Highlights: Internal Audit Roles and Responsibilities

1. An organizationwide risk assurance map is BEST described as:

• A · A financial statement disclosure
• B · A visual inventory showing which risks are covered by which assurance providers
• C · A ranked list of individual auditors by experience
• D · A regulatory filing required annually

A risk assurance map identifies the various sources of assurance across the organization, highlighting coverage of key risks and any gaps or duplication.

2. Which competency is MOST critical for internal auditors providing risk management assurance?

• A · Software engineering
• B · Understanding of risk management frameworks and assessment techniques
• C · Marketing analytics
• D · Product design principles

Auditors delivering risk management assurance must be fluent in risk frameworks (e.g., COSO ERM, ISO 31000) and assessment techniques to add value.

3. If a required competency is not present within the internal audit activity, the chief audit executive should:

• A · Cancel the engagement
• B · Obtain competent advice and assistance (e.g., procure external specialists)
• C · Proceed regardless without disclosure
• D · Reassign the engagement to external audit permanently

The IIA Standards allow the CAE to obtain competent advice and assistance where the required skills are not resident in-house.

4. Which of the following would provide the best guidance to a chief audit executive who is setting internal audit staff requirements?

• A · A review of audit staff education and training records.
• B · Information about the audit staff size and composition of comparable organizations.
• C · Results from discussions of audit needs with executive management and the audit committee.
• D · The results of the audit staff's most recent performance reviews.

Option C is correct because the chief audit executive must align internal audit staff requirements with organizational needs and risk priorities. Direct discussions with executive management and the audit committee ensure that staffing decisions reflect the organization's risk appetite, strategic objectives, and stakeholder expectations—fundamental principles outlined in IIA Standard 2030 (Resource Management). Options A and D focus on evaluating existing staff capabilities rather than determining appropriate staffing levels or skill sets needed. Option B provides useful benchmarking data but cannot replace understanding the specific risk environment and audit coverage expectations unique to the organization. Effective resource planning must be driven primarily by the organization's actual assurance and consulting needs, not solely by peer comparisons or internal performance metrics.

5. Why is it important for the chief audit executive to periodically review the audit charter and present the results to senior management and the board?

• A · Because management requires the review to measure effectiveness of the internal audit activity.
• B · So that the individual objectivity of the internal audit staff can be more clearly established.
• C · So that there is assurance of the internal audit staff's proficiency to complete audit activities.
• D · Because changes in the organization may impair the internal audit activity's ability to meet its objectives.

The correct answer is D because organizational changes—such as restructuring, new business lines, technology implementations, or regulatory requirements—can affect the internal audit activity's scope, authority, and access to resources. Periodic review of the audit charter ensures it remains aligned with the organization's evolving risk landscape and that the internal audit activity retains the necessary authority and independence to fulfill its mandate, as required by IIA Standard 1010. Option A is incorrect because charter review is not primarily about measuring effectiveness; that's addressed through quality assurance programs. Option B is incorrect because individual objectivity is maintained through independence assessments and conflict-of-interest declarations, not charter reviews. Option C is incorrect because staff proficiency is ensured through continuing professional development and competency assessments, separate from charter adequacy.

6. A staff auditor, nearly finished with an audit engagement, discovers that the director of marketing has a gambling habit. The gambling issue is not directly related to the existing engagement, and there is pressure to complete the current engagement. The auditor notes the problem and forwards the information to the chief audit executive, but performs no further follow-up. Which of the following statements is true about the auditor's actions?

• A · They are in violation of the IIA Code of Ethics because the auditor withheld meaningful information.
• B · They are in violation of the Standards because the auditor did not properly follow up on a red flag that might indicate the existence of fraud.
• C · They are in violation of neither the IIA Code of Ethics nor the Standards.
• D · They are not in violation of the Standards but are in violation of the IIA Code of Ethics.

The auditor acted appropriately by documenting the discovery and promptly escalating it to the chief audit executive (CAE). According to IIA Standards, auditors must communicate results to appropriate parties, which the auditor did. The CAE, not the staff auditor, has the responsibility to determine whether additional investigation is warranted and to coordinate follow-up activities. The auditor did not withhold information (violating the Code of Ethics) but properly reported it through the chain of command. The gambling habit, while a potential fraud indicator, was outside the current engagement scope, making immediate escalation to the CAE the correct course of action rather than independent follow-up by the staff auditor.

7. Which of the following activities best reflects the scope and status of the internal audit activity as defined in the internal audit policy statement?

• A · The internal auditor reviews the physical access to merchandise during an inventory count.
• B · The audit manager conducts an internal quality assessment of the internal audit activity’s adherence to the Standards.
• C · The audit manager refrains from assigning an auditor who was a former payroll clerk to conduct a payroll audit.
• D · The board approves the annual performance evaluation of the chief audit executive.

Option A is correct because reviewing physical access to merchandise during an inventory count represents a typical operational audit activity that exemplifies the internal audit function's scope—providing independent, objective assurance over controls and processes. This activity directly reflects how internal audit operates as defined in its charter and policy statement. Option B is incorrect because quality assessments evaluate the audit function itself rather than demonstrating its operational scope. Option C addresses independence considerations but doesn't illustrate the audit activity's scope or status. Option D involves board oversight of the CAE, which demonstrates governance structure rather than the internal audit activity's actual scope of work as defined in the policy statement.

8. While attending a conference, an internal auditor won an all-expense paid trip sponsored by a vendor of the internal auditor's organization. Which of the following actions are most appropriate for the auditor to take?

• A · Consult with an immediate supervisor and notify the organization's audit committee.
• B · Consult with an immediate supervisor and review the organization's ethics policy.
• C · Give the prize to a friend or family member and notitfy the organization's audit committee.
• D · Give the prize to a friend or family member and review the organization's ethics policy.

Option B is correct because accepting a gift from a vendor creates a potential conflict of interest or impairment to independence. The auditor must first consult their supervisor for guidance on how to handle the situation and review the organization's ethics policy to determine whether acceptance is permissible or requires disclosure. This aligns with IIA Standard 1120, which requires auditors to maintain objectivity and avoid conflicts of interest. Option A is excessive at this stage—involving the audit committee before consulting management and reviewing policy is premature. Options C and D inappropriately assume transferring the prize resolves the conflict; however, the auditor still won it through their organizational role, and giving it away without proper consultation or policy review fails to address the underlying ethical concern or follow established procedures.

9. An internal audit activity (IAA) provided assurance services for an activity it was responsible for during the preceding year. As a result, which IIA Code of Ethics principle is presumed to be impaired?

• A · Competence.
• B · Flexibility.
• C · Objectivity.
• D · Independence.

Objectivity is impaired when internal auditors provide assurance services over activities they were previously responsible for, as they may have difficulty making unbiased professional judgments about their own prior work. According to IIA Standard 1130, internal auditors must maintain an impartial, unbiased attitude and avoid conflicts of interest, including auditing operations for which they had previous responsibility. This situation creates a self-review threat to objectivity under the Code of Ethics. Independence (option D) relates to the organizational positioning of the entire IAA, not individual auditor conflicts. Competence (option A) concerns professional knowledge and skills, which are unaffected by prior operational responsibilities. Flexibility (option B) is not an IIA Code of Ethics principle; the four principles are Integrity, Objectivity, Confidentiality, and Competency.

10. Suspecting fraud, the chief financial officer (CFO) asked the internal audit activity to investigate a significant increase in travel related expenditures. Work was performed by a qualified internal auditor. Following the completion of the engagement, the chief audit executive (CAE) reported to the CFO that no violations were found and no fraud had occurred. According to the Standards, which of the following principles did the CAE violate?

• A · Due professional care.
• B · Individual objectivity.
• C · Proficiency.
• D · Organizational independence.

The CAE violated due professional care by providing an absolute conclusion that "no fraud had occurred." Standard 1220 requires internal auditors to exercise due professional care by considering the probability of significant errors, fraud, or noncompliance. However, auditors cannot provide absolute assurance that fraud does not exist, as fraud can be concealed and audit procedures have inherent limitations. The CAE should have stated that no violations were detected or identified based on the work performed, rather than declaring definitively that fraud had not occurred. Individual objectivity (B) and proficiency (C) appear intact since a qualified auditor performed the work. Organizational independence (D) was maintained as the CAE reported directly to the CFO who requested the engagement. The issue is solely the inappropriate level of assurance provided.