CRMA Internal Audit's Assurance Role 2

Question 1

In the three-lines-of-defense model, internal audit occupies the third line primarily because it:

Accepted Answer

Provides independent assurance to senior management and the board

Answer

Manages day-to-day operational risks directly

Answer

Sets risk policy and risk appetite for the organization

Answer

Coordinates risk oversight with external regulators

Question 2

When management requests that internal audit facilitate an ERM risk workshop, the MOST appropriate response is to:

Accepted Answer

Accept only if no assurance will later be provided on the resulting framework

Answer

Decline entirely because any facilitation compromises objectivity

Answer

Facilitate freely since it falls within normal assurance activities

Answer

Accept and disclose the impairment of independence in the assurance report

Question 3

Which activity would MOST compromise internal audit's independence when providing ERM assurance?

Accepted Answer

Setting the organization's risk tolerance thresholds on behalf of management

Answer

Reviewing risk registers prepared by the risk management function

Answer

Assessing the adequacy of management's risk identification process

Answer

Recommending improvements to the ERM framework after the audit

Question 4

According to IIA standards, what most clearly distinguishes an assurance engagement from a consulting engagement?

Accepted Answer

Assurance engagements involve an independent assessment for a third-party stakeholder

Answer

Assurance engagements are always initiated by the chief audit executive

Answer

Consulting engagements require a written charter from the board

Answer

Consulting engagements are limited to risk management topics only

Question 5

Internal audit is reviewing risk management effectiveness. Management claims all key risks are within appetite. The BEST audit approach is to:

Accepted Answer

Independently verify that risk exposure measurements align with stated appetite thresholds

Answer

Accept management's assertion and document it as audit evidence

Answer

Escalate to the board without further testing since management may be biased

Answer

Limit scope to controls testing and exclude risk appetite assessment

Question 6

A significant gap in ERM coverage is identified by internal audit. Who should receive this finding FIRST?

Accepted Answer

Management, so they have an opportunity to remediate before board communication

Answer

External auditors so they can include it in their report

Answer

Regulatory bodies because it represents a compliance breach

Answer

The board audit committee directly, bypassing management

Question 7

The scope of internal audit's assurance on risk management is BEST defined as:

Accepted Answer

The adequacy and effectiveness of the organization's risk management processes

Answer

All operational processes regardless of risk level

Answer

Only financial controls and compliance activities

Answer

External threats identified by the risk management function