Chapter 10

Question

Answer

1.Professional skepticism means that internal auditors

beginning an assurance engagement should:

C-Neither assume client personnel

are honest nor assume they are
dishonest

2.Which of the following statements regarding audit

evidence would be the lease appropriate for an internal
auditor to make?

B-"I do not perform procedures that

provide persuasive evidence because
I must obtain convincing evidence."

3.Audit evidence is generally considered sufficient when:

B-There is enough of it to support

well-founded conclusions

4.Documentary evidence is one of the principal types of

corroborating information used by an internal auditor.
Which of the following examples of documentary
evidence generally is considered the most reliable?

A-A vendor's invoice obtained from

the accounts payable department

5.Which of the following statements regarding

observation as an audit procedure is/are correct?

C-I and II

6.Which of the following is the least reasonable

explanation for the changes observed by the auditor?

C-Sales returned for the credit were

overstated in years 2 and 3

7.Which of the following procedures is most

appropriate?

A-Vouch purchase orders to

approved purchase requisitions

8.Which of the following procedures would most likely

detect this fraud?

C-Perform ratio and trend analysis.

9.Which of the following applications of generalized

C-List all major vendors by product
audit software would be most effective in addressing the
line.
auditor's concern?
10.which of the following most completely describes the
C-Objectives, procedures, facts,
appropriate content of internal audit assurance
conclusions and recommendations
engagement working papers?
Chapter 11
1. The primary reason for an internal auditor to use statistical sampling rather than
nonstatistical sampling is to:
A. Allow the auditor to quantitfy, and therefore control, the risk of making an
incorrect decision based on sample evidence
B. Obtain a smaller sample than would be required if nonstatistical sampling were
used
C. reduce the problems associated with the auditor's judgement concerning the
competency of the vidence gathered when nonstatistial is used

D. Obtain a sample more representative of the population than would be obtained if

nonstatistical sampling techniques were used
2. Which of the follwing is an element of sampling risk as opposed to an element of
nonsampling risk?
A.
B.
C.
D.

Determining a sample size that is too small.

Performing an inappropriate audit procedure.
Failing to detect a control deviation.
Forgetting to perfomr a specified audit procedure.

3. For wchich of the following would an internal auditor most likely use attribute sampling?
A. Determining whether the yer-end inventory balance was overstated.
B. Selecting fixed asset additions to inspect.
C. Choosing inventory items to test count
D. Inspecting employee timecards for proper approval
4. If all other factors specified in an attribute sampling plan remain contstant, chanign the
expected population deviation rate from 1% to 2% and changing the tolerable deviation
rate from 7% to 6% would cause the required sample size to:
A. Increase
B. Decrease
C. Remain the same
D. Change by 2%

5. An internal auditor selects a sample of sales invoices and matches them with shipping
documents. This procedure most directly addresses which of the following assertions?
A. All shipments to customers are recorded as receivables.
B. All billed sales are for goods shipped to customers.
C. All recorded receivables represent goods shipped to customers.
D. All shipments to customers are billed.

6. An internal auditor is testing cash disbursement transactions. Internal control policies

require every check request to be accompanied by an approed voucher (that is, a package
of documents evidencing that a good or service has been received and invoiced by the
vendor). The voucher approval is based on a three-way matching of a purcase order,
receiving report, and verndor's nvoice. To determine whether checks have proper support,
the IA should begin her testing procedures by selecting items from the population of:
A. Check copies
B. Purchse orders
C Receiving Reports
D. Approved couchers.
7. The achieved upper deviation limit is 7% and the risk of assessing control risk too low is
5%. How should the internal auditor interpret this attribute sampling outcome?
A. There is a 7% chance that the deviation rate in the population is less than or equal to
5%
B. There is a 5% chance that the deviation rate in the population is less than 7%
C. There is a 5% chance that the deviation rate in the population exceeds 7%
D. There is a 95% chance that the deviation rate in the population equals 7%

8. An internal auditor should consider the qualitative aspects of dviations found in asample
in addition to evaluating the number of deviations. For which of the following situations
should the internal auditor be most concerned?
A. There wre fewer deviations in the sample than expected.
B. The deviations found are similar in nature to those found during the last audit of the
area.
C. The deviation found appear to have been caused by an employee's misunderstanidng
of instructions
D. The deviations found may have been caused intentionally.
9. An internal auditor wants to test customers' A/R balances for overstatement on a sample
basis. Which of the following would be the least valid reason for deciding to use PPS
sampling rather than classical variables sampling?

A. PPS sampling is generally thought to be earier to use than classical variables

sampling
B. The internal auditor expects to find no misstatements and PPS sampling typically
requires a smaller sample size than classical variables sampling in this situation
C. PPS sampling automatically stratifies the population
D. Using PPS sampling eliminates the need for professional judgement in
determining the appropriate sample size and evaluating the sample results

Chapter 12
1. The task performed during an internal audit assurance engagement should address the
following questions:
I. What are the reason for the results?
II. How can performance be improved?
III. What results are being achieved?
The chronologial order in which these questions should be addressed is:
A. I, III, II
B. III, I, II
C. II, III, I
D. III, II, I
B. III, I, II
2. While planning an assurance engagement, the internal auditor obtains knowledge about
the auditee's oepration to, among other things:
E. Develop an attitufe of professional skepticism concerning management's
assertions.
F. Make constructive suggestions to management regarding internal control
improvements.
G. Evaluate whether misstatements in the auditee's performance reports should be
communicated to senior management and the audit committee.
H. Develop an understanding of the auditee's objectives, risks, and controls.
10. Comprehensive risk assessmenet involves analysis of both causes and effects. Which of
the following statements concerning the analysis of causes and effects is false?
A. Analyzing the causes and effects of a partivular risk should only be
performed after the internal auditor has first obtained evidence that a
problem has occurred.
B. Analyzing the causes and effects of a particular risk provides insights about how
to best manage the risk

C. Analyzing the effects of a particular risk provides insights about the relative
importance of the business objective threatened by the risk
D. Analyzing the root causes of a particular risk helps the internal auditor formulate
recommendations for reducing the risk to an acceptable level
11. Which of the following statements does not illustrate the concept of inherent business
risk?
A. Cash is more susceptible to theft than an inventory of sheet metal.
B. A broken lock on a security gate allows employees to access a restricted are that
they are not authorized to enter.
C. Transactions involving complex calculation are more likely to be misstated than
transactions involving simple calculations
D. Technological developments might make a particular product obsolete.

12. Internal auditors obtain an understanding of controls and perofm tests of controls to:
A. Detect material misstatements in account balances.
B. Reduce control risk to an acceptably low level
C. Evaluate the design adequacy and operating effectivness of the controls
D. Assess the inherent risk associated with transactions
13. If an internal auditor's evaluation of internal control desing indicates that the controls are
designed adequately, the appropriate next step would be to:
A. Prepare a flowchar depicting the system of internal controls
B. Test the operating effectiveness of the controls.
C. Conclude that control risk is high
D. Conclude that residual risk is low
14. Internal auditors soemtimes express opinions in addition tostating observations in their
reports. Due professional care requires that internal audit opinions be:
A. Limited to the effectiveness of internal controls
B. Based on sufficient appropriate evidence
C. Based on experience and free from errors and judegemetn
D. expressed only when requested by management or the audit committee

15. Internal auditors perform both assurance engagements and consulting engagements.
Which of the following would be classigied as a consulting engagement?
A. Directly assessing the organization's compliance with laws and regulations
B. Assessing the desing adequacy of the organization's entity-level monitoring activities
C. Faciliating senior management's assessment of risks threatning the organizations.
D. Assisting the independent outside auditor during the financial statement audit
engagement.
16. Reported internal audit observations emerge by a process of comparing "what should be"
with "what is." In determining "what should be" during an audit of a company's treasury
function, which of the following would be the least desirable criterion against which to
judge current operations?
A. Best practices of the treasure function in relevant industries.
B. Company policies and procedures delegating authority and assigning responsibilities
C. Performance standards established by senior management
D. The operations of the treasury function as documented during the last audit.
17. Which of the following statements best describes an internal audit funcitons's
responsibility for assurance engagement follow-up activities?
A. The internal audit function should determine that corrective action has been
taken and is achieveing the desired results, or that senior management has
assumed the risk associated with no taking corrective action on reported
observations.
B. The internal audit function should determine whether management has initiated
corrective action but has no responsibility to determine whether the corrective
action is achieving the desired results. That determination is management's
responsibility
C. The CAE is responsible for scheduling audit follow-up activities only if asked to
do so by senior management or the audit committee. Otherwise, such activities are
discretionary
D. Audit follow-up activities are not necessary if the auditee has agreed in writing to
implement the internal audit function's recommendations.
Chapter 13

1. Which of the following is not likely to be an assurance engagement objective?

A. Evaluated the design adequacy of the payroll input process.
B. Guarantee the accuracy of recorded inventory balances.
C. Assess compliane with health and safety laws and regulations
D. Determine the operating effectiveness of fixed asset controls
2. A process objective stating "All contracts must me approved by an officer of the company
before being consummated" is an example of what type of objective?
A. Compliance
B. Operations
C. Reporting
D. Strategic
3. Analytical procedures can be applied during which phase(s) of an assurance engagement?
A. Plan and perfom phases
B. Perform Phase.
C. Communicate phase
D. Plan phase

4. Which of the following auditee-prepared documents will likely be of greatest assistance

to the internal auditor in their assessment of process desing adequacy?
A. Narrative memoranda listing key tasks for portions of the process
B. Organization charts and job descriptions
C. Detailed flowchars depicting the flow of the process
D. Policies and procedures manual
5. Which of the following controls is not likely to be an entity-level control?
A. All employees must recieve ongoing training to ensure they maintain their competence
B. All cash disbursement transactions must be approved before they are paid
C. All employees must comply with the Code of Ethics and Business Conduct
D. An organizationwide risk assessment is conducted annually
6. Which of the following is not typically a key element of flowcharts or narrative
memoranda?

A. Key risks and controls

B. Key inputs to the process.
C. Key outputs from the process
D. Overall process of objectives.
7. Which of the following external risks is least lkely to impact the accuracy of the financial
reporting?
A. The standard setting body in the organization's country isseus a financial accounting
standard
B. A recent judicial court case increase the likelihood that pending litigation will result in
an unfavorable outcome
C. Changes in standard industry contracts now allow for netting of payables and
receivables
D. Competitor pressures cause the organization to pursue new sales channels
8. Which of the following groups' risk tolerance levels are least relevant when conducting
an assurance engagement?
A. Vendors and customers
B. Process-level management
C. The internal audit function
D. Senior management
9. Which of the following controls is likeley to be least relevant when evaluating the desing
adequacy of a cash collections process?
A. Calculating the amount of cash received
B. Documenting the rationale for selecting the bank account into which the deposit
will be made
C. Matching the total deposits to the amounts credited to customers' A/R balances
D. Segregating the preperation of deposit slips from the adjustment of customer account
balances
10. An internal auditor determiens that the process is not designed adequately to reduce the
underlying risks to an acceptable level. Which of the following should the internal auditor
do next?
A. Wirte the audit report, there's no reason to test the operating effectiveness of cotnrols

that are not designed adequately.

B. Test compensating cotnrols in other (adjacent) processes to see if the impact of
the desing inadequacy is reduced to an acceptable level
C. Test the existing key controls anyway to prove that, despite the design inadequy, the
process is still meeting the process objectives.
D. Postpone the engagement until the design inadequacy has been rectified

11. In an internal auditor identifies na exception while testing, which of the foloowing may
be appropriate?
A. Test additional items to determine whether the exception is an isolated occurrence or
indicative of a control deficiency
B. Gain an understanding of the root cause, that is, the reason the exception occurred.
C. Draft an observation for the audit report.
D. All of the above
12. Which of the folllowing is an appropriate conclusion that can be drawn when the internal
auditor idnetifies an observation from testing controls?
A. The process objectives cannot be achieved.
B. The area may be vulnerable to fraud
C. Certain risk are not effectively mitigated
D. Overall, the process is not operating effectively
13. Once an observation is identified by the internal auditor, it should be:
A. Scheduled for follow-up
B. Discussed with the audit committee
C. Included in the final audit report
D. Documented in the working papers.
Chapter 14
1. Recommendations should be included in final audit communications to:
A. Provide management with options for addressing audit observations
B. Ensure that problems are resolved in the manner suggested by the auditor

C. Minimize the amount of time required to correct audit observations.

D. Guarantee that audit observations are addressed, regardless of cost
2. Once an observation is identified by the internal auditor, it should be:
A. Documented in the working papers
B. Reported to the independent outside auditors
C. Scheduled for follow-up
D. Included in the final audit report
3. According to the IPPF, which of the following are part of the minimum requirements for
an engagement final communication?
I. Background information
II. Purpose of the enagement
III. Engagement scope
IV. Results of the engagement
V. Summaries
A. I, II, an IV
B. I, III, and V
C. II, III, and IV
D. II, IV, and V
4. Which of the following would not be considered a primary objective of a closing or exit
conference?
A. to resolve conflicts
B. To identify concerns for future audit enagements
C. To discuss the engagement observations and recommendations
D. To identify management's actions and responses to the engagement observations and
recommendations
5. Duing a review of purchasing operations, an internal auditor found that procedures in use
did not agree with stated company procedures. However, audit tests revealed that the
procedures used represented an increase in efficiency and a decrease in processing time,
without a discernible decrease in control. The internal auditor should:
A. Report the lack of adherence to documented procedures as an operational deficiency

B. Develop a flowchart of the new procedures and include it in the report to management.
C. Report the change and suggest that the change in procedures be documented
D. Suspend the completion of the engagement cliet documents the new procedures
6. A formal enagement communication must:
A. provide an opportunity for the auditee to respond
B. Document the corrective actions required of senior management
C. Provide a formal means by which the independent outside auditor assesses potential
reliance on the internal audit function
D. Report significant observations
7. Which of the following does the CAE need to consider when determining the extent of
follow up required?
I. Significance of the reposrted observation
II. Past experience with the manager charged with the corrective action
III. Degree of effort and cost needed for the corrective action
IV. The experience of the internal audit staff.
A. I and III
B. I, II, and III
C. II, III, and IV.
D. I, II, III, and IV
8. An excerpt from an internal audit observation indicates that travel advances exceeded
prescribed maximum amounts. Company policy provides travel funds to authorized
employees for travel. Advances are not exceed 45 days of anticipated expenses. Company
procedures do not require justiication for large travel advances. In this audit observation,
the element of an audit finding known as "effect" is:
E. Advances are not to exceed estimated expenses for 45 days.
F. Travel advances exceed prescribed maximum amounts.
G. Employees accumulate large, unneeded advances
H. Unauthorized employees are given travel advances
18. Internal audit reports can be structured to motivate management to correct deficienceis.
Which of the following report-writing techniques is most likely to be effective?
A. State the procedural inadequacies and resulting improprieties in specific terms
B. Recommend changes and state the punitive measures that will follow if the
recommendations are not implemented
C. List the deficiences found so as to provide an easy-to-follow checklist

D. Suggest practical improvements to address the identified observations

19. The primary purpose of issuing an interim report during an internal audit is to:
A. Provide auditee management the opportunity to act on certain observations
immediately
B. Set the stage for the final report
C. Promptly inform auditee management and their supervisors of audit procedures
performed to date
D. Describe the scope of the audit