engagement
supervision extends to those outside the IAA as well.
An internal auditor plans to conduct an audit of the adequacy of controls over investments in new financial
instruments. Which of the following would not be required as part of such an audit?
A. Determine the nature of controls established by the treasurer to monitor the risks in the investments.
B. Determine the extent of management oversight over investments in sophisticated instruments.
C. Determine if policies exist which describe the risks the treasurer may take and the types of instruments in which
the treasurer may make investments.
D. Determine whether the treasurer is getting higher or lower rates of return on investments than are treasurers in
comparable organizations.
A. A fundamental control concept over cash-like assets is that someone establishes a mechanism to monitor the
risks.
B. Oversight by a management committee is an important control. Therefore, the auditor should determine the
nature of the oversight set up to monitor and authorize such investments.
C. Since new financial instruments are very risky, the first step of such an audit should be to determine the nature
of policies established for the investments.
D. Although this might be informational, there is no need to develop a comparison of investment returns
with other organizations. Indeed, recent financial investment scandals show that such comparisons can be
highly misleading because high returns were due to taking on a high level of risk. Also, this is not a test of
the adequacy of the controls.
Which of the following would not be considered an objective of the audit closing or exit conference?
A. To identify concerns for future audits.

B. To discuss the findings.
C. To identify management's actions and responses to the findings.
D. To resolve conflicts.

Part 2 (3-Part) : 08/17/23 19:53:16
A. Identifying concerns for future audits is not an objective of the audit closing or exit conference.
B. Discussing the findings is an objective of the audit closing or exit conference.
C. Identifying management's actions and responses to the findings is an objective of the audit closing or exit
conference.
D. Resolving conflicts is an objective of the audit closing or exit conference.
In response to a confirmation of the June 30 accounts receivable balances, a customer reported that the balance
confirmed had been paid by a check dated and mailed June 20. The auditor reviewed the postings of cash receipts
in July and found the payment had been recorded on July 13. Given this information, the next audit action should
be to
A. Compare deposit slips to posting records

B. Trace the billing invoice to the related shipping documents and inventory records, comparing dates shipped to
billed to determine proper period.
C. Request a bank cutoff statement for July and reconcile the June deposits in-transit and outstanding checks by
examining supporting documentation.
D. Require an adjusting entry to the payment to June.
A. Comparing the deposit slip to the posting records would determine if the check was deposited but the
posting delayed. Checks should be posted and deposited on the same date.
B. This test deals with late billing, not late posting of receipts.
C. This procedure would reconcile bank and book records; however the issue is the possible delay in posting the
receipt.
D. The issue is why the late deposit.
Question 79 - IIA, adapted CIA H145 - Communicate Engagement Results
The following represents accounts receivable information for a corporation for a 3-year period:
Year One Year Two Year Three
Net accounts receivable as a
23.4% 27.3% 30.8%
percentage of total assets
Accounts receivable turnover ratio 6.98 6.05 5.21
All of the following are plausible explanations for these changes except
A. Allowance for bad debts is understated.

B. Credit and collection procedures have become ineffective.
C. Sales returns for credit have been overstated.
D. Fictitious sales may have been recorded.
A. Understating the allowance for bad debts could be a plausible explanation. If the reserve account is understated,
then the turnover ratio will be lower than it should be.
B. Ineffective credit and collection procedures could be a plausible explanation.
C. Overstating sales returns for credit is not a plausible explanation. Overstating sales returns would
result in a higher turnover ratio, not lower.

Part 2 (3-Part) : 08/17/23 19:53:16
D. Recording fictitious sales could be a plausible explanation. These fictitious sales might not necessarily be
accounted for in the reserve account, thereby causing the turnover ratio to be lower than it should be.
Question 80 - CIA QZP2B.13 - Planning the Engagement
One of the audit objectives for a manufacturing company is to verify that all rework is reviewed by the production
engineer. Which of the following audit procedures would provide the best evidence for meeting this objective?
A. Trace a sample of entries in the rework log to remedial action taken.

B. Trace a sample of rework orders to entries in the review log.
C. Trace a sample of rework orders to entries in the rework log.
D. Trace a sample of entries in the review log to rework orders.
A. Tracing a sample of entries in the rework log to remedial action taken considers only the rework jobs that require
remedial action. Not all of the rework orders will require remedial action.
B. The audit objective is to verify that all rework is reviewed by the production engineer. The best evidence
to meet this objective is to trace a sample of rework orders to entries in the review log.
C. This procedure would be useful for verifying that all rework is recorded in the rework log. But, it would not
provide any evidence that the rework orders were reviewed.
D. The direction of this procedure is wrong. It would not detect unreviewed work orders.
The internal auditor in charge has just been informed of the next engagement and the assigned engagement team.
What is the appropriate phase for finalizing the time budget?
A. During formulation of the internal audit activity's engagement work schedule.

B. After the preliminary survey.
C. After the completion of all fieldwork.
D. During the initial planning meeting.
A. Finalizing the time budget during formulating the IAA's engagement work schedule would not be appropriate.
B. If appropriate, a preliminary survey should be conducted to become familiar with the engagement
client's activities, risks, and control to identify areas for engagement emphasis, and to invite comments
and suggestions from engagement clients (PA 2210.A1-1). Thus, it would be most appropriate to finalize
the time budget after the preliminary survey.
C. The fieldwork is generally the area that consumes the most time, so therefore, finalizing the time budget after
completing all of the fieldwork would defeat the purpose of the time budget.
D. It would not be appropriate to finalize the time budget during the initial planning meeting.
The internal auditor reviewed documentation showing that a customer had recently returned three expensive
products to the regional service center for warranty replacement. The documentation also showed that the warranty
clerk had rejected the claim and sent it to the customer's local distributor. The claim was rejected because the
serial numbers listed in the warranty claim were not found in the computer's sales history file. Subsequently, the
distributor supplied three different serial numbers, all of which were validated by the computer system, and the
clerk completed the warranty claim for replacements. What is the best course of action for the internal auditor

Part 2 (3-Part) : 08/17/23 19:53:16
under the circumstances?
A. Determine if the original serial numbers provided by the customer can be traced to other records, such as
production and inventory records.
B. Summarize this item along with other valid transactions in the internal auditor's test of warranty transactions.
C. Verify with the appropriate supervisor that the warranty clerk had followed relevant procedures in the processing
and disposition of this claim.
D. Notify the appropriate authorities within the organization that there are sufficient indicators that a fraud has been
committed.
A. The best course of action for the internal auditor is to determine if the original serial numbers provided
by the customer can be traced to other records, such as production and inventory records.
B. The internal auditor needs to gather more information on the validity of the claim.
C. Verifying that the warranty clerk had followed procedures in the processing and disposition of the claim will not
provide information on the validity of the warranty claim.
D. The auditor should try to get other information before approaching authorities within the organization.
Question 83 - CIA 1191 I.25 - Supervise Engagement
A working paper is complete when it
A. Complies with the internal audit activity's format requirements.

B. Satisfies the engagement objective for which it is developed.
C. Is clear, concise, and accurate.
D. Contains all of the attributes of an observation.
A. Complying with the IAA format requirements does not indicate whether the working papers have been
completed or not.
B. Working papers are the place in which the internal auditor records all of the work and tests that are
performed during the engagement. The working papers are the basis for any conclusions that are drawn
by the internal auditor.
C. The content of the working paper should be clear, concise, and accurate. These attributes may be present, but
the working papers may still not be complete.
D. Working papers may contain only a part of the attributes of an observation, not necessarily all of them.
The health care processor wishes to implement controls that would help prevent the type of fraud by dentists who
are submitting billings for services not provided. Assume further that all the claims are submitted electronically to
the health care processor. Which of the following control procedures would be the most effective?
A. Require all submitted claims to be accompanied by a signed statement by the dentist testifying to the fact that
the claimed procedures were performed.
B. Develop an integrated test facility and submit false claims to verify that the system is detecting such claims on a

Part 2 (3-Part) : 08/17/23 19:53:16
consistent basis.
C. Send confirmations to the dentists requesting them to confirm the exact nature of the claims submitted to the
health care processor.
D. Develop a program which identifies procedures performed on an individual in excess of expectations based on:
the age of the employee, whether a similar procedure was performed recently, or the average cost per claim.
A. This would slow down processing, but would not prevent the dentist who submitted the fraudulent claim from
continuing to submit such claims.
B. The ITF would provide evidence on the correctness of the processing, not whether the claims that were
submitted were proper. Also, the health care processor may not allow access to their system for an ITF.
C. If fraud was involved, the service provider would confirm that the work was done even when it was not.
D. This would be the most effective procedure because it would highlight unusual transactions that could
be followed up with customer inquiry or other procedures aimed at determining whether claims are
fictitious.
A large manufacturer has a transportation division that supplies gasoline (petrol) for the organization's vehicles.
Gasoline is dispensed by an attendant who records the amount issued on a serially prenumbered gasoline
disbursement form, which is then given to the accounting department for proper recording. When the quantity of
gasoline falls to a certain level, the service station attendant prepares a purchase requisition and sends it to the
purchasing department where a purchase order is prepared and recorded in a gasoline purchases journal. Which
of the following engagement procedures best determines whether gasoline disbursements are fully recorded?
A. Perform analytical procedures comparing this period's gasoline consumption with prior periods.
B. Select a number of gasoline purchases from the gasoline purchases journal and compare them with their
corresponding purchase orders and ascertain that they are serially prenumbered, are matched with purchase
requisitions, and are authorized by someone independent of employees of the service station.
C. Compare the gasoline purchase requisitions with the gasoline disbursement records.
D. Match the quantity of gasoline disbursed according to disbursement forms with an independent reading of
quantity disbursed at the pump.
A. Performing analytical procedures comparing this period's consumption with prior periods would not be a
meaningful procedure.
B. These procedures would not determine whether gasoline disbursements are fully recorded.
C. Comparing gasoline purchase requisitions with disbursement records would not be meaningful. Gasoline may
have been requested.
D. By matching the quantity of gasoline disbursed according to disbursement forms with an independent
reading of quantity disbursed at the pump the internal auditor is in a position to determine whether
gasoline disbursements were fully recorded.
A receiving department receives copies of purchase orders for use in identifying and recording inventory receipts.
The purchase orders list the name of the vendor and the quantities of the materials ordered.
A possible error that this system could allow is
A. Payment to unauthorized vendors.

B. Payment for unauthorized purchases.
C. Delay in recording purchases.

Part 2 (3-Part) : 08/17/23 19:53:16
D. Overpayment for partial deliveries.
A. Comparing receipts to purchase orders will help detect unauthorized vendors and purchases.
B. Comparing receipts to purchase orders will help detect unauthorized vendors and purchases.
C. Using purchase orders to identify receipts will not require extra time to record purchases. Payment is made by a
separate department and processing of receipt paperwork is not delayed.
D. The risk of telling the receiving department the quantities ordered is that the receiving department may
fail to make an accurate count of the materials received. The receiving department needs to know
quantities, but the receiving clerk counting materials received does not.
Which of the following credit approval procedures would be the basis for developing a deficiency finding for a
wholesaler?
A. Trade-credit standards are reviewed and approved by the finance committee of the board of directors.
B. An authorized signature from the credit department, denoting approval of the customer's credit, is to appear on
all credit-sales orders.
C. Salespeople are responsible for evaluating and monitoring the financial condition of prospective and continuing
customers.
D. Customers not meeting trade-credit standards are shipped merchandise on a cash-on-delivery (C.O.D.) basis
only.
A. Having the finance committee of the board of directors review and approve trade-credit standards is a control
strength and would not lead to a deficiency finding.
B. Requiring an authorized signature from the credit department denoting approval of the customer's credit is a
control strength, not the basis for a deficiency finding.
C. Salespeople should not be responsible for monitoring customers' financial condition. Salespeople make
contact with customers and potential customers, make sales and provide customer service where
appropriate. If salespeople are responsible for credit approval, their conflict of interest (desire to make the
sale) could lead to inappropriate approvals. There should be a separate credit approval function.
D. Requiring customers who do not meet trade-credit standards to purchase on a C.O.D. basis is a common
procedure, not a basis for developing a deficiency finding.
An internal auditor performs an analytical procedure to compare the gross margins of various divisional operations
with those of other divisions and with the individual division's performance in previous years. The internal auditor
notes a significant increase in the gross margin at one division. The internal auditor does some preliminary
investigation and also notes that there were no changes in products, production methods, or divisional
management during the year. The most likely cause of the increase in gross margin is
A. An increase in the number of competitors selling similar products.

B. An overstatement of year-end inventory.
C. A decrease in the number of suppliers of the material used in manufacturing the product.
D. An understatement of year-end accounts receivable.
A. An increase in the number of competitors selling similar products would most likely decrease gross margin,
resulting from price competition.
B. An overstatement of year-end inventory would result in gross margin being overstated. Overstating

Part 2 (3-Part) : 08/17/23 19:53:16
inventory means that not all sold inventory was expensed to cost of sales. Thus, gross margin (sales
minus cost of sales) would be greater than it actually should be.
C. A decrease in the number of suppliers of material used by the company would most likely decrease gross
margin by causing upward pressure on material costs.
D. An understatement of year-end accounts receivable would cause sales and gross margin to be understated.
Which of the following procedures should be performed as part of a preliminary review in an audit of a bank’s
investing and lending activities?
A. Review minutes of the board of directors’ meetings to identify changes in policies affecting investments and
loans.
B. Interview management to identify changes made in policies regarding investments or loans.
C. Review reports of audits performed by regulatory and outside auditors since the last internal audit.
A. Review minutes of the board of directors' meetings to identify changes in policies affecting investments and
loans should be part of the preliminary review.
B. Interview management to identify changes made in policiies regarding investments or loans should be part of the
preliminary review.
C. Reviewing reports of audits performed by regulatory and outside auditors since the last internal audit should be
part of the preliminary review.
D. All of the procedures should be performed as part of the preliminary review.
When an office supply company is unable to fill an order completely, it marks the out-of-stock items as
back-ordered on the customer's order and enters these items in a back-order file which management can view or
print. The best approach for ensuring prompt delivery of out-of-stock items is to
A. Increase inventory levels to minimize the number of times that out-of-stock conditions occur.
B. Match the back-order file to goods received daily.
C. Implement electronic data interchange with supply vendors to decrease the time to replenish inventory.
D. Reconcile the sum of filled and back orders with the total of all orders placed daily.
A. Increasing inventory levels might minimize the number of times that out-of-stock conditions occur, but will not
affect delivery of the items that are out-of-stock.
B. Reconciling the back-order file to shipments daily would identify unfilled orders for appropriate action.
C. Implementing electronic data interchange with supply vendors may decrease the time to replenish inventory, but
will not affect delivery of the items that are out-of-stock.
D. Reconciling the sum of filled and back orders with the total of all orders placed daily ensures that orders were
either filled or back-ordered, but will not affect delivery of the items that are out-of-stock.

Part 2 (3-Part) : 08/17/23 19:53:16
Documentation required to plan an internal auditing engagement should include information that
A. Intended engagement observations have been clearly identified.

B. Planned engagement work will be completed on a timely basis.
C. Internal audit activity resources are efficiently and effectively employed.
D. Resources needed to complete the engagement were considered.
A. Intended engagement observations that should be identified would be determined by the scope of work to be
performed.
B. Completing the engagement on time will not be known when planning the engagement.
C. IAA resources are efficiently and effectively employed can only be measured at the end of the engagement.
D. In planning the engagement, internal auditor should consider the resources needed to complete the
engagement.
An auditor has submitted a first draft of an audit report to an auditee in preparation for an exit interview. The
following is an excerpt from that report:
The audit was performed to accomplish several objectives - verify the existence of unused machinery being stored
in the warehouse, determine whether machinery had been damaged during storage, review the handling
procedures being performed by personnel at the warehouse, determine whether proper accounting procedures are
being followed for machinery kept in the warehouse, calculate the current fair market value of warehouse
inventories, and compare the total value of the machinery to company accounting records.
It was confirmed that of the 30 machines selected from purchasing records for the sample, 10 were present on the
warehouse floor and another five were on the loading dock ready for conveyance to the production facility. Twelve
others had already been sent to the production facility at a previous time. An examination of the accounting
procedures used at the warehouse revealed the failure by the warehouse accounting clerk to reconcile inventory
records monthly, as required by policy.
A sample of 25 machines was examined for possible damage, and all but one was in good condition. It was
confirmed by the auditors that handling procedures outlined in the warehouse policy manual appear to be
adequate, and warehouse personnel apparently were following those procedures, except for the examination of
items being received for inventory.
When communicating with auditees, there are both situational factors and message characteristics which can
damage the communication process. An auditor has only limited control over situational factors but has substantial
control over message characteristics.
The objectives of an audit report are to inform and to influence. Whether these objectives are met depends on the
clarity of the writing. Which of the following principles of report clarity was violated in the above audit report?
A. Use active voice verbs.

B. Keep most sentences short and simple.
C. Appropriately organize the report.
A. There are at least two passive sentences.
B. The opening sentence is 73 words, while the next sentence is 37 words.
C. The report is not organized in a clear and concise manner.
D. All of the listed principles of report clarity were violated in the audit report.

Part 2 (3-Part) : 08/17/23 19:53:16
Which of the following is an appropriate audit procedure that may be used to test the adequacy of application
controls over computer-based accounts payable?
A. Testing purchase transactions using a test data approach.

B. Using a computer-generated questionnaire to obtain reliable information about the accuracy and completeness
of input and update of accounts payable data from the organization's computer management personnel.
C. Manually comparing vendor invoice numbers with those listed on computer generated lists of accounts payable
to assess the effectiveness of computer-based sequence checks.
D. Observing computer library and operations area to obtain evidence to support an opinion about the security of
accounts payable data files.
A. In a test data situation, the auditor is creating a set of artificial information (there should be some items
that are incorrect and invalid in the set) and running this set of information through the system. The
results are then compared with what the results for this test data should actually be. This is a good way to
test controls because the controls should identify the incorrect and inappropriate items.
B. Using a computer-generated questionnaire to obtain reliable information about the accuracy and completeness
of input and update of accounts payable data from the organization's computer management personnel is not an
appropriate audit procedure.
C. The vendors, not by the purchasing company, generate vendor invoice checks.
D. Security of accounts payable data files is a general control, not application control.
An internal auditor is auditing a division's accounts and is concerned that the division’s management may have
shipped poor quality merchandise in order to boost sales and profitability for the year and thereby boost the division
manager's bonus. Furthermore, the auditor suspects that returned goods are being shipped to other customers as
new products without defects being fully corrected. Which of the following audit procedures would be the least
effective in determining whether such shipments took place?
A. Interview customer service representatives regarding unusual amounts of customer complaints.

B. Examine credit memos issued after year end for goods shipped before year end.
C. Physically observe the shipping and receiving area for evidence of returned goods.
D. Require the division to take a complete physical inventory at year end, and observe the taking of the inventory.
A. This would provide valuable evidence that is independent of management.
B. This would be an effective procedure to determine the extent to which previous years sales had been inflated by
poor merchandise sales.
C. This would provide evidence on goods that had been returned, but might not yet be accounted for.
D. This would be the least persuasive because the stated scenario also assumed that management is
turning the goods back around by shipping them out again. If they were not doing this, then taking the
physical inventory would lead to a situation where inventory on hand would exceed inventory stated on
the books.
Question 95 - CIA QZP2A.5 - Planning the Engagement
Which of the following examples of audit evidence is the most persuasive?

Part 2 (3-Part) : 08/17/23 19:53:16
A. Time cards for employees that are stored by a manager.

B. Vendor invoices filed by the accounting department.
C. Canceled checks written by the treasurer and returned from a bank.
D. Real estate deeds, which were properly recorded with a government agency.
A. Time cards for employees that are stored by a manager are considered internal information, and thus, less
reliable than purely external information.
B. Vendor invoices filed by the accounting department are considered external-internal information. Even though
the invoices were created externally, the client is the last party to have the document. Thus, the document may be
altered by the client without the knowledge of the third party. This information is more reliable than purely internal
information, but less reliable than purely external information.
C. Canceled checks written by the treasurer and returned from a bank is internal-external information. This
originates with the engagement client but is processed externally. This information is not as persuasive as purely
external information.
D. Real estate deeds are considered to be purely external information. External information is information
that the auditor receives directly from a third party. This is the most persuasive form of information
because the client has not had access to it.
A bank’s policies require that a lending officer review all loan requests and forward those deemed appropriate for
funding to the lending committee for approval. The most efficient audit procedure to determine if loans that were
not funded were rejected using criteria consistent with that contained in bank policies would be to select an
attributes sample of
A. All loan applications, review the applications, and trace them to either a funded or rejected loan to determine if
all actions taken were consistent with bank policies.
B. Loans presented to the lending committee for approval and determine if actions taken by the committee were
consistent with bank policies.
C. Loans that were funded, review the loan applications, and determine if the funded loans complied with bank
policies.
D. Loans not funded and review the loan applications and the reasons for rejecting them.
A. This is an excellent procedure to determine whether all the loans (both funded and unfunded) are being handled
consistent with the stated policies and procedures. However, the audit objective only dealt with loans that were not
funded; therefore, this procedure would cause the auditors to review more loans and would not be as efficient as
the procedure noted in the correct answer.
B. This uses a sample of loans that were presented to the lending committee. It does not include loans that would
have already been rejected by an individual lending officer.
C. This only provides information on loans that were funded. The concern is with loans that may have been
inappropriately rejected.
D. This would be the most appropriate audit procedure because the audit objective only asks for a
determination that rejected loans have been rejected for proper reasons. It is not concerned with approval
of loans that should not have been made.
Employees using personal computers have been reporting occupational injuries and claiming substantial workers'
compensation benefits. The working papers of an engagement performed to determine the extent of the
organization's exposure to such personal injury liability should include

Part 2 (3-Part) : 08/17/23 19:53:16
A. Analysis of claims by type of equipment and extent of use by individual employees.

B. Confirmations from insurance carriers as to claims paid under workers' compensation policies in force.
C. Listings of all personal computers in use and the employees who use them.
D. Reviews of documentation supporting purchases of personal computers.
A. In order to determine the extent of the organization's exposure to personal injury liability an analysis of
claims by type of equipment and extent of use by individual employees should be included.
B. Confirmations from insurance carriers would only be able to confirm claims paid.
C. Listing all PCs in use and the employees who use them does not address the risks associated with using the
computers.
D. Reviewing documentation supporting purchases of PCs will not address the issue of the organization's exposure
to personal injury liability.
An internal auditor has just completed an engagement and is in the process of preparing the final engagement
communication. The observations in the final engagement communication should include
A. Pertinent factual statements concerning the control weaknesses uncovered during the course of the
engagement.
B. Statements of both fact and opinion developed during the course of the engagement.
C. Statements concerning potential future events that may be helpful to the engagement client.
D. Statements of opinion about the cause of an observation.
A. The final engagement communication should contain observations that are objective and factual.
Pertinent factual statements concerning the control weaknesses uncovered during the course of the
engagement would be appropriately included.
B. The final engagement communication should contain observations that are objective and factual.
C. The final engagement communication should contain observations that are objective and factual. A statement
concerning potential future events is inappropriate.
D. The final engagement communication should contain observations that are objective and factual. A statement of
opinion about the cause of an observation is inappropriate.
One purpose of the exit interview is for the internal auditor to
A. Present the final engagement communication to management.

B. Review and verify the appropriateness of the engagement communication based upon client input.
C. Require corrective action.
D. Review the performance of internal auditors assigned to the engagement.
A. The exit interview allows the internal auditor the opportunity to discuss conclusions and recommendations. The
exit interview does not replace the final engagement communications since there may be modifications to the final
report based on the results of the exit interview.
B. The internal auditor should discuss conclusions and recommendations with the appropriate levels of
management before the final communication is issued. This is usually done during the exit interview. One
of the purposes of the meeting is to review and verify the appropriateness of the engagement
communication based upon client input.

Part 2 (3-Part) : 08/17/23 19:53:16
C. The internal auditor can only recommend corrective action. It is management's responsibility to see that
corrective action is taken.
D. Reviewing the performance of the internal auditors assigned to the engagement is not done at the exit interview.
Two merging retail enterprises agree to share data on store operations. The data reveal that three stores in
Organization A are characterized by:
Significantly lower gross margins,
Higher-than-average sales volume, and
Higher levels of employee bonuses.
Assume the internal auditor for the merged enterprise concludes that inventory fraud is the most reasonable
explanation of the observed data. Which of the following engagement procedures will provide the most persuasive
information that fraud is taking place?
A. Schedule a surprise physical inventory. Investigate areas of inventory shrinkage.

B. Interview the three individual store managers to determine if their explanations about the observed differences
are the same. Compare their explanations with those of the section manager.
C. Take a sample of individual store prices and compare them with the sales entered on the cash register for the
same items.
D. Use an integrated test facility (ITF) to compare individual sales transactions with test transactions submitted
through the ITF. Investigate all differences.
A. The most effective way to uncover inventory fraud is to do a surprise physical inventory count. Doing
this keeps the wrongdoers from concealing the facts.
B. Interviewing is not an effective way to get information that fraud is taking place since the person committing the
fraud has reason to lie.
C. Sampling store prices and comparing them with sales entered on the cash register will not provide information
that there is a problem with inventory shrinkage.
D. Using a integrated test facility (ITF) will simply test the correctness of the process but will not provide information
that there is a problem with inventory shrinkage.
The internal audit activity customarily has a dual relationship with management and the audit committee. This
means that
A. The accuracy of engagement communications should be verified with management, and the internal audit
activity should then report to management and the audit committee.
B. Ideally, the internal audit activity works under the audit committee but reports to the chief operating officer on all
engagements relating to operations.
C. The internal audit activity should report directly to the audit committee, without corroborating engagement
communications with management.
D. Management should help the internal audit activity by revising and forwarding engagement communications to
the audit committee.
A. Internal auditors should first discuss conclusions and recommendations with management so
management is able to verify the accuracy of the engagement communications. Final engagement
communications would then be sent to the audit committee.
B. Ideally, the CAE would administratively report to the CEO or high enough officer to maintain independence, and

Part 2 (3-Part) : 08/17/23 19:53:16
functionally to the audit committee or some other appropriate governing board. Under the ideal situation, all
engagement communications are sent to the audit committee as well.
C. Engagements communications should also communicated with management.
D. Engagement communications would go direct to the audit committee.
An operational audit report which deals with the scrap disposal function in a manufacturing company should
address
A. Whether the scrap material inventory is valued at the lower of cost or market.
B. Whether the physical inventory count of scrap material agrees with the recorded amount.
C. The efficiency and effectiveness of the scrap disposal function and include any findings requiring corrective
action.
D. Whether the scrap material inventory is reported as a current asset.
A. An operational audit report of the scrap disposal function would not address the valuation of the scrap material
inventory at the lower of its cost or market.
B. An operational audit report should address the propriety of the function being audited rather than the agreement
between the records and the items being audited.
C. An operational audit report should inform management about the efficiency and effectiveness of the
given operations and should discuss findings requiring corrective action.
D. An operational audit report should address the propriety of the function being audited rather than valuation of
items being audited.
hookup, etc.

10,080 10,000 8,640
locations

Part 2 (3-Part) : 08/17/23 19:53:16

$6,250,000 $4,400,000 $3,750,000
equipment
The internal auditor wishes to investigate whether the number of service calls is based more on the number of
service technicians than on the number of complaints that actually merit service. The following are four
engagement procedures that would be performed in sequence. Indicate when the internal auditor should have
sufficient information to reach a conclusion on the assertion.
Step 1: Perform an analytical review by comparing the number of service calls per service technician and
determine the average number of calls per year by technician.
Step 2: Obtain the customer complaint backlog file and determine the extent to which there is a backlog of service
complaints that need to be addressed. Calculate an average number of backlogged complaints per technician.
Step 3: Send a confirmation to all customers who are shown on the backlog of complaints requesting information
on the length of time for the backlog.
Step 4: Based on the customer's response in step 3, calculate an average number of backlog complaints and
determine the number of new service technicians that would have to be added to address the complaints.
The engagement assertion will be sufficiently addressed when the following steps are completed.
A. Steps 1, 2, 3, and 4.
B. Step 1.
C. Steps 1 and 2.
D. Steps 1, 2, and 3.
A. Confirmation information from customers will not provide any more useful information than was acquired in step
2.
B. Step 1 does not fully address the engagement assertion. The step does address the relationship between
service calls and technicians, but does not address the number of complaints that merit service.
C. Step 1 addresses the relationship between service calls and technicians. However, the step still does
not fully address the engagement assertion. Step 2 goes a step further and gathers information on the
backlog of service complaints and calculates the average number of backlogged complaints per
technician.
D. Confirmation information from customers will not provide any more useful information than was acquired in step
2.
[#5]

Part 2 (3-Part) : 08/17/23 19:53:16
[#6]
[#7]
obsolescence.
[#8]
A major deficiency in paragraph #7 related to the completeness of the engagement communication is
A. The reference to other parts of the engagement communication citing excessive inventory write-downs for
obsolescence is not appropriate. If there is a problem, it should all be discussed within the context of the specific
observation.
B. The recommendation does not follow from the observation. The recommendation could have been reached
without any observation.
C. No separate section adequately discusses the risks associated with the observation.
D. The condition for the observation is not clearly explained.
A. Referring to other parts of the engagement communications citing excessive inventory write-downs for
obsolescence is appropriate, as long as details of the inventory write-downs are given in these other sections.
B. A recommendation is presented.
C. The risks of the problem are discussed.
D. The condition of the observation is not clearly explained. The internal auditor noted that inventory is
"messy." But, it is not known what "messy" means.
A significant part of the auditor's working papers will be the conclusions reached by the auditor regarding the audit
area. In some situations, the supervisor might not agree with the conclusions and will ask the staff auditor to
perform more work. Assume that after subsequent work is performed, the staff auditor and the supervisor continue
to disagree on the conclusions documented in the working paper developed by the staff auditor. Which of the
following audit department responses would not be appropriate?
A. Note the disagreement and retain the notice of disagreement and follow-up work in the audit working papers.
B. Present both conclusions in the audit report and let management and the auditee react to both.
C. Both the staff auditor and the supervisor document their reasons for reaching different conclusions. Retain the
rationale of both parties in the working papers.
D. Present both conclusions to the chief audit executive (CAE) for resolution. The CAE may resolve the matter.
A. This would also be an appropriate action and is consistent with the Standards. This is an appropriate response
since the CAE is ultimately responsible for the supervision of the audit staff as well as the quality of the working
papers.
B. This would not be an appropriate response. The CAE should determine the most reasonable conclusion
and present that to the auditee and management. The issue of disagreements on the working papers
should not necessarily affect the reporting to management unless the director of internal auditing believes

Part 2 (3-Part) : 08/17/23 19:53:16
that both conclusions are equally appropriate and it would enhance management's understanding to be
presented with both.
C. This would be an appropriate response.
D. This is an appropriate response since the CAE is ultimately responsible for the supervision of the audit staff as
well as the quality of the working papers.
One of the primary roles of an engagement work program is to
A. Provide for a standardized approach to the engagement.

B. Assess the risks associated with the activity under review.
C. Serve as a tool for planning and conducting engagement work.
D. Document an internal auditor's evaluations of controls.
A. The engagement work program will probably not be standardized, and will probably change from year-to-year
given the changing conditions of the company.
B. Risk assessment is done in the planning phase of the engagement, which helps to identify objectives. This has
to be done before the work program can be developed.
C. Internal auditors should develop work programs that achieve the engagement objectives. An
engagement work program collects, analyze, interpret, and documents information.
D. The working papers will contain an evaluation of controls.
In preparing for the review of transportation costs, the internal auditor gathers the following information for the past
few years.
Current Last 2 Years 3 Years
Year Year Ago Ago
Bus miles driven 9.0 million 8.4 million 7.2 million 6.8 million
Number of buses in operation 40 40 40 36
Average age of bus 10 years 9 years 8 years 7.5 years
Maintenance costs $1.6 million $1.2 million $750,000 $800,000
Other operating costs $1 million $900,000 $720,000 $680,000
Driver overtime cost $400,000 $240,000 $80,000 $20,000
Accidents or breakdowns per year 480 360 120 50
Purchases of new buses $0 $0 $0 $800,000
Total number of drivers 80 80 75 72
New drivers 30 25 15 5
Total cost of bus operation $5.4 million $4.15 million$3.20 million$3.45 million
Revenue generated $2.98 million$2.52 million$2.16 million$2.42 million

Part 2 (3-Part) : 08/17/23 19:53:16
Bus fare throughout the year $1.00 $.80 $.80 $.60

Growth rate of city population 5% 5% 10% 3%
Bus drivers' salaries have been constant at $30,000 per year.
The average cost of a bus is $200,000.
Buses are depreciated over 20 years using the straight-line method.
A staff auditor has made the following four conclusions about the current year from the data:
1. Bus driver turnover has increased in relation to prior years.
2. Bus ridership in terms of the number of passengers has increased in relation to prior years.
3. The operating cost per bus mile has increased in relation to prior years.
4. Average maintenance cost per bus has increased in relation to prior years.
Which of the above represent appropriate conclusions from the data presented?
A. 1, 3 and 4.
B. 2, 3 and 4.
C. 1, 2 and 3.
D. 1, 2, 3 and 4.
A. Conclusions 1, 3 and 4 are correct. Conclusion 2 is incorrect. Although revenue has increased, the
increase is due to the increase in the bus fare not an increase in the number of riders. The number of
riders has actually decreased from 4.033 million riders three years ago ($2.42 / $0.60 per bus fare) to 2.98
million riders in the current year ($2.98 / $1.00 per bus fare).
B. Conclusion 2 is incorrect. Although revenue has increased, the increase is due to the increase in the bus fare
not an increase in the number of riders. The number of riders has actually decreased from 4.033 million riders
three years ago ($2.42 / $0.60 per bus fare) to 2.98 million riders in the current year ($2.98 / $1.00 per bus fare).
C. Conclusion 2 is incorrect. Although revenue has increased, the increase is due to the increase in the bus fare
not an increase in the number of riders. The number of riders has actually decreased from 4.033 million riders
three years ago ($2.42 / $0.60 per bus fare) to 2.98 million riders in the current year ($2.98 / $1.00 per bus fare).
D. Although revenue has increased, the increase is due to the increase in the bus fare not an increase in the
number of riders. The number of riders has actually decreased from 4.033 million riders three years ago ($2.42 /
$0.60 per bus fare) to 2.98 million riders in the current year ($2.98 / $1.00 per bus fare).
In evaluating the validity of different types of audit evidence, which of the following conclusions is not correct?
A. The validity of confirmations varies directly with the independence of the party receiving the confirmation.
B. Recomputation, though valid, is restricted in its usefulness due to its limited scope.
C. Internally created documentary evidence is considered less valid than externally created documentary evidence.
D. The validity of documentary evidence is independent of the effectiveness of the control system in which it was
created.
A. This is the reason that confirmations are sent to the internal audit department in most cases.
B. Recomputation will not be possible in many applications.
C. With externally created documentary evidence, there is less likelihood of an alteration by a third party.
D. The validity of documentary evidence depends on the internal control system.
Question 109 - CIA 594 III.4 - Planning the Engagement

Part 2 (3-Part) : 08/17/23 19:53:16
The chief audit executive (CAE) of a multinational organization must form an engagement team to examine a newly
acquired subsidiary in another country. Consideration should be given to which of the following factors?
I. Local customs
II. Language skills of the internal auditor
III. Experience of the internal auditor
IV. Monetary exchange rate
A. II, III, and IV.

B. I and III.
C. I and II.
D. I, II, and III.
A. Local customs would also be considered an important factor when selecting the team, but exchange rate would
be irrelevant.
B. The language skills of the internal auditor would also be considered an important factor when selecting the team.
C. The experience of the internal auditor would also be considered an important factor when selecting the team.
D. Local customs, language skills of internal auditors, and experience of the internal auditors are all
important considerations in selecting the engagement team to examine a newly acquired subsidiary in
another country.
A new staff auditor, who has an undergraduate degree in psychology, suggested that a questionnaire be developed
to examine bus driver attitudes toward departmental operations, overtime, number of hours/kilometers driven, etc.
The internal audit activity (IAA) has never used such questionnaires before. Should the chief audit executive (CAE)
approve the development and use of such a questionnaire?
A. No, the audit department does not have sufficient expertise in developing such questionnaires.
B. Yes, the data are relevant to understanding the causes of the accidents and breakdowns.
C. Yes, the questionnaires are a more objective form of evidence gathering than is observation and interviews.
D. No, audit work should be confined to objective data so that audit independence is not compromised.
A. Auditing standards allow outside expertise to be used to develop the questionnaire.
B. The data is relevant to the objective of the test.
C. Objectivity is a secondary issue to relevancy. Therefore, the data is relevant to the objective of the test.
D. Questionnaires do provide relevant objective data.
Which of the following is an appropriate statement of an audit objective?
A. To include information about stockouts in the audit report.

B. To observe the physical inventory count.
C. To determine whether inventory stocks are sufficient to meet projected sales.
D. To search for the existence of obsolete inventory by computing inventory turnover by product line.
A. This is a specification for the audit report.

Part 2 (3-Part) : 08/17/23 19:53:16
B. This specifies part of an engagement program step.
C. This is something the audit is to accomplish. It is also specific since it ties the inventory balance to the
criterion of meeting projected customer needs.
D. This is an engagement program step.
The auditor determines that a major user application is implemented on a spreadsheet. The spreadsheet takes
input regarding projected freight deliveries from the mainframe computer and develops an optimal freight
dispatching plan. When first used two years ago, the spreadsheet helped reduce costs dramatically. However,
freight costs have been increasing and no one, other than the developer, has reviewed the spreadsheet. The
freight dispatching algorithm is complicated, but the auditor has researched the area and understands the
algorithm and its correct computation. The auditor wishes to gain assurance on whether the spreadsheet has
properly implemented the freight dispatching algorithm. Which of the following audit procedures would accomplish
the task?
I. Develop an independent spreadsheet and run test data through it and through the user's spreadsheet.
Compare the results.
II. Use a product to print out the logic of the user spreadsheet. Examine the logic to determine if it has been
correctly incorporated into the spreadsheet.
III. Develop a set of test data and manually calculate the expected results. Run the test data through the user
application.
A. I only.
B. I, II, and III.
C. I and III.
D. II only.
A. All three procedures should accomplish the task.
B. All three procedures should accomplish the task, although, procedure I is probably the most preferable
of the three. The advantage of procedure is that it is a parallel simulation model, and as such, it can
emulate routine processing.
C. All three procedures should accomplish the task.
D. All three procedures should accomplish the task.
Two major retailers, both publicly traded and operating in the same geographic area, have recently merged. They
are approximately the same size and have internal audit activities (IAA). Organization A has little EDI experience.
Organization B has invested heavily in information technology and has EDI connections with its major vendors.
The audit committee has asked the internal auditors from both organizations to analyze risk areas that should be
addressed after the merger. The chief audit executive (CAE) of Organization B has suggested that the two IAAs
have a planning meeting to share work programs, scope of coverage, and copies of engagement communications
that were delivered to their audit committees. Management has also suggested that the internal auditors review the
compatibility of the two computer systems and control philosophy for individual store operations.
One internal auditor has suggested that each IAA conduct an engagement to evaluate consumer satisfaction that
would include an analysis of:

Part 2 (3-Part) : 08/17/23 19:53:16
I. Customer complaints recorded by the customer service department during the last three months,
II. Merchandise returned in the last three months, and
III. Responses to a survey of customers who made purchases in the last three months.
Which of the following statements regarding this approach is true?
A. The survey would not consider customers who did not make purchases in the last three months.
B. Although useful, such an engagement does not address risk factors and would therefore not be compatible with
the audit committee directives.
C. Parts I and II of the engagement plan would not be necessary, or cost effective, if a comprehensive customer
survey were developed.
D. None of the answers are correct.
A. The survey concentrates on those who made purchases in the past 3 months and overlooks those who
made purchases in prior periods. This survey thus fails to consider those who did not make purchases in
the last 3 months.
B. The engagement does address risk factors, so therefore, would be compatible with the audit committee
directives. Customer satisfaction is a risk factor and needs to be considered.
C. Customer complaints and returns are necessary and would be cost effective. This information would probably
provide better information than a comprehensive customer survey.
D. The survey fails to consider those who did not make purchases in the last 3 months.
Question 114 - CIA 598 1.74 - Supervise Engagement
Which of the following involves managerial functions as a control device?
A. Use of a corporate policy manual.

B. Internal auditing.
C. Supervision of employees.
D. Maintenance of a quality control department.
A. This does not control; it only advises.
B. Internal reviews (such as internal auditing) should be independent of the operations reviewed, and are not a
managerial function.
C. The best form of control over the performance of individuals is supervision. This is a managerial
function.
D. A quality control department is a form of internal review and therefore is not a managerial function. The manager
of quality control should be independent of the operations reviewed.
In an engagement to review a non-profit organization's special fund, the primary engagement objective is to
determine whether the entity
A. Prepared its financial statements in accordance with accounting principles generally accepted in its country.
B. Complied with existing fund requirements and performed specified activities.
C. Managed its resources economically and efficiently.
D. Applies the funds in a way that would benefit the greatest number of people.

Part 2 (3-Part) : 08/17/23 19:53:16
A. Non-profit companies follow specific accounting principles that can differ from principles that are followed by
for-profit companies.
B. The primary engagement objective is to determine whether the entity is complying with existing fund
requirements and performing specified activities.
C. The primary engagement objective is to determine whether the entity is complying with existing fund
requirements and performing specified activities. The primary engagement objective is not concerned whether the
resources are managed economically and efficiently.
D. Applying the funds in a way that would benefit the greatest number of people is not a primary objective. The
funds have to be used in accordance with the funding restrictions.
The preliminary survey indicates that severe staff reductions at the engagement location have resulted in extensive
amounts of overtime among accounting staff. Department members are visibly stressed and very vocal about the
effects of the cutbacks. Accounting payrolls are nearly equal to prior years, and many key controls, such as
segregation of duties, are no longer in place. The accounting supervisor now performs all operations within the
cash receipts and posting process and has no time to review and approve transactions generated by the remaining
members of the department. Journal entries for the last 6 months since the staff reductions show increasing
numbers of prior-month adjustments and corrections, including revenues, cost of sales, and accruals that had been
misstated or forgotten during month-end closing activity. The internal auditor should
A. Research temporary help agencies and evaluate the cost and benefit of outsourcing needed services.
B. Suspend further engagement work since the observations are obvious and communicate the final results.
C. Discuss these observations with management of the internal audit activity (IAA) to determine whether further
work would be an efficient use of internal auditing resources at this time.
D. Proceed with the scheduled engagement but add personnel based on the expected number of observations and
anticipated lack of assistance from local accounting management.
A. It will be the responsibility of management to decide whether this is a possible course of action.
B. Under the current difficult circumstances the internal auditor would violate the Standard of due professional care
if the engagement work were suspended.
C. In this case, the internal auditor should discuss modifying the engagement that takes into account the
difficult circumstances and to address the responsibilities of the IAA.
D. Under the current difficult circumstances there is not a clear understanding what additional work will be
necessary.
The internal auditors for a large manufacturing company have been requested to conduct a review of the
company’s production planning system. Production data, collected on personal computers (PC’s) connected by a
local area network (LAN), are used for generating automatic purchases via electronic data interchange. Purchases
are made from authorized vendors based on production plans for the next month and on an authorized materials
requirement plan (MRP) which identifies the parts needed per unit of production.
The auditor wants to determine if purchasing requirements have been updated for changes in production
techniques. Which of the following audit procedures would be most effective in addressing the auditor's objective?
A. Use generalized audit software to develop a report of excess inventory. Compare the inventory with current
production volume.
B. Develop test data to input into the LAN and compare purchase orders generated from test data with purchase
orders generated from production data.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Recalculate parts needed based on current production estimates and on the MRP for the revised production
techniques. Compare these needs with purchase orders generated from the system for the same period.
D. Take a sample of production estimates and MRP’s for several periods and trace them into the system to
determine that input is accurate.
A. Generalized audit software is a good method to identify an inventory problem. However, the excess inventory
may not be the result of a revised production technique. The correct answer more directly addresses the audit
concern.
B. This procedure provides evidence that all items entered are processed. Comparison with currently generated
purchase orders does not provide evidence on whether the correct parts are being ordered.
C. This is the most appropriate procedure because: (a) the auditor has already determined that there is a
concern; and (b) this procedure results in a direct comparison of current part requirements with purchase
orders being generated. Differences can be identified and corrective action taken.
D. This procedure provides evidence on the input of data into the system, but does not provide evidence on
whether changes in the production process have been implemented.
A work program for a comprehensive assurance engagement to evaluate a purchasing function should include
A. A statement of the engagement objectives for the operation under review with agreement by the engagement
client.
B. A focus on risks affecting the financial statements as opposed to controls.
C. Procedures to accomplish engagement objectives.
D. Procedures arranged by relative priority based upon perceived risk.
A. Engagement objectives should be stated, but they do not need to be agreed to by the engagement client.
B. A work program to evaluate the purchasing function should not be so narrowly focused on risks affecting the
financial information.
C. Work programs must include the procedures for identifying, analyzing, evaluating, and documenting
information during the engagement. The work program must be approved prior to the commencement of
work, and any adjustments approved promptly (Standard 2240.A1). Hence, the work program to evaluate a
purchasing function should include procedures to accomplish engagement objectives.
D. The procedures should be arranged in the most efficient manner to accomplish the engagement.
Communication skills are important to internal auditors. They should be able to convey effectively all of the
following to engagement clients except
A. Recommendations that are generated in relationship to a specific engagement client.

B. The risk assessment used in selecting the area for investigation.
C. The objectives designed for a specific engagement.
D. The engagement evaluations based on a preliminary survey.
A. Internal auditors should be able to effectively communicate recommendations to the engagement client.
B. Internal auditors should be skilled in oral & written communications so that they can clearly and
effectively convey such matters as engagement objectives, evaluations, conclusions, and
recommendations. However, risk assessment is not something that necessarily needs to be
communicated.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Internal auditors should be able to effectively communicate engagement objectives.
D. Internal auditors should be able to effectively communicate engagement evaluations.
The internal audit activity (IAA) has just completed an engagement to evaluate loan processing and commercial
loan account balances for a financial institution. Following are a few excerpts from their working papers indicating
potential engagement observations:
1. We took a statistical sample of 100 loan applications and determined that only 85 loans were granted.
2. Of the 85 loans granted, we noted that four loans should have been reviewed and approved by the loan
committee, but were not. Organization policy states that all loans must be approved by the committee prior to
funding. Each of the four loans, however, was approved by the vice president. The matter was discussed
with the vice president, who indicated it was a competitive loan situation to a new customer and in the best
interests of the financial institution to expedite the loan and establish a firm relationship with a growing
customer. All of the other loans were formally approved by the loan committee.
3. Of the 81 loans approved by the loan committee, we found seven in which the actual amount lent exceeded
the approved amount.
4. We noted three instances in which loans were made to related groups of organizations without an analysis of
the total amount of loans made to the controlling entity. There may be statutory limitations on the amount of
loans that can be made to any individual controlling entity.
5. Of the 81 loans approved by the loan committee, we found that 14 contained either insufficient
documentation or were not received by the committee in a timely fashion in advance of their meeting.
The statistical sample was taken with a 95% confidence level using attribute sampling with a tolerable error limit of
4%. You may assume that the sampling plan was implemented correctly. Regarding item 3, which of the following
actions would be inappropriate on the part of the auditor?
A. Determine the amount of differences and make an assessment as to whether the monetary differences are
material. If the amounts are not material, not in violation of government regulations, and can be rationally
explained, omit the observation from the engagement communication.
B. Report the amounts to the loan committee and leave it up to them to correct. Take no further follow-up action at
this time and do not include the items in the engagement communication.
C. Follow up with the vice president and include the vice president's acknowledgment of the situation in the
engagement communication.
D. Examine the loans to determine if there is a pattern of the loans to other organizations. Summarize amounts and
include in the engagement communication.
A. Determining the amount of differences and make an assessment as to materiality would be an appropriate
action on part of the internal auditor. If the internal auditor determines that the amounts are not material, not in
violation of government regulations and can be rationally explained then the internal auditor would be justified not to
report the deviations.
B. Internal auditors must communicate the engagement results (Standard 2400). In addition, the CAE must
establish a follow-up process to monitor and ensure that management actions have been effectively
implemented or that senior management has accepted the risk of not taking action (Standard 2500.A1).
Thus, failure of the internal auditor to conduct follow-up would violate the standards.
C. Following up with the vice-president would be an appropriate action on part of the internal auditor.
D. Examining the loans to determine if there is a pattern of the loans to other organizations would be an appropriate
action on part of the internal auditor.

Part 2 (3-Part) : 08/17/23 19:53:16
An inexperienced internal auditor notified the senior auditor of a significant variance from the engagement client's
budget. The senior told the new internal auditor not to worry because the senior had heard that there had been an
unauthorized work stoppage that probably accounted for the difference. Which of the following statements is most
appropriate?
A. The new internal auditor should have investigated the matter fully and not bothered the senior.
B. The senior should have halted the engagement until the variance was fully explained.
C. The senior used proper judgment in curtailing what could have been a wasteful investigation.
D. The senior should have aided the new internal auditor in formulating a plan for accumulating appropriate
information.
A. The internal auditor was correct to refer the matter to the senior auditor.
B. The variance does need to be fully explained. Thus, the engagement should continue.
C. Without proper review the senior auditor's statement cannot be supported. Thus, it cannot be assumed that
curtailing the investigation would be wasteful.
D. The variance does need to be fully investigated and explained. When analytical auditing procedures
identify unexpected results or relationships, internal auditors should examine and evaluate such or
relationships. The examination and evaluation of unexpected results or relationships from applying
analytical auditing procedures should include inquiries of management and the application of other
engagement procedures until internal auditors are satisfied that the results or relationships are sufficiently
explained.
The chief audit executive (CAE) was reviewing recent reports that had recommended additional engagements
because of risk exposures to the organization. Which of the following represents the greatest risk and should be
the next assignment?
A. Several times cash receipts had been held over an extra day before depositing.
B. There were several purchase orders issued without purchase requisitions.
C. Three prenumbered receiving reports were missing.
D. Payment had been made for routine inventory items without a purchase order or receiving report.
A. This only represents one-day worth of receipts, so the risk of loss is probably not that great.
B. In the case of routine purchases, a purchase requisition may not be required.
C. If a receiving report were missing than payment would not be made.
D. Payment made for routine inventory items without a purchase order or receiving report represents the
greatest risk and should be the next assignment. This would represent a red flag for possible fraud.
During an operational engagement, an internal auditor observes a large number of above-ground storage
containers and a large amount of black emissions from a smokestack. The organization has an environmental
safety department. The engagement is not designed to consider environmental concerns. The best course of
action is to
A. Document the observations and report them to the environmental safety department. Determine if their response
will be timely, and follow-up to determine if they have taken timely action.
B. Report the observations to the audit committee and seek their advice on whether the engagement should be
expanded for the environmental audit.
C. Make a note to consider environmental risk concerns when developing the engagement plan for the next year,

Part 2 (3-Part) : 08/17/23 19:53:16
but do not expand the scope of the existing engagement because the budget and risk priorities are already set.
D. Inquire of local management as to the use of the storage tanks to determine if they are properly classified as an
asset. Do not take action on the environmental issues because the internal auditor is untrained in the area, and
such action is the responsibility of an already existing department.
A. The internal auditor has a responsibility to report the environmental issues to the environmental safety
department. It would not matter if the issues were connected with the current engagement or not. The
internal auditor has to make sure that the department understands the potential risk and is monitoring the
situation. The internal auditor should then conduct follow-up to determine if timely action has been taken.
B. The internal auditor should first report to the company's environmental safety department, not to the audit
committee.
C. The internal auditor has an obligation to report the environmental issues.
D. The internal auditor has a responsibility to report the environmental issues to the environmental safety
department. The internal auditor should then conduct follow-up to determine is timely action has been taken.
A transportation department maintains its vehicle inventory and maintenance records in a database. Which of the
following audit procedures is most appropriate for evaluating the accuracy of the database information?
A. Verify a sample of the records extracted from the database with supporting documentation.
B. Use program tracing to show how, and in what sequence, program instructions are processed in the system.
C. Simulate normal processing by using test programs.
D. Submit batches of test transactions through the current system and verify with expected results.
A. Verifying is the most often used technique in testing the accuracy of information maintained by a
system, whether manual or automated.
B. Tracing would require that additional coding be inserted into the database system programs.
C. Simulating normal processing would test the program but not the accuracy of data.
D. Testing the program will not test the accuracy of data in the database.
An engagement to evaluate the quality control department is being planned. Which of the following is least likely be
used in the preparation of a survey questionnaire?
A. The permanent engagement file.

B. The prior engagement final communication.
C. Management's charter for the quality control department.
D. An analysis of quality control documents.
A. The permanent engagement file would be useful to the internal auditor develop the questionnaire.
B. Prior engagement final communications will help the internal auditor develop the questionnaire.
C. Understanding the function of the department will help the internal auditor develop the questionnaire.
D. Analysis of quality control documents would be carried out during the course of fieldwork, not in
preparing a questionnaire.

Part 2 (3-Part) : 08/17/23 19:53:16
A bank internal auditor wanted to verify the accuracy of the general ledger balance of a depository account. One
engagement procedure used in this process was to mail positive confirmations to statistically sampled depositors.
However, the number of replies received was not adequate to form a valid conclusion about the account's
accuracy. What action should the internal auditor take to accomplish this objective?
A. Verify accuracy of the depositors' addresses. Remail confirmation requests a second time with a notation
indicating that it is a second request.
B. Mail negative confirmation requests to all non-replies and document results of testing. If necessary, telephone
depositors to inquire about any disagreement with balances confirmed.
C. Assume that the nonreplies represent tacit agreements by the depositor, document the results, and perform no
further work on this engagement procedure.
D. Expand the original confirmation sample to include additional depositors.
A. Remailing the confirmation requests a second time would be the best action for the internal auditor to
take.
B. With negative confirmations depositors are requested to reply only if they do not agree with the amounts. Thus,
they might not reply but this does not assure that the amounts are correct. They simply may choose not to reply.
C. The internal auditor should not assume that the nonreplies represent agreements by the depositor.
D. Expanding the original confirmation would not address the issue of the nonreplies. It would be assumed that the
rate of nonreplies for the expanded sample would remain the same.
An internal auditor was evaluating the effectiveness and efficiency of the operation of the motor pool. The
engagement work program included the use of analytical procedures to observe the trend of expenses for major
overhauls of heavy-wheeled vehicles. This trend showed a substantial increase in the last year of the ratios of
monetary amounts spent in relation to (1) the number of vehicles being used, (2) the mileage of the vehicles, (3)
the age of the equipment, and (4) environmental conditions. The auditor's investigation indicated that two new
maintenance firms were being used. The expenditure packages from the maintenance work were complete;
however, the billings for the work had an unusual regularity. The identification of the vehicles being serviced did not
correspond to the vehicle maintenance reports.
Possible engagement procedures include:

1. Discussing the matter with the superintendent of maintenance and ask for an explanation.
2. Preparing a schedule of the types of maintenance being performed and comparing it with manufacturers'
maintenance guides.
3. Analyzing vehicles' trip tickets to determine if they contain indications of problems needing attention.
4. Reviewing deadline reports to determine that vehicles were not in service on the dates of maintenance work.
5. Reviewing dispatch schedules to determine whether vehicles were dispatched for use on days the
maintenance work was reported as performed.
6. Discussing the matter with plant security.
Which of the above actions should have the highest priority?
A. 4, 5 and 6.
B. 1, 6 and 4.
C. 6, 5 and 1.
D. 2, 3 and 4.
A. Items 4, 5 and 6 should have the highest priorities. Analytical auditing procedures assist internal
auditors in identifying conditions that may require subsequent engagement procedures.

Part 2 (3-Part) : 08/17/23 19:53:16
B. Items 4, 5 and 6 should have the highest priorities. Discussing the matter with the superintendent would not be a
high priority since this could curtail the investigation if by chance the superintendent is involved in any fraudulent
activity.
C. Items 4, 5 and 6 should have the highest priorities. Discussing the matter with the superintendent would not be a
high priority since this could curtail the investigation if by chance the superintendent is involved in any fraudulent
activity.
D. Items 4, 5 and 6 should have the highest priorities.
The purpose of including a time budget in an engagement work program is to
A. Assure timely completion of the engagement.

B. Restrict the scope of the engagement.
C. Provide an objective means of evaluating the internal auditor's competence.
D. Provide a means of controlling and evaluating the progress of the engagement.
A. Including a time budget will not assure a timely completion of the engagement.
B. The purpose of the time budget is not to restrict the scope of the engagement.
C. Including a time budget will not provide a means of evaluating the internal auditor's competence. There may be
other factors that will affect the time budget besides competence.
D. Including the time budget is a means of controlling and evaluating the progress of the engagement.
Having a time budget allows for comparing actual time with budgeted time.
The physical examination of the client's inventory is considered to be
A. Both reliable and useful.

B. Both relevant and sufficient.
C. Both sufficient and useful.
D. Both reliable and sufficient.
A. The inspection or observation of a tangible asset is considered both reliable and useful. It is considered
reliable because evidence that is obtained directly by the auditor is the most reliable. It is also considered
useful because it helps the auditor meet the objective of the audit.
B. The inspection or observation of a tangible asset is not sufficient. It is not sufficient because the auditor would
not know if the inventory were actually owned or its value.
C. The inspection or observation of inventory is not sufficient. It is not sufficient because the auditor would not know
if the inventory were actually owned or its value.
D. Inspection or observation of a tangible asset is not sufficient. It is not sufficient because the auditor would not
know if the inventory were actually owned or its value.
Engagement work programs testing controls should

Part 2 (3-Part) : 08/17/23 19:53:16
A. Be tailored for each operation evaluated.

B. Be generalized so as to be usable at all locations of a particular department.
C. Be generalized to fit all situations without regard to departmental lines.
D. Reduce costly duplication of effort by ensuring that every aspect of an operation is examined.
A. The internal auditor plans and conducts the engagement with supervisory review and approval. Prior to
the engagement's commencement, the internal auditor prepares an engagement program that: States the
objectives of the engagement; Identifies technical requirements, objectives, risks, processes, and
transactions that are to be examined; States the nature and extent of testing required; Documents the
internal auditor's procedures for collecting, analyzing, interpreting, and documenting information during
the engagement; states the objectives; and is modified, as appropriate, during the engagement with the
approval of the CAE, or his or her designee (PA 2200-1.1). Therefore, a work program to test controls must
be tailored for each operation being evaluated.
B. A work program to test controls cannot be generalized so as to be usable at all locations of a particular
department. A test of controls must be tailored for each operation being evaluated.
C. A work program to test controls cannot be generalized to fit all situations without regard to departmental lines. A
test of controls must be tailored for each operation being evaluated.
D. Not every aspect of an operation needs to be examined.
Which of the following combinations of participants is most appropriate to attend an exit interview?
A. The chief audit executive and the executive in charge of the activity or function reviewed.
B. Staff auditors who conducted the fieldwork and the executive in charge of the activity or function reviewed.
C. The responsible internal auditor and representatives from management who are knowledgeable about detailed
operations and who can authorize implementation of corrective action.
D. Staff internal auditors who conducted the fieldwork and operating personnel in charge of the daily performance
of the activity or function reviewed.
A. The CAE and the executive in charge of the activity may not be completely knowledgeable of detailed operations.
B. Staff auditors would not have the proper authority.
C. The internal auditor discuss conclusions and recommendations with the appropriate levels of
management before the CAE issues the final communications. The level of participants in the discussions
and reviews vary by organization and nature of the report; they generally include those individuals who
are knowledgeable of detailed operations and those who can authorize the implementation of corrective
action (PA 2440-1).
D. Staff internal auditors and operating personnel do not have the proper authority.
Which of the following best defines an internal auditor's opinion expressed following an assurance engagement?
A. A summary of the significant engagement observations.

B. Conclusions that must be included in the final engagement communication.
C. Recommendations for corrective action.
D. The internal auditor's professional judgment about the situation that was reviewed.
A. Conclusions (opinions) are the internal auditor's evaluations of the effects of the observations and
recommendations on the activities that were reviewed. A summary of the significant engagement observations is

Part 2 (3-Part) : 08/17/23 19:53:16
not an opinion.
B. The standards do not state that opinions are required, but opinions can be a desirable component of the final
engagement communication.
C. Recommendations for corrective action are not the same as the internal auditor's opinion. The opinion is the
internal auditor's professional judgment about the situation that was reviewed.
D. Conclusions (opinions) are the internal auditor's evaluations of the effects of the observations and
recommendations on the activities reviewed. They usually put the observations and recommendations in
perspective based upon their overall implications (PA 2410-1).
Which of the following would not be considered a primary objective of a closing or exit conference?
A. To discuss the audit findings.

B. To identify concerns for future audits.
C. To resolve conflicts.
D. To identify management’s actions and responses to the findings.
A. Discussing the audit findings in order to reach agreement on the facts is an objective of the exit conference.
B. Identifying concerns for future audits is not a primary objective of the exit conference.
C. Resolving conflicts is an objective of the exit conference.
D. Determining management’s action plan and responses is an objective of the exit conference.
A company maintains production data on personal computers, connected by a local area network (LAN), and uses
the data to generate automatic purchases via electronic data interchange. Purchases are made from authorized
vendors based on production plans for the next month and on an authorized materials requirements plan (MRP)
which identifies the parts needed for each unit of production.
The production line has experienced shutdowns because needed production parts were not on hand. Which of the
following audit procedures would best identify the cause of the parts shortages?
A. Use generalized audit software to develop a complete list of the parts shortages that caused each of the
production shutdowns, and analyze this data.
B. Select a random sample of production information for selected days and trace input into the production database
maintained on the LAN.
C. Determine if access controls are sufficient to restrict the input of incorrect data into the production database.
D. Select a random sample of parts on hand per the personal computer databases and compare with actual parts
on hand.
A. This procedure would establish the cause of the problem.
B. This tests only one source of the data inaccuracy, that is, the input of production data; other sources of potential
error are ignored.
C. Access controls are tangential to the issue. Authorized, but incorrect data, could also be the problem.
D. This would provide useful information, but it is not as comprehensive as the correct answer. Further, the correct
answer provides more information on the cause.

Part 2 (3-Part) : 08/17/23 19:53:16
During an audit of cash controls, an auditor compared a sample of cash receipts lists with (1) the total of daily cash
receipts journal entries, and (2) daily bank deposit slip amounts. The comparison revealed that:
Each cash receipts list equaled cash journal entry totals but not daily bank deposit amounts.
Totals for cash receipts lists equaled bank deposit totals in the long run.
To support a finding that "Cash receipts are not deposited intact daily," the above evidence is
A. Sufficient, competent, and relevant.

B. Relevant, but not sufficient or competent.
C. Sufficient, but not competent or relevant.
D. Not sufficient, competent, or relevant.
A. The evidence is sufficient (factual, adequate, and convincing), competent (reliable and the best
attainable through appropriate audit techniques), and relevant (consistent with audit objectives).
B. The evidence is sufficient and competent.
C. The evidence is competent and relevant.
D. The evidence is sufficient, competent, and relevant.
Which of the following is not a benefit of using an interim report?
A. An interim report allows information requiring immediate attention to be communicated.

B. Interim reporting can be conducted on an informal basis.
C. A formal, written interim report may eliminate the need for a final report.
D. The time required for writing the final report can be minimized.
A. Improved communications is an advantage.
B. Interim reports may be written or oral and may be transmitted formally or informally (PA 2410-1).
C. Interim reports are written or oral and may be transmitted formally or informally. Use of interim reports
to communicate information that requires immediate attention, to communicate a change in engagement
engagements extend over a long period. The use of interim reports does not diminish or eliminate the
need for a final report (PA 2410-1).
D. The interim report can minimize report writing time.
Question 137 - IIA, adapted CIA H138 - Monitor Engagement Outcomes
An audit of an organization's claims department determined that a large number of duplicate payments had been
issued due to problems in the claims processing system. During the exit conference, the vice president of the
claims department informed the auditors that attempts to recover the duplicate payments would be initiated
immediately and that the claims processing system would be enhanced within six months to correct the problems.
Based on this response, the chief audit executive (CAE) should
A. Adjust the scope of the next regularly scheduled audit of the claims department to assess controls within the
claims processing system.

Part 2 (3-Part) : 08/17/23 19:53:16
B. Schedule a follow-up engagement within six months to assess the status of corrective action.
C. Discuss the findings with the audit committee and ask the committee to determine the appropriate follow-up
action.
D. Monitor the status of corrective action and schedule a follow-up engagement when appropriate.
A. The issue is significant, so therefore, it should not wait until the next audit engagement in order to assess the
corrective action.
B. The IAA should monitor the corrective action and schedule the follow-up engagement when appropriate.
C. Although, it would be appropriate to discuss significant findings with the audit committee, the CAE has the
responsible to determine the timing and extent of the follow-up engagement.
D. The CAE must establish a follow-up process to monitor and ensure that management actions have been
2500.A1). Thus, the internal auditor should schedule a follow-up engagement when changes have been
implemented in order to test the effectiveness of the new system.
Bank tellers might use authorized teller terminals to conceal overdrafts in their personal checking accounts by
transferring funds to and from customer accounts. The best control to detect such unauthorized actions by a teller
is to require
A. Supervisor only authorization for transfers between customer accounts.

B. Annual vacations for employees with access to teller functions.
C. Overnight balancing of all accounts by the on-line teller system.
D. Periodic examination of accounts of employees with access to teller functions.
A. Supervisor only authorization for transfers between the bank's customers would interfere with normal bank
operations, which include transfers between accounts of the bank's customers.
B. Required vacations for employees with access to teller functions might expose a teller's actions to scrutiny but
would not ensure their detection, especially if the teller remedied any overdrafts before going on vacation.
C. Overnight balancing of all accounts by the on-line teller system ensures that all parts of all transactions are
accounted for but does not ensure that all transactions are authorized.
D. Periodic examination of accounts of employees with access to automated teller functions may detect
unusual activity to and from employees' accounts.
Shipments are made from the warehouse based on customer purchase orders. The matched shipping documents
and purchase orders are then forwarded to the billing department for sales invoice preparation. The shipping
documents are neither accounted for nor prenumbered. Which of the following substantive tests should be
extended as a result of this control weakness?
A. Trace quantities and prices on the sales invoice to the customer purchase order and test extensions and
footings.
B. Foot the sales register and trace the total to the general ledger.
C. Trace a sample of purchase orders to the related sales invoices.
D. Select bills of lading from the warehouse and trace the shipments to the related sales invoices.
A. Tracing quantities and prices on the sales invoice to the customer purchase order and testing extensions and
footings would not test to see whether all shipments are being billed.

Part 2 (3-Part) : 08/17/23 19:53:16
B. Footing the sales register and tracing the total to the general ledger would not test to see whether all shipments
are being billed.
C. Tracing a sample of purchase orders to the related sales invoices would not test to see whether all shipments
are being billed.
D. Since shipping documents are neither accounted for nor prenumbered, it is likely that some shipments
will leave the warehouse without being billed. Selecting bills of lading from the warehouse and tracing the
shipments to the related customer invoices is a test to see whether all shipments are being billed.
As a means of controlling projects and avoiding time-budget overruns, decisions to revise time budgets for an audit
should normally be made
A. Immediately after expanding tests to establish reliability of findings.

B. Immediately after completing the preliminary survey.
C. When inexperienced audit staff members are assigned to an audit.
D. When a significant deficiency has been substantiated.
A. Expanded tests should have no effect on the time budget; the budget would have already been expanded as
necessary.
B. Time budgets should be appraised for revision after the preliminary survey and preparation of the audit
program.
C. The assignment of inexperienced staff should have no effect on the time budget.
D. When a deficiency has been substantiated, no further audit work is required.
Which of the following individuals would normally not receive an internal auditing report related to a review of the
purchasing cycle?
A. The independent external auditor.

B. The chairman of the board of directors.
C. The director of purchasing.
D. The general auditor.
A. The internal audit report should be distributed to everyone who has a direct interest in the audit. The
independent external auditor would have a direct interest in the audit and thus should receive a copy of the report.
B. The audit report should be distributed to everyone who has a direct interest in the audit. This includes
the executive or executives to whom internal audit reports, the person to whom people will reply about the
report, persons responsible for the activities or operations audited, and people who will need to take
corrective action as a result of the audit. The board of directors usually should receive a summary report.
C. The director of purchasing should properly receive an internal audit report related to a review of the purchasing
cycle because the report should be distributed to everyone who has a direct interest in the audit. This includes the
result of the audit.
D. The audit report should be distributed to everyone who has a direct interest in the audit. This includes the

Part 2 (3-Part) : 08/17/23 19:53:16
result of the audit.
Which of the following best describes a preliminary survey?
A. A "walk-through" of the financial control system to identify risks and the controls that can address those risks.
B. A standardized questionnaire used to obtain an understanding of management objectives.
C. A process used to become familiar with activities and risks in order to identify areas for engagement emphasis.
D. A statistical sample of key employee attitudes, skills, and knowledge.
A. A "walk through" would be one of the procedures used during the preliminary survey.
B. A questionnaire is one of the procedures used during the preliminary survey.
C. A preliminary survey should be conducted to become familiar with the engagement client's activities,
risks, and control to identify areas for engagement emphasis, and to invite comments and suggestions
from engagement clients (PA 2210.A1-1).
D. A statistical sample of key employee attributes, skills, and knowledge is one of the procedures used during the
preliminary survey.
Determining that audit objectives have been met is part of the overall supervision of an audit assignment and is the
ultimate responsibility of the
A. Audit committee.
B. Staff internal auditor.
C. Chief Audit Executive
D. Internal auditing supervisor.
A. The overall supervision of an audit assignment is not the ultimate responsibility of the audit committee.
B. The overall supervision of an audit assignment is not the ultimate responsibility of the staff internal auditor.
C. The overall supervision of an audit assignment is the ultimate responsibility of the chief audit executive
(CAE).
D. The overall supervision of an audit assignment is not the ultimate responsibility of an internal auditing supervisor.
Which of the following situations is most likely to be the subject of a written interim report to management of a
department being audited?
A. 70% of the planned audit work has been completed with no significant adverse findings.
B. The auditors have decided to substitute survey procedures for some of the planned detailed review of certain
records.
C. The audit program has been expanded because of indications of possible fraud.
D. Open burning at a subsidiary plant is a possible violation of pollution regulations.
A. An interim report should be issued during the audit process whenever there is something that needs to be
addressed immediately, if there is a need to change the scope of the audit, or simply to keep people informed when

Part 2 (3-Part) : 08/17/23 19:53:16
the audit process is a long one. No significant adverse findings after 70% of the planned audit work has been
completed is not a situation in which an interim report should be issued.
B. An interim report should be issued during the audit process whenever there is something that needs to be
the audit process is a long one. The auditors' decision to substitute survey procedures for some of the planned
detailed review of certain records is not a situation in which an interim report should be issued.
C. An interim report should be issued during the audit process whenever there is something that needs to be
the audit process is a long one. While an indication of possible fraud implies that additional investigation is
required, it is not a situation in which an interim report should be issued.
D. An interim report should be issued during the audit process whenever there is something that needs to
be addressed immediately, or if there is a need to change the scope of the audit, or simply to keep people
informed when the audit process is a long one. Open burning at a subsidiary plant which is a possible
violation of pollution regulations is a situation in which an interim report is indicated because it is
something that needs to be addressed immediately.
An outside consultant is developing methods for the management of a city's capital facilities. An appropriate scope
of an engagement to evaluate the consultant's product is to
A. Review the consultant's contract to determine its propriety.

B. Determine the adequacy of the risk management and control systems for the management of capital facilities.
C. Review the handling of idle equipment.
D. Establish the parameters of the value of the items being managed and controlled.
A. The review of the consultant's contract to determine its propriety is a procurement decision.
B. In planning the engagement, internal auditors must consider the adequacy and effectiveness of the
activity's risk management and control systems compared to a relevant control framework or model
(Standard 2201).
C. The review of the handling of idle equipment is management's responsibility.
D. The establishment of the parameters of the value of the items being managed and controlled is the responsibility
of management.
An internal auditor's preliminary analysis of accounts receivable turnover revealed the following rates for three
successive periods:
Year 1 Year 3
Year 2
4.3
7.3 6.2
Which of the following is the most likely cause of the decrease in accounts receivable turnover?
A. Increase in the cash discount offered.

B. Shortening of due date terms.
C. Liberalization of credit policy.
D. Increased cash sales.

Part 2 (3-Part) : 08/17/23 19:53:16
A. It is not possible to determine what the affect on the accounts receivable turnover ratio would be with an
increase in cash discounts offered.
B. Shortening due dates will likely cause an increase in the turnover ratio.
C. The accounts receivable turnover ratio is found by dividing net credit sales by average accounts
receivable (Net credit sales / Average accounts receivable). Liberalizing the credit policy will most likely
cause average accounts receivable to increase at a faster rate than net credit sales, thereby decreasing the
accounts receivable turnover ratio.
D. An increase in cash sales will not necessarily increase or decrease the accounts receivable turnover ratio.
During an engagement to review the personnel function, an internal auditor notes that there are several employee
benefit programs and that participation in some of the programs is optional. Which of the following is the best
information for assessing the acceptability of various benefit programs to employees?
A. Evaluate program participation ratios and their trends.

B. Evaluate methods used to make employees aware of available program options.
C. Discuss satisfaction levels with the director of personnel.
D. Discuss satisfaction levels with program participants.
A. This would be the best information to assess the acceptability of the program because evaluating
program participation ratios and there tends is analytical information and of the choices is the most
persuasive.
B. Evaluating methods used to make employees aware of available program options would not provide useful
information about participation satisfaction.
C. This would not be the best information to assess the acceptability of the program because discussing
satisfaction levels with the director of personnel does not provide as persuasive information as program
participation ratios.
D. This would not be best information to assess the acceptability of the program since it excludes discussions with
nonparticipants.
In advance of a preliminary survey, a chief audit executive (CAE) sends a memorandum and questionnaire to the
supervisors of the department to be evaluated. What is the most likely result of that procedure?
A. It creates apprehension about the engagement.

B. It is an uneconomical approach to obtaining information.
C. It involves the engagement client's supervisory personnel in the engagement.
D. It is only useful for engagements of distant locations.
A. Sending a memorandum and questionnaire will remove apprehension about the engagement since the
supervisors will have a better understanding of the upcoming engagement.
B. Sending a memorandum and questionnaire is an economical approach to obtaining information.
C. Sending a memorandum and questionnaire helps to remove apprehension about the upcoming
engagement. The supervisors will have a better understanding of the up coming engagement, so
therefore, they should be more willing to assist the internal auditor in gathering and evaluating operations.
D. In most cases, sending a memorandum and questionnaire is considered to be useful.

Part 2 (3-Part) : 08/17/23 19:53:16
hookup, etc.

10,080 10,000 8,640
locations
$6,250,000 $4,400,000 $3,750,000
equipment
Based on the data, the internal auditor can justifiably conclude that:
I. Total revenue is increasing more rapidly than is total cost.
II. The service department is more efficient because revenue has increased dramatically in the current year.
III. The service department is more efficient because revenue has increased by a greater percentage than the
increase in costs in the current year.
IV. The service department has excess capacity because 11 total staff members serviced 1,000,000
customers. Thus, 14 total staff members should be able to service more than 1,250,000 customers.
A. I, II, and III.

B. III and IV only.
C. I, II, III, IV.
D. I only.
A. Only conclusion I is correct. There is not enough available information to make a conclusion on the department's
efficiency (II and III).
B. Only conclusion I is correct. Conclusion III cannot be supported by the available data, and a conclusion on
capacity for item IV can be substantiated since each staff person is supporting about 90,000 customers.
C. Only conclusion I is correct. From 2008 to 2010, total revenue per customer increased from $3.75 to 5.00. There
is not enough available information to make a conclusion on the department's efficiency (II and III). Conclusion IV is
not correct since each staff person is supporting about 90,000 customers. Thus, a conclusion on capacity is not
supported by the available data.

Part 2 (3-Part) : 08/17/23 19:53:16
D. Only conclusion I is correct. From 2008 to 2010, total revenue per customer increased from $3.75 to 5.00
The following elements are usually included in final audit reports: purpose, scope, results, conclusions, and
recommendations. Which of the following describes all of the elements missing from the above report?
A. Result, conclusion, recommendation.

B. Purpose, scope, recommendation.
C. Purpose, result, recommendation.
D. Scope, conclusion, recommendation.
A. See the correct answer for the explaantion.
C. The purpose or objective of the audit was clearly stated. Results of the audit were also given.
D. While a portion of the scope is discussed, (30 machines selected), the reader cannot recognize the
significance or insignificance of this amount without knowing the total amount of machines which could
have been selected. The value of the machinery is not given. Also, the conclusion or auditor's opinion of
the operation is not given and the report does not make any recommendations.
An internal auditor is assigned to perform an engagement to evaluate the organization's insurance program,
including the appropriateness of the approach to minimizing risks. The organization self-insures against large
casualty losses and health benefits provided for all its employees. It is a large national entity with over 15,000
program. The organization's medical costs have been rising by approximately 8% per year for the past five years,
and management is concerned with controlling these costs.
Which of the following analytical review procedures would provide the most insight into the reasonableness of the

Part 2 (3-Part) : 08/17/23 19:53:16
increase in health care costs?
A. Obtain a bid from another health care administrator to provide the same administrative services as the current
health care administrator.
B. Obtain the government index of health care costs for the comparable period of time and compare the rate of
increase with that of the cost per employee incurred by the company.
C. Develop a comparison of overall health insurance costs incurred by the company.
D. Develop a comparison of the costs incurred with similar costs incurred by other companies.
A. This is not an analytical procedure. Further, it considers only once aspect of the total health care costs (the cost
of processing) and does not consider the underlying health care coverage.
B. This is the best approach because it considers that the number of employees may have changed.
C. This approach would be effective if it were scaled by the number of employees and the coverage provided. This
is a good step, but not as good as obtaining a government index of health care costs and comparing it with the rate
of increase with that of the cost per employee.
D. This approach does not consider that the number of employees covered may have changed during the time
period considered.
A manufacturing company has been expanding rapidly and is considering adding a new production line. Employees
are currently working double shifts and receiving large amounts of overtime pay. Demand for all of the company's
products is currently high, but management worries about demand fluctuations with changes in the economy and
technological developments by competitors. Management is concerned with such issues as whether it is efficiently
using its resources, whether it is expanding too rapidly or not rapidly enough, whether employee morale is
decreasing, and whether future expansion should be financed internally or through debt.
Management is concerned that employee productivity and morale may be decreasing even though production
workers are being paid more overtime wages. Which of the following audit procedures would be least effective in
addressing this concern?
A. Take a statistical sample of employees and interview selected employees regarding their morale, productivity,
and views on methods to improve efficiency.
B. Obtain "best practices" production data from a comparable industry and identify areas of differences. Follow-up
with interviews of production supervisors.
C. Develop a schedule of production per employee over the past two years stratified by production during standard
work shifts and production during overtime periods.
D. Develop a schedule of employee pay and analyze changes in overtime pay.
A. Interviews with employees would be effective in understanding morale issues as well as gathering suggestions
for improvement.
B. Best practices, where available, can be useful in providing insight on potential areas of improvement.
C. This procedure would be effective in determining whether productivity decreases during overtime periods.
D. This would be the least effective procedure because it only analyzes overtime costs. It does not relate
the costs to underlying production data.
Which of the following is least likely to be placed on the agenda for discussion at a pre-engagement meeting?
A. Sampling plan and key criteria.

Part 2 (3-Part) : 08/17/23 19:53:16
B. Records and client personnel needed.

C. Purpose and scope of the engagement.
D. Expected starting and completion dates.
A. The sampling plan and key criteria would not be discussed until after the preliminary survey work has
been completed.
B. Records and client personnel needed would be on the agenda of pre-engagement meetings.
C. Purpose and scope of the engagement would be on the agenda of pre-engagement meetings.
D. Starting and completion dates would be expected to be on the agenda of pre-engagement meetings.
Internal auditors occasionally express opinions as well as state facts in audit reports. Due professional care
requires that the auditor’s opinions be
A. Based on sufficient factual evidence that warrants the expression of the opinions.
B. Expressed only when requested by top management or management of the audited function.
C. Based on experience and free from all bias.
D. Limited to the effectiveness of controls.
A. Audit opinions may encompass the entire scope of the audit or only specific aspects. Opinions should
be identified as such and should be based on factual information gathered during the audit.
B. An auditor's opinion is not just expressed when requested by top management, or management of the audited
function.
C. An auditor's opinion is not just based on experience and free from all bias.
D. An auditor's opinion is not just limited to giving an opinion on the effectiveness of controls.
Engagement information is usually considered relevant when it is
A. Objective and unbiased.

B. Consistent with the engagement objectives.
C. Derived through valid statistical sampling.
D. Factual, adequate, and convincing.
A. Objectivity and being unbiased will not assure that the information will be considered relevant.
B. Information should be sufficient, reliable, relevant, and useful to provide a sound basis for engagement
observations, conclusions, and recommendations. Relevant information supports engagement
observations and recommendations and is consistent with the objectives for the engagement.
C. Valid statistical sampling is related to the determination of sufficiency and reliability rather than relevance.
D. Factual, adequate and convincing information will not assure that the information will be considered relevant.

Part 2 (3-Part) : 08/17/23 19:53:16
Which of the following audit procedures would be least effective in determining whether a division recorded
subsequent-year sales in the current year?
A. Use an integrated test facility to run data through the computer during the last month of the year and the first
month of the subsequent year to determine if sales were recorded correctly.
B. Confirm the amount of year-end accounts receivable with major customers.
C. Perform an analytical review comparing the unit volume of major products shipped during the last month of the
year and the first month of the subsequent year.
D. Perform analytical review procedures which compare like-month sales for the past two years, including the
months before and after the year end.
A. This would be the least effective audit procedure. An ITF tests the correctness of processing, but the
fraud that would be occurring here is not because the computer does not process items correctly; it is
because items are processed that should not be processed.
B. Confirmation with knowledgeable customers would be useful because if the customers respond correctly, they
would show a different year-end account balance because of the sales recorded after year-end.
C. This would be an effective procedure because analytical review would show the clear discrepancy in sales
between the two months and would present questions the auditor should follow-up as part of the investigation.
D. This would be an effective analytical review procedure because it would help the auditor delineate any unusual
deviation from the past year or between the last month of the current year and the first month of the subsequent
year.
An excerpt from an engagement observation indicates that travel advances exceeded prescribed maximum
amounts. Organizational policy provides travel funds to authorized employees for travel. Advances are not to
exceed 45 days of anticipated expenses. Organizational procedures do not require justification for large travel
advances. Employees can and do accumulate large, unneeded advances. The cause of the engagement
observation is
A. Travel advances have not been cleared in timely manner.

B. Employees accumulate large travel advances.
C. Advance procedures do not require specific justification.
D. Organizational policy is to provide travel funds to authorized employees.
A. Travel advances not having cleared in a timely manner is an effect, not a cause.
B. Employees that accumulate large travel advances are an effect, not a cause.
C. The cause is the reason that there is a difference between what does exist and what should exist. Thus,
the cause of the engagement observation is that advance procedures do not require specific justifications.
D. An organizational policy that provides travel funds to only authorized employees is not considered the cause of
the engagement observation.
An internal auditor would compare a department’s staffing level with industry standards in order to reach a
conclusion about the
A. Adequacy of controls over payroll processing.

B. Current level of performance of the department.
C. Adequacy of controls over hiring.
D. Degree of compliance with human resources policies.

Part 2 (3-Part) : 08/17/23 19:53:16
A. Such a comparison will not test the adequacy of controls over payroll processing.
B. The goal of such a test would be to assess current performance and make any recommendations for
improvement.
C. Comparison of staffing levels with industry standards will not test the adequacy of internal controls over hiring.
D. An auditor would be more concerned with adherence with policies while performing compliance testing.
Which of the following are least valuable in predicting the amount of uncollectible accounts for an organization?
A. Written forecasts from the credit manager regarding expected future cash collections.
B. Dollar amounts of accounts actually written off by the organization for each of the past six months.
C. Published economic indices indicating a general business downturn.
D. Total monthly sales for each of the past six months.
A. Information should be sufficient, reliable, relevant, and useful to provide a sound basis for engagement
observations, conclusions, and recommendations. Sufficient information is factual, adequate, and
convincing so that a prudent, informed person would reach the same conclusions as the internal auditor.
Reliable information is competent and the best attainable through the use of appropriate engagement
techniques. Relevant information supports engagement observations and recommendations and is
consistent with the objectives for the engagement. Useful information helps the organization meet its
goals. Written forecast from the credit manager is solely based on the manager’s opinion, and thus, is the
least valuable in predicting the amount of uncollectible accounts.
B. Prior experience of the organization has a high degree of reliability.
C. Published economic indices may not be the most valuable information available in predicting the amount of
uncollectible accounts, but it is still reliable because it has been published by an independent source.
D. Prior experience of the organization has a high degree of reliability.
Question 160 - CIA 1186 II.44 - Monitor Engagement Outcomes
It is the policy of some organizations to have engagement clients respond to engagement communications by
writing to an administrative vice president who has the primary responsibility for follow-up. Under such
arrangements, copies of responses are usually sent to the internal audit activity (IAA), which reviews them for
adequacy. If the IAA considers the response to a particular report inadequate, which of the following is the most
appropriate course of action?
A. Perform a follow-up engagement immediately.

B. Follow up in connection with the next regularly scheduled engagement to review the engagement client.
C. Inform the administrative vice president that the response is not considered adequate, and coordinate any
additional follow-up with the vice president.
D. Schedule a follow-up engagement within 6 months.
A. In this case, the administrative vice-president is responsibility for follow-up.
B. Follow-ups should be prompt.
C. The CAE must establish a follow-up process to monitor and ensure that management actions have been
2500.A1). If the administrative vice-president has responsibility for follow-up then the internal auditor
should coordinate any additional follow-up with him or her.

Part 2 (3-Part) : 08/17/23 19:53:16
D. Follow-ups should be prompt.
Engagement work programs testing internal controls should
A. Be tailored for the audit of each operation.

B. Reduce costly duplication of effort by ensuring that every aspect of an operation is examined.
C. Be generalized so as to be usable at all locations of a particular department.
D. Be generalized to fit all situations without regard to departmental lines.
A. A tailored program will be more relevant to an operation than will a generalized program.
B. Every aspect of an operation need not be examined--only those likely to conceal problems and difficulties.
C. A generalized program cannot take into account variations in circumstances and conditions.
D. A generalized program cannot take into account variations resulting from changing circumstances and varied
conditions.
Which of the following statements conveys negative information in such a way that a favorable response from the
auditee may still be achieved?
A. "Your bookkeeper has failed to reconcile the bank statement each month."
B. "Unfortunately, your bookkeeper has not taken the time to reconcile the bank statement each month."
C. "The bank statements have not been reconciled each month."
D. "You have apparently failed to inform your bookkeeper that the bank statements should be reconciled on a
timely basis."
A. Placing the blame and using words like "failed" will make the individual react negatively.
B. Placing the blame in a manner that seems mean spirited and using words like "unfortunately" will make the
reader react negatively.
C. Using the passive version without placing blame or making the statement personal is more likely to
make the reader react positively.
D. Placing the blame on the reader and using words like "failed" will make the reader react negatively.
The best control over the work on which internal auditors' opinions are based is
A. Supervisory review of all engagement work.

B. Preparation of time budgets for internal auditing activities.
C. Staffing of internal audit activities.
D. Preparation of engagement working papers.
A. Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and
staff is developed (Standard 2340).

Part 2 (3-Part) : 08/17/23 19:53:16
B. Although, time budgets are useful to compare actual time results against the allocated time, they do not provide
control over the work on which the internal auditor's opinion is based on.
C. Staffing of the internal audit activity is important to ensure completion of the engagement, but supervision is
required to ensure objectives are achieved, and quality is assured.
D. Working papers provide information so internal auditors' are able to formalize an opinion.
Which of the following controls would help prevent overpayment of a vendor?
A. Requiring the check signer to mail the check directly to the vendor.
B. Reviewing the account distribution for each expenditure.
C. Reviewing and canceling supporting documents when payment is issued.
D. Approving the purchase order before ordering the material from the vendor.
A. This would prevent the check from being misappropriated.
B. This would ensure that the expenditure is debited to the proper account(s).
C. Reviewing and canceling the supporting documents would prevent paying a vendor twice for the same
purchase.
D. This would ensure that only authorized purchases are made.
An intermediate fact, or group of facts, from which the internal auditor can infer the fairness of an assertion being
reviewed is
A. Circumstantial evidence.
B. Conclusive evidence.
C. Corroborative evidence.
D. Direct evidence
A. An intermediate fact, or group of facts, from which the internal auditor can infer the fairness of an
assertion being reviewed is circumstantial evidence. Circumstantial evidence is indirect evidence so
therefore; it does not include direct evidence that is crucial to the internal auditor during an engagement.
B. Conclusive evidence is evidence that is so strong only one conclusion can be drawn about the subject.
C. Corroborative evidence is evidence that supports other evidence. Enough corroborative evidence may
eventually become conclusive.
D. Direct evidence is simple, fact-based comments that are presented without interpretation or assumptions.
Question 166 - CIA QZP2B.11 - Planning the Engagement
Which of the following procedures would an auditor least likely perform in planning a financial statement audit.
A. Reading the current year’s interim financial statements.

B. Discussing matters that may affect the audit with firm personnel responsible for non-audit services to the entity.
C. Coordinating the assistance of entity personnel in data preparation.

Part 2 (3-Part) : 08/17/23 19:53:16
D. Selecting a sample of vendors’ invoices for comparison with receiving reports.
A. Reading the current year's interim financial statements is an example of a planning procedure.
B. Discussing matters that may affect the audit with firm personnel responsible for non-audit services is an
example of a planning procedure.
C. Coordinating the assistance of entity personnel in data preparation is an example of a planning procedure.
D. Selecting a sample of vendor's invoices for comparison is a substantive test that would be conducted
during the fieldwork stage.
If a department’s operating standards are vague and thus subject to interpretation, an auditor should
A. Omit any comments on standards and the department’s performance in relationship to those standards,
because such an analysis would be meaningless.
B. Determine best practices in the area and use them as the standard.
C. Interpret the standards in their strictest sense because standards are otherwise only minimum measures of
acceptance.
D. Seek agreement with the departmental manager as to the standards to be used to measure operating
performance.
A. The auditor should first seek to gain an understanding with the departmental manager on the appropriate
standards.
B. The auditor should seek to understand the operating standards as they are applied to the organization. Also,
best practices may produce overly high standards.
C. The Standards states that if internal auditors must interpret standards, they should seek agreement with the
auditee.
D. When standards are vague, authoritative interpretations should be sought. If internal auditors are
required to interpret or select operating standards, they should seek agreement with auditees as to the
standards needed to measure operating performance.
[#5]
[#6]

Part 2 (3-Part) : 08/17/23 19:53:16
[#7]
obsolescence.
[#8]
A major deficiency in paragraph #6 related to the completeness of the engagement communication is
A. The cause of the problem is not defined.

B. The risk is presented in an "over-dramatic" fashion.
C. The factual support for the observation is not given.
D. The recommendation is incomplete.
A. The cause of the problem is stated very clearly: The receiving reports are not filled out when the receiving
department becomes busy.
B. The internal auditor states very clearly the consequences of not taking corrective action. The risk is not
presented in an "over dramatic" fashion.
C. The factual support comes from the internal auditors visual inspection of the process.
D. The recommendation is for receiving reports to be prepared. This seems to be incomplete since the
receiving reports are prepared, but they are not prepared on a timely basis. Thus, the recommendation
should probably be more detailed.
To ascertain that all credit sales are recorded in accounts receivable, an internal auditor should
A. Vouch a sample of subsidiary ledger entries to related sales invoices and to related shipping documents.
B. Confirm selected accounts receivable balances by direct correspondence with customers.
C. Trace a sample of shipping documents to related sales invoices and the subsidiary ledger.
D. Compare a sample of customer purchase orders with related shipping documents.
A. Vouching a sample of entries will not detect any unrecorded receivables.
B. Confirming selected accounts receivable balances by direct correspondence with customers would not detect
any unrecorded receivables.
C. Tracing a sample of shipping documents to related sales invoices and subsidiary ledger would confirm
whether any there are any unrecorded credit sales.
D. Comparing a sample of customer purchase orders with related shipping documents would not detect
unrecorded receivables.
In evaluating the quality of housekeeping services performed in a large hospital, the most reliable source of

Part 2 (3-Part) : 08/17/23 19:53:16
evidence would be
A. A review of survey forms returned by medical personnel directly to the manager of housekeeping services.
B. A review of housekeeping records maintained by the medical records department of the hospital.
C. Interviews with top hospital officials.
D. Interviews with a sample of medical personnel.
A. Prior to the auditor’s visit, the manager could have removed survey forms with critical comments.
B. The medical records department would be unlikely to maintain any records except those of patients.
C. It's unlikely top hospital officials would be able to evaluate the quality of the housekeeping services.
D. Evidence gathered first-hand by the auditor and also originating with unbiased parties is considered
most competent.
Question 171 - CIA 594 III.92 - Planning the Engagement
Which of the following activities does not constitute engagement supervision?
A. Providing appropriate instructions to the internal auditors.

B. Ensuring that engagement communications meet appropriate criteria.
C. Reviewing engagement working papers.
D. Preparing a preliminary engagement work program.
A. Providing appropriate instructions to the internal auditors is an aspect of supervision.
B. Ensuring the engagement communications meet appropriate criteria is an aspect of supervision.
C. Reviewing engagement working papers is an aspect of supervision.
D. Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and
staff is developed (Standard 2340). Preparing a preliminary engagement work program does not constitute
a supervision activity.
What is a possible consequence of allowing an unaccompanied employee access to the corporate safety deposit
box containing investment securities?
A. The corporation would be unable to obtain a fidelity bond on its employees.

B. The employee could steal the securities and the theft would never be discovered.
C. There would be no record of when corporate personnel visited the safety deposit box.
D. The employee could pledge corporate investment securities to secure a short-term personal loan.
A. Fidelity bonds are based on a person’s character and previous record.
B. Eventually, the theft would be uncovered during an audit.
C. The bank would have a record.
D. An employee could temporarily borrow securities without being caught because the company would
still receive interest and dividends.

Part 2 (3-Part) : 08/17/23 19:53:16
Which of the following actions constitutes a violation of the confidentiality concept regarding working papers? An
internal auditor
A. Shows working papers on occasion to engagement clients.

B. Takes working papers to her hotel room overnight.
C. Allows the external auditor to copy working papers.
D. Misplaces working papers occasionally.
A. The working papers may, on occasion, be shown to the engagement client, with the CAE's approval.
B. During fieldwork it may be necessary to have possession of the working papers at all times.
C. It is permissible to allow the external auditor to copy the internal auditor's working papers. It is not uncommon for
internal and external auditors to exchange work programs and working papers.
D. The working papers belong to the auditor and should have proper control maintained over them.
Misplacing the working papers, even occasionally, is not maintaining proper control over them.
An internal auditing supervisor reviewed the system of controls and the organizational objective of the purchasing
department. What facet of engagement planning was the supervisor developing?
A. Internal auditing budget.

B. Engagement work program.
C. Internal auditing policy manual.
D. Engagement work schedule.
A. The internal auditing budget is not a relevant objective for the purchasing department.
B. Internal auditors must develop work programs that achieve the engagement objectives (Standard 2240).
Work programs must include the procedures for identifying, analyzing, evaluating, and documenting
information during the engagement. The work program must be approved prior to its implementation, and
any adjustments approved promptly (Standard 2240.A1).
C. The internal auditing policy manual is relevant to the IAA, not to the purchasing department.
D. An engagement work schedule should include the following: what activities are to be performed; when they will
be performed; and the estimated time required.
Which of the following procedures would provide the most relevant evidence to determine the adequacy of the
allowance for doubtful accounts receivable?
A. Analyze the allowance through an aging of receivables and an analysis of current economic data.
B. Confirmation of the receivables.
C. Test the controls over the write-off of accounts receivable to ensure that management approves all write-offs.
D. Analysis of the following month's payments on the accounts receivable balances outstanding.
A. Aging of receivables lends direct, relevant evidence regarding the valuation of receiv-ables and thus the
allowance account.
B. Although some valuation information is implied from the confirmation, aging is more relevant and persuasive.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Controls over write-offs is not relevant to the account's valuation, but to the authorization of the write-off.
D. One month's receipts is too little information on which to base the collectibility of accounts.
On an audit of the purchasing department, an internal auditor receives information from an employee alleging that
a buyer for the company favors a particular supplier. Audit evidence indicates that in some cases the supplier
received awards even though not the low bidder. Generally the most appropriate step for the auditor to take next is
to
A. Seek advice of company general counsel

B. Contact the supplier to discuss the purchases.
C. Discuss the purchases with the buyer.
D. Discuss the purchases with the buyer's supervisor.
A. At this point, the auditor has no reason to believe that legal help is yet needed. However, the auditor should be
alert to the possibilities of potential buyer misconduct that may require legal assistance.
B. The circumstances do not justify contacting the supplier. In addition, it cannot be assumed that the supplier can
explain the buyer's actions.
C. The auditor should discuss factual items with the buyer to understand if additional information is
available to justify the purchases.
D. Under the circumstances, the auditor is not justified in bringing the matter to the supervisor's attention before
giving the buyer ample opportunity to explain his actions.
During the first meeting, a disagreement occurs over the approach taken regarding store compliance. The chief
audit executive (CAE) for company B questions company A's extensive use of store compliance testing, stating that
the approach is neither responsive to materiality concepts nor an appropriate application of risk assessment.
Company A's CAE presents the following reasoning:
I. You have misconstrued materiality. Materiality is not based only on the size of individual stores; it is also
based on the control structure that affects the whole organization.
II. Any deviation from a prescribed control procedure is, by definition, material.
III. The only way to ensure that a material amount of the company's control structure is covered is to
comprehensively audit all stores.
Which of the statements by the CAE of company A are valid?
A. I only.
B. III only.
C. I and II only.
D. I, II, and III.
A. Materiality is defined by the potential impact of an item on the organization and is not limited to items
that can be assessed only in quantitative terms.
B. Sampling approaches may be used to comprehensively cover the control structure of an organization.
C. There may be some control failures of a minor nature that would not be considered material.

Part 2 (3-Part) : 08/17/23 19:53:16
Which of the following is not likely to be included as an audit step when assessing vendor performance policies?
A. Determine whether the quality of the goods purchased from the vendors has been satisfactory.
B. Determine whether agreed upon lot sizes were sent by vendors.
C. Determine whether the balances owed to vendors are correct.
D. Determine whether only authorized items were received from vendors.
A. Quality of goods is directly related to vendor performance.
B. Lot size is directly related to vendor performance.
C. Balance confirmations usually are done to assess internal accounting procedures.
D. Delivery of only authorized items is directly related to vendor performance.
An internal auditor's working papers should be reviewed by the
A. Management of the organization's security division.

B. Chief audit executive.
C. Audit committee of the board.
D. Management of the engagement client.
A. An organization's security division might need to review the auditor's working papers when conducting an
investigation, but they are not part of the general review process.
B. The auditor's working papers should be reviewed by the CAE. It is the CAE who is responsible for the
performance of the review.
C. The audit committee will review summarized communications. The audit committee will rarely review the
auditor's working papers.
D. Management of the engagement client will rarely see or review the auditor's working papers.
Question 180 - CIA QZP1E.6 - Planning the Engagement
Tracing is the process of starting with a source document and following it through the accounting records into the
final ledger. This is a test for what?
A. Completeness.
B. Usefulness.
C. Sufficiency.
D. Existence.
A. Tracing is a test for completeness, to make sure that every event or transaction that occurred is actually
recorded.
B. Useful information helps the organization achieve its goals.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Sufficiency has to do with evidence that is factual, adequate and convincing so that a prudent, informed person
would reach the same conclusion.
D. Vouching is a test for existence.
If a review of the working papers of the last audit of cash operations revealed that a recently discovered fraudulent
transaction was not included in a properly designed statistical sample of transactions tested, which of the following
is a valid conclusion?
A. Extraordinary care is required in the performance of a cash operations audit and the auditor should be held
responsible for the oversight.
B. The audit was performed with due professional care since an appropriate statistical sample of material
transactions was tested.
C. Fraud should not have gone undetected in a recently audited area.
D. Since cash operations are a high-risk area, a test of all transactions should have been performed.
A. Due care implies reasonable care and competence, not infallibility or extraordinary performance.
B. Due professional care implies reasonable care and competence, not infallibility.
C. Internal auditors cannot give absolute assurance that noncompliance or irregularities do not exist.
D. Due professional care requires the auditor to conduct examinations and verifications to a reasonable extent, but
does not require detailed audits of all transactions.
An internal auditor's working papers should support the observations, conclusions, and recommendations to be
communicated. One of the purposes of this requirement is to
A. Permit the audit committee to review observations, conclusions, and recommendations.

B. Provide control over working papers.
C. Provide support for the internal audit activity's financial budget.
D. Facilitate quality assurance reviews.
A. Audit committee would generally receive a summary report, not the full final engagement.
B. The working papers belong to the auditor and should have proper control maintained over them. There should
be policies in place that set out who is able to access the working papers and for what purposes. The CAE
authorizes the policy.
C. The IAA financial budget is based on engagement work schedules, administrative activities, education and
training requirements, and audit research and development efforts.
D. Working papers are the place in which the internal auditor records all of the work and tests that are
performed during the engagement. The working papers are the basis for any conclusions that are drawn
by the internal auditor. Thus, working papers help to facilitate quality assurance reviews.
Which of the following procedures would provide the best evidence of the effectiveness of a credit-granting
function?

Part 2 (3-Part) : 08/17/23 19:53:16
A. Review the trend in receivables write-offs.

B. Ask the credit manager about the effectiveness of the function.
C. Check for evidence of credit approval on a sample of customer orders.
D. Observe the process.
A. The purpose of the credit-granting function is to minimize write-offs while at the same time accepting
sales likely to result in collection. Reviewing the trend in write-offs will provide some insight concerning
the minimization of write-offs.
B. Responses from the credit manager will lack objectivity, a key attribute of competent evidence.
C. The credit limits may be set too high or not properly revised periodically. The existence of approval will not
detect these problems
D. Observation will provide evidence on whether the credit personnel are following the procedures while being
observed. However, since they know they are being watched, they will probably do what they believe they should
do, not what they normally do.
An auditor for a bank noted a significant deficiency relating to access to cash in the bank's vault at one of the
branch banks. Which of the following is the most satisfactory means of addressing this deficiency? The auditor
should
A. Discuss the deficiency with the branch manager before drafting the written audit report. If the auditor and branch
manager agree upon corrective action, include both the deficiency and corrective action in the audit report.
B. Not discuss the deficiency with the branch manager before or after the audit report is published; discussion may
dilute the impact of the written report.
C. Discuss the deficiency with the branch manager before drafting the written audit report. If the auditor and branch
manager agree upon corrective action and the action is initiated before the report is published, the deficiency need
not be included in the report.
D. Discuss the deficiency with the branch manager only after the audit report is published.
A. This approach takes nothing away from the auditor, and it builds a problem-solving partnership
between the auditor and branch manager.
B. Discussion prior to issuing the report helps insure that there have been no misunderstandings nor
misinterpretations of fact, and provides the branch manager the opportunity to clarify specific items.
C. Top management should be made aware of signifi-cant deficiencies that have existed, even though they may
have been corrected by the time the audit report is issued.
D. Discussion prior to issuing the report helps insure that there have been no misunderstandings nor
misinterpretations of fact, and provides the branch manager the opportunity to clarify specific items.
A standardized (pro forma) internal engagement work program would not be appropriate for which of the following
situations?
A. A stable operating environment undergoing only minimal changes.

B. A complex or changing operating environment.
C. Subsequent inventory audits performed at the same location.
D. Multiple locations with similar operations.
A. A standard engagement work program would be appropriate for use in a minimally changing operating

Part 2 (3-Part) : 08/17/23 19:53:16
environment.
B. A standard engagement work program would not be appropriate for a complex or changing operating
environment because the audit objectives and related work steps may no longer have relevance.
C. A standard engagement work program would be acceptable for conducting subsequent inventory audits at the
same location.
D. A standard engagement work program could be used to audit multiple locations with similar operations.
A recommendation in a final engagement communication should address what attribute?
A. Criteria.
B. Cause.
C. Effect.
D. Condition.
A. Criteria are the standards, measures or expectations that will be used making measurement (what should exist).
B. The recommendations are based on the observations and conclusions of the internal auditor. Any
observations and recommendations that are made should be based on four attributes. The
recommendation in the final engagement communication is addressed by the cause attribute. The cause
attribute states the reason for the difference between the expected and actual conditions (why the
difference exists).
C. Effect is the risk or exposure that the organization (or others) face as a result of the fact that the actual
conditions are different than they should be (impact of the difference).
D. Statement of condition is the factual information that the auditor found during the engagement (what does exist).
In deciding whether recorded sales are valid, which of the following items of information is most reliable?
A. The shipping document, independent bill of lading, and the invoice for the merchandise.
B. A memorandum from the director of the shipping department stating that another employee verified the personal
delivery of the merchandise to the customer.
C. Accounts receivable records showing cash collections from the customer.
D. A copy of the customer's purchase order.
A. Information is reliable if it is the best attainable information through the use of appropriate engagement
techniques (Interpretation: Standard 2310). The shipping document and invoice is the most reliable
information that a sale was made. The bill of lading will show that the merchandise was shipped.
B. The memorandum in this problem cannot be verified.
C. Accounts receivable records showing cash collections from the customer is less reliable than the shipping
document and invoice.
D. A copy of the customer's purchase order will only prove that the customer ordered the item, not that the
customer purchased it.

Part 2 (3-Part) : 08/17/23 19:53:16
Which of the following would seem to be a message characteristic that the auditor who prepared the above report
overlooked?
A. Nature of the audience.

B. Sequence of message.
C. Noise.
D. History of prior events leading to the current encounter.
A. The nature of an audience is a situational factor that is outside the control of the auditor.
B. Complex messages are more understandable if they follow a logical sequence. Thus, the sequence or
organization of the message is a characteristic that is within the control of the sender.
C. Noise is a situational factor that interferes with the effective communication of intended messages.
D. The history of previous encounters is a situa-tional factor that is outside the control of the auditor.
An electric utility company records capital and maintenance expenditures through the use of a computerized
project tracking system. Labor, material, and overhead are charged to the applicable project number. Monthly
reports are produced which detail individual charges to each project, and expenditure totals are provided for the
current month, fiscal year, and project life to date.
Monthly project reports compare actual costs to original budget estimates and compute variances. Project
variations greater than 10 percent of budget require subsequent explanation and approval by the supervisor.
Which of the following audit test(s) would the internal auditor use to determine whether the required procedure is
being followed?
I. Select a sample of over-budget explanations and test for subsequent approvals.
II. Trace over-budget explanations to supporting monthly project reports.

Part 2 (3-Part) : 08/17/23 19:53:16
III. Use audit software to recompute monthly project report variances and totals.
IV. Compare a sample of project variances to documented approvals and explanations.
A. I, II and III.
B. III and IV.
C. IV only.
D. I and II only.
A. Recomputing totals does not test the procedure described.
B. Recomputing totals does not test the procedure described.
C. This is the only test that selects from the appropriate population (project variances) and verifies that
needed approvals and explanations are given.
D. Tracing to the monthly report does not ensure that all variances have explanations.
Which of the following audit procedures would provide the least relevant evidence that the company had included
all of its outstanding debt on a recent disclosure statement that was made public?
A. Send bank confirmations to all banks that have done business with the company, asking for information on
outstanding notes.
B. Analyze the interest expense and notes payable accounts to determine if interest has been recorded for notes
that are not on the disclosure statement
C. Prepare a schedule of outstanding notes using the company's list of notes payable, and trace them to the
general ledger and disclosure statement.
D. Compare the notes listed in last year's audited disclosure statement with the notes listed this year and reconcile
the differences.
A. Bank confirmations are relevant and a common audit procedure for unrecorded liability tests.
B. Analytical tests of interest expense to debt is relevant and a common audit proce-dure.
C. A list prepared from the company's notes would not include unrecorded notes.
D. Comparison to previous year's outstanding debt and verifying payment or inclusion on this year's disclosure is a
relevant and common procedure.
Internal auditors should develop and record a plan for each engagement. The planning process should include all
the following except
A. Identifying sufficient information to achieve engagement objectives.

B. Obtaining background information about the activities to be reviewed.
C. Determining how, when, and to whom the engagement results will be communicated.
D. Establishing engagement objectives and scope of work.
A. Identifying sufficient information to achieve engagement objectives is done during the fieldwork phase,
not during the planning phase.
B. The planning process includes obtaining background information.
C. The planning process includes determining how, when, and to whom the engagement results will be

Part 2 (3-Part) : 08/17/23 19:53:16
communicated.
D. The planning process includes establishing engagement objectives and scope of work.
Which of the following best describes what should determine the extent of supervision required for a particular
internal auditing engagement?
A. Whether the engagement involves possible violations of laws or governmental regulations.

B. Whether the engagement involves possible fraud on the part of management.
C. The proficiency of the internal auditors and the complexity of the engagement.
D. The internal audit activity's prior experience in dealing with the particular engagement client.
A. Whether the engagement involves possible violations of laws or governmental regulations is not the primary
determinant of the extent of supervision required.
B. Whether the engagement involves fraud or not is not the primary determinant of the extent of supervision
required.
C. Engagements should be properly supervised to ensure objectives are achieved, quality is assured, and
staff is developed (Standard 2340). Appropriate evidence of supervision is documented and retained. The
extent of supervision required will depend on the proficiency and experience of internal auditors and the
complexity of the engagement (PA 2340-1).
D. The IAA's prior experience in dealing with a particular engagement client is not the primary determinant of the
extent of supervision required.
In an examination of receiving operations for a manufacturer of small appliances, an auditor will be most concerned
with the risk that the function has
A. Failed to detect the receipt of substandard goods.

B. Received goods that were not ordered.
C. Accepted goods in excess of current needs.
D. Paid inflated prices for goods from related parties.
A. Inspection of goods by receiving inspectors is essential to prompt detection and reporting of all
materials received that fail to meet specifications.
B. This is a significant receiving risk, but returns to vendors are possible since no contract exists for goods that
were not ordered. The lack of an order can be detected promptly in either receiving (matching purchase order with
the goods received) or in accounting (matching invoice with requisition, receiving report, and purchase order).
There is a lesser risk of loss than with undetected substandard materials received.
C. Excessive acquisitions are a purchasing function risk, and not a receiving department risk.
D. Inappropriate purchasing is involved here, and the risk is associated with non-economical buying practices and
conflicts of interest.
An organization sells products via catalog and takes orders over the phone. All orders are entered on-line and the

Part 2 (3-Part) : 08/17/23 19:53:16
organization's objective is to ship all orders within 24 hours. The audit trail is kept in machine readable form. The
only papers generated are the packing slip and the invoice sent to the customer. Revenue is recorded upon
shipment of the goods. The organization maintains a detailed customer database which allows the customer to
return goods for credit at any time.
Which of the following control procedures would be least effective in assuring that the correct product is shipped
and billed at the appropriate price?
A. Self-checking digits are used on all product numbers and customers must order from a catalog with product
numbers.
B. The customer service representative prepares batch totals of the number of items ordered and the total dollar
amount of the orders.
C. The customer service representative verbally verifies both the product description and price with the customer
before the order is closed for processing.
D. The product database is tightly restricted and only the director of marketing (and limited personnel in the
marketing department) can approve changes to the price file.
A. Self-checking digits provide effective control to properly identify products for shipment.
B. This procedure would be useful in ensuring that once the order is captured it is not lost. However, it
does not assist in ensuring that the right product is shipped at the right priced.
C. This is one of the best control procedures because the service representative verified both the product and the
price.
D. This procedure provides excellent control over the correct pricing of the products
When determining the retention period for the working papers of a contract engagement, it is best to
A. Review the organization's policy manual developed by the records management area for the section regarding
business records.
B. Check with the accounting department because accounting records are involved.
C. Seek the assistance of the legal department to assure compliance with contract provisions.
D. Follow the contractor's own record retention policies.
A. The organization's policy manual may not address a specific contractual agreement.
B. The accounting office would concern itself with the processing of routine accounting information, not with the
retention period for the working papers of a contract agreement.
C. In setting retention policy, the CAE should consult with legal counsel to ensure that all documents that
are required to be kept for a certain period by law or other contractual agreement are kept for the required
time.
D. Following the contractor's own retention policies has nothing to do with the organization's own retention of
working papers.
An internal auditor has set an engagement objective of ascertaining compliance with a city ordinance forbidding city
purchasing from vendors affiliated with elected city officials. Which of the following engagement techniques will
best meet this objective?
A. Analytical review.
B. Inspection of documents.

Part 2 (3-Part) : 08/17/23 19:53:16
C. Observation.
D. Inquiry.
A. Analytical review would not be the best technique to ensure compliance with the city ordinance.
B. The inspection of documents would allow the internal auditor to inspect the list of approved vendors.
C. Observation would not be the best technique to ensure compliance with the city ordinance.
D. Inquiry would not be the best technique to ensure compliance with the city ordinance.
What action should an internal auditor take upon discovering that an area was omitted from the engagement work
program?
A. Evaluate whether completion of the engagement as planned will be adequate.

B. Document the problem in the engagement working papers and take no further action until instructed to do so.
C. Perform the additional work needed without regard to the added time required to complete the engagement.
D. Continue the engagement as planned and include the unforeseen problem in a subsequent engagement.
A. The internal auditor has to evaluate whether the engagement as planned will be able to achieve the
objectives. If modifications to the engagement are necessary the internal auditor must consult with
supervisors to get proper authorization.
B. If the internal auditor discovers that an area was omitted from the engagement work program then it will be the
internal auditor's responsibility to determine if changes in the engagement will be needed.
C. If additional work is required then the internal auditor will have to get proper authorization.
D. It will be necessary for the internal auditor to review whether completion of the engagement as planned will be
adequate.
Which of the following represents the most reliable information that a receivable actually exists?
A. A receiving report.
B. A positive confirmation.
C. A bill of lading.
D. A sales invoice.
A. A receiving report would provide no useful information on the status of a receivable.
B. A confirmation is the most reliable source of information to confirm that a receivable actually exists.
C. A bill of lading would provide no useful information on the status of a receivable. A bill of lading would be used to
confirm that shipments were made.
D. A sales invoice is internally generated, therefore, it is not the most reliable source of information to confirm that a
receivable actually exists.

Part 2 (3-Part) : 08/17/23 19:53:16
To determine whether credit controls are inconsistently applied, preventing valid sales to creditworthy customers,
the internal auditor should
A. Trace postings on the accounts receivable ledger.

B. Compare credit histories for those receiving credit and for those denied credit.
C. Confirm current accounts receivable.
D. Analyze collection rates and credit histories.
A. Tracing posting to the accounts receivable ledger account would not be useful since there is no posting to the
account if credit is denied.
B. Comparing credit histories for those receiving credit and for those denied credit would be the best
method to determine whether credit controls are properly administered.
C. Confirming current accounts receivable would not be useful since there is no posting to the account if credit is
denied.
D. If credit is denied there is no accounts receivable to collect on.
Which of the following is a step in an engagement work program?
A. A determination is made concerning whether the manufacturing operations are effective and efficient.
B. The methods used to identify defective units produced are observed.
C. Internal auditors may not reveal engagement observations to non-supervisory, operational personnel during the
course of this engagement.
D. The engagement will commence in 6 weeks and include tests of compliance with laws, regulations, and
contracts.
A. Determining is made concerning whether the manufacturing operations are effective and efficient is an
engagement objective.
B. Work programs should establish the procedures for identifying, analyzing, evaluating, and recording
information during the engagement. Thus, methods used to identify defective units is a step in an
engagement work program.
C. Not revealing engagement observations to other personal is a rule of conduct for internal auditors.
D. The proposed starting time of the engagement is not a step in an engagement work program.

Prelim Review

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Prelim Review

Uploaded by

Copyright:

Available Formats

Part 2 (3-Part) : 08/17/23 19:45:12

Question 1 - CIA 598 1.49 - Types of Engagements

A determination of cost savings is most likely to be an objective of

A. Program audits address accomplishment of program objectives.

B. Financial auditing addresses accuracy of financial records.

Question 2 - CIA 588 II.20 - Planning

A. Establishing standards for employee performance.

A. Management sets establishing standards for employee performance.

Question 3 - CIA 592 II.2 - Report to Senior Management & Board

C. The audit committee provides an oversight role, not an operational.

(c) HOCK international, page 1

Question 4 - CIA 1190 II.5 - Strategic Role of Internal Auditing

Question 5 - CIA QZP2B.21 - Types of Engagements

Question 6 - CIA QZP2B.1 - Types of Engagements

(c) HOCK international, page 2

Question 7 - CIA 594 I.55 - Planning

The term "risk" is best defined as the uncertainty that

B. This is the definition of detection risk that is a component of risk.

Question 8 - CIA QZP1B.19 - Report to Senior Management & Board

IV. The safeguarding of assets.

A. I, II and III only.

(c) HOCK international, page 3

C. Safeguarding of assets is management’s responsibility, not the CAE’s or audit committees.

D. Safeguarding of assets is management’s responsibility, not the CAE’s or audit committees.

Question 9 - CIA 591 II.9 - Managing Resources

Question 10 - CIA QZP1C.2 - Risk Management

Which of the following would be considered risk factors to an organization?

I. A significant improvement in the competitor's product.

II. The purchase of new equipment that will improve profitability.

IV. No organizational commitment to develop employees' technical skills.

A. I, III and IV only.

(c) HOCK international, page 4

Question 11 - CIA 1194 I.64 - Report to Senior Management & Board

A. Inform the chief audit executive.

Question 12 - CIA 1196 I.53 - Types of Engagements

A. Clean-up costs are reasonably estimated.

(c) HOCK international, page 5

corresponding expense on the income statement.

Question 13 - CIA 1184 I.14 - Types of Engagements

A. Analytical skills and tools are necessary in financial engagements.

Question 14 - CIA 1193 I.44 - Strategic Role of Internal Auditing

Question 15 - CIA 596 3.38 - Risk Management

(c) HOCK international, page 6

A. Monitoring for fraud or abuse during recovery.

Question 16 - CIA QZP1B.1 - Managing Resources

The following are good techniques for providing feedback:

I. Focusing on specific behaviors.

II. Keeping feedback personal.

IV. Making feedback well timed.

A. I, III and IV only.

Question 17 - CIA QZP1B.12 - Policies & Procedures

The written policies of an internal audit activity (IAA) should:

I. Define the scope and status of internal auditing.

(c) HOCK international, page 7

II. Contain the authority to carry out engagements.

A. Items I and II are contained in the IAA's charter.

C. Item I is contained in the IAA’s charter.

D. Items I and II are contained in the IAA’s charter.

Question 18 - CIA 1192 II.8 - Managing Resources

Question 19 - CIA 1195 1.24 - Types of Engagements

(c) HOCK international, page 8

Question 20 - HOCK CIA P2B H8 - Control Self-Assessment (CSA)

A. Facilitated team workshop.

B. Surveys or questionnaires tend to ask simple "Yes or No" questions.