IIA IIA-ACCA Online Free Test

Posted by: Pdfprep Category: IIA Online Questions Tags: IIA-ACCA Online Questions Post Date: January 15, 2021

Pdfprep2021-01-15T02:17:44+00:00

When there are some critical comments, IIA will carry out measures as soon as possible, and do improvement and make the IIA-ACCA prep questions are more perfect. When you buy IIA-ACCA premium dumps, you will find the contents are very clear, and the main points are easy to acquire. If you have doubts, the analysis is very particular and easy understanding.

Page 1 of 25

1. The critical path for any project is the path that exhibits which of the following characteristics?

Has the longest duration in time.

Costs the most money.

Requires the largest amount of labor

Is deemed most important to the project.

2. Organizations use matrix management to accomplish which of the following?

To improve the chain of command.

To strengthen corporate headquarters.

To focus better on a single market.

To increase lateral communication.

3. Which of the following is a characteristic of an emerging industry?

Established strategy of players.

Low number of new firms.

High unit costs.

Technical expertise.

4. Which of the following statements is true with regard to information protection?

All personal information, by definition is considered to be sensitive, requiring specialized controls.

Information is not considered personal if it can only be linked to or used to identify an individual indirectly.

Individuals who provide personal information to organizations share in the risk of inappropriate disclosure.

Good protection controls remove any restrictions on the quantity of personal information that can be collected

5. An organization produces two products, X and Y. The materials used for the production of both products are limited to 500 kilograms (kg) per month. All other resources are unlimited and their costs are fixed.

Individual product details are as follows:

Product X

Product Y

Selling price per unit

$10

$13

Materials per unit (at $1/kg)

2 kg

6 kg

Monthly demand

100 units

120 units

In order to maximize profit, how much of product Y should the organization produce each month?

50 units.

60 units.

100 units.

120 units.

6. Data encryption is an example of which of the following controls?

Application control.

IT general control

Data input control

Data output control

7. Which stage of group development is characterized by a decrease in conflict and hostility among group members and an increase in cohesiveness?

Forming stage.

Norming stage.

Performing stage.

Storming stage.

8. A brand manager in a consumer food products organization suspected that several days of the point-of-sale data on the spreadsheet from one grocery chain were missing.

The best approach for detecting missing rows in spreadsheet data would be to:

Sort on product identification code and identify missing product identification codes.

Review store identification code and identify missing product identification codes.

Compare product identification codes for consecutive periods.

Compare product identification codes by store for consecutive periods.

9. Which of the following statements best describes the frameworks set forth by the International Standards Organization?

Globally accepted standards for industries and processes.

Bridging the gaps among control requirements, technical issues, and business risks.

Practical guidance and benchmarks for all organizations that use information systems.

Frameworks and guidance on enterprise risk management, internal control, and fraud deterrence.

10. An internationally recognized brand name is an entrance barrier to new competitors because new competitors would:

Have to initiate a price war in order to enter the industry.

Face increased production costs.

Face increased marketing costs.

Face higher learning costs, which would increase fixed costs.

Page 2 of 25

11. Which of the following statements is true regarding the relationship between an individual’s average tax rate and marginal tax rate?

In a regressive personal tax system, an individual's marginal tax rate is normally greater than his average tax rate.

In a regressive personal tax system, an individual's marginal tax rate is normally equal to his average tax rate.

In a progressive personal tax system, an individual's marginal tax rate is normally equal to his average tax rate.

In a progressive personal tax system, an individual's marginal tax rate is normally greater than his average tax rate.

12. What kind of strategy would be most effective for an organization to adopt in order to implement a unique advertising campaign for selling identical product lines across all of its markets?

Export strategy

Transnational strategy.

Multi-domestic strategy

Globalization strategy.

13. Which mindset promotes the most comprehensive risk management strategy?

Increase shareholder value.

Maximize market share.

Improve operational efficiency.

Mitigate losses.

14. Which of the following conflict resolution methods should be applied when the intention of the parties is to solve the problem by clarifying differences and attaining everyone's objectives?

Accommodating.

Compromising.

Collaborating.

Competing.

15. An internal auditor was asked to review an equal equity partnership In one sampled transaction Partner A transferred equipment into the partnership with a self-declared value of $10,000 and Partner B contributed equipment with a self-declared value of $15 000 The capital accounts of each partner were subsequently credited with S12,500.

Which of the following statements is true regarding this transaction?

The capital accounts of the partners should be increased by the original cost of the contnbuted equipment.

The capital accounts should be increased using a weighted average based on the current percentage of ownership

No action is needed as the capital account of each partner was increased by the correct amount

The capital accounts of the partners should be increased by the fair market value of their contribution

16. Role of the company's leadership in ensuring IT supports the organization's strategies and objectives.

1 and 2 only

3 and 4 only

1, 2, and 4 only

2, 3, and 4 only

17. A multinational organization has multiple divisions that sell their products internally to other divisions.

When selling internally, which of the following transfer prices would lead to the best decisions for the organization?

Full cost

Full cost plus a markup.

Market price of the product

Variable cost plus a markup

18. An internal auditor performed a review of IT outsourcing and found that the service provider was failing to meet the terms of the service level agreement.

Which of the following approaches is most appropriate to address this concern?

The organization should review the skill requirements and ensure that the service provider is maintaining sufficient expertise and retaining skilled resources.

The organization should proactively monitor the performance of the service provider, escalate concerns, and use penalty clauses in the contract where necessary.

The organization should ensure that there is a clear management communication strategy and path for evaluating and reporting on all outsourced services concerns.

The organization should work with the service provider to review the current agreement and expectations relating to objectives, processes, and overall performance.

19. According to IIA guidance, which of the following corporate social responsibility (CSR) activities is appropriate for the internal audit activity to perform?

Determine the optimal amount of resources for the organization to invest in CS

Align CSR program objectives with the organization's strategic plan.

Integrate CSR activities into the organization's decision-making process.

Determine whether the organization has an appropriate policy governing its CSR activities.

20. An organization has started allowing employees to use their personal smart devices to accept vendor payments.

What should the organization's bring-your-own-device (BYOD) policy include to specifically address security and privacy required by the Payment Card Data Security Standard (PCI DSS)?

Approved devices

Mobile applications

Data storage.

Backups and transfers

Page 3 of 25

21. Which of the following is not a potential area of concern when an internal auditor places reliance on spreadsheets developed by users?

Increasing complexity over time.

Interface with corporate systems.

Ability to meet user needs.

Hidden data columns or worksheets.

22. According to IIA guidance on IT auditing, which of the following would not be an area examined by the internal audit activity?

Access system security.

Policy development.

Change management.

Operations processes.

23. Which of the following is the most appropriate test to assess the privacy risks associated with an organization's workstations?

Penetration test.

Social engineering test.

Vulnerability test.

Physical control test.

24. Which of the following IT controls includes protection for mainframe computers and workstations?

Change management controls

Physical and environmental controls.

System software controls

Organization and management controls

25. Which of the following is an element of effective negotiating?

Ensuring that the other party has a personal stake in the agreement.

Focusing on interests rather than on obtaining a winning position.

Considering a few select choices during the settlement phase.

Basing the agreement on negotiating power and positioning leverage.

26. Which of the following statements is true regarding a bring-your-own-device (BYOD) environment?

There is a greater need Kr organizations to rely on users to comply with policies and procedures.

With fewer devices owned by the organization, there is reduced need to maintain documented policies and procedures.

Incident response times are less critical in the BYOD environment. compared to a traditional environment

There is greater sharing of operational risk in a BYOD environment.

27. Which of the following is true regarding the COSO enterprise risk management framework?

The framework categorizes an organization's objectives to distinct, non overlapping objectives.

Control environment is one of the framework's eight components.

The framework facilitates effective risk management, even if objectives have not been established.

The framework integrates with, but is not dependent upon, the corresponding internal control framework.

28. Which of the following local area network physical layouts is subject to the greatest risk of failure if one device fails?

Star network.

Bus network.

Token ring network.

Mesh network.

29. During the last year, an organization had an opening inventory of $300,000, purchases of $980,000, sales of $1,850,000, and a gross margin of 40 percent.

What is the closing inventory if the periodic inventory system is used?

$170,000

$280,000

$300,000

$540,000

30. In order to provide useful information for an organization's risk management decisions, which of the following factors is least important to assess?

The underlying causes of the risk.

The impact of the risk on the organization's objectives.

The risk levels of current and future events.

The potential for eliminating risk factors.

Page 4 of 25

31. Pricing models linked to seasonal demand.

1 and 2 only

2 and 3 only

1, 2, and 3 only

1, 2, 3, and 4

32. Which of the following network types should an organization choose if it wants to allow access only to its own personnel?

An extranet

A local area network.

An intranet

The internet

33. Independent verification of data integrity and accuracy.

1, 2, and 3

1, 2, and 4

1, 3, and 4

2, 3, and 4

34. During a review of a web-based application used by customers to check the status of their bank accounts, it would be most important for the internal auditor to ensure that:

Access to read application logs is restricted to authorized users.

Account balance information is encrypted in the database.

The web server used to host the application is located in a physically secure area.

Sensitive data, such as account numbers, are submitted using encrypted communications.

35. Which of the following would provide the most relevant assurance that the application under development will provide maximum value to the organization?

Use of a formal systems development lifecycle.

End-user involvement.

Adequate software documentation.

Formalized non-regression testing phase.

36. When writing a business memorandum, the writer should choose a writing style that achieves all of the following except:

Draws positive attention to the writing style.

Treats all receivers with respect.

Suits the method of presentation and delivery.

Develops ideas without overstatement.

37. The decision to implement enhanced failure detection and back-up systems to improve data integrity is an example of which risk response?

Risk acceptance.

Risk sharing.

Risk avoidance.

Risk reduction.

38. What is the most significant potential problem introduced by just-in-time inventory systems?

They require significant computer resources.

They are susceptible to supply-chain disruptions.

They require complicated materials-supply contracts.

They prevent manufacturers from scaling up or down to meet changing demands.

39. In the current year, a merchandising organization had an inventory turnover ratio of 3.0, which was less than the industry average of 6.5.

Which of the following offers the most likely explanation for this difference?

The organization has understated the amount of inventory in its financial statements

The organization has overstated the cost of purchases in its financial statements.

The organization is holding obsolete or damaged items in its inventory

The organization experienced an unexpectedly large increase in sales shortly before year end.

40. Which of the following statements regarding program change management is not correct?

The goal of the change management process is to sustain and improve organizational operations.

The degree of risk associated with a proposed change determines if the change request requires authorization.

In order to protect the production environment, changes must be managed in a repeatable, defined, and predictable manner.

All changes should be tested in a non-production environment before migrating to the production environment.

Page 5 of 25

41. Which of the following professional organizations sets standards for quality and environmental audits?

The Committee of Sponsoring Organizations of the Treadway Commission.

The Board of Environmental, Health, and Safety Auditor Certifications.

The International Organization of Supreme Audit Institutions.

The International Standards Organization.

42. Which of the following is an example of an application control?

Automated password change requirements

System data backup process

User testing of system changes

Formatted data fields

43. Refer to the exhibit.

Presented below are partial year-end financial statement data (000 omitted from dollar amounts) for companies A and B:

If company A has a quick ratio of 2:1, then it has an accounts receivable balance of:

$100

$200

$300

$500

44. 5

Based on this data, which of the following describes the value of Cost X in relation to the value of Output Produced?

Cost X is a variable cost.

Cost X is a fixed cost.

Cost X is a semi-fixed cost.

Cost X and the value of Output Produced are unrelated.

45. How inputs combine with outputs to generate activities.

1 and 2 only

1 and 3 only

2 and 4 only

3 and 4 only

46. Which of the following is a key responsibility of a database administrator?

Troubleshoot end user problems

Provide production support.

Provide physical security of databases

Maintain database integrity

47. Which of the following statements about COBIT is not true?

COBIT helps management understand and manage the risks associated with information technology (IT) processes.

Management needs to determine the cost-benefit ratio of adopting COBIT control objectives.

COBIT control objectives are specific to various IT platforms and help determine minimum controls.

COBIT provides management with the capability to conduct self-assessments against industry best practices.

48. Listening effectiveness is best increased by:

Resisting both internal and external distractions.

Waiting to review key concepts until the speaker has finished talking.

Tuning out messages that do not seem to fit the meeting purpose.

Factoring in biases in order to evaluate the information being given.

49. Sales trends.

1 only

4 only

1 and 4 only

1, 2, and 3 only

50. Which of the following strategies would most likely prevent an organization from adjusting to evolving industry market conditions?

Specializing in proven manufacturing techniques that have made the organization profitable in the past.

Substituting its own production technology with advanced techniques used by its competitors.

Forgoing profits over a period of time to gain market share from its competitors.

Using the same branding to sell its products through new sales channels to target new markets.

Page 6 of 25

51. Which of the following is the first step an internal audit activity should undertake when executing a data analytics process'?

Conduct a risk assessment regarding the effectiveness of the data analytics process.

Analyze possible and available sources of raw data

Define the purpose and the anticipated value

Select data for cleaning and normalization procedures.

52. Which of the following are the most common characteristics of big data?

Visibility, validity, vulnerability

Velocity, variety volume.

Complexity completeness constancy

Continuity, control convenience

53. For employees, the primary value of implementing job enrichment is which of the following?

Validation of the achievement of their goals and objectives.

Increased knowledge through the performance of additional tasks.

Support for personal growth and a meaningful work experience.

An increased opportunity to manage better the work done by their subordinates.

54. An organization needs to borrow a large amount of cash to fund its expansion plan.

Which of the following annual interest rates is least expensive?

7 percent simple interest with a 10 percent compensating balance.

7 percent simple interest paid at the end of each year.

7 percent discount interest.

7 percent compounding interest.

55. An organization uses a database management system (DBMS) as a repository for data. The DBMS, in turn, supports a number of end-user developed applications which were created using fourth-generation programming languages. Some of the applications update the database.

Which of the following is the most important control related to the integrity of the data in the database?

End users have their read-only applications approved by the information systems department before accessing the database.

Concurrency update controls are in place.

End-user applications are developed on personal computers before being implemented on the mainframe.

A hierarchical database model is adopted so that multiple users can be served at the same time.

56. In an analysis of alternative credit-management policies, which of the following components will cause the net present value of receivables on credit sales to increase, if everything else remains constant?

A tougher collections policy that reduces the bad debt loss ratio.

A higher cost per unit sold.

A longer average collection period.

An increase in the cost of capital.

57. The greatest advantage of functional departmentalization is that it:

Facilitates communication between primary functions.

Helps to focus on the achievement of organizational goals.

Provides for efficient use of specialized knowledge.

Accommodates geographically dispersed companies

58. When initiating international ventures, an organization should consider cultural dimensions in order to prevent misunderstandings.

Which of the following does not represent a recognized cultural dimension in a work environment?

Self control.

Power distance.

Masculinity versus femininity.

Uncertainty avoidance.

59. Which of the following is a type of network in which an organization permits specific users (such as existing customers) to have access to its internal network through the Internet by building a virtual private network?

Intranet.

Extranet.

Digital subscriber line.

Broadband.

60. Refer to the exhibit.

If the profit margin of an organization decreases, and all else remains equal, which of the following describes how the "Funds Needed" line in the graph below will shift?

The "Funds Needed" line will remain pointed upward, but will become less steep.

The "Funds Needed" line will remain pointed upward, but will become more steep.

The "Funds Needed" line will point downward with a minimal slope.

The "Funds Needed" line will point downward with an extreme slope.

Page 7 of 25

61. Which of the following is an example of a phishing attack?

An employee receives an email that appears to be from the organization's bank, though it is not. The employee replies to the email and sends the requested confidential information.

An organization's website has been hacked. The hacker added political content that is not consistent with the organization's views.

An organization's systems have been compromised by malicious software. The software locks the organization's operating system until d ransom is paid.

An organization's communication systems have been intercepted. A communication session is controlled by an unauthorized third party.

62. Which of the following is the most likely reason an organization may decide to undertake a stock split?

To keep stock price constant.

To keep shareholders' equity constant.

To increase shareholders' equity.

To enhance the stock liquidity.

63. Which of the following engagement observations would provide the least motivation for management to amend or replace an existing cost accounting system?

The distorted unit cost of a service is 50 percent lower than the true cost, while the true cost is 50 percent higher than the competition's cost.

The organization is losing $1,000,000 annually because it incorrectly outsourced an operation based on information from its current system.

The cost of rework, hidden by the current system, is 50 percent of the total cost of all services.

50 percent of total organizational cost has been allocated on a volume basis.

64. A small furniture-manufacturing firm with 100 employees is located in a two-story building and does not plan to expand. The furniture manufactured is not special-ordered or custom-made.

The most likely structure for this organization would be:

Functional departmentalization.

Product departmentalization.

Matrix organization.

Divisional organization.

65. Ability to empathize with other people.

1 and 2 only

1 and 3 only

2 and 3 only

1, 2, and 3

66. Which of the following price adjustment strategies encourages prompt payment?

Cash discounts.

Quantity discounts.

Functional discounts.

Seasonal discounts.

67. Which stage in the industry life cycle is characterized by many different product variations?

Introduction.

Growth.

Maturity.

Decline.

68. A multinational organization involved in online business has planned to set up a help desk service.

Which of the following best describes the role performed by the help desk?

Monitoring access to the online database.

Backing up and maintaining archived data.

Responding to customer inquiries.

Maintaining and assuring network security.

69. Which of the following conditions could lead an organization to enter into a new business through internal development rather than through acquisition?

It is expected that there will be slow retaliation from incumbents.

The acquiring organization has information that the selling organization is weak.

The number of bidders to acquire the organization for sale is low.

The condition of the economy is poor.

70. When applied to international economics, the theory of comparative advantage proposes that total worldwide output will be greatest when:

Each nation's total imports approximately equal its total exports.

Each good is produced by the nation that has the lowest opportunity cost for that good.

Goods that contribute to a nation's balance-of-payments deficit are no longer imported.

International trade is unrestricted and tariffs are not imposed.

Page 8 of 25

71. Organization X owns a 38 percent equity stake in Organization Y.

Which of the following statements is true regarding the financial treatment for this relationship?

Y should be listed as an investment asset on X's balance sheet

X must consolidate the financial statements for both organizations

Y should be reported as a footnote to X's financial statements

Y should not be reported by X as X does not have a controlling interest

72. Which of the following statements is true regarding reversing entries in an accounting cycled

Reversing all previous closing adjustments is a mandatory step in the accounting cycle

Reversing entries should be completed at the end of the next accounting period after recording regular transactions of the period

Reversing entries are identical to the adjusting entries made in the previous period.

Reversing entries are the exact opposite of the adjustments made in the previous period.

73. A supervisor receives a complaint from an employee who is frustrated about having to learn a new software program. The supervisor responds that the new software will enable the employee to work more efficiently and with greater accuracy.

This response is an example of:

Empathetic listening.

Reframing.

Reflective listening.

Dialogue.

74. Instances of unauthorized changes

1 and 3

1 and 4

2 and 3

2 and 4

75. Which of the following would best prevent unauthorized external changes to an organization's data?

Antivirus software, firewall, data encryption.

Firewall, data encryption, backup procedures.

Antivirus software, firewall, backup procedures.

Antivirus software, data encryption, change logs.

76. Which of the following factors is most responsible for the increasing risk that unauthorized parties may obtain or tamper with personal data?

The lack of legal and industry frameworks on privacy.

The absence of generally accepted privacy principles.

The rapid growth and evolution of technology.

The legislated need to retain sensitive personal information.

77. An organization is projecting sales of 100,000 units, at a unit price of $12. Unit variable costs are $7.

If fixed costs are $350,000, what is the projected total contribution margin?

$350,000

$500,000

$850,000

$1,200,000

78. Which of the following standards would be most useful in evaluating the performance of a customer-service group?

The average time per customer inquiry should be kept to a minimum.

Customer complaints should be processed promptly.

Employees should maintain a positive attitude when dealing with customers.

All customer inquiries should be answered within seven days of receipt.

79. Which of the following is a characteristic of just-in-time inventory management systems?

Users determine the optimal level of safety stocks.

They are applicable only to large organizations.

They do not really increase overall economic efficiency because they merely shift inventory levels further up the supply chain.

They rely heavily on high quality materials.

80. If legal or regulatory standards prohibit conformance with certain parts of The IIA's Standards, the auditor should do which of the following?

Conform with all other parts of The IIA's Standards and provide appropriate disclosures.

Conform with all other parts of The IIA's Standards; there is no need to provide appropriate disclosures.

Continue the engagement without conforming with the other parts of The IIA's Standards.

Withdraw from the engagement.

Page 9 of 25

81. Which of the following IT strategies is most effective for responding to competitive pressures created by the marketplace?

Promote closer linkage between organizational strategy and information.

Provide users with greater online access to information systems.

Enhance the functionality of application systems.

Expand the use of automated controls.

82. A key advantage of developing a computer application by using the prototyping approach is that it:

Does not require testing for user acceptance.

Allows applications to be portable across multiple system platforms.

Is less expensive since it is self-documenting.

Better involves users in the design process.

83. A rapidly expanding retail organization continues to be tightly controlled by its original small management team.

Which of the following is a potential risk in this vertically centralized organization?

Lack of coordination among different business units.

Operational decisions are inconsistent with organizational goals.

Suboptimal decision-making.

Duplication of business activities.

84. An organization has a complex systems infrastructure consisting of multiple internally developed, off the shelf, and purchased but significantly customized applications. Some of these applications share databases or process data that is used by another stand-alone application, and interfaces have been written to move data between these applications as needed through batch processing.

Which of the following situations presents the greatest risk exposure given this environment?

Documentation of each system and its interactions, interfaces, and dependencies with other systems and databases is not gathered and maintained.

Batch processing jobs include key financial data that is not posted to the accounting system until the next day. preventing real-time queries.

The job scheduling tool frequently malfunctions, causing scheduled jobs not to run. An error message is sent to IT personnel when a job fails.

The implementation of a major update for a key application is delayed until any potential interdependencies are identified and analyzed.

85. Which of the following is not a barrier to effective communication?

Filtering.

Communication overload.

Similar frames of reference.

Lack of source credibility.

86. An internal auditor has been asked to conduct an investigation involving allegations of independent contractor fraud.

Which of the following controls would be least effective in detecting any potential fraudulent activity?

Exception report identifying payment anomalies.

Documented policy and procedures.

Periodic account reconciliation of contractor charges.

Monthly management review of all contractor activity.

87. Which of the following application-based controls is an example of a programmed edit check?

Reasonableness check.

Transaction log.

Input error correction.

Authorization for access.

88. Which of the following distinguishes the added-value negotiation method from traditional negotiating methods?

Each party's negotiator presents a menu of options to the other party.

Each party adopts one initial position from which to start.

Each negotiator minimizes the information provided to the other party.

Each negotiator starts with an offer, which is optimal from the negotiator's perspective.

89. Which of the following characteristics is most important specifically for a global manager to possess in order to be successful?

Knowledge of different languages.

Understanding of uncertainty avoidance differences

Emotional intelligence

Cultural intelligence

90. Which of the following is the best example of a compliance risk that is likely to arise when adopting a bring-your-own-device (BYOD) policy?

The risk that users try to bypass controls and do not install required software updates.

The risk that smart devices can be lost or stolen due to their mobile nature.

The risk that an organization intrusively monitors personal information stored on smart devices.

The risk that proprietary information is not deleted from the device when an employee leaves.

Page 10 of 25

91. Which of the following are the most appropriate measures for evaluating the change in an organization's liquidity position?

Times interest earned, return on assets, and inventory turnover.

Accounts receivable turnover, inventory turnover in days, and the current ratio.

Accounts receivable turnover, return on assets, and the current ratio.

Inventory turnover in days, the current ratio, and return on equity.

92. Multinational organizations generally spend more time and effort to identify and evaluate:

Internal strengths and weaknesses.

Break-even points.

External trends and events.

Internal risk factors.

93. Which of the following costs would be incurred in an inventory stockout?

Lost sales, lost customers, and backorder.

Lost sales, safety stock, and backorder.

Lost customers, safety stock, and backorder.

Lost sales, lost customers, and safety stock.

94. Which of the following financial instruments should be recorded at fair market value on the financial statements?

Accounts receivable in the short term

Bonds to be held to maturity.

Notes receivable in the short term

Bonds to be held for sale in the short term.

95. Organizational structure.

1 and 3 only

2 and 4 only

1, 2, and 3 only

1, 2, and 4 only

96. The market price is the most appropriate transfer price to be charged by one department to another in the same organization for a service provided when:

There is an external market for that service.

The selling department operates at 50 percent of its capacity.

The purchasing department has more negotiating power than the selling department.

There is no external market for that service.

97. Which of the following factors would reduce dissatisfaction for a management trainee but would not particularly motivate the trainee?

A sense of achievement.

Promotion.

Recognition.

An incremental increase in salary.

98. According to IIA guidance, which of the following statements is true regarding analytical procedures?

Data relationships are assumed to exist and to continue where no known conflicting conditions exist.

Analytical procedures are intended primarily to ensure the accuracy of the information being examined.

Data relationships cannot include comparisons between operational and statistical data

Analytical procedures can be used to identify unexpected differences but cannot be used to identify the absence of differences

99. Evaluate whether the procedures for program change management are adequate.

1 only

1 and 3 only

2 and 4 only

1, 3, and 4 only

100. Operational management in the IT department has introduced performance evaluation policies that are linked to employees achieving continuing education hours.

This activity is designed to prevent which of the following conditions?

Knowledge/skills gap

Monitoring gap

Accountability/reward failure.

Communication failure.

Page 11 of 25

101. To assess the performance of employees.

1 and 2 only

1 and 3 only

2 and 3 only

2 and 4 only

102. Which of the following options correctly defines a transmission control protocol/Internet protocol (TCP/IP)?

System software that acts as an interface between a user and a computer.

A standardized set of guidelines that facilitates communication between computers on different networks.

System software that translates hypertext markup language to allow users to view a remote webpage.

A network of servers used to control a variety of mission-critical operations.

103. Which of the following is a limiting factor for capacity expansion?

Government pressure on organizations to increase or maintain employment.

Production orientation of management.

Lack of credible market leader in the industry.

Company diversification.

104. The first stage in the development of a crisis management program is to:

Formulate contingency plans.

Conduct a risk analysis.

Create a crisis management team.

Practice the response to a crisis.

105. All of the following are possible explanations for a significant unfavorable material efficiency variance except:

Cutbacks in preventive maintenance.

An inadequately trained and supervised labor force.

A large number of rush orders.

Production of more units than planned for in the master budget.

106. It can lead to cultural myopia.

1 and 4 only

2 and 3 only

1, 2, and 3 only

1, 2, and 4 only

107. Which of the following is true regarding an organization's relationship with external stakeholders?

Specific guidance must be followed when interacting with nongovernmental organizations.

Disclosure laws tend to be consistent from one jurisdiction to another.

There are several internationally recognized standards for dealing with financial donors.

Legal representation should be consulted before releasing internal audit information to other assurance providers.

108. Overall system costs are lower.

1 and 2 only

1 and 3 only

2 and 4 only

3 and 4 only

109. Which of the following is false with regard to Internet connection firewalls?

Firewalls can protect against computer viruses.

Firewalls monitor attacks from the Internet.

Firewalls provide network administrators tools to retaliate against hackers.

Firewalls may be software-based or hardware-based.

110. An organization's account for office supplies on hand had a balance of S9,000 at the end of year one. During year two. the organization recorded an expense of $45,000 for purchasing office supplies. At the end of year two. a physical count determined that the organization has $11,500 in office supplies on hand.

Based on this information, what would be recorded in the adjusting entry at the end of year two?

A debit to office supplies on hand for S2.500

A debit to office supplies on hand for $11,500

A debit to office supplies on hand for S20.500

A debit to office supplies on hand for S42.500

Page 12 of 25

111. A holding company set up a centralized group technology department, using a local area network with a mainframe computer to process accounting information for all companies within the group.

An internal auditor would expect to find all of the following controls within the technology department except:

Adequate segregation of duties between data processing controls and file security controls.

Documented procedures for remote job entry and for local data file retention.

Emergency and disaster recovery procedures and maintenance agreements in place to ensure continuity of operations.

Established procedures to prevent and detect unauthorized changes to data files.

112. Which of the following is a primary objective of the theory of constraints?

Full or near capacity in processes.

Smooth workflow among processes.

Few or no defects.

Lowered inventory levels.

113. According to the waterfall cycle approach to systems development, which of the following sequence of events is correct?

Program design, system requirements, software design, analysis, coding, testing, operations.

System requirements, software design, analysis, program design, testing, coding, operations.

System requirements, software design, analysis, program design, coding, testing, operations.

System requirements, analysis, coding, software design, program design, testing, operations.

114. The activity that involves a trial run of a product in a typical segment of the market before proceeding to a national launch is referred to as:

Test marketing

Experimentation

Segmentation

Positioning

115. Preferred stock is less risky for investors than is common stock because:

Common stock pays dividends as a stated percentage of face value.

Common stock has priority over preferred stock with regard to earnings and assets.

Preferred dividends are usually cumulative.

Preferred stock with no conversion feature has a higher dividend yield than does convertible preferred stock.

116. Which of the following does not provide operational assurance that a computer system is operating properly?

Performing a system audit.

Making system changes.

Testing policy compliance.

Conducting system monitoring.

117. Which of the following roles would be least appropriate for the internal audit activity to undertake with regard to an organization's corporate social responsibility (CSR) program?

Consult on project design and implementation of the CSR program.

Serve as an advisor on internal controls related to CS

Identify and prioritize the CSR issues that are important to the organization.

Evaluate the effectiveness of the organization's CSR efforts.

118. Which of the following authentication controls combines what a user knows with the unique characteristics of the user respectively?

Voice recognition and token.

Password and fingerprint.

Fingerprint and voice recognition

Password and token

119. An employee frequently uses a personal smart device to send and receive work-related emails.

Which of the following controls would be most effective to mitigate security risks related to these transmissions?

Hardware encryption.

Software encryption

Data encryption.

Authentication.

120. Which of the following is not a common feature of cumulative preferred stock?

Priority over common stock with regard to dilution of shares.

Priority over common stock with regard to earnings.

Priority over common stock with regard to dividend payment.

Priority over common stock with regard to assets.

Page 13 of 25

121. Which of the following statements is true regarding the capital budgeting procedure known as discounted payback period?

It calculates the overall value of a project

It ignores the time value of money

It calculates the time a project takes to break even.

It begins at time zero for the project.

122. What should the internal auditor's role be in assessing the organization's ethical climate?

Perform ongoing surveys of the employees, customers, and partners of the organization to assess the organization's ethical climate. ^Evaluate the effectiveness of the organization's strategies and

processes for achieving the desired level of legal and ethical compliance.

Maintain a whistleblower hotline to identify inappropriate or illegal activity within the organization.

Perform background checks of potential new employees before they are hired by the organization.

123. According to COSO, which of the following is not considered one of the components of an organization's internal environment?

Authority and responsibility to resolve issues.

Framework to plan, execute and monitor activities.

Integrated responses to multiple risks.

Knowledge and skills needed to perform activities.

124. Which of the following enhances the independence of the internal audit activity?

The chief audit executive (CAE) approves the annual internal audit plan.

The CAE administratively reports to the board.

The audit committee approves the CAE's annual salary increase.

The chief executive officer approves the internal audit charter.

125. A medical insurance provider uses an electronic claims-submission process and suspects that a number of physicians have submitted claims for treatments that were not performed.

Which of the following control procedures would be most effective to detect this type of fraud?

Require the physician to submit a signed statement attesting that the treatments had been performed.

Send confirmations to the physicians, requesting them to verify the exact nature of the claims submitted to the insurance provider.

Develop an integrated test facility and submit false claims to verify that the system is detecting such claims on a consistent basis.

Use computer software to identify abnormal claims based on the insured's age and medical history.

126. Which of the following activities is most likely to require a fraud specialist to supplement the knowledge and skills of the internal audit activity?

Planning an engagement of the area in which fraud is suspected.

Employing audit tests to detect fraud.

Interrogating a suspected fraudster.

Completing a process review to improve controls to prevent fraud.

127. Non-statistical sampling does not require which of the following?

The sample to be representative of the population.

The sample to be selected haphazardly.

A smaller sample size than if selected using statistical sampling.

Projecting the results to the population.

128. The internal audit activity is planning a procurement audit and needs to obtain a thorough understanding of the subcontracting process, which can involve multiple individuals in multiple countries.

Which of the following internal audit tools would be most effective to document the process and the key controls?

Internal control checklist.

Procurement employee survey.

Cross-functional flow chart.

Segregation of duties matrix.

129. An auditor identifies three errors in the sample of 25 entries selected for review (a 12 percent error rate). Based on this result, the auditor assumes that approximately 59 of the total population of 492 entries are incorrect.

To reach this assumption, the auditor has used a technique known as which of the following?

Variability tolerance.

Ratio estimation.

Stratification.

Acceptance sampling.

130. Which of the following is most likely to enhance an internal auditor's objectivity?

An auditor is appropriately able to communicate results.

An auditor performs his work free from interference.

An auditor is unrestricted in determination of scope.

An auditor avoids conflicts of interest.

Page 14 of 25

131. According to IIA guidance, which of the following should be formally documented in the internal audit charter?

The internal audit activity's responsibility for imposing risk management processes.

The internal audit activity's responsibility for the organization's governance framework.

The nature of consulting services provided by the internal audit activity.

The budgeting process for the internal audit activity.

132. An internal auditor wants to sample data to test an audit theory in a cost-effective way.

Which of the following sampling strategies should she use?

Statistical sampling only

Nonstatistical sampling only

A combination of both statistical and nonstatistical sampling.

Neither approach to testing the audit theory would be cost effective.

133. The internal audit activity's responsibilities.

4 only.

1 and 2 only.

3 and 4.

1,2, and 3.

134. Which of the following would not be considered part of preliminary survey of an engagement area?

Interviews with individuals affected by the entity.

Functional walk through test.

Analytical reviews.

Sampling scope.

135. The internal audit charter requires the CAE to report functionally to the audit committee.

3 only

1 and 2 only

2 and 3 only

1, 2, and 3

136. Management would like to self-assess the overall effectiveness of the controls in place for its 200-person manufacturing department.

Which of the following client-facilitated approaches is likely to be the most efficient way to accomplish this objective?

Workshops.

Surveys.

Interviews.

Observation.

137. Information regarding assumptions and procedures to be employed.

1 and 4 only

2 and 3 only

1, 2, and 3 only

1, 2, 3, and 4

138. In the area of business acumen, which of the following competencies would be the sole responsibility of an internal audit staff member?

Maintaining industry-specific knowledge appropriate to the organization.

Assessing how IT contributes to organization objectives, risks, and relevance to audit.

Maintaining technical aspects of accounting standards and reporting processes.

Understanding regulatory and legal framework and assessing its relevance.

139. When developing the organization's first risk universe, which of the following would the chief audit executive be least likely to consider?

The amount of risk that an organization is willing to seek or accept.

The extent and degree of interdependency for identified key risks.

The boundaries established to manage the amount of risk taken.

The exposure to risks following management's risk responses.

140. A multinational organization has asked the internal audit activity to assist in setting up the organization's risk management system. The chief audit executive (CAE) agrees to take on the engagement as a consultant.

Which of the following tasks is appropriate for the CAE to undertake?

Coordinate and facilitate risk workshops for management to attend.

Establish the degree of risk appetite for management to accept.

Set risk indicators and mitigation plans for management to implement.

Determine the number of significant risks for management to report to the board.

Page 15 of 25

141. Which of the following is a common type of payroll fraud?

Unauthorized overtime.

Fictitious employees.

Unearned bonuses or commissions.

Skimming.

142. Which of the following types of fraud includes embezzlement?

Fraudulent statements.

Bribery.

Misappropriation of assets.

Corruption.

143. A furniture manufacturer has installed a new fire sprinkler system at its central warehouse and canceled the existing fire insurance policy on that property.

What change of risk response strategy does this course of action most likely reflect?

From sharing to reduction.

From acceptance to reduction.

From sharing to avoidance.

From acceptance to avoidance.

144. Providing a vehicle driver handbook is an example of a detective control.

1 and 2.

1 and 4.

2 and 3.

3 and 4.

145. Which of the following scenarios best illustrates a rationalization as the root cause of potential fraud?

Managers who have been with the organization for several decades become aware that newly hired, younger managers are being moved more quickly into senior positions.

The controller at a nationwide manufacturing company recently opted to no longer require two-week mandatory vacations for accounting staff.

Security cameras that monitor cash handling at the register are not functioning.

The organization is slowly phasing out three mature products that produce the highest commissions for the sales staff.

146. Who is responsible for setting the risk appetite?

External auditors.

Chief risk officer.

Operations management.

Board of directors.

147. Which of the following offers the best evidence that the internal audit activity has achieved organizational independence?

An independent third party has assessed the organization's system of internal controls to be adequate and effective.

The chief audit executive reports both functionally and administratively to the CE

The internal audit charter is drafted properly and approved by the appropriate parties.

The mission statement and strategy of the internal audit activity demonstrates alignment to organizational objectives.

148. Losing bidders are hired as subcontractors.

1 only

2 only

1 and 3.

2 and 4.

149. Which of the following responsibilities would fall under the role of the chief audit executive, rather than internal audit staff or the audit manager?

Manage and support a quality assurance and improvement program.

Maintain industry-specific knowledge appropriate to the audit engagements

Set clear performance standards for internal auditors and the internal audit activity.

Apply problem-solving techniques for routine situations.

150. According to The IIA's Code of Ethics, which of the following statements is true?

When an internal auditor releases required information to a regulator, resulting in a significant loss through fines and penalties for the organization, he fails to add value.

When an internal auditor limits the scope of the audit engagement after learning that management is hiding relevant information, he demonstrates integrity.

When an internal auditor disagrees with the treatment received by workers in the organization's foreign subsidiary and alters the audit program to highlight the issue, he fails to demonstrate objectivity.

When an internal auditor continues with an audit engagement, despite the audit client's claims that the work performed is unnecessary and redundant he fails to demonstrate competency.

Page 16 of 25

151. Which of the following controls could an internal auditor reasonably conclude is effective by observing the physical controls of a large server room?

Adequate signs are in place to assist in locating safety equipment.

Servers are secured individually to their racks by locks.

Foam fire extinguishers are operable to protect against electrical fires.

Swipe card access is required to gain access to the server room.

152. Which of the following are generally recognized as essential elements of a corporate social responsibility program?

Human rights and the environment.

Organizational governance and financial reporting.

Fair operating practices and government regulation.

Consumer issues and return on investment.

153. While preparing for an audit of senior management expenses, the chief audit executive (CAE) learns that management is unable to locate a number of original expense claims to support the related disbursements. She decides to defer the engagement until they can be located.

Which of the following principles likely guided the CAE's decision?

Objectivity.

Proficiency.

Independence.

Due professional care.

154. According to IIA guidance, which of the following must the internal auditor consider to meet the requirements for due professional care?

The training courses necessary to enhance the internal auditor's knowledge, skills, and other competencies.

The appropriateness of assurance procedures necessary to ensure all significant risks will be identified.

The use of innovative technology and data analysis techniques.

The extent of work needed to achieve the engagement’s objectives.

155. Which of the following is not an objective of internal control?

Compliance.

Accuracy.

Efficiency.

Validation.

156. A headquarters-based internal auditor has been sent to a major overseas subsidiary to conduct various engagements. Initially, the internal auditor spends time to become familiar with local customs and organization's practices while embarking on the first engagement.

Which of the following competencies does the internal auditor exercise?

Communication.

Persuasion and collaboration.

Business acumen.

Governance, risk, and control.

157. According to IIA guidance, which of the following statements describes one of the similarities between assurance and consulting services?

When planning assurance and consulting engagements, internal auditors must consider the strategies and objectives of the activity being reviewed.

Internal auditors determine the engagement objectives, scope, and work program for both assurance and consulting services.

Internal auditors must not provide assurance or consulting services for an activity for which they had responsibility within the previous year.

Both assurance and consulting services generally involve the internal auditor, the area under review, senior management, and the board.

158. An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language.

Which of the following statements about a common risk language is true?

Management will be able to reduce inherent risk because they will have a better understanding of risk.

Internal auditors will be able to reduce their sample sizes because controls will be more consistent.

Stakeholders will have more assurance that the risks are assessed consistently.

Decision makers will understand that the likelihood of missing or ineffective controls will be reduced.

159. Which of the following is the primary engagement responsibility of an entry-level internal auditor?

Leadership.

Documentation.

Analysis.

Reporting.

160. Which of the following options is the most cost-effective and efficient way for internal auditors to keep current with the latest developments in the internal audit profession?

Attending annual professional conferences and seminars.

Participating in on-the-job training in various departments of the organization.

Pursuing as many professional certifications as possible.

Maintaining membership in The HA and similar professional organizations and subscribing to relevant email updates or news feeds.

Page 17 of 25

161. According to The MA Global Internal Audit Competency Framework, which of the following areas of training would best assist the internal audit activity in improving its use of tools and techniques?

Negotiation and conflict resolution.

Project management.

Financial accounting.

Ethics and fraud.

162. Forty-five percent of an organization's customer payments are submitted online. Eight percent of online payments are rejected. Executive management decides to outsource its online payment services to a contractor that will assume 75 percent of the total value of rejected payments. The organization estimates $1.25 million customer payments due during the contract period.

Which of the following represents the organization's residual risk for online customer payments due?

$11, 250

$25, 000

$33, 750

$45, 000

163. Which of the following is the most common way that occupational fraud is detected?

Internal audits.

Whistleblower hotline.

Key controls.

External audits.

164. An internal auditor completed an audit of a bank's loan department and found all significant risks to be managed adequately through effective internal controls.

Which of the following would be an appropriate conclusion to report to management?

The residual risk is lower than or equal to the risk appetite.

The residual risk is higher than or equal to the risk appetite.

The inherent risk is lower than or equal to the risk tolerance.

The inherent risk is higher than or equal to the risk tolerance.

165. An organization is facing a financial downturn and needs to impose major budget reductions to all departments.

According to MA guidance, which of the following actions is most appropriate for the board to take to evaluate the potential impact on the internal audit activity?

Ask management to determine which internal audit engagements are lower risk and could be considered for removal from the annual audit plan.

Ask appropriate stakeholders for their opinion on the potential impacts of reducing the scope of the internal audit plan.

Ask the chief audit executive to determine whether budgetary limitations impede the ability of the internal audit activity to execute its responsibilities.

Ask The human resources department to determine how the annual compensation and salary of the audit staff could be adjusted to achieve savings.

166. Which of the following control activities is the most effective to ensure users' levels of access are appropriate for their current roles?

The human resources department generates a monthly list of terminated and transferred employees and requests IT to update the user access as required.

Standardized user access profiles are developed and the appropriate access profiles are automatically assigned to new or transferred employees.

System administrator rights are assigned to one user in each department who can update user access of terminated or transferred employees immediately.

Department managers are required to perform periodic user access reviews of relevant systems and applications.

167. Which of the following items should the chief audit executive disclose to senior management regarding the results of the internal audit activity's quality assessments?

The internal audit activity's plan for resource allocation.

The amount of the organization's potential loss prevented by the risk-based auditing of the internal audit activity.

The number of audits from the annual internal audit plan that were completed last year.

The qualifications and independence of the assessment Team.

168. Which of the following is an example of a management control technique?

A budget.

A risk assessment.

The board of directors.

The control environment.

169. An internal auditor uses a predefined macro provided in a popular spreadsheet application to verify the present value of the organization's investments.

Which of the following is the most appropriate course of action regarding the auditor's use of this functionality?

The auditor should accept the calculations generated by the function, as any further work or documentation would be inefficient.

The auditor should perform a manual recalculation of several results to validate and document the results.

The auditor should review the programming of the macro before its use to ensure that it is appropriate for the required calculations.

The auditor should tabulate the results in the spreadsheet to ensure the macro has generated the correct results for all calculations.

170. CORRECT TEXT

According to IIA guidance, which of the following scenarios demonstrates an internal auditor exercising due professional care?

When auditing investments, the auditor identified instruments with which he was unfamiliar. He decided not to select that type of investment in his sample, as he did not have the knowledge needed to

perform a proper assessment.

An auditor was reviewing inventory counts conducted by the warehouse staff. One truck containing an immaterial amount of inventory was off-site and wasn't verified by the auditor.

An auditor visited a plant that produces a significant portion of the organization's inventory. The day he arrived, the plant manager was out sick, so the auditor issued the report without interviewing the manager.

An auditor in charge needed to have testing completed by the end of the month, but was behind schedule. He identified a junior auditor to conduct the work for him on a complex area of the organization.

Page 18 of 25

171. A snow removal company is conducting a scenario planning exercise where participating employees consider the potential impacts of a significant reduction in annua snowfall for the coming winter.

Which of the following best describes this type of risk?

Residual.

Net.

Inherent.

Accepted.

172. An internal auditor needs to recommend a policy element to be included in an organization's code of ethics.

Which of the following recommendations would be most effective?

Ethics should vary with local customs in the organization's foreign operations.

Whistleblowing should be discouraged because it can cause distrust among employees.

Ethical behavior should be incorporated into performance evaluations.

Senior management should be granted specific exemptions to the code of ethics.

173. An internal audit activity is using the auditing-by-element approach to audit the organization's controls around corporate social responsibility.

Which of the following would be an element for the internal audit activity to consider?

Working conditions.

Employees' families.

Marketplace competition.

Shareholders and investors.

174. According to IIA guidance, which of the following statements about working papers is false?

They assist in the implementation of recommendations.

They provide support for communication to third parties.

They demonstrate compliance with auditing standards.

They contribute to development of the internal audit staff.

175. Which of the following factors have the greatest influence on the independence of the internal audit activity?

Quality assessments and cultural biases of the internal audit activity.

Rotational assignments and familiarity of the internal audit activity.

Employee incentives and self review of the internal audit activity.

Organizational positioning and scope control of the internal audit activity.

176. Which of the following is a requirement for an assurance engagement that may not be for a consulting engagement?

The internal audit activity has to ensure team members' objectivity is not impaired.

Auditors cannot participate in an assurance engagement of a function for which they previously performed a consulting engagement.

The scope and objective of the engagement is agreed upon based on the engagement client's needs.

The internal audit activity must ensure management actions have been implemented effectively or risk accepted.

177. Which of the following would be the most appropriate first step for the board to take when developing an effective system of governance?

Determine the organization's overall risk appetite.

Establish a governance committee.

Delegate authority to members of senior management.

Identify key stakeholders and their expectations.

178. Planning safeguards for assets in high-risk areas.

1 and 2.

1 and 3.

2 and 3.

3 and 4.

179. If appropriate safeguards exist, which of the following is considered a legitimate internal audit role within risk management at an organization?

Imposing risk management processes.

Providing consolidated reporting on risks.

Taking accountability for risk management.

Making decisions on risk responses.

180. According to COSO, which of the following describes a principle related to the control environment?

The organization identifies and assesses changes that could significantly impact the system of internal control.

The organization establishes appropriate authorities and responsibilities in the pursuit of objectives.

The organization selects and develops control activities that contribute to the mitigation of risks.

The organization performs evaluations to ascertain whether internal control components are present and functioning.

Page 19 of 25

181. The manager for an organization's accounts payable department resigned her post in that capacity. Three months later, she was recruited to the internal audit activity and has been working with the audit team for the last eight months.

Which of the following assignments would the newly hired internal auditor be able to execute without any impairments to independence or objectivity?

An operations audit of the accounts payable department.

A consulting engagement related to a new accounts payable optimization initiative.

A review of the employees' sports club finances, which are overseen by the chief audit executive.

An assurance review for a sales program on which she previously provided consultation.

182. A chief audit executive (CAE) is reviewing the internal audit activity's performance and is concerned that the average number of revisions to findings is steadily rising, making it increasingly difficult to trace the finding to the supporting evidence and workpapers.

According to MA guidance, which of the following elements of the internal audit activity's quality assurance and improvement program would provide the CAE with the most helpful insight into the cause of this problem?

The overall effectiveness of the internal audit activity's periodic self assessments.

The type of audit productivity and performance statistics reported.

The adequacy of the day-to-day supervision and review process.

The scope and frequency of external assessments.

183. Which of the following is most likely to be considered a control weakness?

Vendor invoice payment requests are accompanied by a purchase order and receiving report.

Purchase orders are typed by the purchasing department using prenumbered forms.

Buyers promptly update the official vendor listing as new supplier sources become known.

Department managers initiate purchase requests that must be approved by the plant superintendent.

184. A new director was hired to lead the internal audit activity at a small start-up company.

Which of the following assignments would impair the director's independence?

Preparing the financial statements for the company's defined contribution plan.

Performing a pre-implementation review of the company's payroll application.

Providing the COBIT framework as a possible IT management tool.

Reviewing the company's policy for foreign currency translation adjustments for compliance with accounting standards.

185. A credit card company detects potential errors in credit card numbers by checking whether all entered numbers contain the correct amount of digits.

This is an example of which of the following IT controls?

Logic test.

Check digits.

Data integrity tests.

Balancing control activities.

186. According to IIA guidance, the results of a formal quality assessment should be reported to which of the following groups?

The audit committee and senior management.

The audit committee and the external auditors.

Senior management and management of the audited area.

Senior management and the external auditors.

187. Which of the following documents is most appropriate in promoting the objectivity of the internal audit activity?

Usage of IT system policy.

Risk management framework.

Acceptance of gifts policy.

Personal responsibility policy.

188. An organization decides to take no action on one of its financial risks because the cost of implementing the control outweighs the value of the asset being protected.

Which of the following best describes this risk strategy?

Risk avoidance.

Risk-benefit analysis.

Risk sharing.

Risk acceptance.

189. An internal auditor in a small broadcasting organization was assigned to review the revenue collection process. The auditor discovered that some checks from three customers were never recorded in the organization's financial records.

Which of the following documents would be the least useful for the auditor to verify the finding?

Bank statements.

Customer confirmation letters.

Copies of sales invoices.

Copies of deposit slips.

190. Evidence of strong access controls ensuring that authorized individuals have access only to the functions related to their responsibilities.

1 and 3.

1 and 4.

2 and 3.

2 and 4.

Page 20 of 25

191. A fraud investigation was completed by management, and a proven fraud was communicated to relevant authorities.

According to MA guidance, which of the following roles would be most appropriate for the internal audit activity to undertake after the investigation?

Plan employee sessions and team building strategies for the organization to improve awareness of fraud among employees.

Review the investigation and implement any improvements to the process.

Conduct lessons learned sessions to ascertain how the fraud occurred and which controls failed.

Determine why The fraud was not detected earlier and design controls to strengthen early detection.

192. Which of the following statements is true about The IIA Global Internal Audit Competency Framework?

The core competencies outlined in the framework are not expected of a person undertaking an entry-level position as an internal auditor.

The framework is designed to be used primarily by chief audit executives that are developing indicators to measure the performance of the internal audit activity for which they are responsible.

The framework lists the core competencies internal auditors should possess before attempting to attain The IIA's Certified Internal Auditor certification.

The framework describes competencies needed for individual internal auditors, but not those necessary at the chief audit executive level.

193. Which of the following is an example of a directive control?

Segregation of duties.

Exception reports.

Incentive compensation plans.

Automated reconciliations.

194. Identify fraud.

1 and 4.

1 and 3.

2 and 3.

3 and 4.

195. According to IIA guidance, which of the following best describes internal auditors' responsibility regarding fraud?

Internal auditors should take a leading role in investigating all fraud-related cases.

Internal auditors must have sufficient knowledge to evaluate the risk of fraud.

Internal auditors should report all fraud cases to law enforcement agents, in accordance with the Code of Ethics.

Internal auditors are responsible for ensuring that fraud does not occur.

196. Which of the following types of social responsibilities is voluntary and guided purely by the organization's desire to make social contributions?

The bottom of the pyramid responsibility.

Innovative responsibility.

Ethical responsibility.

Discretionary responsibility.

197. Which of the following combinations of conditions is most likely a red flag for fraud?

The practice of surprise audits and the implementation of an employee support program.

Hiring an employee with a prior fraud conviction and yearly management review.

Occasional accounting department overrides and discontinuation of the anonymous fraud hotline due to infrequent use.

A veteran employee in upper management experiencing financial difficulties and recently implemented enhanced controls.

198. According to IIA guidance, which of the following statements is true when an internal auditor performs consulting services that improve an organization's operations?

The services must be aligned with those defined in the internal audit charter.

The services must not be performed by the same internal auditor who performed assurance services, in order to maintain objectivity.

The services may preclude assurance services from the consulting engagement.

The services impose no responsibility to communicate information other than to the engagement client.

199. The extent of other ongoing services that the engineer may be performing for the organization.

1 and 4 only

2 and 3 only

3 and 4 only

1, 2, and 4 only

200. According to the COSO enterprise risk management (ERM) framework, which of the following is not part of the new paradigm in ERM?

Assessing the risk factors.

Aligning risk appetite and strategy.

Enhancing risk response decisions.

Reducing operational surprises and losses.

Page 21 of 25

201. According to IIA guidance, which of the following statements is true regarding periodic internal assessments of the internal audit activity?

Internal assessments are conducted to benchmark the internal audit activity's performance against industry best practices.

Internal assessments must be performed at least once every five years by a qualified assessor.

An internal auditor may perform a peer review of a colleague's workpapers, as long as the auditor wasn't involved in the audit under review.

Follow-up to ensure appropriate improvements are implemented is a recommended, but not mandatory, element of internal assessments.

202. Given the highly technical and legal nature of privacy issues, which of the following statements best describes the internal audit activity's responsibility with regard to assessing an organization's privacy framework?

If an organization does not have a mature privacy framework, the internal audit activity should assist in developing and implementing an appropriate privacy framework.

Because the audit committee is ultimately responsible for ensuring that appropriate control processes are in place to mitigate risks associated with personal information, the internal audit activity is

required to conduct privacy assessments.

The internal audit activity may delegate to nonaudit IT specialists the responsibility of determining whether personal information has been secured adequately and data protection controls are sufficient.

The internal audit activity should have appropriate knowledge and competence to conduct an asses .......framework.

203. Which of the following best demonstrates the authority of the internal audit activity?

Suggesting alternatives to decision makers.

Improving the integrity of information.

Determining the scope of internal audit services.

Achieving engagement objectives.

204. Which of the following would be the most important consideration by the internal audit activity when selecting employees to perform an internal quality assessment?

Their understanding of auditing standards.

Previous experience working with the internal audit activity.

Their reporting line within the organization.

The nature of their regular duties and responsibilities.

205. Which of the following actions best demonstrates that an internal auditor is exercising due professional care?

The auditor performs thorough reviews and provides absolute assurance of regulatory compliance.

The auditor is alert to the possibility of fraud and activities where irregularities are most likely to occur.

The auditor recommends improvements for all of the organization's procedures and practices.

The auditor is cognizant of reducing travel expenses by combining a personal vacation with a business trip.

206. An internal auditor is reviewing the accounts receivable when she discovers account balances more than three years old. The auditor was previously supervising the area during this time, and she subsequently advises the chief audit executive (CAE) of a potential conflict.

Which of the following is the most appropriate course of action for the CAE to take?

Replace the auditor with another audit staff member.

Continue with the present auditor, as more than one year has passed.

Withdraw the audit team and outsource the financial audit of the division.

Work with the division's management to resolve the situation.

207. The ability to recognize the existence of problems related to tax accounting.

1 and 4 only.

3 and 4 only.

2, 3, and 4 only.

1,2, 3, and 4.

208. According to IIA guidance, which of the following practices by the chief audit executive (CAE) best enhances the organizational independence of the internal audit activity?

CAE reviews and approves the annual audit plan.

CAE meets privately with The CEO at least annually.

CAE meets privately with The board at least annually.

CAE reports to the board regarding audit staff performance evaluation and compensation.

209. Evidence discovered during the course of an engagement suggests that multiple incidents

of fraud have occurred. There do not appear to be sufficient controls in place to prevent reoccurrence.

Which of the following is the internal auditor's most appropriate next step?

Immediately notify management of the area under review and the other internal auditors involved in the engagement.

Discuss the situation with the engagement supervisor to determine whether fraud investigation experts are required to investigate the matter properly.

Fully document in the workpapers the evidence that has been discovered and recommend appropriate controls to address the fraud.

Provide the evidence that was discovered to local law enforcement for possible prosecution of the suspected fraud.

210. Ensure that the entire data set is tested.

1 and 2.

1 and 3.

2 and 3.

2 and 4.

Page 22 of 25

211. What is the primary benefit to the internal audit activity for undertaking an internal quality assessment?

To help the internal audit activity complete its annual assurance plan.

To identify inefficiencies within the internal audit team.

To help improve the overall quality of the internal audit activity's work.

To identify key risks and areas of concern within the organization.

212. According to IIA guidance, which of the following statements is true regarding the reporting of results from an external quality assessment of the internal audit activity?

The external assessment results are reported upon completion in confidence directly to the board, and senior management is advised only of the recommendations and improvement action plans.

The results of self-assessments with independent external validation are shared with the board upon completion, and monitoring of recommended improvements must be reported monthly.

The external assessment results are communicated upon completion to senior management and the board, but action plans for recommended improvements do not have to be reported.

The requirements for reporting quality assessment results are the same for external assessments and self-assessments with independent external validation.

213. A large sales organization maintains a system of internal control according to the COSO model and has updated its code of conduct.

This change relates to which component of the COSO framework?

Control activities.

Information and communication.

Commitment.

Control environment.

214. Which of the following techniques would provide the most compelling evidence that a safety hazard exists within a manufacturing facility?

Observation of the facility during operations.

Questioning of facility management, including the facility safety officer.

Analysis of facility operating reports, focusing on instances when breakdowns occurred.

Review of records involving safety violations, filed by facility production employees.

215. An IT contractor applied for an internal audit position at a bank. The contractor worked for the bank's IT security manager two years ago.

If the audit manager interviewed the contractor and wants to extend a job offer, which of the following actions should the chief audit executive pursue?

Allow the audit manager to hire the contractor and state that the individual is free to perform IT audits, including security.

Not allow the audit manager to hire the contractor, as it would be a conflict of interest.

Allow the audit manager to hire the contractor, but state that the individual is not allowed to work on IT security audits for one year.

Not allow the audit manager to hire the contractor and ask the individual to apply again in one year.

216. A new internal audit activity is creating its first charter.

According to IIA guidance, which of the following objectives would be appropriate for inclusion in the charter?

Continuously monitor the organization's overall risk activities in relation to its risk appetite.

Evaluate the adequacy and effectiveness of the organization's governance activities.

Oversee the establishment and administration of an effective risk management program.

Assist management in implementing recommended control improvements.

217. An internal audit charter, approved by the board, restricts the internal audit activity to providing assurance only on the reliability of financial information and the effectiveness of internal accounting controls.

Which of the following statements is true regarding the extent to which the external auditor may rely on the internal audit activity's work?

The external auditor may make full use of the work, as the audit charter is very specific as to the work the internal audit activity may undertake.

The external auditor may use the work, as the board has approved the charter, thus taking responsibility for any deficiencies.

The external auditor must disregard the work, as the scope of the charter may introduce bias and result in a lack of due professional care.

The external auditor may use the work with caution, due to the internal audit activity's scope and responsibility restrictions.

218. An internal auditor is performing analytical reviews as part of an audit of a supermarket's merchandising department.

Because the economy has declined since midyear, the auditor can expect to encounter which of the following?

Higher inventory turnover.

Higher operating margin.

Lower obsolete stock disposal.

Lower sales volume.

219. Which of the following is an example of collusion?

An employee includes a faked receipt in his expense claim, and the claim is signed by the employee's manager.

A vendor inflates the price of an item and remits a portion of the excess to the purchasing manager.

A vendor sends a duplicate invoice with a new invoice number, and the accounts payable system fails to detect the duplication.

An employee works with the IT manager to develop a program for identifying duplicate invoice payments.

220. In which of the following scenarios would the chief audit executive (CAE) be required to decline the assignment?

The CAE would need to procure external services to deliver the internal audit assurance program.

There is no expertise within the internal audit team for detecting and investigating fraud.

There is no expertise within the internal audit team for auditing an IT engagement.

There is no available expertise on the internal audit team to perform a consulting engagement.

Page 23 of 25

221. Which of the following actions should the audit committee take to promote organizational independence for the internal audit activity?

Delegate final approval of the risk-based internal audit plan to the chief audit executive (CAE).

Approve the annual budget and resource plan for the internal audit activity.

Assist the CAE with hiring objective and competent internal audit staff.

Encourage the CAE to communicate and coordinate with the external auditor.

222. With regard To IT governance, which of the following is the most effective and appropriate role for the internal audit activity?

Independently evaluate the skills and experience of potential chief information officer candidates to assess the best fit based on the organization's risk appetite.

Evaluate the organization's governance standards and assess IT-related activities to identify gaps and develop policies, ensuring alignment with the organization's risk appetite.

Assist management in interpreting complex IT-related privacy and security risk exposures and evaluating potential mitigation strategies.

Assess whether governance activities are aligned with the organization's risk appetite and take into consideration emerging risks.

223. Which of the following best describes the misdirection of payments on accounts receivable to an employee's bank account?

Fraud open on the books.

Fraud hidden on the books.

Fraud off the books.

Fraud on the balance sheet.

224. Percentage of audits completed within 90 days.

1 and 2.

1 and 3.

2 and 3.

3 and 4.

225. Which of the following is the best way to detect fraud?

Conduct anti-fraud training.

Perform background investigations.

Implement process controls.

Activate a whistleblower hotline.

226. In which of the following functions would fraud be most likely to occur?

Maintaining custody of inventory records.

Collecting payments on accounts.

Approving changes to employee records.

Preparing customer statements.

227. An internal auditor is evaluating techniques management uses to mitigate risks within a particular product division.

Which of the following is an example of risk reduction?

Management sells the product division to a competitor.

Management outsources the product division to a third party.

Management allows the product division to remain unchanged.

Management modifies the product division to minimize errors.

228. According to the HA Code of Ethics, which of the following statements best describes the principle of competency?

Internal auditors shall perform their work with honesty, diligence, and responsibility.

Internal auditors shall perform their work in accordance with the Standards.

Internal auditors shall perform their work in accordance with the law and make disclosures expected by the law.

Internal auditors shall be prudent in the use of information acquired while performing their work.

229. Annually, the organization reviews and communicates the code of expected behavior.

1 and 2.

1 and 3.

2 and 3.

2 and 4.

230. The ability to trace each transaction to an accountable and responsible individual.

1,2, and 3.

1.2, and 4.

1.3, and 4.

2, 3, and 4.

Page 24 of 25

231. According to IIA guidance, which of the following is an area in which the internal auditor should be proficient?

Management principles.

Computerized information systems.

Internal audit standards, procedures, and techniques.

Fundamentals of accounting, economics, and finance.

232. According to IIA guidance, which of the following should be included in the internal audit charter?

The minimum resources and competencies needed for the internal audit activity.

Identification of the organizational units where engagements are to be performed.

Organizational relationships and reporting lines.

Assigned responsibilities for designing and implementing controls.

233. According to the COSO enterprise risk management framework, which of the following best describes the activity that helps ensure risk responses are carried out effectively?

Objective setting.

Control activities.

Information and communication.

Event identification.

234. A manufacturing line supervisor joins the internal audit activity for a two-year rotational job assignment and is assigned to an accounts receivable audit.

With regard to this assignment, which of the following should be the primary concern of the audit manager?

Due professional care.

Individual independence.

Individual objectivity.

Organizational independence.

235. Which of the following is an example of a detective control?

Automatic shut-off valve.

Auto-correct software functionality.

Confirmation with suppliers and vendors.

Safety instructions.

236. The relative complexity and extent of work needed to achieve the engagement's objectives.

1, 2, and 3

1, 2, and 4

1, 3, and 4

2, 3, and 4

237. Click the Exhibit.

Internal auditors are asked to keep track of how many hours per day they spend planning the audit, conducting the engagement, and writing the audit report.

The data for two days has been collected as follows:

Day 1

Day 2

Planning the audit

2 hours

3 hours

Conducting the engagement

1 hour

1 hour

Writing the audit report

2 hours

4 hours

Which of the following graphs depicts the data accurately?

Graph A only

Graph B only

Both A and

Neither A nor

238. To use the information obtained as evidence in the current engagement.

4 only

1 and 3 only

1 and 4 only

2, 3, and 4 only

239. Which of the following activities should the chief audit executive perform to ensure compliance with an organization's code of conduct?

Act as an adviser to the committee responsible for reviewing violations of the code.

Review and adjudicate all violations of the code of conduct.

Lead the committee responsible for the oversight of the code.

Implement a system of procedures to inform all employees of the code.

240. An auditor in charge was reviewing the workpapers submitted by a newly hired internal auditor. She noted that the new auditor's analytical work did not include any rating or quantification of the risk assessment results, and she returned the workpapers for correction.

Which section of the workpapers will the new auditor need to modify?

Condition section.

Criteria section.

Effect section.

Cause section.

Page 25 of 25

241. Request a copy of the report from a purchasing audit conducted last year by an external service provider.

1 and 2.

1 and 3.

2 and 4.

3 and 4.

242. Level of audit risk.

1 and 4

2 and 3 only

1, 2, and 3

2, 3, and 4