Certified Internal Auditor Certified Internal Auditor 3 — Questions and Answers
Question 1: During an audit, an internal auditor discovers that a senior manager is circumventing established controls. The auditor should FIRST:
- Immediately report the finding to external regulators
- Confront the manager directly and demand an explanation
- Inform the chief audit executive and consider escalation to the audit committee (Correct answer)
- Close the engagement without reporting to avoid conflict
Correct answer: Inform the chief audit executive and consider escalation to the audit committee
The auditor should escalate findings involving senior management misconduct to the CAE, who may then communicate with the audit committee.
Question 2: The concept of 'due professional care' in internal auditing requires auditors to:
- Guarantee detection of all fraud and errors
- Apply the skill and diligence of a reasonably prudent auditor (Correct answer)
- Obtain a professional certification before performing any audit
- Conduct every audit using forensic investigation techniques
Correct answer: Apply the skill and diligence of a reasonably prudent auditor
Due professional care means applying the skill and diligence expected of a reasonably prudent and competent internal auditor.
Question 3: Which sampling method gives every item in a population an equal chance of selection and is considered the purest form of statistical sampling?
- Systematic sampling
- Stratified sampling
- Simple random sampling (Correct answer)
- Judgment sampling
Correct answer: Simple random sampling
Simple random sampling gives each item an equal probability of selection, making it the purest statistical sampling technique.
Question 4: An internal audit function's organizational independence is BEST supported by:
- Reporting administratively to the CFO and functionally to the audit committee (Correct answer)
- Reporting both administratively and functionally to the CEO
- Having the CAE appointed by the internal audit staff
- Operating within the finance department under the controller
Correct answer: Reporting administratively to the CFO and functionally to the audit committee
Dual reporting — administratively to senior management and functionally to the audit committee — provides optimal organizational independence.
Question 5: A control that prevents errors or irregularities from occurring is BEST classified as:
- Detective control
- Corrective control
- Compensating control
- Preventive control (Correct answer)
Correct answer: Preventive control
Preventive controls are designed to stop errors or irregularities before they occur, as opposed to detecting or correcting them after the fact.
Question 6: When assessing the adequacy of a sample size for a test of controls, an auditor should consider:
- The age of the transactions being tested
- The tolerable deviation rate and expected population deviation rate (Correct answer)
- Only the total dollar value of the population
- The number of external auditors on the engagement
Correct answer: The tolerable deviation rate and expected population deviation rate
Sample size for tests of controls is influenced by the tolerable deviation rate and the auditor's expectation of errors in the population.
Question 7: Which COSO component addresses an organization's shared values, ethical standards, and the 'tone at the top'?
- Risk Assessment
- Control Activities
- Information and Communication
- Control Environment (Correct answer)
Correct answer: Control Environment
The Control Environment is the foundation of COSO's internal control framework, encompassing organizational culture, ethics, and management's commitment to integrity.
Certified Internal Auditor Certified Internal Auditor 3
During an audit, an internal auditor discovers that a senior manager is circumventing established controls.
The auditor should FIRST: