CIA Ethics & Professional Standards 2 — Questions and Answers
Question 1: An internal auditor transferred from the accounts payable department to internal audit four months ago. She is asked to perform an assurance review of accounts payable. What is the most appropriate action?
- Perform the review but have a peer review her workpapers
- Decline or be reassigned, since she was responsible for that activity within the past year (Correct answer)
- Perform the review because she has the best knowledge of the process
- Perform the review only if management approves in writing
Correct answer: Decline or be reassigned, since she was responsible for that activity within the past year
Objectivity is presumed impaired when an auditor gives assurance on an activity they were responsible for within the previous year.
Question 2: A vendor under audit offers an internal auditor courtesy tickets to a professional sports event worth several hundred dollars. Which response best reflects IIA ethics guidance?
- Accept, since the tickets are not cash
- Accept, as long as the audit report is not affected
- Decline, because accepting could impair or appear to impair professional judgment (Correct answer)
- Accept and disclose it in the final audit report
Correct answer: Decline, because accepting could impair or appear to impair professional judgment
Internal auditors should not accept anything that may impair or be presumed to impair their professional judgment.
Question 3: During an engagement, an internal auditor learns confidential information about a planned acquisition and buys shares in the target company. Which principle has been violated most directly?
- Competency
- Confidentiality (Correct answer)
- Due professional care
- Independence of the internal audit function
Correct answer: Confidentiality
Confidentiality prohibits using information obtained in the course of duties for personal gain.
Question 4: An internal auditor is assigned an IT security engagement but lacks the technical knowledge to perform it. What should the chief audit executive (CAE) do?
- Proceed with the engagement and limit the scope of the report
- Obtain competent advice and assistance, or decline the engagement (Correct answer)
- Assign the auditor and rely on management's representations
- Cancel all IT engagements for the year
Correct answer: Obtain competent advice and assistance, or decline the engagement
When staff lack the needed competencies, the CAE must obtain competent advice and assistance or decline the engagement.
Question 5: Which statement best describes due professional care?
- It requires the auditor to provide absolute assurance that no fraud exists
- It requires the care and skill of a reasonably prudent and competent auditor, not infallibility (Correct answer)
- It requires the auditor to test 100% of transactions
- It applies only to assurance engagements, not to consulting
Correct answer: It requires the care and skill of a reasonably prudent and competent auditor, not infallibility
Due professional care means acting as a reasonably prudent, competent auditor would, and it does not imply infallibility.
Question 6: Which reporting arrangement best supports the organizational independence of the internal audit function?
- The CAE reports functionally to the CFO and administratively to the board
- The CAE reports functionally to the board and administratively to senior management (Correct answer)
- The CAE reports both functionally and administratively to the controller
- The CAE reports functionally to external auditors
Correct answer: The CAE reports functionally to the board and administratively to senior management
A direct functional reporting line to the board is the main structural safeguard for internal audit independence.
Question 7: An internal auditor discovers that management has acted illegally, and the auditor's organization has a legal obligation to report it to regulators. Under the principle of integrity, the auditor should:
- Keep the matter confidential because all engagement information is confidential
- Make disclosures expected by law and the profession through appropriate channels (Correct answer)
- Resign immediately without informing anyone
- Disclose it only to the press to ensure public awareness
Correct answer: Make disclosures expected by law and the profession through appropriate channels
Integrity requires internal auditors to observe the law and make disclosures required by law and the profession.
