Certified Internal Auditor Certified Internal Auditor MCQ 3 — Questions and Answers
Question 1: An internal auditor is assessing a company's enterprise risk management (ERM) program. According to COSO ERM, which component focuses on an organization's risk appetite and strategy?
- Control Activities
- Strategy and Objective-Setting (Correct answer)
- Information, Communication, and Reporting
- Review and Revision
Correct answer: Strategy and Objective-Setting
The Strategy and Objective-Setting component of COSO ERM is where risk appetite is established and aligned with strategy.
Question 2: Which of the following is NOT a characteristic of a well-written audit observation (finding)?
- Criteria — the standard or benchmark used to evaluate
- Condition — what was found during the audit
- Cause — the reason the condition exists
- Cost — the budget allocated for remediation (Correct answer)
Correct answer: Cost — the budget allocated for remediation
The standard elements of an audit finding are criteria, condition, cause, and effect/risk — not the remediation budget.
Question 3: An auditor uses regression analysis during an engagement. This is an example of which type of audit procedure?
- Substantive testing
- Analytical procedure (Correct answer)
- Walk-through procedure
- Compliance testing
Correct answer: Analytical procedure
Regression analysis is an analytical procedure used to identify relationships and unusual variations in data.
Question 4: Under the IIA Code of Ethics, which principle requires internal auditors to perform their work with honesty, diligence, and responsibility?
- Independence
- Objectivity
- Integrity (Correct answer)
- Confidentiality
Correct answer: Integrity
The Integrity principle requires auditors to perform their work honestly, diligently, and responsibly.
Question 5: During a payroll audit, an auditor wants to verify that all employees on the payroll actually exist. Which audit procedure is most appropriate?
- Vouching payroll disbursements to vendor invoices
- Comparing payroll totals to the prior period budget
- Physically observing a payroll distribution or confirming employee identities with HR records (Correct answer)
- Recalculating gross-to-net pay for a sample of employees
Correct answer: Physically observing a payroll distribution or confirming employee identities with HR records
Physical observation or HR confirmation directly tests whether payroll employees are real, addressing ghost-employee fraud risk.
Question 6: Which of the following best describes 'residual risk'?
- The risk that remains after management has implemented controls to mitigate inherent risk (Correct answer)
- The total exposure before any controls are applied
- The risk transferred to a third party through insurance or outsourcing
- The risk identified during the annual risk assessment but not yet assigned to an owner
Correct answer: The risk that remains after management has implemented controls to mitigate inherent risk
Residual risk is what remains after controls are applied to reduce inherent (gross) risk.
Question 7: An internal audit engagement is planned for an area with high inherent risk and weak controls. How should this affect the engagement approach?
- Reduce the sample size to finish faster and escalate findings quickly
- Expand the scope and increase testing depth to obtain sufficient evidence (Correct answer)
- Limit procedures to inquiry and observation to avoid disturbing operations
- Defer the engagement to the next audit cycle when controls may improve
Correct answer: Expand the scope and increase testing depth to obtain sufficient evidence
High inherent risk combined with weak controls requires expanded scope and more rigorous testing to gather sufficient, reliable evidence.
Certified Internal Auditor Certified Internal Auditor MCQ 3
An internal auditor is assessing a company's enterprise risk management (ERM) program.
According to COSO ERM, which component focuses on an organization's risk appetite and strategy?