Auditing & Corporate Governance Flashcards

A government CAE (Chief Audit Executive) receives instructions from management to exclude a high-risk area from the annual audit plan. The appropriate response is to:

Answer: Document the exclusion and communicate the resulting risk gap to the governing body

The CAE must document scope limitations and communicate the risk implications to the governing body to maintain transparency and independence.

Which element of corporate governance specifically addresses mechanisms that align management's interests with those of stakeholders?

Answer: Executive compensation and incentive structures

Compensation and incentive structures are key governance tools designed to align management behavior with organizational and stakeholder interests.

During a CGAP audit, an auditor identifies a transaction that is legal but appears to conflict with the entity's code of ethics. The auditor should:

Answer: Document and report it as a governance concern to appropriate oversight

Ethical violations, even when not illegal, are governance concerns that should be documented and communicated to the appropriate level of oversight.

The concept of 'materiality' in government auditing differs from private sector auditing primarily because:

Answer: Materiality may include qualitative factors such as sensitivity, visibility, or public interest

In government auditing, materiality encompasses qualitative factors like political sensitivity and public interest, not just dollar thresholds.

Which type of audit evidence is generally considered MOST reliable for a government auditor?

Answer: Evidence obtained directly by the auditor from independent external sources

Evidence obtained directly from independent external sources is most reliable because it is uninfluenced by the auditee and carries the highest assurance.

A government entity's risk assessment process should update identified risks when:

Answer: Whenever significant changes in the environment, operations, or personnel occur

Risk assessments must be dynamic and updated whenever significant organizational or environmental changes occur that could affect the control environment.

Which IIA Standard requires internal audit to evaluate the effectiveness of the organization's risk management processes?

Answer: Standard 2120 — Risk Management

IIA Standard 2120 specifically requires internal audit to evaluate the effectiveness and contribution of risk management processes.