Sample Questions
Question 1
Easy
According to IIA guidance, who ordinarily participates in an engagement's closing communication?
Solution
D is correct. The closing communication, often called the exit conference, brings together the internal auditors who performed the work and the management of the activity reviewed, that is, the people with direct knowledge of the process and the authority to act on the results. Its purpose is to confirm the factual accuracy of the observations, discuss the conclusions and their significance, and agree action plans before the final engagement communication is prepared. Standard 15.1 then makes the chief audit executive responsible for reviewing and approving the final communication and determining its recipients.
Question 2
Medium
Management rejects the recommended system control as too costly and proposes a lower-cost manual alternative. What is the most appropriate response?
Solution
A is correct. Recommendations propose a way to address a finding, but management decides how to respond and weighs the cost of the action against the benefit obtained. Under Standard 14.4, the internal auditor assesses the action management proposes against the root cause stated in the finding and against the risk that would remain after implementation. If the alternative addresses the root cause and brings risk within acceptable levels, it becomes the agreed action plan and is monitored to completion.
Question 3
Hard
Two engagements a year apart report the same root cause, a defective validation rule owned by shared services. Each business unit accepted a local detective action plan. What is most appropriate?
Solution
C is correct. An action plan is adequate only when it addresses the root cause of the condition, and here the cause sits in a validation rule maintained by shared services rather than in either business unit. Detective plans adopted locally catch errors after they occur but leave the defective rule intact, which is why the same condition surfaced in a second engagement. The chief audit executive aggregates the two observations into a single systemic finding, directs it to the shared services owner who has the authority to correct the rule, and requests an action plan from that owner while retaining the local plans as interim mitigation. Follow-up then tests the corrected rule rather than the compensating detective work in each unit.
