Sample Questions
Question 1
Easy
Which control most directly prevents payments to fictitious vendors?
Solution
A is correct. A fictitious vendor scheme needs two things: a way to set up a fake payee and a way to process invoices for it. Limiting changes to the vendor master file to people who have no accounts payable duties separates these functions. As a result, no one person can both create a vendor and get it paid. This segregation of duties stops the scheme before any payment goes out, so it is a preventive control rather than a detective one.
Question 2
Medium
During an accounts receivable engagement, which observation is the strongest process-level red flag of lapping?
Solution
C is correct. Lapping hides a stolen customer payment by applying a later customer's payment to the first account, then covering that account with the next receipt, in a rolling chain. Each payment in the chain is posted later than it was received, so a growing gap between deposit dates and posting dates is the classic process-level indicator. Auditors surface it by testing the delay between receipt and posting on customer accounts. The other observations are red flags of different schemes and do not point to misapplied receipts.
Question 3
Hard
An anonymous hotline complaint alleges bid-rigging in procurement. The auditor assigned to investigate managed procurement contracts until six months ago. What should the chief audit executive do?
Solution
C is correct. Three considerations combine here. First, whistleblower complaints alleging a corruption scheme are handled under the organization's investigation protocol, with coordination among internal audit, legal counsel, and fraud specialists, not by the function whose staff are implicated. Second, the assigned auditor held operational responsibility for the exact process under investigation, and that responsibility ended only six months ago, well inside the period the Standards treat as creating a self-review and personal objectivity impairment. Third, Standard 2.2 requires the chief audit executive to identify and manage such threats; for a recent operational role the effective safeguard is to remove the individual from the engagement and staff it with auditors who have no history with procurement, drawing on resources outside the function if the necessary independence or skills are unavailable internally. Disclosure and supervision complement that step but do not substitute for it.
