Certified Internal Auditor (IIA) 4 — Questions and Answers
Question 1: When the internal audit activity conforms with the IIA Standards, the CAE may state conformance in external communications:
- Only after receiving approval from the external auditors
- Only if a favorable external quality assessment has been completed within the past five years (Correct answer)
- At any time the CAE deems appropriate
- Only if the board approves the statement
Correct answer: Only if a favorable external quality assessment has been completed within the past five years
The IIA Standards require that conformance can only be stated publicly when supported by a favorable external quality assessment conducted within the past five years.
Question 2: Which governance body does the CAE primarily report functionally to?
- Chief Financial Officer
- Chief Executive Officer
- The Board or Audit Committee (Correct answer)
- External auditors
Correct answer: The Board or Audit Committee
To maintain independence, the CAE has a functional reporting relationship to the board or audit committee, which oversees the internal audit activity.
Question 3: An internal auditor using analytical procedures compares current-year expense ratios to the prior year. This technique is BEST categorized as:
- Reperformance
- Trend analysis (Correct answer)
- Confirmation
- Inquiry
Correct answer: Trend analysis
Comparing financial or operational data over time periods is a form of trend analysis, a subset of analytical procedures.
Question 4: Which of the following scenarios MOST likely represents a conflict of interest for an internal auditor?
- The auditor reviews a process they helped design two years ago
- The auditor discloses a financial interest in a vendor being audited (Correct answer)
- The auditor uses computer-assisted audit tools
- The auditor seeks continuing education in a new audit domain
Correct answer: The auditor discloses a financial interest in a vendor being audited
A financial interest in an audited vendor creates a direct conflict of interest that impairs objectivity and must be disclosed and managed.
Question 5: The IIA Standards require that final audit communications include which of the following?
- A complete listing of all work papers reviewed
- The engagement's objectives, scope, and applicable results (Correct answer)
- Resumes of the audit team members
- Management responses only if findings are critical
Correct answer: The engagement's objectives, scope, and applicable results
Final communications must include the engagement objectives, scope, and the results, including conclusions, recommendations, and action plans.
Question 6: A risk-based audit plan is PRIMARILY designed to:
- Cover every department on a rotating cycle
- Allocate audit resources to areas with the highest risk (Correct answer)
- Satisfy the external auditors' requests
- Audit all areas where fraud has previously occurred
Correct answer: Allocate audit resources to areas with the highest risk
A risk-based audit plan ensures that limited internal audit resources are directed toward areas posing the greatest risk to the organization's objectives.
Question 7: When management disagrees with an audit finding and chooses to accept the risk, the internal auditor should:
- Remove the finding from the report
- Escalate immediately to external regulators
- Document management's response and report it to appropriate governance levels (Correct answer)
- Conduct additional tests to force agreement
Correct answer: Document management's response and report it to appropriate governance levels
If management accepts the risk without remediation, the auditor documents this decision and reports it to the board or audit committee as appropriate.
Certified Internal Auditor (IIA) 4
When the internal audit activity conforms with the IIA Standards, the CAE may state conformance in external communications: