CIA Client Relations 5 — Questions and Answers
Question 1: Which stakeholder is the internal audit activity's PRIMARY reporting relationship for functional purposes?
- The board or audit committee (Correct answer)
- The CFO
- Engagement clients
- The external auditor
Correct answer: The board or audit committee
The CAE reports functionally to the board to support independence and administratively to senior management.
Question 2: When an engagement client requests a quick informal review of a new system right before go-live, the internal auditor should:
- Issue a formal assurance opinion on the system
- Treat it as a consulting engagement, clarify scope and limitations, and document the agreement (Correct answer)
- Perform it without documentation
- Refuse all informal requests
Correct answer: Treat it as a consulting engagement, clarify scope and limitations, and document the agreement
Informal advisory work should still have an agreed understanding and appropriate documentation.
Question 3: During an engagement, the auditor discovers indicators of fraud involving the auditee's supervisor. The auditor should:
- Communicate the matter to appropriate authorities per the organization's policies, such as the CAE and legal (Correct answer)
- Confront the supervisor immediately
- Ignore it to protect the client relationship
- Notify the auditee manager who reports to the supervisor
Correct answer: Communicate the matter to appropriate authorities per the organization's policies, such as the CAE and legal
Fraud indicators must be escalated through proper channels, not discussed with potentially involved parties.
Question 4: Which practice helps internal audit understand stakeholder expectations when developing the annual audit plan?
- Allowing each department to choose its audits
- Relying only on prior-year plans
- Soliciting input from senior management and the board (Correct answer)
- Copying the external auditor's plan
Correct answer: Soliciting input from senior management and the board
Risk-based planning considers input from senior management and the board.
Question 5: An auditee responds to a recommendation by proposing an alternative corrective action. The internal auditor should:
- Escalate immediately to the board
- Evaluate whether the alternative adequately addresses the underlying risk (Correct answer)
- Accept it without evaluation
- Reject any action that differs from the recommendation
Correct answer: Evaluate whether the alternative adequately addresses the underlying risk
Management may choose different actions as long as the risk is adequately mitigated.
Question 6: Which of the following BEST describes the purpose of maintaining an ongoing relationship with management between engagements?
- To negotiate favorable audit ratings
- To stay informed of emerging risks and organizational changes (Correct answer)
- To pre-approve audit findings
- To reduce the number of audits performed
Correct answer: To stay informed of emerging risks and organizational changes
Continuous engagement helps internal audit identify emerging risks and remain relevant.
Question 7: If engagement results are released outside the organization, the CAE should generally:
- Release them freely to any requester
- Assess potential risk, consult senior management or legal counsel, and control dissemination (Correct answer)
- Let the engagement client decide alone
- Post them publicly for transparency
Correct answer: Assess potential risk, consult senior management or legal counsel, and control dissemination
External dissemination requires assessing risks, consulting appropriate parties, and limiting use.
