IAP Part 2

Risk assessment is a systematic process for assessing and integrating professional judgments about probable adverse conditions or events. Which of the following statements reflects the appropriate action for the chief audit executive to take?

• The CAE should generally assign engagement priorities to activities with higher risks

• The CAE should restrict the number of sources of information used in the risk assessment process

• Work schedule priorities should be established to lead the CAE in the risk assessment process

• The risk assessment process should be conducted at least every 3 to 5 years

Risk management is critical to the sound governance of which of the following?

• Financial activities of the organization.

• Manufacturing activities of the organization

• All organization activities that produce more than 10% of revenue

• All organizational activities, regardless of revenue

Fact Pattern: The chief audit executive (CAE) of a mid-sized internal audit activity was concerned that management might outsource the internal auditing function. Thus, the CAE adopted a very aggressive program to promote the internal audit activity within the organization. The CAE planned to present the results to senior management and the board and recommend modification of the internal audit activity’s charter after using the new program. The following lists six actions the CAE took to promote a positive image within the organization:

1. Engagement assignments concentrated on efficiency. The engagements focused solely on cost savings, and each engagement communication highlighted potential costs to be saved. Negative observations were omitted. The focus on efficiency was new, but the engagement clients seemed very happy.

2. Drafts of all engagement communications were carefully reviewed with the engagement clients to get their input. Their comments were carefully considered when developing the final engagement communication.

3. The information technology internal auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development.

4. Given limited resources, the engagement manager performed a risk assessment to establish engagement work schedule priorities. This was a marked departure from the previous approach of ensuring that all operations are evaluated on at least a 3-year interval.

5. To save time, the CAE no longer required that a standard internal control questionnaire be completed for each engagement.

6. When the internal auditors found that the engagement client had not developed specific criteria or data to evaluate operations, the internal auditors were instructed to perform research, develop specific criteria, review the criteria with the engagement client, and, if acceptable, use them to evaluate the engagement client’s operations. If the engagement client disagreed with the criteria, a negotiation took place until acceptable criteria could be agreed upon. The engagement communication commented on the engagement client’s operations in conjunction with the agreed-upon criteria.

Regarding Action 6, which of the following elements of the action most likely would have rendered it inappropriate if omitted?

• Seek agreement with the client about the criteria

• Developing a set of criteria to present to the engagement client as a basis for evaluating the engagement client’s operations

• Commenting on the agreed-upon criteria

• All of the answers are correct

In evaluating the effectiveness and efficiency with which resources are employed, an internal auditor is responsible for

• Determining the extent to which adequate operating criteria have been established

• Verifying the existence of assets

• Reviewing the reliability of operating information

• Verifying the accuracy of asset valuation

Before an assurance engagement can be performed, the auditor must identify appropriate criteria. The sources of such criteria are least likely to include

• Benchmarks for the leading firms in the industry

• Best practices for another industry

• Historical cost information for the processes examined

• Government regulations for the industry

Internal auditors need to determine the extent to which management has established adequate control criteria. For this purpose, which of the following actions may be appropriate?

1. Determining whether objectives have been accomplished

2. Using management’s adequate control criteria in their evaluation

3. Working with management to develop appropriate control evaluation criteria

• 1 only

• 1 and 2 only

• 1, 2, and 3

• 2 only

Developing engagement observations, conclusions, and recommendations involves comparing the condition with the relevant standard or criterion. Which of the following choices best represents an appropriate standard or criterion to support engagement observations, conclusions, and recommendations?

• A quality standard operating procedure (number and date) for the department

• An internal accounting control principle, cited and copied from a public accounting reference

• A sound industry practice, based on the internal auditor’s knowledge and experience obtained during many engagement assignments within the organization

• All of the answers represent an appropriate standard or criterion to support engagement observations, conclusions, and recommendations

A United States organization plans to expand operations to Gambia. Which of the following are plausible assurance engagement objectives for an internal audit of the human resources department?

1. Evaluate the clarity and transparency of the design of global compensation and benefit systems.

2. Identify methods of improving communications with assignees, line management, and leadership.

3. Assess compliance with applicable requirements for visas and work permits.

4. Provide consultation to potential assignees and line management on terms and conditions of the internal assignment.

• 1 and 3 only

• 2 and 4 only

• 3 and 4 only

• 1, 2, and 4 only

Which of the following documents should the internal auditor examine to determine whether only authorized purchases are being accepted by the receiving department?

• A bill of lading

• A copy of the purchase order

• An invoice

• Policies and procedures for the receiving function

An internal audit activity is planning an assurance engagement in the transportation department of a large engineering firm. The firm owns and operates a fleet of cars and trucks of various sizes. One engagement objective is to evaluate the department’s vehicle maintenance procedures. Which procedures are appropriate to this engagement objective?

1. Interview service technicians to gather information about maintenance procedures.

2. Compare costs for selected procedures with industry standards.

3. Compare manufacturer maintenance guidelines with departmental procedures.

4. Analyze vehicle losses.

• 1 and 2 only

• 1, 2, and 3 only

• 4 only

• 1, 2, 3, and 4