GRC Internal Controls & Audit Processes 4 — Questions and Answers
Question 1: During a risk-based audit, auditors prioritize testing based on:
- Areas with the highest dollar values only
- Areas with the greatest inherent risk and weak controls (Correct answer)
- Alphabetical order of process names
- The preferences of the external auditors
Correct answer: Areas with the greatest inherent risk and weak controls
Risk-based auditing allocates resources to areas with high inherent risk and insufficient controls to address that risk.
Question 2: What distinguishes a 'significant deficiency' from a 'material weakness' in internal controls?
- A significant deficiency is more severe than a material weakness
- A material weakness represents a reasonable possibility of material misstatement; a significant deficiency is less severe (Correct answer)
- They are synonymous terms used interchangeably
- A material weakness applies only to IT controls
Correct answer: A material weakness represents a reasonable possibility of material misstatement; a significant deficiency is less severe
A material weakness is more severe, indicating a reasonable possibility of a material misstatement; a significant deficiency is noteworthy but less severe.
Question 3: Which sampling technique gives every item in the population an equal chance of selection?
- Judgmental sampling
- Systematic sampling
- Random sampling (Correct answer)
- Haphazard sampling
Correct answer: Random sampling
Random sampling uses statistical methods to ensure every item has an equal probability of being chosen.
Question 4: The 'three lines of defense' model assigns internal audit to which line?
- First line
- Second line
- Third line (Correct answer)
- Fourth line
Correct answer: Third line
Internal audit is the third line of defense, providing independent assurance over the first (operations) and second (risk/compliance) lines.
Question 5: What is the purpose of an 'audit trail'?
- A physical path auditors follow during a facility tour
- A chronological record of transactions and events that enables reconstruction and verification (Correct answer)
- A list of auditors who have worked on an engagement
- A summary of audit findings presented to the board
Correct answer: A chronological record of transactions and events that enables reconstruction and verification
An audit trail captures a time-stamped sequence of records to allow reconstruction of transactions and detection of unauthorized activity.
Question 6: In continuous auditing, the primary advantage over traditional periodic audits is:
- Lower cost per audit cycle
- Near real-time monitoring that enables faster detection of anomalies (Correct answer)
- Less documentation required
- Elimination of the need for external auditors
Correct answer: Near real-time monitoring that enables faster detection of anomalies
Continuous auditing uses automated tools to monitor transactions constantly, allowing quicker identification and response to control failures.
Question 7: Which document formally communicates the results of an internal audit to management and the audit committee?
- Engagement letter
- Audit work papers
- Audit report (Correct answer)
- Risk register
Correct answer: Audit report
The audit report summarizes findings, conclusions, and recommendations and is distributed to stakeholders after fieldwork is complete.
GRC Internal Controls & Audit Processes 4
During a risk-based audit, auditors prioritize testing based on: