Certified Internal Auditor Certified Internal Auditor MCQ 5 — Questions and Answers
Question 1: According to the IIA's Three Lines Model, which group is primarily responsible for managing risk on a day-to-day basis?
- The board and senior management (governing body)
- Internal audit (third line)
- Risk and compliance functions (second line)
- Operational management and staff (first line) (Correct answer)
Correct answer: Operational management and staff (first line)
The first line consists of operational management and staff who own and manage risks as part of their daily responsibilities.
Question 2: An auditor discovers that an organization consistently records revenue one day before shipment occurs to meet quarterly targets. Under GAAP, this is most likely a violation of which accounting principle?
- Conservatism
- Revenue recognition / matching principle (Correct answer)
- Full disclosure
- Consistency
Correct answer: Revenue recognition / matching principle
Under GAAP/ASC 606, revenue must be recognized when performance obligations are satisfied (delivery), not before shipment is complete.
Question 3: Which of the following statements about the internal audit charter is correct?
- The charter must be updated quarterly to reflect changes in audit scope
- The charter is approved by the CAE and does not require board approval
- The charter establishes the purpose, authority, and responsibility of the internal audit activity and must be approved by the board (Correct answer)
- The charter is a confidential document shared only within the audit department
Correct answer: The charter establishes the purpose, authority, and responsibility of the internal audit activity and must be approved by the board
The internal audit charter defines the purpose, authority, and responsibility of the function and must be approved by the board (or equivalent governing body).
Question 4: When conducting a data analytics procedure, an internal auditor sorts all transactions by amount from highest to lowest and reviews the top 10%. This is an example of which technique?
- Benford's Law analysis
- Gap testing
- Stratification (Correct answer)
- Duplicate testing
Correct answer: Stratification
Stratification involves dividing a population into subgroups (e.g., by amount) to focus testing on higher-risk segments.
Question 5: An organization has identified a risk but decided to take no action because the cost of the control exceeds the potential loss. This is an example of which risk response?
- Risk avoidance
- Risk sharing
- Risk acceptance (Correct answer)
- Risk reduction
Correct answer: Risk acceptance
Risk acceptance is the deliberate decision to retain a risk because the cost of mitigation outweighs the potential impact.
Question 6: During an engagement, an internal auditor finds that management's response to a reported finding is inadequate. According to IIA Standards, what should the auditor do?
- Close the finding since management has responded and move on
- Rewrite the finding to match management's proposed action
- Communicate the unresolved issue to senior management and the board if necessary (Correct answer)
- Wait until the next audit cycle to re-evaluate the finding
Correct answer: Communicate the unresolved issue to senior management and the board if necessary
When management's corrective action plan is inadequate, the CAE must escalate the unresolved matter to senior management and ultimately the board.
Question 7: Which of the following best describes 'professional skepticism' as it applies to internal auditors?
- Assuming all management representations are fraudulent until proven otherwise
- Maintaining a questioning mind and critically assessing evidence regardless of past relationships or prior audit results (Correct answer)
- Refusing to rely on any evidence that was not independently gathered by the auditor
- Limiting audit procedures to only those areas where fraud indicators exist
Correct answer: Maintaining a questioning mind and critically assessing evidence regardless of past relationships or prior audit results
Professional skepticism means maintaining a questioning mind and critically evaluating evidence rather than accepting representations at face value.
Certified Internal Auditor Certified Internal Auditor MCQ 5
According to the IIA's Three Lines Model, which group is primarily responsible for managing risk on a day-to-day basis?