Free IIA CIA Part 1 (Internal Audit Fundamentals) Governance, Risk Management, and Control Practice Questions

D is correct. Residual risk is the exposure that persists after management has designed and operated its risk responses, including internal controls. Internal auditors evaluate residual risk when concluding on the adequacy of risk management and control processes, because it is the residual level, not the gross level, that must fall within the board-approved risk appetite. Standard 9.1 requires the internal audit function to understand the organization's governance, risk management, and control processes, which includes distinguishing inherent from residual exposure.

B is correct. The internal audit function may provide advisory input on the design of the organization's ethical framework, including a whistleblower hotline, but management retains responsibility for approving, owning, and operating it. Keeping approval and implementation with management preserves objectivity so the function can later provide assurance over the hotline's effectiveness. Standard 2.2 requires safeguards over objectivity, and the guidance on advisory services permits input without assuming management responsibility.

D is correct. Under the Three Lines Model, a unit that designs controls and reports through the operations director is performing management activity and is not organizationally independent of the process it evaluates, so its work cannot be treated as equivalent to internal audit assurance. IIA guidance on coordination and reliance requires the chief audit executive to evaluate the competence, objectivity, and methodology of other assurance providers before using their work, and to determine what additional internal audit procedures are needed. Self-monitoring of self-designed controls is a recognized objectivity concern; reliance may remain possible, but only after that assessment and with the scope of reliance adjusted accordingly.