Question 1

Which of the following best describes the four components of a balanced scorecard?

Options :

A : Customers, innovation, growth, and internal processes.

B : Business objectives, critical success factors, innovation, and growth.

C : Customers, support, critical success factors, and learning.

D : Financial measures, learning and growth, customers, and internal processes.

Answer: D

Question 2

During an internal audit engagement, which of the following is true regarding the decision to use statistical sampling or nonstatistical sampling?

Options :

A : The decision affects the test procedures performed.

B : The auditor-s response to errors detected will be influenced.

C : The competence of the evidence obtained is greater with statistical sampling.

D : Nonstatistical sampling may be more cost effective.

Answer: A

Question 3

Which of the following recommendations made by the internal audit activity (IAA) is most likely to help prevent fraud?

Options :

A :

A review of password policy compliance found that employees frequently use the same password more than once during a year. The IAA recommends that the access control software reject any password used more than once during a 12-month period.

B :

A review of internal service-level agreement compliance in financial services found that requests for information frequently are fulfilled up to two weeks late. The IAA recommends that the financial services unit be eliminated for its ineffectiveness.

C :

A vacation policy compliance review found that employees frequently leave on vacation before their leave applications are signed by their manager. The IAA recommends that the manager attend to the leave applications in a more timely fashion.

D :

A review of customer service-level agreements found that orders to several customers are frequently delivered late. The IAA recommends that the organization extend the expected delivery time advertised on its website.

Answer: A

Question 4

While conducting an information security audit, an internal auditor learns that the existing disaster recovery plan is four years old and untested. The auditor also learns that in the four years since the recovery plan was implemented, the information systems have undergone extensive changes. Which of the following actions is most appropriate for the auditor to take?

Options :

A : Inform management and request that the plan be tested immediately.

B : Update the recovery plan for management, as part of the review.

C : Evaluate the recovery plan and report weaknesses to management.

D : Recommend that management and users update and test the recovery plan.

Answer: D

Question 5

When setting the scope for the identification and assessment of key risks and controls in a process, which of the following would be the least appropriate approach?

Options :

A :

Develop the scope of the audit based on a bottom-up perspective to ensure that all business objectives are considered.

B :

Develop the scope of the audit to include controls that are necessary to manage risk associated with a critical business objective.

C :

Specify that the auditors need to assess only key controls, but may include an assessment of non-key controls if there is value to the business in providing such assurance

D :

Ensure the audit includes an assessment of manual and automated controls to determine whether business risks are effectively managed.

Answer: A