CGRC Audit Management 3 — Questions and Answers
Question 1: Which of the following best describes 'audit universe'?
- The total number of auditors available for engagements
- The complete inventory of auditable entities and activities within an organization (Correct answer)
- The set of standards governing audit practice
- The list of external stakeholders who receive audit reports
Correct answer: The complete inventory of auditable entities and activities within an organization
The audit universe encompasses all potential auditable areas, including processes, systems, departments, and locations.
Question 2: In audit risk model terms, detection risk is best managed by:
- Strengthening internal controls
- Adjusting the extent and nature of audit procedures (Correct answer)
- Reducing inherent risk in the business process
- Increasing the audit budget
Correct answer: Adjusting the extent and nature of audit procedures
Detection risk—the risk that audit procedures fail to catch misstatements—is controlled by modifying audit procedures, not by changing underlying controls.
Question 3: Which type of audit opinion is issued when financial statements are fairly presented except for a specific, material issue?
- Unqualified opinion
- Qualified opinion (Correct answer)
- Adverse opinion
- Disclaimer of opinion
Correct answer: Qualified opinion
A qualified opinion indicates that statements are fairly presented 'except for' a specific departure from the applicable financial reporting framework.
Question 4: Under IIA Standards, the internal audit function's independence is primarily safeguarded by:
- Having audit staff rotate roles with management
- Reporting functionally to the board or audit committee (Correct answer)
- Limiting audit scope to financial controls only
- Using only external auditors for sensitive reviews
Correct answer: Reporting functionally to the board or audit committee
Functional reporting to the board or audit committee preserves organizational independence by keeping internal audit free from management influence.
Question 5: What does 'sufficiency of audit evidence' mean?
- The evidence is obtained from independent external sources
- There is enough evidence to support the audit conclusions (Correct answer)
- The evidence is documented in standardized workpapers
- The evidence covers all fiscal years under review
Correct answer: There is enough evidence to support the audit conclusions
Sufficiency refers to the quantity of evidence—whether there is enough to draw reasonable audit conclusions.
Question 6: An auditor uses computer-assisted audit techniques (CAATs) primarily to:
- Replace manual testing procedures entirely
- Analyze large data sets to identify anomalies and exceptions (Correct answer)
- Automate the preparation of audit reports
- Communicate findings to management electronically
Correct answer: Analyze large data sets to identify anomalies and exceptions
CAATs enable auditors to process and analyze large volumes of data efficiently to detect patterns, exceptions, or unusual transactions.
Question 7: Which element distinguishes a performance audit from a financial audit?
- Performance audits always require external auditors
- Performance audits evaluate economy, efficiency, and effectiveness of operations (Correct answer)
- Performance audits focus solely on internal control design
- Performance audits are conducted only at the request of regulators
Correct answer: Performance audits evaluate economy, efficiency, and effectiveness of operations
Performance audits assess whether programs and operations achieve their intended objectives economically and efficiently, beyond financial accuracy.
CGRC Audit Management 3
Which of the following best describes 'audit universe'?