CRMA Internal Audit's Assurance Role 2

Question 1

In the three-lines-of-defense model, internal audit occupies the third line primarily because it:

Accepted Answer

Provides independent assurance to senior management and the board

Answer

The third line (internal audit) provides independent, objective assurance over the effectiveness of risk management and controls operated by the first and second lines.

Question 2

When management requests that internal audit facilitate an ERM risk workshop, the MOST appropriate response is to:

Accepted Answer

Accept only if no assurance will later be provided on the resulting framework

Answer

IIA guidance allows internal audit to facilitate risk workshops as a consulting service, but doing so impairs objectivity for subsequent assurance work on that same area.

Question 3

Which activity would MOST compromise internal audit's independence when providing ERM assurance?

Accepted Answer

Setting the organization's risk tolerance thresholds on behalf of management

Answer

Setting risk tolerance is a management responsibility; assuming that role removes internal audit's ability to independently assess those decisions.

Question 4

According to IIA standards, what most clearly distinguishes an assurance engagement from a consulting engagement?

Accepted Answer

Assurance engagements involve an independent assessment for a third-party stakeholder

Answer

Assurance engagements provide an objective assessment where the nature and scope are determined by internal audit for use by intended stakeholders, while consulting scope is defined by the client.

Question 5

Internal audit is reviewing risk management effectiveness. Management claims all key risks are within appetite. The BEST audit approach is to:

Accepted Answer

Independently verify that risk exposure measurements align with stated appetite thresholds

Answer

Effective assurance requires independent corroboration of management's risk assessments against documented appetite thresholds rather than reliance on assertion alone.

(CRMA) Certification in Risk Management Assurance Practice Test

(CRMA) Certification in Risk Management Assurance Practice Test

CRMA Internal Audit's Assurance Role 2