CIA P1 Foundations of Internal Auditing: practice questions with answers

Question 1

The audit committee of Marlinspike Ports wants evidence that internal audit is achieving the Purpose of Internal Auditing in Domain I, rather than simply being busy. Which observation in the CAE's annual report provides the best evidence?

1. A Internal audit issued 38 reports this year, four more than last year, all within the budgeted audit days.
2. B Management has accepted every finding raised over the last three years without challenging any of them.
3. C Board and management decisions on risk and control have been better informed by internal audit's work.
4. D No fraud or control failure has occurred during the year in any of the areas that internal audit reviewed.

Show the answer

Answer: C. Domain I states that internal auditing strengthens the organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight. Among the benefits it lists is enhanced decision-making and oversight. The best evidence that the Purpose is being achieved is therefore that the board and management actually use internal audit's work to make better-informed decisions on governance, risk and control. Report counts, uncontested findings or the absence of incidents measure activity or luck, not the value the Purpose describes.

Question 2

The draft internal audit charter of Wenlock Housing states: "Internal auditors may access records and staff once the director responsible for the area has given written consent." Why is this clause a concern?

1. A It is too detailed; the charter should not mention access, which is agreed separately for each engagement.
2. B It omits the external auditor's right to review internal audit's working papers, which the charter must grant.
3. C It lets the auditee decide whether internal audit gets access, so access is no longer unrestricted.
4. D It should require consent from the chief executive instead of directors, to keep a single point of control.

Show the answer

Answer: C. Internal audit can fulfil its mandate only with unrestricted access to the data, records, information, personnel and physical properties relevant to its work. The Standards' essential conditions expect the board to ensure, and senior management to support, this access, and charters normally state it as part of internal audit's authority. Making access depend on the consent of the director being audited lets auditees block or delay engagements, which also threatens internal audit's ability to work free from interference (Standard 7.1). The clause should grant unrestricted access, with confidentiality protected by internal audit's own policies on the use of information.

Question 3

During an advisory engagement on a new ERP system at Tamsin Textiles, the project director asks the internal audit lead to approve user-access role assignments and to sign the go-live authorization. What should the internal audit lead do?

1. A Approve the access roles but decline the go-live sign-off, because only go-live decisions are management responsibilities.
2. B Agree to both, provided the advisory engagement letter is updated to record the extra tasks.
3. C Agree to both, because advisory engagements allow internal audit to take on operational tasks requested by management.
4. D Decline both, because these are management responsibilities, while continuing to advise on the design of access controls.

Show the answer

Answer: D. Advisory services are provided without taking on management responsibilities. Approving access rights and authorizing go-live are management decisions. Taking them on would impair objectivity for future assurance work on the system.

Question 4

A newly appointed non-executive director at Corvel Aggregates asks the CAE what internal auditing is meant to enhance for the organization, according to Domain I (Purpose of Internal Auditing) of the Global Internal Audit Standards. Which answer is consistent with the Standards?

1. A The accuracy of its financial statements, for which internal audit shares primary responsibility with management.
2. B Its risk appetite, which internal audit sets each year on the board's behalf after its risk assessment.
3. C Its decision-making and oversight, its credibility with stakeholders, and its ability to serve the public interest.
4. D The absolute prevention of fraud and error, through internal audit's continuous review of every transaction.

Show the answer

Answer: C. Domain I states that internal auditing strengthens the organization's ability to create, protect and sustain value by providing assurance, advice, insight and foresight. It enhances the organization's: successful achievement of objectives; governance, risk management and control processes; decision-making and oversight; reputation and credibility with stakeholders; and ability to serve the public interest. It does not take over management's responsibilities or guarantee the absence of fraud.

Question 5

The chief digital officer of Sennen Insurance asks internal audit to advise on governance controls for a machine-learning model that will triage motor claims. No one in the internal audit function has data-science or model-risk expertise. What should the CAE do?

1. A Accept, and have the team learn the subject while the engagement progresses.
2. B Obtain the needed competence, for example through an external specialist, or decline the engagement.
3. C Accept, but state in the final communication that the advice may be unreliable.
4. D Pass the request to the external auditor, who must provide any service internal audit cannot.

Show the answer

Answer: B. Under Principle 3 (Demonstrate Competency) and the resource standards in Domain IV, internal auditors must possess or obtain the competencies needed for their work, and the CAE must ensure the function has the resources to perform each engagement. For an advisory request outside the team's expertise, the CAE can obtain competence, for example by engaging an external model-risk specialist or co-sourcing, or can decline the engagement. Accepting without competence, or relying on a disclaimer, would not meet the requirement for due professional care.

Question 6

The Glossary of the Global Internal Audit Standards gives examples of assurance and advisory services. Which of the following is listed as an example of an advisory service?

1. A Compliance engagements
2. B Technology engagements
3. C Financial engagements
4. D Providing forensic services

Show the answer

Answer: D. The Glossary's examples of assurance services are compliance, financial, operational/performance and technology engagements. Its examples of advisory services are advising on the design and implementation of new policies, processes, systems and products; providing forensic services; providing training; and facilitating discussions about risks and controls.