CIA Part 1 - Q25

25. Periodic external assessments of an internal audit activity's quality assurance and improvement program should be undertaken. On completion of such an assessment, a formal report or other communication should be issued expressing an opinion as to the 

a. Adequacy of internal control.

b. Effectiveness of the internal auditing coverage.

c. Conformance with the internal audit activity's charter.

d. Internal audit activity's compliance with the Standards.

25. Solution: d

a. Incorrect. External assessments express an opinion on the overall effectiveness of the quality program, not the adequacy of internal controls.

b. Incorrect. External assessments express an opinion on the overall effectiveness of the quality program, not the effectiveness of the internal auditing coverage.

c. Incorrect. External assessments express an opinion on the overall effectiveness of the quality program, not conforming to the IAA charter.

d. Correct. The external assessment should consist of a broad scope of coverage that includes conformance with the Definition of Internal Auditing; the Code of Ethics; and the Standards (PA 1312-1.10).

CIA Part 1 - Q24

24. Which of the following best describes an internal auditor’s purpose in reviewing the organization’s existing risk management, control and governance processes?

a. To help determine the nature, timing, and extent of tests necessary to achieve engagement objectives.

b. To ensure that weaknesses in the internal control system are corrected.

c. To provide reasonable assurance that the processes will enable the organization’s objectives and goals to be met efficiently and economically.

d. To determine whether the processes ensure that the accounting records are correct and that financial statements are fairly stated.

24. Solution: c
a. Incorrect. This is the purpose of the audit plan.

b. Incorrect. Correcting internal control weaknesses is the function of management, not a function of the internal auditor.

c. Correct. As described by the IIA, the internal auditors’ primary purpose in reviewing an organization’s existing risk management, control, and governance processes is to provide reasonable assurance that these processes are functioning as intended and will enable the organization’s objectives and goals to be met.

d. Incorrect. This is a basic objective from a financial accounting and auditing perspective, but is not broad enough to cover the internal auditor’s entire purpose for review.

CIA Part 1 - Q23

23. According to the Standards, the internal audit activity’s goals should specify

a. Policies and procedures to guide the internal audit staff.

b. Engagement work schedules and activities to be reviewed.

c. Measurement criteria and target dates for completion.

d. Staffing plans and financial budgets.

23. Solution: c

a. Incorrect. Goals are statements of activities that are to be accomplished. Policies and procedures are the means in which the goals are achieved.

b. Incorrect. Goals are statements of activities that are to be accomplished. Engagement work schedules are a means to achieve goals.

c. Correct. The goals of the IAA should be capable of being accomplished within specified operating plans and budgets and, to the extent possible, should be measurable. They should be accompanied by measurement criteria and targeted dates of accomplishment.

d. Incorrect. Staffing plans and financial budgets are a means of accomplishing specified goals.

CIA Part 1 - Q22

22. You were appointed the chief audit executive (CAE) of an organization one week ago. An engagement client has come to you complaining vigorously that one of your internal auditors is taking up an excessive amount of the client’s time on an engagement that seems to be lacking a clear purpose. In handling this conflict with the client, you should consider

a. Promising the client that you will have the internal auditor finish the work within 1 week.

b. Whether existing procedures within the internal audit activity provide for proper planning and quality assurance.

c. Presenting an immediate defense of the internal auditor based upon currently known facts.

d. Discounting what is said, but documenting the complaint.

22. Solution: b

a. Incorrect. Promising the client to have the internal auditor finish the work within one week without proper background information on the current engagement would jeopardize the authority of the CAE.

b. Correct. In this situation the CAE would have a responsibility to review the existing procedures to determine whether the IAA had provided for proper planning and quality assurance. Not doing so would jeopardize the authority of the CAE.

c. Incorrect. Presenting an immediate defense of the internal auditor could potentially harm future communications with the client. It also could jeopardize the authority of the CAE.

d. Incorrect. The CAE has a responsibility to review the existing procedures to determine whether the IAA had provided for proper planning and quality assurance. But, the CAE also has a responsibility not to discard potentially valid complaints.

CIA Part 1 - Q21

21. The Standards require that internal auditors possess which of the following skills?

I. Internal auditors should understand human relations and be skilled in dealing with people.

II. Internal auditors should be able to recognize and evaluate the materiality and significance of deviations from good business practices.

III. Internal auditors should be experts on subjects such as economics, commercial law, taxation, finance, and information technology.

IV. Internal auditors should be skilled in oral and written communication.

a. I and II only.

b. I, II and III only.

c. I, II, III and IV.

d. I, II and IV only.

21. Solution: d (I, II and IV)

I. Correct. Internal auditors need to understand human relations and be skilled in dealing with people.

II. Correct. Internal auditors need to be able to understand what constitutes materiality and significance of deviations from good business practice.

III. Incorrect. Internal auditors are not expected to be experts in a wide variety of fields related to their audit responsibilities.

IV. Correct. Internal auditors should be skilled in oral and written communication.

CIA Part 1 - Q20

20. Independence from outside pressure is an important factor for the internal audit activity (IAA) to work freely and objectively. Which of the following contributes to the internal auditor’s independence?

a. Management should assist the IAA by reviewing, revising and forwarding engagement communications to the audit committee.

b. The IAA reports directly to the audit committee, without corroborating engagement communications with management.

c. Ideally, the IAA functionally reports to the audit committee but reports to the chief operating officer on all engagements relating to operations.

d. The accuracy of the engagement communications should be verified with management, and the IAA should then report to management and the audit committee.

20. Solution: d

a. Incorrect. Engagement communications would go direct to the audit committee, not forwarded by management.

b. Incorrect. Engagements communications should also be communicated with management.

c. Incorrect. Ideally, the CAE would administratively report to the CEO or high enough officer to maintain independence, and functionally to the audit committee or some other appropriate governing board. Under the ideal situation, all engagement communications are sent to the audit committee as well.

d. Correct. Internal auditors should first discuss conclusions and recommendations with management so management is able to verify the accuracy of the engagement communications. Final engagement communications would then be sent to the audit committee.

CIA Part 1 - Q19

19. If a department outside of the internal audit activity (IAA) is responsible for reviewing a function or process, the internal auditor should

a. Consider the work of the other department when assessing the function or process.

b. Ignore the work of the other department and proceed with an independent audit.

c. Reduce the scope of the audit since the work has already been performed by the other department.

d. Yield the responsibility for assessing the function or process to the other department.

19. Solution: a

a. Correct. Review and testing of the other department’s procedures may reduce necessary audit coverage of the function or process.

b. Incorrect. Concentrating on the function or process might lead to a duplication of efforts.

c. Incorrect. The internal auditor cannot rely on the work of others without verifying the results.

d. Incorrect. The internal audit activity’s overall responsibility for assessing the function or process is not affected by the other department’s coverage.

CIA Part 1 - Q18

18. Internal auditors need have an understanding with respect to which discipline?

a. Internal auditing procedures and techniques.

b. Accounting principles and techniques.

c. Management principles.

d. Marketing techniques.

18. Solution: c

a. Incorrect. The internal auditor needs to be proficient in the auditing procedures and techniques.

b. Incorrect. The internal auditor needs to have an appreciation of accounting principles and techniques.

c. Correct. The internal auditor needs to have an understanding of management principles.

d. Incorrect. Internal auditors generally don’t need to be proficient, or have an understanding, or appreciation of, marketing techniques.

CIA Part 1 - Q17

17. During an internal audit, the internal auditor should exercise due professional care. Due professional care means that the internal auditor should consider

I. The extent of work needed to achieve the engagement’s objectives.

II. The relative complexity and materiality to which assurance procedures are applied.

III. The probability of significant errors, irregularities, or noncompliance.

IV. The engagement procedures necessary to ensure that all significant risks have been identified.

a. I and II only.

b. I, II and IV only.

c. I, II, III and IV.

d. I, II and III only.

17. Solution: d

a. Incorrect. Items I and II are correct.

b. Incorrect. Items I and II are correct. However, item IV is not correct. Engagement procedures, even exercised with due professional care, cannot guarantee that all significant risks will be identified.

c. Incorrect. Items I, II and III are correct. Item IV is not correct. Engagement procedures, even exercised with due professional care, cannot guarantee that all significant risks will be identified.

d. Correct. Only items I, II and III are correct. The internal auditor can only provide reasonable assurance that significant risks will be identified, not a guarantee.

CIA Part 1 - Q16

16. External assessment of an internal audit activity is not likely to evaluate

a. The tools and techniques employed by the internal audit activity.

b. Detailed cost-benefit analysis of the internal audit activity.

c. Compliance with the Standards for the International Professional Practice of Internal Auditing.

d. Adherence to the internal audit activity’s charter.

16. Solution: b

a. Incorrect. The tools and techniques employed by the IAA would be within the broad scope of coverage of the external assessment.

b. Correct. The external assessment should consist of a broad scope of coverage that includes: 

(1) Conformance with the Definition of Internal Auditing, Standards, The Code of Ethics and the internal audit activity’s charter, plans, policies, procedures, practices, and applicable legislative and regulatory requirements;

(2) the expectations of the IAA expressed by the board, executive management and operational managers; 

(3) the integration of the IAA into the organization’s governance process, including the relationships between and among the key groups involved in the process; 

(4) tools and techniques employed by the IAA; (5) the mix of knowledge, experience, and disciplines within the staff, including staff focus on process improvement; and (6) the determination as to whether or not the IAA adds value and improves the organization’s operations (PA 1312- 1.10). A detailed cost-benefit analysis of the IAA would not be part of the external assessment.

c. Incorrect. Compliance of the Standards for the International Professional Practice of Internal Auditing is within the broad scope of coverage of the external assessment. 

d. Incorrect. Adherence with the IAA’s charter is within the broad scope of coverage of the external assessment.

CIA Part 1 - Q15

15. During an engagement to evaluate the organization’s accounts payable function, an internal auditor plans to confirm balances with suppliers. What is the source of authority for such contacts with units outside the organization?

a. Internal audit activity policies and procedures.

b. The Standards.

c. The Code of Ethics.

d. The internal audit activity’s charter.

15. Solution: d

a. Incorrect. Policies and procedures provide guidance, but will not be the source of authority.

b. Incorrect. The authority of the internal audit activity is detailed in the charter and approved by the board.

c. Incorrect. The Code of Ethics is the means of promoting an ethical culture in the internal auditing profession.

d. Correct. The purpose, authority and responsibility of the internal audit activity should be defined in the charter. The charter should establish the internal audit activity’s position within the organization; authorize access to records, personnel, and physical properties relevant to the performance of engagements; and define the scope of internal audit activities (PA 1000-1).

CIA Part 1 - Q14

14. Quality program assessments may be performed internally or externally. A distinguishing feature of an external assessment is its objective to:

a. Provide independent assurance.

b. Set forth the recommendations for improvement.

c. Determine whether internal auditing services meet professional standards.

d. Identify tasks that can be performed better.

14. Solution: a

a. Correct. External assessments of an IAA should appraise and express an opinion as to the IAA’s compliance with the Standards for the International Professional Practice of Internal Auditing and, as appropriate, should include recommendations for improvement. External assessment should be conducted at least once every five years (PA 1312-1).

b. Incorrect. It will be the internal assessment that will provide recommendations for improvement.

c. Incorrect. It will be the internal assessment that will determine whether internal auditing services meet professional standards.

d. Incorrect. It will be the internal assessment that will identify tasks that can be performed better.

CIA Part 1 - Q13

13. The best means for the internal auditing activity (IAA) to determine whether its goal of implementing broader audit coverage of functional activities has been met is through

a. Accumulation of audit findings by auditable area.

b. Comparison of the audit plan to actual audit activity.

c. Surveys of management satisfaction with the internal audit activity.

d. Implementation of a quality assurance and improvement program.

13. Solution: d

a. Incorrect. This will not help the CAE understand whether any specific IAA goal is being met.

b. Incorrect. Comparing the audit plan with actual audit activity will not tell the CAE whether the IAA’s broader audit coverage goals are being met.

c. Incorrect. Surveys of management satisfaction will only tell the IAA how management feels about the services provided by the IAA and not whether any specific IAA goal is being accomplished.

d. Correct. Implementing a quality assurance and improvement program (QAIP) can assist the CAE in determining whether the IAA’s audit coverage goals are being met. The QAIP evaluates and analyzes the effectiveness and efficiency of IAA operations, which has to do with understanding whether stated IAA goals and objectives are being achieved.

CIA Part 1 - Q12

12. The Standards require that the chief audit executive (CAE) seek the approval of management and the board of a formal, written internal audit charter. The purpose of the internal audit charter is to

a. Protect the internal auditing activity from outside influence.

b. Establish the purpose, authority, and responsibility of the internal auditing activity.

c. Define the internal auditor’s relationship with the external auditor.

d. Define the role of the chief audit executive as a member of the audit committee.

12. Solution: b

a. Incorrect. The IAA charter does not protect the IAA from outside influence.

b. Correct. The purpose, authority and responsibility of the IAA must be formally defined in the charter.

c. Incorrect. The IAA charter does not define the relationship between the internal and external auditors.

d. Incorrect. The CAE should not, under any circumstance, be a member of the audit committee.

CIA Part 1 - Q11

11. One of the purposes of the Standards for the International Professional Practice of Internal Auditing as stated in the Introduction to the current version of the Standards is to

a. Encourage the professionalization of internal auditing.

b. Establish the independence of the internal audit activity and emphasize the objectivity of internal auditing.

c. Encourage external auditors to make more extensive use of the work of internal auditors.

d. Establish the basis for evaluating internal auditing performance.

11. Solution: d

a. Incorrect. The professionalization of internal auditing is important, but it is not one of the purposes of the Standards.

b. Incorrect. Independence and objectivity are aspects of the internal audit activity, but not one of the purposes of the Standards.

c. Incorrect. This is not one of the purposes of the Standards.

d. Correct. 

According to the IIA, the Standards are intended to: 

(1) State basic principles for the practice of internal auditing; 

(2) Provide a framework for performing and promoting value added internal audit activities; 

(3) Establish the basis for evaluating internal auditing performance; and 

(4) Improve organizational processes and operations.

CIA Part 1 - Q10

10. Independence is most likely impaired by an internal auditor’s

a. Continuation on an engagement at a division for which (s)he will soon be responsible as the result of a

promotion.

b. Reduction of the scope of an engagement due to budget restrictions.

c. Participation on a task force that recommends standards for control of a new distribution system.

d. Review of a purchasing agent’s contract drafts prior to their execution.

10. Solution: a

a. Correct. When the IAA or individual internal auditor is responsible for, or management is considering assigning, an operation that it might audit, the internal auditor’s independence and objectivity may be impaired.

b. Incorrect. Budget restrictions do not constitute impairment of an engagement.

c. Incorrect. It is acceptable for the internal auditor to recommend standards of control, but the internal auditor is not able to design, install or draft procedures. These functions may impair the internal auditor’s objectivity.

d. Incorrect. It is acceptable for the internal auditor to review contracts prior to their execution.