Certified Internal Auditor Internal Audit Standards & Ethics 3 — Questions and Answers
Question 1: An external assessment of the internal audit activity must be conducted at least once every:
- Two years
- Three years
- Five years (Correct answer)
- Seven years
Correct answer: Five years
Standard 1312 requires external assessments to be conducted at least once every five years by a qualified, independent assessor or assessment team.
Question 2: The IIA Code of Ethics rule on 'Confidentiality' prohibits internal auditors from:
- Sharing audit reports with external auditors
- Disclosing information without appropriate authority unless legally obligated (Correct answer)
- Retaining working papers beyond one audit cycle
- Using electronic communication for sensitive findings
Correct answer: Disclosing information without appropriate authority unless legally obligated
The Confidentiality rule prohibits auditors from disclosing information without appropriate authority unless there is a legal or professional obligation to do so.
Question 3: Standard 2050 requires the CAE to share information and coordinate activities with other internal and external providers of assurance to:
- Reduce the internal audit budget
- Ensure adequate coverage and minimize duplication (Correct answer)
- Eliminate the need for external audit
- Standardize audit methodologies across providers
Correct answer: Ensure adequate coverage and minimize duplication
Standard 2050 aims to ensure adequate coverage of risk areas and minimize duplication of effort among assurance providers.
Question 4: Which scenario represents a violation of the IIA's principle of 'Integrity'?
- Declining to audit a department managed by a close relative
- Omitting an unfavorable finding from a report to avoid conflict (Correct answer)
- Seeking additional training before performing an IT audit
- Consulting with legal counsel on a sensitive finding
Correct answer: Omitting an unfavorable finding from a report to avoid conflict
Integrity requires auditors to be honest and not suppress findings; omitting an unfavorable finding directly violates this principle.
Question 5: When the CAE determines that the internal audit activity has been impaired due to a scope limitation, the Standards require the CAE to:
- Accept the limitation and complete the engagement as modified
- Communicate the impairment to senior management and the board (Correct answer)
- Escalate the matter to external regulators immediately
- Suspend all audit activity until the limitation is resolved
Correct answer: Communicate the impairment to senior management and the board
Standard 1130.A1 requires the CAE to communicate independence or objectivity impairments to senior management and the board.
Question 6: The International Standards for the Professional Practice of Internal Auditing are organized into which two main categories?
- Financial and Operational Standards
- Attribute and Performance Standards (Correct answer)
- Mandatory and Recommended Standards
- Assurance and Consulting Standards
Correct answer: Attribute and Performance Standards
The Standards are organized into Attribute Standards (1000 series), which describe characteristics of the audit activity, and Performance Standards (2000 series), which describe the nature of audit work.
Question 7: Standard 2340 requires that engagement working papers be:
- Destroyed after the final report is issued
- Retained according to the organization's retention policies and applicable regulations (Correct answer)
- Shared with external auditors upon request
- Approved by the board audit committee before filing
Correct answer: Retained according to the organization's retention policies and applicable regulations
Standard 2340 requires the CAE to develop and maintain record retention policies consistent with organizational guidelines and applicable regulations.
Certified Internal Auditor Internal Audit Standards & Ethics 3
An external assessment of the internal audit activity must be conducted at least once every: