Certified Internal Auditor Certified Internal Auditor 2 — Questions and Answers
Question 1: Which of the following best describes the concept of 'reasonable assurance' in internal auditing?
- Absolute certainty that all risks have been eliminated
- A high level of confidence that objectives are being met, though not a guarantee (Correct answer)
- Assurance provided only on financial controls
- Confirmation that no fraud exists within the organization
Correct answer: A high level of confidence that objectives are being met, though not a guarantee
Reasonable assurance is a high but not absolute level of confidence that controls are functioning and objectives are being achieved.
Question 2: An internal audit activity uses a risk-based audit plan. Which element is MOST critical when determining the audit universe?
- Number of available audit staff
- The organization's risk appetite and strategic objectives (Correct answer)
- Prior audit findings only
- External auditor recommendations
Correct answer: The organization's risk appetite and strategic objectives
A risk-based audit plan aligns the audit universe with the organization's risk appetite and strategic objectives to prioritize high-risk areas.
Question 3: When an internal auditor identifies a control deficiency that management chooses to accept rather than remediate, the auditor should:
- Remove the finding from the audit report
- Escalate the issue directly to external regulators
- Document management's risk acceptance decision in the audit report (Correct answer)
- Resign from the engagement
Correct answer: Document management's risk acceptance decision in the audit report
When management accepts risk without remediation, the auditor must document this decision in the final audit communication.
Question 4: The IIA's International Professional Practices Framework (IPPF) is BEST described as:
- A mandatory set of laws governing internal audit globally
- A conceptual framework including mandatory guidance and recommended guidance (Correct answer)
- A framework applicable only to publicly traded companies
- A collection of best practices from external auditing standards
Correct answer: A conceptual framework including mandatory guidance and recommended guidance
The IPPF consists of mandatory guidance (Core Principles, Standards, Code of Ethics) and recommended guidance (Implementation Guidance, Supplemental Guidance).
Question 5: An auditor is reviewing a company's segregation of duties in accounts payable. Which finding represents the GREATEST control risk?
- One person approves vendor invoices and reconciles the accounts payable ledger (Correct answer)
- The CFO reviews all payments over $50,000
- Vendor master file changes require dual approval
- Payments are processed through an automated ERP system
Correct answer: One person approves vendor invoices and reconciles the accounts payable ledger
Combining invoice approval and ledger reconciliation in one person eliminates a key detective control and creates significant fraud risk.
Question 6: Which type of audit engagement focuses on whether an organization's activities comply with applicable laws, regulations, and policies?
- Operational audit
- Financial audit
- Compliance audit (Correct answer)
- IT audit
Correct answer: Compliance audit
A compliance audit evaluates the extent to which the organization adheres to laws, regulations, and internal policies.
Question 7: According to IIA Standards, the chief audit executive (CAE) must communicate the internal audit activity's independence to whom?
- Only to senior management
- Only to the external auditors
- To senior management and the board (Correct answer)
- To regulators and shareholders only
Correct answer: To senior management and the board
The CAE must confirm to senior management and the board at least annually that the internal audit activity is independent.
Certified Internal Auditor Certified Internal Auditor 2
Which of the following best describes the concept of 'reasonable assurance' in internal auditing?