Question 1

An examination of the accounts payable function evidenced multiple findings with respect to segregation of duties. After management's response and action plan are received and documented in the final report, which of the following is most appropriate?

Options :

A : Follow up after the applicable changes have been incorporated to validate management’s response.

B : Include the items in the scope of the next scheduled audit of the accounts payable function.

C : Because management agreed with the findings, no further action is deemed necessary.

D : Have an internal audit staff member placed into the accounting department until corrections are made.

Answer: A

Question 2

Which of the following is a disadvantage of using flowcharts during a risk assessment?

Options :

A : People cannot quickly understand the processes via flowcharts

B : Flowcharts are not applicable for evaluating the design of controls

C : Some serious risks that are not part of the linear process can be missed

D : Flowcharts do not enable auditors to identify missing controls

Answer: C

Question 3

A large investment organization hired a chief risk officer (CRO) to be responsible for the organization's risk management processes. Which of the following people should prioritize risks to be used for the audit plan?

Options :

A :

Operational management, because they are responsible for the day-to-day management of the operational risks.

B :

The CRO, because he is responsible for coordinating and project managing risk activities based on his specialized skills and knowledge.

C : The chief audit executive, although he is not accountable for risk management in the organization.

D :

The CEO, because he has ultimate responsibility for ensuring that risks are managed within the agreed tolerance limits set by the board.

Answer: C

Question 4

Senior management wants assurance that third-party contractors are following procedures as agreed with the organization. Which type of audit would be most appropriate to achieve this objective?

Options :

A : A compliance audit.

B : A due diligence audit.

C : A financial audit.

D : An external audit.

Answer: A

Question 5

While conducting an information security audit, an internal auditor learns that the existing disaster recovery plan is four years old and untested. The auditor also learns that in the four years since the recovery plan was implemented, the information systems have undergone extensive changes. Which of the following actions is most appropriate for the auditor to take?

Options :

A : Inform management and request that the plan be tested immediately.

B : Update the recovery plan for management, as part of the review.

C : Evaluate the recovery plan and report weaknesses to management.

D : Recommend that management and users update and test the recovery plan.

Answer: D

Smartly Prepare Exam with Free Online IIA-CIA-Part2 Practice Test

Buying Options: