CA Audit & Risk Management 3 — Questions and Answers
Question 1: Under ISA 240, which of the following is the PRIMARY responsibility for the prevention and detection of fraud?
- External auditors
- Internal auditors
- Management and those charged with governance (Correct answer)
- Regulatory authorities
Correct answer: Management and those charged with governance
ISA 240 states that management bears primary responsibility for preventing and detecting fraud, while auditors must maintain professional skepticism and assess fraud risks.
Question 2: Which risk response strategy involves accepting the potential impact of a risk without taking action to reduce it?
- Risk avoidance
- Risk transfer
- Risk reduction
- Risk retention (Correct answer)
Correct answer: Risk retention
Risk retention (acceptance) means an organization consciously decides to bear the financial consequence of a risk, often because the cost of mitigation exceeds the expected loss.
Question 3: When assessing going concern under ISA 570, which period must management evaluate?
- At least 12 months from the balance sheet date
- At least 12 months from the date the financial statements are authorized for issue (Correct answer)
- 24 months from the balance sheet date
- The full economic life of the entity's major assets
Correct answer: At least 12 months from the date the financial statements are authorized for issue
ISA 570 requires management to assess going concern for a period of at least 12 months from the date the financial statements are authorized for issue, not just from the balance sheet date.
Question 4: The 'three lines of defense' model in risk governance places internal audit in which position?
- First line — operational management
- Second line — risk management and compliance functions
- Third line — independent assurance to the board and senior management (Correct answer)
- Fourth line — external audit and regulatory oversight
Correct answer: Third line — independent assurance to the board and senior management
Internal audit constitutes the third line of defense, providing independent assurance to the board and senior management on the effectiveness of governance, risk management, and internal controls.
Question 5: An external auditor discovers that a key audit team member has a direct financial interest in the audit client. The appropriate action is to:
- Disclose the interest in the audit report footnotes
- Remove the team member from the engagement to eliminate the independence threat (Correct answer)
- Obtain client management approval to continue with enhanced safeguards
- Reduce the audit scope to compensate for the bias risk
Correct answer: Remove the team member from the engagement to eliminate the independence threat
A direct financial interest in an audit client creates a self-interest threat to independence that cannot be mitigated by safeguards; the team member must be removed from the engagement.
Question 6: Key Risk Indicators (KRIs) are BEST described as:
- Metrics used to measure the financial performance of a business unit
- Forward-looking metrics that signal changes in an organization's risk profile (Correct answer)
- Historical measures of losses from past risk events
- Compliance checklists used by internal auditors during field work
Correct answer: Forward-looking metrics that signal changes in an organization's risk profile
KRIs are forward-looking metrics that provide early warning signals about increasing risk exposures, enabling proactive risk management before losses occur.
Question 7: Which audit procedure provides the MOST reliable evidence when verifying the existence of accounts receivable?
- Reviewing the aged accounts receivable listing prepared by management
- Recalculating interest on overdue balances
- Sending positive confirmation requests directly to the customers (Correct answer)
- Inspecting the sales contracts retained in the client's files
Correct answer: Sending positive confirmation requests directly to the customers
Positive confirmations, which require the recipient to respond whether they agree or disagree with the stated balance, provide highly reliable third-party evidence of the existence of receivables.
CA Audit & Risk Management 3
Under ISA 240, which of the following is the PRIMARY responsibility for the prevention and detection of fraud?