CIA P3 Internal Audit Operations: practice questions with answers

Question 1

Priya Raman has just been appointed chief audit executive (CAE) of Halvorsen Logistics. The audit committee asks her to produce an internal audit strategy before the next planning cycle. Under the Global Internal Audit Standards, which content is MOST essential to that strategy?

1. A A vision for the function, strategic objectives and supporting initiatives aligned with the organization's strategy
2. B A schedule of the engagements to be performed in the next twelve months, with the budgeted hours for each engagement
3. C A statement of the function's purpose, authority, responsibilities and unrestricted access to records, personnel and property
4. D A detailed manual covering workpaper format, sampling procedures, finding ratings and review sign-offs for engagements

Show the answer

Answer: A. The Global Internal Audit Standards (Principle 9) distinguish several planning documents. The internal audit strategy sets the long-term direction: a vision of what the function aims to become, strategic objectives to get there and initiatives (for example, talent, technology, quality) that support them, aligned with the organization's strategy and stakeholder expectations. The charter records the mandate and authority, the methodologies guide how work is done, and the internal audit plan lists the engagements and resources for a period. The CAE reviews the strategy with the board and senior management periodically.

Question 2

The internal audit strategy of Aysgarth Utilities aims to build a permanent in-house cybersecurity audit capability within three years. This year's risk-based plan includes two high-risk cybersecurity engagements, but no current internal auditor has the expertise needed and recruitment is expected to take about a year. Which resourcing approach BEST supports both the plan and the strategy?

1. A Outsource all cybersecurity engagements to a specialist firm on a three-year contract, so that coverage is secure for the whole of the strategy period
2. B Defer both engagements until the in-house capability has been recruited, so that the work is carried out by the function's permanent staff
3. C Assign the engagements to the function's most experienced financial auditors, who can build cybersecurity knowledge during the fieldwork
4. D Co-source this year's engagements with a contract requiring knowledge transfer to internal auditors, while recruiting and training in-house staff

Show the answer

Answer: D. Resource planning should serve both the current risk-based plan and the longer-term strategy (Standards 9.2, 10.2). Here the plan needs cybersecurity expertise immediately, and the strategy needs that expertise to be held in-house within three years.

A co-sourcing arrangement that deliberately pairs internal auditors with the external specialists, combined with recruitment and training, meets both needs. Fully outsourcing for the whole period meets the plan but not the strategy; deferring meets neither; and using unqualified staff would breach the requirement that the function collectively has, or obtains, the competencies needed to perform the plan.

Question 3

The CAE of Borrowby Health learns that her brother has just been appointed director of procurement. A high-risk assurance engagement on procurement is scheduled in the approved internal audit plan for next quarter. What should the CAE do?

1. A Proceed as planned, since she will not perform any fieldwork herself and the objectivity of the engagement team is not affected by the relationship
2. B Remove the procurement engagement from the plan for as long as her brother remains director of procurement, and explain the change to management
3. C Disclose the relationship to the board and have the engagement supervised and reported independently of her, under the audit committee's oversight
4. D Mention the relationship in the final engagement report, so that readers can take it into account when they consider the engagement's conclusions

Show the answer

Answer: C. A close family member managing the area under review creates at least an appearance of impaired objectivity for the CAE. The Standards require impairments to independence or objectivity, in fact or appearance, to be disclosed promptly to appropriate parties; for the CAE, that means the board. The CAE should also communicate independence concerns to the board as part of her relationship with it.

Because the CAE directs the function and approves engagement communications, the safeguard is to remove her from the engagement: for example, the engagement is supervised and its results approved and reported by someone independent of her (such as an external provider or senior auditor reporting to the audit committee for this engagement). Dropping the engagement would leave a high-risk area uncovered.

Question 4

Hartside Inc., whose shares are registered with the US Securities and Exchange Commission, wants to outsource its internal audit engagements, most of which cover internal accounting controls and financial systems. The lowest bid comes from the registered public accounting firm that audits Hartside's financial statements. What should the CAE conclude?

1. A The firm can perform the engagements if the audit committee pre-approves the service in advance and the fee is disclosed in the company's annual filings
2. B The firm can perform the engagements, provided that different partners and staff carry out the internal audit work and the external audit
3. C The firm cannot perform these engagements, because US rules bar an issuer's external auditor from providing such internal audit outsourcing services
4. D The firm can perform the assurance engagements, but any advisory engagements must be given to a provider that does not audit the company

Show the answer

Answer: C. In managing external service providers, the CAE must consider the provider's independence and objectivity and any legal restrictions. For a US issuer, Section 201 of the Sarbanes-Oxley Act and the SEC's auditor independence rules list internal audit outsourcing services (relating to internal accounting controls, financial systems or financial statements) among the non-audit services that the company's registered public accounting firm may not provide to its audit client (Securities Exchange Act section 10A(g), added by SOX section 201, and Regulation S-X Rule 2-01(c)(4)(v)). This is a US requirement that applies here because Hartside is an SEC registrant; organizations in other jurisdictions must check their own auditor-independence rules, which may differ.

Audit committee pre-approval only applies to services that are permitted, and staffing arrangements within the firm do not cure the conflict of the auditor reviewing its own work. The CAE should choose another qualified provider.

Question 5

The IIA has issued a new Topical Requirement on a subject that appears regularly in the internal audit plan of Glenarm Bank. The requirement becomes effective in twelve months. Which action BEST prepares the function's methodologies?

1. A Leave the methodologies unchanged, because Topical Requirements apply only to functions that perform advisory engagements
2. B Apply the requirement only after an external quality assessment has confirmed that it is relevant to the bank
3. C Ask the business areas concerned to update their own procedures, because Topical Requirements are directed at management
4. D Compare the methodologies and work programs with the new requirement, update them before it is effective and train internal auditors

Show the answer

Answer: D. Topical Requirements are part of the IIA's International Professional Practices Framework and are mandatory when internal auditors provide assurance on the topic covered. They take effect twelve months after issue, and The IIA encourages earlier adoption. Under Standard 9.3, the CAE must establish methodologies and evaluate and update them as needed; a new mandatory requirement is a typical trigger.

A sensible approach is to:
1. perform a gap analysis of methodologies, risk assessment and work programs against the requirement;
2. update them, including how applicability is assessed and how any excluded requirements are justified and documented;
3. train internal auditors before the effective date.

Question 6

Between audit committee meetings, the CAE of Yarrowby Foods phones the committee chair to propose dropping a planned high-risk engagement on food safety and adding a review requested by the chief executive. The chair says the change "sounds fine". The committee's terms of reference reserve approval of the plan and of significant changes to the full committee. What should the CAE do?

1. A Make the change at once, because the committee chair's agreement is equivalent to approval by the full committee
2. B Make the change at once and record the chair's comment as the committee's approval in the planning file
3. C Ask the chief executive to approve the change in writing, because the review being added was requested by him
4. D Treat the call as informal and present the significant change to the committee for approval through its formal process

Show the answer

Answer: D. Standard 11.1 encourages the CAE to use both formal and informal communication with the board. Informal contact, such as calls with the audit committee chair, is valuable for early discussion and building relationships. However, Standard 9.4 requires the board to approve the internal audit plan and significant changes to it.

Dropping a high-risk food safety engagement for a management request is a significant change. The CAE should brief the chair informally, then present the change, its rationale and its effect on coverage to the committee through its formal process (a meeting or a documented written resolution, as its terms allow), and record the decision.