CORES Internal Audit & Three Lines of Defense 3

Question 1

Co-sourcing of internal audit services refers to:

Accepted Answer

Engaging external specialists to supplement internal audit staff for specific expertise or capacity

Answer

Completely outsourcing the internal audit function to an external firm

Answer

Sharing audit findings with external regulators

Answer

Using automated tools to replace human auditors

Question 2

Continuous auditing differs from traditional periodic auditing primarily in that it:

Accepted Answer

Uses automated monitoring to provide near real-time assurance over controls and transactions

Answer

Eliminates the need for internal audit staff

Answer

Is only applicable to financial statement auditing

Answer

Replaces the risk-based audit planning process

Question 3

How does the internal audit function BEST integrate with the operational risk management framework to add value?

Accepted Answer

By providing independent assurance that the operational risk framework is operating effectively

Answer

By designing the operational risk framework on behalf of management

Answer

By substituting for second-line risk oversight when resources are constrained

Answer

By setting the organization's risk appetite and tolerance levels

Question 4

Under U.S. banking regulation, which guidance specifically articulates supervisory expectations for internal audit functions at large financial institutions?

Accepted Answer

SR 03-5: Amended Interagency Guidance on the Internal Audit Function

Answer

Basel II Pillar 3 market discipline requirements

Answer

Dodd-Frank Section 165 enhanced prudential standards

Answer

FDIC Improvement Act Section 112 attestation requirements

Question 5

A Quality Assurance and Improvement Program (QAIP) for internal audit is REQUIRED by IIA standards to include:

Accepted Answer

Ongoing internal monitoring, periodic internal assessments, and external assessments at least every five years

Answer

Annual external assessment only, with no internal monitoring required

Answer

Quarterly reviews by the Chief Risk Officer

Answer

An annual sign-off by external auditors on the internal audit workpapers

Question 6

When emerging operational risks (e.g., AI model risk, climate risk) outpace the existing audit universe, what is the BEST practice for the internal audit function?

Accepted Answer

Perform horizon scanning and dynamically update the audit universe and risk assessments to reflect emerging risks

Answer

Exclude emerging risks until they are fully mature and have established control frameworks

Answer

Delegate coverage of emerging risks entirely to the second line

Answer

Wait for regulatory guidance before adding emerging risks to audit scope

Question 7

Which metric BEST reflects the effectiveness of the audit follow-up process in reducing operational risk exposure?

Accepted Answer

Percentage of high/critical findings remediated within agreed target dates

Answer

Total number of audit reports issued per year

Answer

Average duration of individual audit engagements

Answer

Number of external assessment ratings received by internal audit