According to the risk factors approach (linking business processes and risks is through the development of basic risk factors used to evaluate risks across processes),which of the following are internal factors?

(I) Internal control effectiveness

(II) Significant changes in operations, processes, personnel, or technology within the company

(III) Legal/regulatory/external requirements

(IV) Complexity

Which of the following symbols in a process map will most likely contain a question?

What risk response option are being applied by the organization: “The risk impact or likelihood is reduced by transferring or otherwise sharing a portion of the risk. Common techniques include purchasing insurance products, engaging in hedging transactions, or outsourcing an activity”

In a risk by process matrix, a process that helps to manage a risk indirectly would be shown to have:

A company has recently outsourced its payroll process to a third-party service provider. An audit team was scheduled to audit payroll controls in the annual audit plan prepared prior to the outsourcing.
What action should the audit team take, considering the outsourcing decision?

Use the chart to answer question. 

If a risk appears in the bottom right of quadrant II in the above risk control map, it means that:

The set of connected activities linker with each other for purpose of achieving an objective?

What risk response option are being applied by the organization: “No action is taken to decrease risk impact or likelihood. The organization is willing to accept the risk at the current level rather than spend valuable resources deploying one of the other risk response options”

What is a business process?

According to the risk factors approach (linking business processes and risks is through the development of basic risk factors used to evaluate risks across processes), which of the following are external factors?

(i) Market Visibility

(ii) Size of process/operation

(iii) Legal/regulatory/external requirements

(iv) Internal control stability

What risk response option are being applied by the organization: “A decision is made to exit or divest of the activities giving rise to the risk. For example, exiting a product line, deciding not to expand to a new geographical market, or selling a division”

Begins by looking at all processes directly at the activity level, and then aggregates the identified processes across the organization.

Refers to how management plans to achieve the organization's objectives.

What risk response option are being applied by the organization: “Exploit the risk if taking such a risk is advantageous to the organization or is necessary to achieve a particular business objective”

Which of the following are business processes?

I. Strategic planning.

II. Review and write-off of delinquent loans.

III. Safeguarding of assets.

IV. Remittance of payroll taxes to the respective tax authorities.

Begins at the entity level with the organization's objectives, and then identifies the key processes critical to the success of each of the organization's objectives

In assessing organizational risk in a manufacturing organization, which of the following would have the greatest long-range impact on the organization? 

A major upgrade to an important information system would most likely represent a high

Internal auditors often prepare process maps and reference  portions of these maps to narrative descriptions of certain activities. This is an appropriate procedure to:

After business risks have been identified, they should be assessed in terms of their inherent:

Use the chart to answer question. 

Which of the following circumstances would concern the internal auditor the most?

What an entity desires to achieve. When referring to what an organization wants to achieve, these are called business objectives, and may be classified as strategic, operations, reporting, and compliance? 

What types of risk response options are there?

According to the risk factors approach (linking business processes and risks is through the development of basic risk factors used to evaluate risks across processes),which of the following are other factors?

Use the chart to answer question. 

If a risk appears in the middle of quadrant IV in the above risk control map, it means that:

The process plays a direct and key role in managing the risk

Which of the following is true regarding business process outsourcing?

What risk response option are being applied by the organization: “Action is taken to reduce the risk impact, likelihood, or both. This involves a myriad of everyday business decisions, such as implementing controls”

Which flowcharting symbol indicates the start or end of a process?

Who has primary responsibility for the monitoring component of internal control?

Reasonable assurance, as it pertains to internal control, means that:

operational level within an organization. The COSO framework uses the terms "Entity-Level Control", "Process-Level Control" and "Transaction-Level Control" to generally describe these controls.

The control activities “Controls over management override” is classified as?

When assessing the risk associated with an activity, an internal auditor should:       

Who has primary responsibility for the control activities component of internal control?

Which of the following best describes an internal auditor's purpose in reviewing the organization's existing governance, risk management, and control processes?

An effective system of internal controls is most likely to detect a fraud perpetrated by a:

COSO's Internal Control Framework consists of five internal control components and 17 principles for achieving effective internal control. Which of the following is/are (a) principle (s)?

I. The organization demonstrates a commitment to integrity and ethical values.
II. A level of assurance that is supported by generally accepted auditing procedures and judgments.
III. A body of guiding principles that form a template against which organizations can evaluate a multitude of business practices

IV. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

Appropriate internal control for a multinational corporation's branch office that has a department responsible for the transfer of money requires that:

The requirement that purchases be made from suppliers on an approved vendor list is an example of a:

An adequate system of internal controls is most likely to detect an irregularity perpetrated by a:

"Internal control is not the responsibility of everyone in an organization. Only the board of directors, management and internal auditors are responsible for internal control". Is this statement true or false?

Who is primarily responsible for the system of internal control system?

COSO's Internal Control Framework consists of five internal control components and 17 principles for achieving effective internal control.

The principle "The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives" supports which component of internal control?

An internal auditor plans to conduct an audit of the adequacy of controls over investments in new financial instruments. Which of the following would not be required as part of such an engagement?

27. COSO's Internal Control Framework consists of five internal control components and 17 principles for achieving effective internal control.

The principle " The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels " supports which component of internal control?

Which of the following best exemplifies a control activity referred to as independent verification?

What is residual risk?

Who is responsible for overseeing management, provides direction regarding internal control, and ultimately has responsibility for overseeing the system of internal controls.

The risk assessment component of internal control involves the:

All controls are designed to mitigate risk either at the enterprise level or at the operational level within an organization. The COSO framework uses the terms "Entity-Level Control", "Process-Level Control" and "Transaction-Level Control" to generally describe these controls.

The control activities “Authorizations.” is classified as?

The control that would most likely ensure that payroll checks are written only for authorized amounts is to:

All controls are designed to mitigate risk either at the enterprise level or at the operational level within an organization. The COSO framework uses the terms "Entity-Level Control", "Process-Level Control" and "Transaction-Level Control" to generally describe these controls.

The control activities “Physical verifications of assets (such as inventory counts).” is classified as?