Question 1

Senior IT management requests the internal audit activity to perform an audit of a complex IT area. The chief audit executive (CAE) knows that the internal audit activity lacks the expertise to perform the engagement. Which of the following is the most appropriate action for the CAE to take?

Options :

A :

Decline the audit engagement, because the Standards prohibit internal auditors from performing engagements where they lack the necessary competencies.

B :

Accept the audit engagement and use the engagement as an opportunity to develop the audit team-s IT expertise while performing the audit work.

C :

Temporarily hire an experienced and knowledgeable IT analyst from the organization-s IT department to lead the audit.

D : Outsource the audit engagement to a reputable IT audit consulting firm.

Answer: D

Question 2

Which of the following recommendations made by the internal audit activity (IAA) is most likely to help prevent fraud?

Options :

A :

A review of password policy compliance found that employees frequently use the same password more than once during a year. The IAA recommends that the access control software reject any password used more than once during a 12-month period.

B :

A review of internal service-level agreement compliance in financial services found that requests for information frequently are fulfilled up to two weeks late. The IAA recommends that the financial services unit be eliminated for its ineffectiveness.

C :

A vacation policy compliance review found that employees frequently leave on vacation before their leave applications are signed by their manager. The IAA recommends that the manager attend to the leave applications in a more timely fashion.

D :

A review of customer service-level agreements found that orders to several customers are frequently delivered late. The IAA recommends that the organization extend the expected delivery time advertised on its website.

Answer: A

Question 3

An internal auditor is conducting an initial risk assessment of an audit area and wants to assess management's compliance with privacy laws for safeguarding customer information stored on the organization's servers. Which course of action is appropriate for this phase of the engagement?

Options :

A : Solicit the services of a specialist information systems auditor

B : Obtain the most current approved copies of the organization-s privacy policy

C : Consult with legal counsel about new privacy laws to establish appropriate criteria

D : Consider the detection risk of noncompliance with the laws

Answer: B

Question 4

An internal auditor plans to conduct a walk-through to evaluate the control design of a process. Which of the following techniques is the auditor most likely to use?

Options :

A : Observation and inspection.

B : Inquiry and observation.

C : Inspection and reperformance.

D : Inquiry and reperformance.

Answer: B

Question 5

According to IIA guidance, which of the following is true when the internal audit activity is asked to investigate potential ethics violations in a foreign subsidiary?

Options :

A :

Communication of any internal ethics violations to external parties may occur with appropriate safeguards.

B : Cultural impacts are less critical where the organization practices uniform polices around the globe.

C : Cross-cultural differences should always be handled by the staff of the same cultural background.

D : Local law enforcement should be involved as they are more familiar with the applicable local laws.

Answer: A

Confidently Practice Online with Free IIA-CIA-Part2 Exam Cram

Buying Options: