A company's chief audit executive determines that the internal audit staff does not have the
requisite skills to conduct an audit of the financial derivatives area. Which of the following
actions would be the least acceptable?

A.

Notify the audit committee of the problem and consult with them regarding outsourcing
the audit engagement to a qualified external auditing firm.

B.

Determine the requisite knowledge needed and obtain the proper training for auditors if
such training is available within the appropriate time framework outlined by the audit
committee.

C.

Notify the audit committee of the problem and assign the most competent auditors to
perform the audit engagement.

D.

Employ the skills of a financial derivatives expert to consult on the project,and
supplement the consulting with a local seminar on financial derivatives.

An internal auditor has taken an attributes sample of a bank's existing loan portfolio. Out of
a sample of 60 loans,the auditorfound:
Four that were not properly collateralized.
Five that were not in compliance with bank policies (other than lack of
collateralization).
Four that were part of a related-party group,but were set up as separate loan
entities.
Of the 60 loans selected in the sample,these errors were noted on a total of 10
loans.
Several loans had multiple problems.
Which of the following conclusions can the auditor reach from these observations?
1.There is sufficient evidence that fraudulent activity is taking place by one or more of the
bank's lending officers.
2.The financial statements will be misstated as a result of these actions.
3.There are significant noncompliance audit findings that should be reported.

A.

3only

B.

1 and 2only

C.

1 and 3only

D.

2 and 3only

According to the Standards,a review team must express an opinion on which of the
following when performing an external assessment of an internal audit activity?
1.Conformance with the Standards and IIA Code of Ethics.
2.Effectiveness of continuous improvement activities.
3.Feedback from internal audit customers and other stakeholder groups.
4.Efficiency and effectiveness of the internal audit activity's administration processes.

A.

1only

B.

3only

C.

1 and 2only

D.

2 and 4only

Which of the following statements is correct with regard to risk management?

A.

The board's responsibility for risk management cannot be assigned to a board
committee,such as a board risk committee.

B.

The chief audit executive is accountable to the board for designing,implementing and
monitoring the risk management process.

C.

The total process of risk management,which includes a related system of internal
control,is the responsibility of the board.

D.

The finance director is responsible for the overall implementation of the risk
management process.

Some of an organization's payroll transactions were batch posted to the payroll file but
were not uploaded correctly to the general ledger file on the mainframe. The best control to
detect this type of error would be:

A.

Edit controls on the payroll file.

B.

Appropriate segregation of duties for batch approval.

C.

Validation of hash totals.

D.

Reconciliation of paychecks to the bank account.

Which of the following would most likely function as a detective control?

A.

Security dogs.

B.

Alert employees.

C.

Insurance claims.

D.

Cycle counts.

Which of the following would be the best example of a monitoring control for a chain of
restaurants?

A.

Each restaurant manager reconciles the cash received with the food orders recorded on
the computer.

B.

All food orders must be entered through the computer,and there is segregation of duties
between the food servers and the cooks.

C.

Corporate management prepares a detailed analysis of gross margin per restaurant and
investigates those showing a significantly lower gross margin.

D.

Proof of bank deposit is transmitted to corporate headquarters on a daily basis.

To develop greater internal auditing expertise,the chief audit executive (CAE) has been
assigning the same relatively inexperienced team of internal auditors to a series of
engagements spanning several months. Is this practice consistent with the Standards?

A.

Yes. The CAE is promoting the professional development of the staff.

B.

Yes. The experience will quickly build specialized skills and competencies.

C.

No. The team should collectively possess the competencies appropriate for the
engagements.

D.

No. Teams should be comprised of both experienced and inexperienced auditors.

Which of the following is considered a common red flag indicator in helping to uncover
fraud?

A.

Improper segregation of duties.

B.

Repeated poor performance.

C.

Termination from previous employer.

D.

Experiencing financial difficulty.

Which of the following processes or tools can be used as ongoing internal assessments of
the performance of the internal audit activity?
1.Analyses of audit plan completion and cost recoveries.
2.Selective peer reviews of work papers by staff involved in the respective audits.
3.Self-assessment of the internal audit activity with on-site validation by a qualified
independent reviewer.
4.Feedback from audit customers and stakeholders.

A.

1 only

B.

1 and 2 only

C.

3 and 4 only

D.

1,2,and 4 only

A production division received 45 responses to a customer-service survey distributed to
100 purchasing departments randomly selected from all customers who made purchases in
the prior 12 months. Which of the following is the most likely reason that the division
manager would be concerned about nonresponse bias in this situation?

A.

The sample means and standard errors are more difficult to compute.

B.

Those who did not respond may be systematically different from those who did.

C.

The sample size is too small.

D.

Confidence intervals are narrower.

An internal auditor pays to participate in the company's annual golf tournament,which is
held outside of normal business hours.
The auditor wins the putting contest and is awarded an all-expense-paid weekend vacation.
According to the IIA Code of Ethics regarding objectivity,the auditor's best course of action
would be to:

A.

Refuse the prize because the amount is significant.

B.

Accept the prize because the event was held outside of normal business hours.

C.

Refuse the prize because it represents an impairment to objectivity.

D.

Accept the prize because the auditor received no special treatment.