CCB Internal Auditing & Control Systems 5 — Questions and Answers
Question 1: Which sampling method gives every item in the population an equal chance of being selected?
- Judgmental sampling
- Systematic sampling
- Random sampling (Correct answer)
- Haphazard sampling
Correct answer: Random sampling
Random sampling (also called probability sampling) ensures every item has an equal and known chance of selection, supporting statistically valid conclusions.
Question 2: A 'control gap' is BEST described as:
- A difference between budgeted and actual expenses
- A situation where no control exists or existing controls are insufficient to mitigate a risk (Correct answer)
- An unreconciled balance in the general ledger
- A finding noted in a prior audit that was corrected
Correct answer: A situation where no control exists or existing controls are insufficient to mitigate a risk
A control gap exists when the level of risk is not adequately addressed by existing controls, leaving the organization exposed to potential losses or misstatements.
Question 3: Under Sarbanes-Oxley Section 404, management is required to:
- Conduct annual external fraud investigations
- Assess and report on the effectiveness of internal controls over financial reporting (Correct answer)
- Rotate external auditors every three years
- Submit quarterly compliance certifications to the IIA
Correct answer: Assess and report on the effectiveness of internal controls over financial reporting
SOX Section 404 requires management to assess and report on the design and operating effectiveness of internal controls over financial reporting, with external auditor attestation.
Question 4: Which type of audit evidence is generally considered MOST reliable?
- Oral statements from management
- Internal documents prepared by the client
- External documents obtained directly from third parties (Correct answer)
- Copies of original source documents
Correct answer: External documents obtained directly from third parties
Evidence obtained directly from independent external sources (e.g., bank confirmations, attorney letters) is more reliable than internally generated documents.
Question 5: The purpose of an exit conference at the end of an internal audit is to:
- Present the final audit report to regulators
- Discuss findings and recommendations with management before the report is issued (Correct answer)
- Obtain management sign-off on audit working papers
- Archive audit documentation for future reference
Correct answer: Discuss findings and recommendations with management before the report is issued
The exit conference allows auditors to review draft findings with management, verify factual accuracy, and obtain preliminary management responses before the final report.
Question 6: Which control objective does a disaster recovery plan primarily address?
- Confidentiality of data
- Authorization of transactions
- Availability and continuity of operations (Correct answer)
- Accuracy of financial reporting
Correct answer: Availability and continuity of operations
Disaster recovery plans are designed to restore IT systems and operations quickly after a disruption, primarily addressing the availability objective.
Question 7: An auditor who reports functionally to the audit committee and administratively to the CFO BEST demonstrates:
- A conflict of interest that impairs independence
- The appropriate dual-reporting structure for internal audit independence (Correct answer)
- Non-compliance with IIA standards
- Over-reliance on management oversight
Correct answer: The appropriate dual-reporting structure for internal audit independence
IIA standards recommend that the chief audit executive report functionally to the board or audit committee (for independence) and administratively to senior management (for day-to-day operations).
CCB Internal Auditing & Control Systems 5
Which sampling method gives every item in the population an equal chance of being selected?