Certified Internal Auditor Case Studies & Practical Application 5

Question 1

An auditor finds that a nonprofit organization's board approved a $500,000 grant to a charity where the executive director serves as a board member, with no conflict of interest disclosure on record. What is the primary issue?

Accepted Answer

An undisclosed conflict of interest that may violate the organization's governance policies and state nonprofit law

Answer

Failure to disclose and manage a board member's conflict of interest in grant decisions violates fiduciary duty and may constitute self-dealing under nonprofit law.

Question 2

During an operational audit of a hospital's medication dispensing, the auditor finds that controlled substances dispensed exceed physician orders by 12% at one unit. What should the auditor prioritize?

Accepted Answer

Investigating whether the discrepancy indicates diversion of controlled substances by staff

Answer

A consistent excess of controlled substances dispensed over physician orders is a primary indicator of drug diversion, a serious patient safety and legal issue.

Question 3

An auditor reviewing a company's third-party risk management program finds that 40% of critical vendors have never been assessed for financial stability or operational resilience. What is the correct audit conclusion?

Accepted Answer

A material gap in vendor risk oversight that exposes the organization to unmitigated concentration and operational risks

Answer

Unassessed critical vendors represent unmitigated risks to the organization's operations and financial condition that the TPRM program should be capturing.

Question 4

An auditor is presenting a draft audit report to management. Management disputes a finding, arguing that the auditor misunderstood the control. After reviewing management's evidence, the auditor concludes the finding is valid. What is the appropriate action?

Accepted Answer

Retain the finding but accurately reflect management's response and disagreement in the report

Answer

IIA standards require that audit reports reflect the auditor's objective conclusions while also including management's responses, including disagreements.

Question 5

A company implements a new ERP system and the internal audit team is asked to assess implementation controls. The auditor finds that parallel testing was skipped due to go-live timeline pressure. What risk does this create?

Accepted Answer

Data migration errors and system configuration issues may not be detected before the system goes live, compromising data integrity

Answer

Skipping parallel testing removes the primary detective control for identifying data migration errors and misconfigured processes before they affect production operations.

Certified Internal Auditor Practice Test

Certified Internal Auditor Practice Test

Certified Internal Auditor Case Studies & Practical Application 5