Sample Questions
Question 1
Easy
Which of the following is best described as a detective control over fraud?
Solution
B is correct. Detective controls are designed to identify fraud that has already occurred or is in progress. A whistleblower hotline surfaces allegations after the fact and is consistently the single largest source of fraud detection in organizations. Preventive controls, by contrast, are designed to stop fraud before it happens by restricting access, dividing incompatible duties, or limiting authority. Under IIA guidance, internal auditors evaluate whether management's fraud risk management framework includes both preventive and detective elements.
Question 2
Medium
While planning an engagement over procurement, which observed condition indicates the greatest fraud risk warranting special consideration?
Solution
D is correct. Fraud risk is greatest where a single individual holds incompatible duties that create the opportunity to both originate and conceal a scheme. A buyer who can add or amend vendor records and also approve invoices under the supervisory review threshold can create a fictitious or related-party vendor and authorize payments that never receive independent scrutiny. Under IIA guidance, the internal audit function considers the potential for fraud when assessing engagement risks, focusing on processes where opportunity, access, and weak monitoring converge rather than on routine or administrative conditions.
Question 3
Hard
An anonymous hotline complaint alleges bid-rigging in procurement. The auditor assigned to investigate managed procurement contracts until six months ago. What should the chief audit executive do?
Solution
C is correct. Three considerations combine here. First, whistleblower complaints alleging a corruption scheme are handled under the organization's investigation protocol, with coordination among internal audit, legal counsel, and fraud specialists, not by the function whose staff are implicated. Second, the assigned auditor held operational responsibility for the exact process under investigation, and that responsibility ended only six months ago, well inside the period the Standards treat as creating a self-review and personal objectivity impairment. Third, Standard 2.2 requires the chief audit executive to identify and manage such threats; for a recent operational role the effective safeguard is to remove the individual from the engagement and staff it with auditors who have no history with procurement, drawing on resources outside the function if the necessary independence or skills are unavailable internally. Disclosure and supervision complement that step but do not substitute for it.
