CORES Internal Audit & Three Lines of Defense 2

Question 1

A risk-based internal audit approach prioritizes audit resources based on:

Accepted Answer

The relative risk exposure and significance of auditable entities

Answer

Risk-based auditing allocates audit effort proportionally to the risk profile of each auditable entity, ensuring the highest-risk areas receive the most scrutiny.

Question 2

The 'audit universe' in internal audit planning refers to:

Accepted Answer

A comprehensive inventory of all auditable entities, processes, and systems

Answer

The audit universe is a complete catalog of all auditable areas across the organization, which the audit function uses to develop its risk-based multi-year audit plan.

Question 3

During an operational risk audit, an auditor identifies a control that exists in policy but is consistently not followed in practice. This situation BEST exemplifies:

Accepted Answer

Operating effectiveness deficiency

Answer

An operating effectiveness deficiency means a control is properly designed but fails to function as intended during the period under review.

Question 4

When rating audit findings, a 'high' or 'critical' severity classification typically indicates:

Accepted Answer

A significant control gap exposing the organization to material risk or regulatory breach

Answer

High/critical findings represent material control failures that could result in significant financial loss, regulatory sanction, or reputational damage requiring urgent remediation.

Question 5

Which practice BEST supports the integrity of the audit follow-up process for operational risk findings?

Accepted Answer

Independently testing and validating that remediation actions have been effectively implemented

Answer

Effective follow-up requires internal audit to independently verify that management's corrective actions have been implemented and are operating effectively, not merely relying on management assertions.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Internal Audit & Three Lines of Defense 2