35 IAA

What are the four important risk-based outputs that successful management of risk depends on?

• Optional, assurance, decision making, effective and efficient core processes

• Mandatory, assurance, decision making, ineffective and inefficient core processes

• Mandatory, assurance, decision making, effective and efficient core processes

• Mandatory, assurance, guesswork, effective and efficient core processes

What is the primary concern of internal audit?

• Risk assurance

• Risk identification

• Risk avoidance

• Risk acceptance

What is the purpose of the fieldwork in an internal audit exercise?

• To understand risks and controls in place

• To finalize the audit report

• To set audit priorities

• To collect information for the audit

What is the main focus of internal auditors during an audit?

• Implementing controls

• Designing controls

• Avoiding controls

• Testing controls

What is the primary responsibility for managing risk within an organization?

• Executive management

• Internal audit

• Risk management

• External auditors

What is the main difference between the three lines of defense model and the five lines of assurance model?

• Reporting relationships

• Focus on assurance vs. control

• Focus on control vs. assurance

• Number of lines

What is the role of the board of directors in the five lines of assurance model?

• Provide overall assurance

• Implement controls

• Ignore risks

• Audit controls

What is the purpose of the risk register in relation to internal audit activities?

• Record current controls and make recommendations

• Finalize audit reports

• Set audit priorities

• Collect information for the audit

What is the main focus of the internal audit department in an organization?

• Risk assurance and internal controls

• Human resources

• Financial management

• Marketing strategies

What is the key role of internal audit in enterprise risk management (ERM) initiatives?

• Facilitating identification of risks

• Reviewing key risks, evaluating risk management processes

• Setting risk appetite, imposing risk management processes

• Taking decisions on risk responses