Case Studies & Practical Application Flashcards
7 cards from real Certified Internal Auditor practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Case Studies & Practical Application flashcards as text
An internal auditor discovers that a regional manager has been approving vendor invoices that exceed her authorization limit by routing them through a subordinate with higher limits. What should the auditor do first?
Answer: Document the finding and assess whether it constitutes a control override requiring escalation
The auditor should document the control override finding and evaluate its significance before determining the appropriate escalation path per IIA standards.
During a procurement audit, an auditor finds that 80% of purchase orders over $50,000 were awarded to a single vendor without competitive bidding. Management states the vendor provides unique services. What is the auditor's most appropriate response?
Answer: Verify whether the sole-source justifications were documented and approved per policy
The auditor should verify whether required sole-source documentation and approvals exist rather than accepting an undocumented verbal explanation.
A company's IT general controls audit reveals that privileged user access reviews are performed annually. Industry best practice recommends quarterly reviews. How should the auditor classify this finding?
Answer: A control gap with risk rated based on the sensitivity of systems and data accessed
The severity of a control gap should be assessed based on actual risk exposure, not simply deviation from best practice.
An auditor is reviewing expense reimbursements and notices that a senior executive submitted $12,000 in meal receipts over three months, all just below the $500 per-event threshold requiring additional approval. What fraud scheme does this pattern suggest?
Answer: Structuring (threshold avoidance)
Consistently submitting expenses just below approval thresholds is a classic structuring scheme designed to avoid control triggers.
During a payroll audit, the auditor finds 15 employees whose direct deposit accounts were changed in the two weeks before payroll processing, with no corresponding HR change requests. What is the most likely risk indicated?
Answer: Unauthorized redirection of payroll funds, possibly via compromised credentials
Bank account changes without HR authorization are a strong indicator of payroll fraud through unauthorized account redirection.
An auditor is testing controls over financial statement close. She finds that journal entries posted after period-end cutoff lack supporting documentation 40% of the time. Management says this is due to time pressure. What is the primary audit concern?
Answer: Risk of unsupported or fraudulent manual journal entries manipulating reported results
Unsupported post-close journal entries represent a high risk for earnings manipulation and are a key fraud indicator in financial reporting audits.
A healthcare organization's auditor reviews patient billing and finds that claims for a specific procedure code increased 300% in one quarter with no corresponding increase in patient volume. What should the auditor do?
Answer: Investigate whether the code is being upcoded or applied to ineligible services
A dramatic increase in a specific billing code without corresponding patient volume growth is a red flag for upcoding fraud requiring immediate investigation.