CORES Internal Audit & Three Lines of Defense 2

Question 1

A risk-based internal audit approach prioritizes audit resources based on:

Accepted Answer

The relative risk exposure and significance of auditable entities

Answer

Alphabetical order of business units

Answer

Management's personal preferences for audit coverage

Answer

The age of the previous audit engagement

Question 2

The 'audit universe' in internal audit planning refers to:

Accepted Answer

A comprehensive inventory of all auditable entities, processes, and systems

Answer

The external regulatory bodies that govern the organization

Answer

The scope of a single audit engagement

Answer

The pool of certified internal auditors available for assignment

Question 3

During an operational risk audit, an auditor identifies a control that exists in policy but is consistently not followed in practice. This situation BEST exemplifies:

Accepted Answer

Operating effectiveness deficiency

Answer

Design deficiency

Answer

Inherent risk escalation

Answer

Residual risk acceptance

Question 4

When rating audit findings, a 'high' or 'critical' severity classification typically indicates:

Accepted Answer

A significant control gap exposing the organization to material risk or regulatory breach

Answer

A minor process improvement opportunity with limited financial impact

Answer

A finding that management has already remediated

Answer

A theoretical risk with no current evidence of occurrence

Question 5

Which practice BEST supports the integrity of the audit follow-up process for operational risk findings?

Accepted Answer

Independently testing and validating that remediation actions have been effectively implemented

Answer

Accepting management's assertion that a finding is remediated without validation

Answer

Closing all findings at the end of each fiscal year regardless of status

Answer

Allowing the first line to self-certify remediation with no second or third line review

Question 6

What is the PRIMARY reporting responsibility of the Chief Audit Executive (CAE) in most governance frameworks?

Accepted Answer

Reporting functionally to the Audit Committee of the Board and administratively to senior management

Answer

Reporting exclusively to the Chief Risk Officer

Answer

Reporting to the Chief Financial Officer for budget purposes and risk purposes

Answer

Reporting only to the Chief Executive Officer

Question 7

Which International Standards for the Professional Practice of Internal Auditing (ISPPIA) attribute standard addresses the organizational independence of internal audit?

Accepted Answer

Standard 1110 – Organizational Independence

Answer

Standard 2010 – Planning

Answer

Standard 2300 – Performing the Engagement

Answer

Standard 2600 – Communicating the Acceptance of Risk