Question 1

To effectively communicate the acceptance of risk in an organization a chief audit executive must first consider which of the following?

Options :

A : The organization-s view on risk tolerance

B : The organization-s principal risk events.

C : The organization-s risk response strategies

D : The organization-s major control activities

Answer: A

Question 2

Which of the following recommendations made by the internal audit activity (IAA) is most likely to help prevent fraud?

Options :

A :

A review of password policy compliance found that employees frequently use the same password more than once during a year. The IAA recommends that the access control software reject any password used more than once during a 12-month period.

B :

A review of internal service-level agreement compliance in financial services found that requests for information frequently are fulfilled up to two weeks late. The IAA recommends that the financial services unit be eliminated for its ineffectiveness.

C :

A vacation policy compliance review found that employees frequently leave on vacation before their leave applications are signed by their manager. The IAA recommends that the manager attend to the leave applications in a more timely fashion.

D :

A review of customer service-level agreements found that orders to several customers are frequently delivered late. The IAA recommends that the organization extend the expected delivery time advertised on its website.

Answer: A

Question 3

An internal auditor is assessing the organization's risk management framework. Which of the following formulas should he use to calculate the residual risk?

Options :

A :

B :

C :

D :

Answer: C

Question 4

An internal auditor plans to conduct a walk-through to evaluate the control design of a process. Which of the following techniques is the auditor most likely to use?

Options :

A : Observation and inspection.

B : Inquiry and observation.

C : Inspection and reperformance.

D : Inquiry and reperformance.

Answer: B

Question 5

Following an audit, management developed an action plan to improve controls over the handling of scrap metal. Which of the following would be the most appropriate course of action for the auditor to follow up?

Options :

A :

Conduct another audit engagement to ensure all risks related to the sales of scrap metal have been mitigated.

B : Ensure new procedures have been documented, approved, and distributed to the employees responsible.

C :

Perform retesting to confirm that new procedures address the previously identified deficient control activities

D :

Analyze the new procedures, then report to senior management whether the associated risks have been managed.

Answer: C