Reviewer Corp Gov

According to COSO, which of the following is not considered one of the components of an organization’s internal environment?

• Authority and responsibility to resolve issues.
• Framework to plan, executeand monitor activities
• integrated responses to multiple risks.
• Knowledge and skills needed to perform activities.

An organization that outsources much of its internal audit work to an external service provider is planning for an external quality assessment. Which of the following options would accomplish this task and be in conformance with the Standards?

• External industry associate that performed a similar review for a supplier of the organization
• A team from an independent entity that previously employed the chief audit executive of the organization.
• A team under the direction of the organization’s chief audit executive with validation by a former manager of the internal audit activity
• . The same external service provider because of its competency and experience with the organization.

During the planning phase of an audit of suspected overbilling on contracts for security services, an auditor should perform all of the following except:

• Interviewing an official of the security services company to determine the cause of recent increases in billings for services.
• Interviewing the manager who requested the audit engagement
• Obtaining a copy of the contract between the two organizations.
• Preparing an engagement program.

If an internal auditor discloses confidential information in response to a lawsuit, the internal auditor has violated

• The IIA Code of Ethics.
• the Standards
• Both the IIA Code of Ethics and the Standards.
• Neither the IIA Code of Ethics nor the Standards.

In developing an appropriate work program for an audit engagement, the most important factor for an audit supervisor to consider is the:

• Availability of records and data.
• Potential impact of risks.
• Audit personnel’s knowledge and experience.
• Time required to complete the engagement.

An organization has a policy requiring two signatures on all checks written for amounts in excess of $10, 000. When evaluating controls over disbursements, an auditor would conclude that a greater risk exists if.

• the auditor located two checks for $9, 000 each that contained one authorized signature.
• The $10, 000 was an immaterial amount to the organization and very few cash disbursements required an amount in excess of $10, 000.
• The director of accounting was not one of the authorized signers.
• There were several instances in which successively numbered checks for amounts between $5, 000 and $10, 000 were made payable to the same vendor.

Which of the following is not an appropriate type of coordination between the internal audit activity and regulatory auditors?

• Regulatory auditors share their perspective on risk management, control, and governance with the internal auditors
• Internal auditors perform fieldwork at the direction of the regulatory auditors
• Internal auditors review copies of regulatory reports in planning related internal engagements.
• Regulatory and internal auditors exchange information about planned activities.

Which of the following is an appropriate role for the board in governance?

• Preparing written organizational policies that relate to compliance with laws, regulations, ethics, and conflicts of interest.
• Ensuring that financial statements are understandable, transparent, and reliable.
• Assisting the internal audit activity in performing annual reviews of governance.
• Working with the organization’s attorneys to develop a strategy regarding current litigation, pending litigation, or regulatory proceedings governance.

According to the Standards, the organizational status of the internal audit activity:

• Must be sufficient to permit the accomplishment of its audit responsibilities.
• Is best when the reporting relationship is direct to the board of directors
• Requires the board’s annual approval of the audit schedules, plans, and budgets.
• Is guaranteed when the charter specifically defines its independence.

An internal auditor is reviewing a new automated human resources system. The system contains a table of pay rates which are matched to the employee job classifications. The best control to ensure that the table is updated correctly for only valid pay changes would be to:

• Limit access to the data table to management and line supervisors who have the authority to determine pay rates.
• Require a supervisor in the department, who does not have the ability to change the table, to compare the changes to a signed management authorization
• Ensure that adequate edit and reasonableness checks are built into the automated system.
• Require that all pay changes be signed by the employee to verify that the change goes to a bona fide employee.