Free Practice Questions for IIA IIA-CIA-Part2 Exam

The IIA Standards require the CAE to communicate risk acceptance that may be unacceptable to senior management and the board. The first step is to discuss the issue with senior management to understand their perspective and potentially resolve the concern. If senior management does not take appropriate action, the CAE must then inform the board to ensure they are aware of the risk and can take necessary action.References:

The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards)

"Internal Auditing: Assurance and Advisory Services" by Urton L. Anderson et al.

Flowcharts provide a visual depiction of the processes in the area under review, helping internal auditors and stakeholders understand the workflow and identify key control points. Additionally, flowcharts highlight control points, which assist auditors in evaluating the design of controls. These visual tools make it easier to identify potential gaps or weaknesses in the control design and understand how different processes and controls interact. They do not reduce the need for testing whether employees are observing internal control processes or directly prioritize internal control design weaknesses.References: The IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2201 - Planning Considerations.

Given the urgency and the lack of internal expertise in forensic investigation, the most effective and immediate solution is to outsource the investigation to independent professional consultants. This approach ensures that the investigation is conducted by individuals with the necessary skills and experience, thereby maintaining the integrity and quality of the investigation. Training internal staff or recruiting new auditors would take time and may not address the immediate need, while declining the engagement would not fulfill the audit committee's request. References:

"Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)

"Forensic Accounting and Fraud Investigation for Non-Experts" (Howard Silverstone and Michael Sheetz)

According to the Institute of Internal Auditors (IIA) guidance, the independence and objectivity of the internal audit function are fundamental principles. Independence is compromised if the internal audit function takes on roles or responsibilities that are part of management's duties. Coordinating and managing the risk management process is a management responsibility. If internal auditors assume this role, it impairs their ability to remain independent and objective when auditing the effectiveness of the risk management process. References: IIA Standard 1112 – Chief Audit Executive Roles Beyond Internal Auditing

One of the five attributes that internal auditors include when documenting a deficiency is the criteria used to make the evaluation. The criteria represent the standards, measures, or expectations used in the evaluation process. Documenting the criteria is essential as it provides a benchmark against which the actual conditions can be compared, thereby helping to identify and explain deficiencies in controls or processes.

When developing the objectives for an assurance engagement in a newly acquired subsidiary, the most critical items to consider are the organizational strategy, objectives, risks, control framework, and the expectations of stakeholders regarding the audit. This holistic approach ensures that the internal audit aligns with the broader goals and risk management processes of the organization, providing a comprehensive evaluation of the subsidiary's operations within the context of the entire entity.

Organizational Strategy and Objectives: Understanding the overarching goals and strategic direction of the organization helps to align the audit objectives with business priorities and ensures that the subsidiary’s operations are evaluated in the context of their contribution to these goals.

Risks: Identifying and assessing the risks associated with the subsidiary is essential for focusing audit efforts on areas that could significantly impact the organization. This involves understanding both inherent and residual risks.

Control Framework: Evaluating the existing control framework within the subsidiary helps determine the adequacy and effectiveness of controls in mitigating identified risks.

Stakeholder Expectations: Considering what stakeholders expect from the audit helps in shaping objectives that address key concerns and provide valuable insights, fostering greater acceptance and implementation of audit recommendations.

This comprehensive approach ensures the audit is relevant, targeted, and capable of adding significant value to the organization by addressing key risk areas and strategic objectives.

According to the IIA guidance, engagement supervisors' review notes are used during the audit process to ensure thoroughness and accuracy. Once these review notes have been addressed, they can be removed from the final documentation. This practice ensures that the final audit report is clear and concise, containing only the necessary documentation to support audit findings and conclusions. The review notes are considered part of the working papers during the review process but do not need to be retained in the final audit documentation once all issues have been resolved.

When setting the scope for identifying and assessing key risks and controls in a process, developing the scope of the audit based on a bottom-up perspective is the least appropriate approach. A bottom-up perspective typically focuses on individual controls and processes without necessarily aligning with the organization’s critical business objectives and risk appetite. Effective risk assessment should begin with a top-down approach, identifying key business objectives and the associated risks, and then determining the necessary controls to manage these risks. References: IIA Practice Guide – Auditing Key Risk Management, IIA Standard 2200 – Engagement Planning

A privacy audit engagement should comprehensively cover all aspects related to the collection, storage, and compliance of personal information. This includes assessing the appropriateness of the information gathered (1), reviewing the methods used to collect the information (2), ensuring the information collected complies with applicable laws (3), and determining how the information is stored (4). This comprehensive approach ensures that the organization adheres to privacy standards and regulations effectively. References: = IIA’s Practice Guide: “Privacy Impact Assessment” and IIA Standard 2110.A2 -

Internal auditors generally determine the priority of the areas within the engagement scope by assessing the risk of those areas. This involves estimating the likelihood of a risk occurring and the potential impact of that risk on the organization. High-risk areas with a high likelihood of occurrence and significant impact are prioritized to ensure that critical risks are addressed promptly. This risk-based approach to prioritization helps ensure that the audit resources are focused on the most significant areas, enhancing the effectiveness and efficiency of the audit.References:

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2010 - Planning