Certified Internal Auditor Case Studies & Practical Application 2

Question 1

An internal auditor discovers that a regional manager has been approving vendor invoices that exceed her authorization limit by routing them through a subordinate with higher limits. What should the auditor do first?

Accepted Answer

Document the finding and assess whether it constitutes a control override requiring escalation

Answer

The auditor should document the control override finding and evaluate its significance before determining the appropriate escalation path per IIA standards.

Question 2

During a procurement audit, an auditor finds that 80% of purchase orders over $50,000 were awarded to a single vendor without competitive bidding. Management states the vendor provides unique services. What is the auditor's most appropriate response?

Accepted Answer

Verify whether the sole-source justifications were documented and approved per policy

Answer

The auditor should verify whether required sole-source documentation and approvals exist rather than accepting an undocumented verbal explanation.

Question 3

A company's IT general controls audit reveals that privileged user access reviews are performed annually. Industry best practice recommends quarterly reviews. How should the auditor classify this finding?

Accepted Answer

A control gap with risk rated based on the sensitivity of systems and data accessed

Answer

The severity of a control gap should be assessed based on actual risk exposure, not simply deviation from best practice.

Question 4

An auditor is reviewing expense reimbursements and notices that a senior executive submitted $12,000 in meal receipts over three months, all just below the $500 per-event threshold requiring additional approval. What fraud scheme does this pattern suggest?

Accepted Answer

Structuring (threshold avoidance)

Answer

Consistently submitting expenses just below approval thresholds is a classic structuring scheme designed to avoid control triggers.

Question 5

During a payroll audit, the auditor finds 15 employees whose direct deposit accounts were changed in the two weeks before payroll processing, with no corresponding HR change requests. What is the most likely risk indicated?

Accepted Answer

Unauthorized redirection of payroll funds, possibly via compromised credentials

Answer

Bank account changes without HR authorization are a strong indicator of payroll fraud through unauthorized account redirection.

Certified Internal Auditor Practice Test

Certified Internal Auditor Practice Test

Certified Internal Auditor Case Studies & Practical Application 2