Worksheetsfinal kiem noi bo
Total questions: 100
Worksheet time: 50mins
Which of the following is the best reason for the CAE to consider the organization's strategic plan in developing the annual internal audit plan?
To emphasize the importance of the internal audit function to the organization.
To ensure that the internal audit plan will be approved by senior management
To make recommendations to improve the strategic plan
To ensure that the internal audit plan supports the overall business objectives
Which of the following is the premier certification sponsored by the IIA?
Certification in Control Self-Assessment
Certified Internal Auditor
Certification in Risk Management Assessment
Certified Information Systems Auditor
Which of the following is not a potential value driver for implementing ERM?
Financial results will improve in the short run
There will be fewer surprises from year to year
There will be better information available to make risk decisions.
An organization's risk appetite can be aligned with strategic planning
Which competency is described as the ability to inspire trust through consistent competence and integrity
Credibility
Competence
Courage
Communication
Which of the following is NOT a risk response strategy for a positive risk?
Exploiting
Enhancing
Transferring
Acceptance
How does COSO ERM define 'risk'?
A random event that has no influence on business outcomes
The possibility that events will occur and affect the achievement of strategy and objectives
The unavoidable circumstances that must be ignored
A financial event that is predictable and manageable
While planning an internal audit, the internal auditor obtains knowledge about the auditee to, among other things
Develop an understanding of the auditee's objectives and risks
Develop an attitude of professional skepticism about management's assertions
Make constructive suggestions to management concerning internal control improvements.
Evaluate whether misstatements in the auditee's performance reports should be communicated to senior management and the audit committee.
Who is responsible for implementing ERM?
The chief financial officer
The chief audit executive
The chief compliance officer
Management throughout the organization
Assurance, Insight, and Objectivity comprise
The mission of internal auditing
The three lines of defense model
The value proposition
The objectives of internal auditing
Internal auditing is designed to add value through which of the following activities?
Assurance and consulting activities aimed at improving operations
Only identifying non-compliance issues
Conducting market research
Monitoring employee performance reviews
Who is responsible for establishing the strategic objectives of an organization?
The board of directors.
Consensus among all levels of management.
Senior management.
The board and senior management jointly
The competency 'Courage' is essential for internal auditors because it involves:
The ability to connect with stakeholders
Inspiring trust through competence and integrity
The personal fortitude to remain independent and objective, and to stand by the results of engagements
Communicating results in multiple forms
AVF Company's new CFO has asked the company's CAE to meet with him to discuss the role of the internal audit function. The CAE should inform the CFO that the overall responsibility of internal audit is to
Review the integrity of financial and operating information and the methods used to accumulate and report information
Determine whether the company's system of internal controls provides reasonable assurance that information is effectively and efficiently communicated to management
Serve as an independent assurance and consulting activity designed to add value and improve the company's operations
Assess the company's methods for safeguarding its assets and, as appropriate, verify the existence of the assets
Which of the following exemplifies a risk exploitation strategy?
Implementing robust security measures to mitigate cyber threats.
Collaborating with competitors to share market insights.
Diversifying investments to reduce financial risk.
Purchasing insurance to transfer risk to a third party
Which of the following is one of the 5 Cs essential to success as an internal auditor?
(1) Courage.
(2) Collaboration.
(3) Candidness.
(4) Competence
After business risks have been identified, they should be assessed in terms of their inherent
Impact and likelihood
Likelihood and probability
Significance and severity
Significance and control effectiveness
If the business objective is 'Ship all orders no later than 48 hours after receiving them,' what should the audit engagement objective be?
Reviewing sales data for accuracy
Determining whether orders are actually being shipped within 48 hours of receipt
Ensuring financial statements comply with GAAP
Assessing the adequacy of OSHA training procedures
Independent outside auditors provide financial reporting assurance services primarily for
The benefit of third parties
Management
Board of directors
The CEO
Which of the following would be considered a first line of defense in the Three Lines of Defense model
An accounts payable supervisor conducting a weekly review to ensure all payments were issued by the required payment date
A divisional compliance and ethics officer conducting a review of employee training records to ensure that all marketing and sales staff have completed the required FCPA training
The external audit team observes the counting of inventory on December 31
An internal audit team conducting an engagement to provide assurance on the company's Sarbanes-Oxley compliance with internal controls over financial reporting
Growing the organization's market share, by acquiring complementary businesses, is a specific business objective of which of the following
Reporting objective
Operations objective
Strategic objective
Compliance objective
What risk response option is being applied by the organization when the organization acknowledges a risk but chooses not to take specific actions to mitigate or transfer it?
Avoidance
Exploitation
Acceptance
Transfer
Internal auditors provide their financial reporting assurance services primarily for the benefit of: (Select all correct answers)
Third parties
Management
Board of directors
Employees
Which of the following roles should internal audit avoid to maintain its independence?
Reviewing risk mitigation measures
Setting the risk appetite for the organization
Supporting risk analysis
Coordinating ERM activities
What is a key responsibility of the internal audit function in relation to management?
Dictating corporate strategies and objectives
Monitoring employee attendance and punctuality
Facilitating social events for company employees
Providing independent evaluations and recommendations to improve internal controls and risk management
Which of the following best characterizes a risk avoidance strategy?
Accepting all risks without mitigation measures.
Transferring risks to external parties.
Implementing measures to minimize the impact of identified risks.
Choosing not to engage in activities that carry certain risks.
Which of the following is mandatory guidance within the IPPF
Implementation guidance
Supplemental guidance
The value proposition
The core principles
Which of the following represents a risk reduction strategy?
Increasing investment in high-risk ventures
Transferring all liabilities to a third party
Implementing safety protocols to minimize workplace accidents
Ignoring potential risks and proceeding with business as usual
Roles the internal audit function should not undertake?
Evaluating risk management processes
Giving assurance on the risk management processes
Making decisions on risk responses
Reviewing the management of key risks
What is the focus of 'Communication' as a key competency for internal auditors?
Having the courage to remain independent
Understanding the needs of stakeholders
Instituting methods of relaying information and listening to individuals
Providing advisory services that add value
What are the major components of governance?
1. Strategic direction
2. Oversight
3. Regulations
4. Ethics
Which of the following are key roles of the internal audit function? (Select all that apply)
Conducting external financial audits
Providing independent assurance on risk management and internal control
Evaluating the effectiveness of compliance programs
Managing day-to-day operational decisions
What is the primary focus of the 'Strategy and Business Objectives' component in the COSO ERM Framework?
Establishing financial reports
Aligning risk management with the entity's strategy
Managing employee performance
Developing organizational policies
Ship all orders no later than 48 hours after receiving the orders, is a specific business objective of which of the following?
Reporting objective
Operations objective
Strategic objective
Compliance objective
The internal audit function should not:
Assess the organization's governance and risk management processes
Provide advice about how to improve the organization's governance and risk management processes.
Oversee the organization's governance and risk management processes.
Coordinate its governance and risk management-related activities with those of the independent outside auditor.
Which principle is essential for internal auditors to maintain during their engagements?
Independence and objectivity
Profit maximization
Direct involvement in management decisions
Exclusive focus on financial statements
Which of the following is not a goal of corporate governance
Complying with society's legal and regulatory rules
Providing an overall benefit to society
Maximizing executive compensation
Reporting fully and truthfully to stakeholders
What risk response option is being applied by the organization: "Action is taken to reduce the risk impact, likelihood, or both. This involves a myriad of everyday business decisions, such as implementing controls"
Acceptance
Avoidance
Pursuit
Reduction
Sharing
Which of the following are components of the definition of internal auditing?
Independence and objectivity
A systematic and disciplined approach
Helping the organization accomplish its objectives
All of the answers
Comply with Occupational Safety and Health Administration (OSHA) regulations, is a specific business objective of which of the following?
Reporting
Compliance
Operations
Strategic
Governance should help ensure that the objectives of an entity's stakeholders are met. Stakeholders include
Employees and Customers
Regulators and Suppliers
Suppliers, Regulators and Customers
Employees, Suppliers, Regulators and Customers
What does "ERM" stand for in the COSO ERM Framework?
External Risk Management
Enterprise Risk Management
Employee Risk Management
Environmental Risk Management
What risk response option is being applied by the organization: "Discontinuing a specific business activity or exiting a particular market"
Acceptance
Reduction
Avoidance
Exploitation
What is the main objective of the internal audit function within an organization?
Managing external stakeholder relationships
Monitoring employee productivity
Ensuring compliance with legal requirements and internal policies
Conducting market research for product development
Who is ultimately responsible for identifying new or emerging key risk areas that should be covered by the organization's governance process?
The board of directors.
Risk owners.
Senior management.
The internal audit function
What is one of the main focuses of internal auditing according to its definition?
Focusing solely on financial reporting
Evaluating and improving the effectiveness of risk management, control, and governance processes
Ensuring the organization achieves maximum profits
Overseeing external audits
Which of the following best illustrates a risk acceptance strategy?
Investing in comprehensive insurance coverage to mitigate potential losses
Implementing strict quality control measures to prevent product defects
Accepting potential risks without taking specific actions to mitigate them
Collaborating with suppliers to share supply chain risks
According to COSO ERM, which of the following is not an inherent challenge that arises as part of establishing strategy and business objectives?
Ensuring culture is clearly articulated by the board.
Possibility of strategy not aligning
Implications from the strategy chosen
Risk to achieving the strategy
When assessing the risk associated with an activity, an internal auditor should
Determine how the risk should best be managed.
Provide assurance on the management of the risk.
Update the risk management process based on risk exposures.
Design controls to mitigate the identified risks.
What is residual risk?
Impact of risk.
Risk that is under control
Underlying risk in the environment
Risk that is not managed.
What does "Competence" refer to as a key competency for internal auditors
The skills and knowledge required to provide assurance and advisory services that add value
The ability to stand by the results of engagements conducted
Understanding the needs of each stakeholder individually
Inspiring trust based on consistent integrity
Which of the following is not an example of a risk sharing strategy?
Outsourcing a noncore, high-risk area
Hedging against interest rate fluctuations
Selling a nonstrategic business unit
Buying an insurance policy to protect against adverse weather
What is a core role of internal audit in ERM?
Implementing risk mitigation strategies
Providing assurance on risk management processes
Setting the organization's risk appetite
Making decisions on risk responses
"Connectivity" as a competency for internal auditors involves:
Understanding the needs of stakeholders individually while considering the whole organization
Relaying information in various forms
Ensuring accuracy in financial statements
Demonstrating courage in the face of challenges
Within the context of internal auditing, assurance services are best defined as
Professional activities that measure and communicate financial and business data
Advisory services intended to add value and improve an organization's operations
Objective examinations of evidence for the purpose of providing independent assessments
Objective evaluations of compliance with policies, plans, procedures, laws, and regulations
How does ERM influence the internal audit function's approach to assurance?
It restricts internal audit to focus only on financial risks
It provides a framework for internal audit to prioritize high-risk areas and optimize resources
It eliminates the need for internal audit involvement in risk management
It requires internal audit to set the organization's risk appetite
Management has careful evaluated the likelihood and impact of events on its foreign operations. In the event 3% variation in exchange rate, the impact is estimated at $10 million without any action taken by management and $6 million if the company purchases a hedge instrument. The impact of the residual risk of changes in foreign currency exchange on achieving company's business objectives is:
$10 M
$16 M
$6 M
$4 M
Which of the following best describes the role of the internal audit function within an organization?
Conducting independent evaluations to ensure compliance with laws, regulations, and internal policies
Providing external stakeholders with financial reports and disclosures
Assisting in the recruitment and training of new employees
Overseeing marketing strategies and sales operations
The COSO ERM Framework emphasizes integrating risk management with what?
Legal Compliance
The organization's strategy and decision-making process
Operational Procedures
Technological Innovation
Which of the following would be considered a second line of defense in the Three Lines of Defense model?
An accounts payable supervisor conducting a weekly review to ensure all payments were issued by the required payment date.
A divisional compliance and ethics officer conducting a review of employee training records to ensure that all marketing and sales staff have completed the required FCPA training
A shift supervisor inspecting a sample of finished goods to ensure quality standards are met.
An internal audit team conducting an engagement to provide assurance on the company's Sarbanes-Oxley compliance with internal controls over financial reporting
Who is responsible for the 3rd Line of Defense in the Three Lines of Defense Model?
Internal Audit
Financial Controller
External Assurance Providers
Senior Management
Record only valid sales transactions is a specific business objective of which of the following?
Reporting objective
Operations objective
Strategic objective
Compliance objective
Who is responsible for overseeing the effectiveness of the entire Three Lines of Defense Model?
Senior Management
Governing Body/Board/Audit Committee
Internal Audit
External Assurance Providers
Which of the following best describes a risk-sharing strategy?
Transferring all risks to a third-party insurer
Provide assurance on the management of the risk
Allocating risks among different parties to reduce individual exposure
Ignoring risks and hoping for the best outcome
Internal auditing follows a specific approach. What is it?
A systematic and disciplined approach, particularly through the engagement process
A spontaneous and ad-hoc method for identifying risks
A flexible and unstructured methodology based on department needs
A focus on external auditing standards
Which of the following best describes an internal auditor's purpose in reviewing the organization's existing governance, risk management, and control processes?
To help determine the nature, timing, and extent of tests necessary to achieve engagement objectives
To ensure that weaknesses in the internal control system are corrected.
To provide reasonable assurance that the processes will enable the organization's objectives and goals to be met efficiently and economically.
To determine whether the processes ensure that the accounting records are correct and that financial statements are fairly stated
Which of the following best describes the role of the "COSO ERM Components"?
They are guidelines for external audits.
They represent the structural elements needed to manage risks effectively.
They are tools for financial reporting.
They focus solely on compliance with laws and regulations.
According to the COSO ERM Framework, which of the following is part of the organization's core elements that ERM aligns with?
Organizational Structure
Mission, Vision, and Core Values
IT Systems
Profit and Loss Statements
Which of the following is a key purpose of internal auditing?
Focusing solely on financial reporting
Helping the organization accomplish its objectives
Monitoring only compliance with laws
Maximizing external auditor reliance
Which of the following is the ultimate position of a career internal auditor?
CEO
CFO
CRO
CAE
According to COSO, the difference between inherent risk and residual risk is management's?
inability to reduce the inherent risk
actions to reduce the inherent risk
inability to share the residual risk
actions to reduce the residual risk
Which of the following statements is not true about business objectives
Business objectives represent targets of performance
Establishing meaningful business objectives is a key component of the management process
Establishing meaningful business objectives is a prerequisite to effective internal control
Business objectives are management's means of employing resources and assigning responsibilities
One key benefit of implementing the COSO ERM Framework is:
Guaranteeing higher profits
Aligning risk appetite with strategic decision-making
Eliminating all organizational risks
Reducing the need for external auditors
According to COSO ERM, which of the following is not an inherent challenge that arises as part of establishing strategy and business objectives?
Ensuring culture is clearly articulated by the board.
Possibility of strategy not aligning.
Implications from the strategy chosen.
Risk to achieving the strategy
A company requires two levels of approval for significant financial transactions when an automated system check is not feasible. This is an example of:
detective control
preventive control
corrective control
compensating control
The internal audit function is expected to:
Design and implement internal controls to prevent fraud.
Make arrests of employees suspected of committing fraud.
Provide independent assessments of the effectiveness of fraud controls.
Approve budget allocations for fraud prevention initiatives.
The bank reconciliation uncovered a transposition error in the books. This is an example of a
detective control
preventive control
corrective control
feedforward control
Which of the following is not an internal control procedure?
authorization
management's operating style
independent verification
physical control
Reasonable assurance, as it pertains to internal control, means that:
The objectives of internal control vary depending on the method of data processing used
A well-designed system of internal controls will prevent or detect all errors and fraud
Inherent limitations of internal control preclude a system of internal control from providing absolute assurance that objectives will be achieved
Management cannot override controls, and employees cannot circumvent controls through collusion
A well-designed purchase order is an example of a?
detective control
preventive control
corrective control
feedforward control
Who has primary responsibility for the monitoring component of internal control?
The organization's independent outside auditor.
The organization's internal audit function.
The organization's management.
The organization's board of directors
The risk assessment component of internal control involves the:
Independent outside auditor's assessment of residual risk.
Internal audit function's assessment of control deficiencies.
Organization's identification and analysis of the risks that threaten the achievement of its objectives.
Organization's monitoring of financial information for potential material misstatements.
An effective system of internal controls is most likely to detect a fraud perpetrated by a:
Group of employees in collusion
Single employee
Group of managers in collusion
Single manager
Which of the following is a responsibility of management in the context of fraud risk management?
Setting the tone at the top and providing oversight.
Retaining outside counsel and experts.
Implementing the system of internal controls.
Monitoring reports about fraud incidents.
Which control type would be implemented after a problem has been detected to ensure it does not happen again?
detective control
preventive control
corrective control
compensating control
What responsibility does the Board of Directors have in a fraud risk management program?
Daily execution of fraud control activities.
Implementing the overall fraud risk management program.
A comprehensive understanding of key fraud risks.
Participating in monitoring activities.
Which of the following is not an element of the internal control environment?
management philosophy and operating style
organizational structure of the firm
well-designed documents and records
the functioning of the board of directors and the audit committee
What is not a typical role of the internal audit function regarding fraud?
Conducting audits to identify weaknesses in fraud prevention measures.
Providing assurance that controls to mitigate fraud risks are effective.
Leading all company-wide fraud prevention training sessions.
Monitoring the organization's whistleblower hotline and reporting to management.
Which of the following is not a duty of the Board of Directors regarding fraud oversight?
Directing the internal audit function and independent auditors.
A comprehensive understanding of fraud-related policies and procedures.
Conducting investigations of fraud incidents themselves.
Receiving and monitoring reports on fraud incidents.
What should employees do as part of their role in fraud risk management?
Investigate suspicious activities on their own.
Retain outside counsel when fraud is suspected.
Have a basic understanding of fraud and red flags.
Provide assurance to the board about fraud risks.
COSO's Internal Control Framework consists of five internal control components and 17 principles for achieving effective internal control. Which of the following is/are (a) principle(s)?
I. The organization demonstrates a commitment to integrity and ethical values.
II. A level of assurance that is supported by generally accepted auditing procedures and judgments.
III. A body of guiding principles that form a template against which organizations can evaluate a multitude of business practices.
IV. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
The internal audit function's responsibilities with respect to fraud are limited to:
The organization's operational and compliance activities only because financial reporting matters are the responsibility of the independent outside auditor
Monitoring any calls received through the organization's whistleblower hotline but not necessarily conducting a follow-up investigation
Being aware of fraud indicators, including those relating to financial reporting fraud, but not necessarily possessing the expertise of a fraud investigation specialist
Ensuring that all employees have received adequate fraud awareness training
Which of the following is a preventive control?
credit check before approving a sale on account
bank reconciliation
physical inventory count
comparing the accounts receivable subsidiary
Which of the following describes a detective control?
Regularly reviewing financial transactions to identify errors or anomalies
Implementing measures to prevent unauthorized access to sensitive data
Providing training to employees on cybersecurity best practices
Conducting background checks on prospective employees before hiring
Which of the following best exemplifies a control activity referred to as independent verification?
Reconciliation of bank accounts by someone who does not handle cash or record cash transactions
Identification badges and security codes used to restrict entry to the production facility
Accounting records and documents that provide a trail of sales and cash receipt transactions
Separating the physical custody of inventory from inventory accounting
The requirement that purchases be made from suppliers on an approved vendor list is an example of a:
detective control
preventive control
corrective control
compensating control
Which rationale is least likely to be used by a fraud perpetrator?
I deserve this after all the extra work I've done.
This is a temporary fix to my financial situation.
I want to prove how clever I am by beating the system.
I need to help my family with this money.
Which of the following is a key responsibility of the internal audit function in managing fraud risk?
Reviewing and approving all changes to employee pay rates.
Conducting full forensic investigations of all suspected fraud incidents.
Reporting any identified fraud risks to senior management and the board.
Training external auditors on the organization's internal controls.
What is one of the key roles of the internal audit function in managing fraud risk?
Developing fraud-related policies and incentive plans.
Conducting day-to-day fraud detection activities.
Providing independent assurance to the board and management.
Establishing a system of monitoring and reporting.
What fraud schemes were reported to be most common in the ACFE's 2016 Report to the Nations?
Corruption
Fraudulent billing.
Misappropriation of assets by employees.
Inappropriately reporting revenues in published financial results.
A payroll clerk increased the hourly pay rate of a friend and shared the resulting overpayment with the friend. Which of the following controls would have best served to prevent this fraud?
Requiring that all changes to pay records be recorded on a standard form
Periodically reconciling pay rates per personnel records with those of the payroll system
Limiting the ability to make changes in payroll system personnel information
