CIA P3 Engagement Results and Monitoring: practice questions with answers

Question 1

At Merriott Breweries, the actions agreed for an engagement on IT backup controls will be carried out by an outsourced IT service provider under contract. The draft final communication names the provider's account manager as responsible for every action. Whom should the final communication identify as responsible for addressing the findings?

1. A The Merriott manager accountable for the outsourced service, with planned dates
2. B No individual, since actions performed by a third party fall outside the final communication
3. C Only the provider's account manager, since the provider will carry out the remediation work
4. D The CAE, since internal audit will follow up the actions until they are confirmed

Show the answer

Answer: A. Standard 15.1 requires the final communication to specify the individuals responsible for addressing the findings and the planned dates by which the actions should be completed. Management keeps responsibility for risks and controls even when an activity is outsourced, so the responsible individual is the Merriott manager who oversees the service and the contract. The provider may do the work, but accountability (and follow-up) runs through that manager.

Question 2

At Thornbridge Chemicals, the auditor-in-charge emailed the draft report on solvent storage to the plant director and the COO labelled "Final" before the CAE had reviewed it. The CAE's review then finds that one finding overstates the number of exceptions. What should the CAE do?

1. A Treat the email as the final communication, because the recipients may already have acted on it
2. B Approve the emailed version without changes, so recipients do not receive conflicting reports
3. C Tell recipients it was not approved, complete the review, issue an approved final and fix the process
4. D Ask recipients to delete the email, and issue nothing further until next quarter's reporting

Show the answer

Answer: C. Standard 15.1 requires the final engagement communication to be reviewed and approved by the CAE (or a delegate, with the CAE keeping overall responsibility) before it is disseminated. The emailed document was never approved and contains an error, so the recipients should be told promptly that it is not the final communication. The CAE then completes the review, corrects the finding and issues the approved final. The breakdown in the approval process should also be addressed, for example through the quality assurance and improvement program.

Question 3

At Sedgemoor Foods, follow-up of a three-part action plan on supplier onboarding shows that two parts have been implemented and tested. The third, independent verification of supplier bank details, has not started, and its due date has passed. How should internal audit record the status?

1. A Keep the item open, but report it to the audit committee as fully implemented
2. B Delete the third part, because it was not completed by its agreed due date
3. C Record it as partly implemented and open, with the explanation and revised date
4. D Close the action, because most of the agreed steps have now been implemented and tested

Show the answer

Answer: C. Standard 15.2 requires internal auditors to update the status of management's actions in a tracking system. The status should reflect the facts: two parts done and tested, one not started. For the overdue part, internal auditors obtain and document management's explanation and discuss it with the CAE, who decides whether senior management or the board should be told. The item stays open until all parts are confirmed.

Question 4

The draft final communication on purchase-invoice approvals at Arnsdale Textiles states that 37 of the 50 invoices sampled lacked a documented approval. The workpapers show that 7 of the 50 lacked approval. The rest of the report agrees with the evidence. Which quality attribute of communications does this draft fail to meet?

1. A Concise
2. B Constructive
3. C Accurate
4. D Timely

Show the answer

Answer: C. Standard 11.2 requires internal audit communications to be accurate, objective, clear, concise, constructive, complete and timely. Accurate communications are free from errors and distortions and faithful to the underlying facts. Reporting 37 exceptions when the evidence supports 7 misstates the condition by a factor of more than five. That would distort the significance of the finding, so the figure must be corrected before the communication is approved.

Question 5

An audit manager at Oakwood Valley Utilities plans to determine the root cause of repeated meter-reading errors using only data analytics, without involving operations management. He believes that discussing causes with management would compromise internal audit's objectivity. What does Standard 14.3 expect?

1. A Identify the root cause independently, because management's input would impair objectivity
2. B Leave root-cause analysis to management, because internal audit's role is to report conditions only
3. C Collaborate with management to identify root causes when possible, while auditors keep their own judgment
4. D Agree the root cause with management, and adopt management's view wherever the two differ

Show the answer

Answer: C. Standard 14.3 (Evaluation of Findings) requires internal auditors, when possible, to collaborate with management to identify the root causes of findings, determine their potential effects and evaluate their significance. Management often knows the process best, and involving it makes it more likely that action plans tackle the real cause. Objectivity is preserved because internal auditors still evaluate the evidence and form their own judgment; they neither exclude management nor simply adopt its view.

Question 6

The board of Pentland Energy asks the CAE for a view on the residual risk of health and safety across the group's eight sites. Internal audit covered two sites this year. The health and safety function's inspections covered all eight, and the CAE has evaluated that work as reliable. How should the CAE form the view?

1. A Use only the two sites internal audit visited and apply that result to all eight sites
2. B Decline to give any view until internal audit itself has visited all eight sites
3. C Combine its own results with the reliable inspection work, explaining the basis
4. D Adopt the health and safety function's own overall rating without considering its scope

Show the answer

Answer: C. Under Standard 9.5, the CAE may rely on the work of other assurance providers and must document the basis for that reliance; in practice this follows an evaluation of their competence, objectivity and work quality. When giving a view on residual risk across the organization, the CAE combines internal audit's results with reliable work by others, such as second-line inspections, and uses professional judgment. The communication should explain the basis of the view, the sources relied on and any limitations, so that the board can understand it.