CORES Internal Audit & Three Lines of Defense 3

Question 1

Co-sourcing of internal audit services refers to:

Accepted Answer

Engaging external specialists to supplement internal audit staff for specific expertise or capacity

Answer

Co-sourcing blends internal audit staff with external specialists, allowing organizations to access niche expertise (e.g., cybersecurity, model risk) while retaining core audit management internally.

Question 2

Continuous auditing differs from traditional periodic auditing primarily in that it:

Accepted Answer

Uses automated monitoring to provide near real-time assurance over controls and transactions

Answer

Continuous auditing leverages data analytics and automated tools to monitor transactions and controls on an ongoing basis, enabling faster identification of anomalies and control failures.

Question 3

How does the internal audit function BEST integrate with the operational risk management framework to add value?

Accepted Answer

By providing independent assurance that the operational risk framework is operating effectively

Answer

Internal audit's value in operational risk comes from independently assessing whether the framework, governance, and controls are working as designed — not from designing or operating them.

Question 4

Under U.S. banking regulation, which guidance specifically articulates supervisory expectations for internal audit functions at large financial institutions?

Accepted Answer

SR 03-5: Amended Interagency Guidance on the Internal Audit Function

Answer

SR 03-5 (and subsequent updates) provides the Federal Reserve's guidance on what constitutes a satisfactory internal audit function, including independence, scope, and reporting requirements.

Question 5

A Quality Assurance and Improvement Program (QAIP) for internal audit is REQUIRED by IIA standards to include:

Accepted Answer

Ongoing internal monitoring, periodic internal assessments, and external assessments at least every five years

Answer

IIA Standard 1300 requires a QAIP that includes ongoing internal monitoring, periodic internal self-assessments, and external assessments by a qualified independent reviewer at least every five years.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Internal Audit & Three Lines of Defense 3