IIA IIA-CIA-Part2 Actual Questions

The most critical situation for the chief audit executive (CAE) to report to the board is the disagreement with the business unit manager's initial decision to accept a particular risk, which was only addressed after discussion with senior management. This situation is critical because it involves a risk that was initially accepted without proper mitigation, which could have significant implications for the organization. Reporting this to the board ensures that they are aware of potential disagreements regarding risk acceptance and management's approach to risk mitigation.

References:

IIA Standards: 2060 - Reporting to Senior Management and the Board

IIA Practice Guide: Reporting to the Board and Senior Management

To ensure that the company is not taking any unwanted credit risks, the internal auditor should test controls that ensure construction orders are initiated only after the second invoice, which represents 70% of the payment, is paid. This control is critical because it minimizes the financial risk to the company by ensuring that a significant portion of the payment is received before the majority of the work is undertaken. This practice helps protect the company from potential non-payment issues and reduces the financial exposure associated with the project.

References:

COSO Framework

The Institute of Internal Auditors (IIA) Standard 2130: Control

Internal control questionnaires are used to determine whether specific control procedures are in place within an organization. They help auditors identify the existence and implementation of controls designed to mitigate risks. These questionnaires can provide a preliminary understanding of the control environment and identify areas that may require further detailed testing.

References:

The Institute of Internal Auditors (IIA) Practice Guide: Using Internal Control Questionnaires to Assess Risk

IIA Standard 2130 - Control

In internal auditing, evidence must meet certain criteria to support conclusions and recommendations. According to IIA guidance, evidence should be sufficient, reliable, relevant, and useful. In this scenario, the internal auditor concludes that additional staff are needed to fully utilize a fraud surveillance system based on an employee’s statement. However, the conclusion may lack sufficient evidence to support it.

IIA Standard 2310 – Identifying Information:

This standard requires that internal auditors identify sufficient, reliable, relevant, and useful information to achieve the engagement’s objectives. "Sufficiency" refers to the quantity of evidence necessary to convince an informed person of the validity of the auditor’s findings and recommendations.

Sufficiency of Evidence:

The auditor's conclusion about the need for additional staff is based on a single employee’s remark, which is not sufficient evidence. The auditor would need to gather more evidence, such as analyzing workload data, reviewing system logs, or assessing staff capacity, to support the conclusion fully.

IIA Practice Advisory 2310-1:

This advisory emphasizes the need for auditors to obtain enough factual evidence to support their findings. Relying solely on anecdotal evidence from one employee does not meet the standard for sufficiency.

Option B (Reliability): Reliability refers to the accuracy and credibility of the evidence. The employee's statement might be credible but still insufficient in quantity.

Option C (Relevancy): The employee’s comment is relevant to the issue, but relevancy alone does not make the evidence sufficient.

Option D (Usefulness): The information could be useful, but it lacks the sufficiency needed to justify the auditor’s conclusion.

Detailed Explanation:Why Not Other Options?