Free IIA CIA Part 1 (Internal Audit Fundamentals) Practice Questions

D is correct. Residual risk is the exposure that persists after management has designed and operated its risk responses, including internal controls. Internal auditors evaluate residual risk when concluding on the adequacy of risk management and control processes, because it is the residual level, not the gross level, that must fall within the board-approved risk appetite. Standard 9.1 requires the internal audit function to understand the organization's governance, risk management, and control processes, which includes distinguishing inherent from residual exposure.

D is correct. Under the Global Internal Audit Standards the board reviews and approves the internal audit function's resources, including the budget, and the chief audit executive reports to the board when resources are insufficient (Standards 8.2 and 10.1). When senior management alone determines the budget, the areas subject to audit gain indirect control over how much work the function can perform, which is a resource-based limitation on scope and therefore an impairment of organizational independence that the chief audit executive must communicate to the board.

B is correct. Two obligations operate at once. Standard 1.3 (Legal and Ethical Behavior) and Standard 5.1 (Use of Information) prohibit the auditor from using information obtained improperly or in violation of privacy expectations, so the file itself cannot be treated as engagement evidence at the auditor's own discretion. At the same time, Standard 4.3 (Professional Skepticism) requires an unbiased and critical assessment of the allegation, which cannot be dismissed simply because its source is tainted. Escalating to the chief audit executive resolves both: the allegation enters the organization's established channel for suspected fraud, and decisions about handling the improperly obtained document, involving legal counsel, and pursuing the matter through authorized sources are made at the appropriate level.