Question 1

Senior IT management requests the internal audit activity to perform an audit of a complex IT area. The chief audit executive (CAE) knows that the internal audit activity lacks the expertise to perform the engagement. Which of the following is the most appropriate action for the CAE to take?

Options :

A :

Decline the audit engagement, because the Standards prohibit internal auditors from performing engagements where they lack the necessary competencies.

B :

Accept the audit engagement and use the engagement as an opportunity to develop the audit team-s IT expertise while performing the audit work.

C :

Temporarily hire an experienced and knowledgeable IT analyst from the organization-s IT department to lead the audit.

D : Outsource the audit engagement to a reputable IT audit consulting firm.

Answer: D

Question 2

An internal auditor used a risk and control matrix to prepare a work program for testing a software release.

During the engagement planning stage, he tested the design of

the release procedure as a key control and concluded that the control was not designed well. During the

performance stage, he tested the operation of this control and

concluded that it was implemented as designed. Which of the following statements is true regarding this

scenario?

Options :

A : The test of the control design should have occurred at the performance stage.

B : The test of the operating effectiveness of the control was not necessary.

C : A risk and control matrix is not appropriate for this type of engagement.

D : The test of the operating effectiveness of the control should have occurred at the planning stage.

Answer: B

Question 3

During a review of the treasury function an internal auditor identified a risk that all bank accounts may net to include in the daily reconciliation process. Which of the following responses would be most effective to mitigate this risk?

Options :

A :

The treasury supervisor establishes a threshold for amounts on bank statements to be reconciled against data in the system

B :

The treasury analyst performs a daily reconciliation of al bank statements obtained via email against data in the system

C :

The treasury analyst reviews a daily report automatically generated by the treasury system, which shows bank statements that have not been uploaded into the accounting system.

D :

The treasury supervisor seeks an annual confirmation from the bank regarding the bank statements processed within a year

Answer: C

Question 4

An internal auditor is assessing the organization's risk management framework. Which of the following formulas should he use to calculate the residual risk?

Options :

A :

B :

C :

D :

Answer: C

Question 5

What is the primary reason that audit supervision includes approval of the engagement report?

Confidently Practice Online with Free IIA-CIA-Part2 Exam Cram

Buying Options: