IIA-CIA-Part2 Exam Dumps - IIA CIA Questions and Answers

Consulting Engagements: Consulting engagements are advisory in nature and are intended to add value and improve an organization’s governance, risk management, and control processes.

Role of Internal Auditor: In a consulting role, an internal auditor provides advice, facilitates risk management, and helps enhance the efficiency and effectiveness of operations.

Briefing Managers: By briefing department managers on how to implement risk management processes into their daily operations, the internal auditor is providing valuable advice that can help improve the organization ' s risk management framework.

IIA Standards: The IIA’s standards emphasize that consulting activities should aim at improving governance, risk management, and control processes without taking on management responsibilities.

Application software tracing and mapping tracks the program logic line by line to detect unauthorized code, errors, or inconsistencies. Utility software (A) supports system operations, generalized audit software (B) is used for testing data, and audit expert systems (D) assist with decision-making. For identifying unauthorized code, the best tool is Option C.

Bank confirmations are the most reliable source for verifying the current year-end bank balances. These confirmations are direct responses from the bank to the auditor, providing independent verification of the account balances as of the end of the year. This external confirmation is considered more reliable than internal documents like bank statements, reconciliations, or general ledger balances because it comes directly from a third-party source, ensuring its accuracy and completeness.

The Institute of Internal Auditors (IIA) - Practice Guide: External Confirmations

Auditing Standards (e.g., ISA 505 - External Confirmations)

Standard 2340 – Engagement Supervision requires supervisors to review work performed and provide feedback to ensure sufficiency and appropriateness. The first step when finding insufficient information is to discuss the issue with the auditor who prepared the workpapers, clarify what was done, and guide improvements. Training material adjustments may follow later, but the immediate supervisory responsibility is to resolve the issue directly with the assigned auditor.

When communicating the results of the quality assurance and improvement program (QAIP) to the board of a large organization, the chief audit executive (CAE) should explain the rating conclusions and the impact of the results from the external assessment. This ensures transparency and helps the board understand the effectiveness and areas for improvement in the internal audit function.

Rating Conclusions: These provide a summary of the overall quality and performance of the internal audit function.

Impact Explanation: Discussing the impact helps the board understand how the results affect the internal audit ' s ability to fulfill its responsibilities and improve its processes.

Transparency: Clear communication of these aspects helps build trust and provides a basis for informed decision-making by the board.

An internal audit procedures manual typically includes detailed information on the methodologies, tools, and techniques used during audits. It also outlines the protocols and guidelines for auditors to follow, including their authority and the scope of their work. Clearly defining the extent of the auditor ' s authority to collect data from management ensures that auditors understand their rights and limitations, which is essential for carrying out effective and efficient audits.

The Institute of Internal Auditors (IIA), Practice Guide on Developing the Internal Audit Manual

" Internal Auditing: Assurance and Advisory Services " by Urton L. Anderson, Michael J. Head, Sridhar Ramamoorti, Chris A. Bailey, and David A. Sarens

When a significant finding is noted early during a review of the accounts payable function, the best course of action for communicating the issue is to inform internal accounting management via an interim memorandum update. This allows for timely communication and potential early remediation actions, ensuring that management is aware of the issue and can address it promptly before the final audit report is issued.

The primary purpose of creating a preliminary draft audit report is to facilitate communication with management of the area under review. This draft allows for discussion and feedback on the findings, recommendations, and any potential misunderstandings or disagreements before the final report is issued. It helps ensure that the final report is accurate, fair, and reflects the input of both the auditors and management. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2410 - Criteria for Communicating.

The IIA’s Practice Guide on Communicating Results.

Introduction:

The independence and objectivity of the internal audit function are paramount, especially when the CAE has had prior involvement in the area under review.

Scenario Analysis:

Option A: Previous consulting assignments may raise concerns but do not inherently impair independence if managed correctly.

Option B: A historical role in accounting functions is less problematic if sufficient time has passed and there is no ongoing influence.

Option C: Having been the payroll manager presents a direct conflict of interest, compromising the CAE ' s objectivity.

Option D: Reviews following consulting assignments are common practice and do not necessarily indicate a conflict.

Conclusion:

It is problematic for the CAE to provide assurance over payroll functions if they were previously the payroll manager, as this creates a clear conflict of interest and threatens audit objectivity.

IIA’s International Standards for the Professional Practice of Internal Auditing, Standard 1130: Impairment to Independence or Objectivity.

In internal auditing, when assessing the accuracy and completeness of employee time reporting, auditors often use sampling to determine the overall compliance of the process. In this scenario, the internal auditor sampled 30 employee time reports and found 5 incorrect and 4 unsupported reports. This indicates that a majority (21 out of 30) were accurate, suggesting that the organization generally ensures accurate reporting. However, the presence of incorrect and unsupported reports indicates deficiencies that need to be addressed, but do not point to systemic fraud or abuse. Thus, option D accurately reflects the findings by acknowledging both the general accuracy and the instances of errors.

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing

COSO Framework - Control Activities and Monitoring

The primary reason for audit supervision to include the approval of the engagement report is to ensure that the findings and conclusions presented in the report are substantiated by adequate and appropriate evidence. This is critical for maintaining the credibility and reliability of the audit function.

IIA Standard 2340 – Engagement Supervision:

This standard requires that engagements be properly supervised to ensure that objectives are achieved, audit work is performed according to appropriate standards, and that the results are supported by sufficient, reliable, and relevant evidence.

Substantiation of Findings:

Approval of the engagement report by the supervisor ensures that the findings and conclusions are not only accurate but also supported by documented evidence. This substantiation is essential for the report to be credible and for the audit to fulfill its purpose.

IIA Practice Advisory 2340-1:

The advisory emphasizes the role of supervisors in reviewing and approving the engagement report to ensure that all findings are well-founded and appropriately supported by the audit evidence.

Option A (Ensure objectives are met): While meeting objectives is important, the primary focus of report approval is to ensure that the findings are substantiated.

Option B (Ensure senior management support): Support from management is necessary, but it should be based on a report that is well-supported by evidence.

Option C (Ensure style and grammar): Style and grammar are secondary considerations; the primary focus should be on the accuracy and substantiation of findings.

Detailed Explanation:Why Not Other Options?Conclusion: Option D is correct because the primary reason for the supervisor’s approval of the engagement report is to ensure that the findings are substantiated by evidence, ensuring the credibility and reliability of the audit report, in line with IIA standards.

The IIA Standards emphasize that the chief audit executive (CAE) should develop the internal audit plan based on a thorough assessment of risks facing the organization. This risk-based approach ensures that the most significant and relevant areas are prioritized. While input from senior management and regulatory requirements are also important, the primary driver should be the most recent and comprehensive risk assessment. References:

IIA Standards - 2010: Planning

IIA Practice Guide - Developing the Risk-based Internal Audit Plan

If an internal auditor identifies that some employees have inappropriate access to a key system in the early stage of an audit, the best course of action is to issue an interim audit report so that management can implement action plans. This approach ensures that the identified issue is formally communicated to management promptly, allowing them to take immediate corrective action to mitigate the risk. It also documents the auditor ' s findings and recommendations, providing a clear audit trail and supporting accountability. Obtaining verbal assurance or creating a ticket might address the issue temporarily but lacks the formal documentation and follow-up mechanisms inherent in an interim audit report.

IIA Standard 2440: " Disseminating Results "

IIA Practice Advisory 2440-1: " Communicating Interim Engagement Results "

Probability-proportional-to-size (PPS) sampling is a technique used to reach conclusions regarding monetary amounts in a population. It is designed to handle variable sampling by focusing on monetary units, making it appropriate for testing account balances. On the other hand, attribute sampling is used to assess the rate of occurrence of a specific characteristic or attribute in a population, such as compliance with a control procedure, and does not focus on monetary amounts.

The Institute of Internal Auditors (IIA) Practice Guide on " Audit Sampling "

Generally Accepted Auditing Standards (GAAS)

Introduction:

Continuing Professional Development (CPD) is essential for internal auditors to maintain and enhance their skills and knowledge.

Responsibility for CPD:

While the organization and CAE provide support and resources, the primary responsibility for ensuring CPD rests with the individual internal auditors.

Options Analysis:

Option A: Individual internal auditors are responsible for their own CPD.

Option B: The CAE facilitates opportunities for CPD but is not solely responsible.

Option C: The board oversees overall governance and strategy but not individual CPD.

Option D: Engagement supervisors support auditors in their roles but do not manage their CPD.

Conclusion:

Individual internal auditors are responsible for ensuring their own continuing professional development.

IIA ' s Continuing Professional Education Requirements