A chief audit executive (CAE) for a specialty retailer is asked by management to review the
controls in place to manage their electronic funds transfer process. The internal audit
activity has no experience with similar engagements. What is the most appropriate course
of action for the CAE to take?

A.

Plan the engagement and begin fieldwork using existing staff.

B.

Attempt to discourage management from the request.

C.

Hire an outside consulting firm to assist with the engagement.

D.

Defer the audit until current staff can be appropriately trained.

A company has established its environmental audit activity as part of its legal department
rather than part of its internal audit activity,which reports to the audit committee. The board
has requested that the chief audit executive (CAE) provide an annual opinion on whether
environmental risks are being properly addressed. In these circumstances,the CAE should
recommend to the audit committee that the internal audit activity:

A.

Review the recommendations in all environmental audit reports.

B.

Discuss with the environmental auditors the results of their reviews.

C.

Periodically carry out a quality assessment of the environmental audit activity.

D.

Include a review of environmental issues in some internal audit engagements.

In order to effectively handle conflict between audit team members,an audit team leadershould:

A.

Avoid addressing the conflict until the leader is sure that there is a problem.

B.

Be assertive and keep the team members focused on a resolution.

C.

Ask one of the team members to resolve the issue by being more conciliatory.

D.

Transfer one of the team members to another assignment.

It is important for a chief audit executive to seek formal approval from the board regarding
an internal audit charter so that:

A.

The effectiveness of the internal audit activity can be measured.

B.

The status of the internal audit activity can be more clearly established.

C.

There is assurance that all internal audit activities will be completed.

D.

Improvements can be implemented in internal audit processes.

The chief audit executive (CAE) routinely provides activity reports to the board during
quarterly board meetings. Senior management has asked to review the CAE's board
presentation before each board meeting so that any issues or questions can be discussed
beforehand. The CAEshould:

A.

Provide the activity reports to senior management as requested and discuss any issues
that may require action to be taken.

B.

Not provide activity reports to senior management because such matters are the sole
province of the board.

C.

Disclose only those matters in the activity reports that pertain to expenditures and
financial budgets of the internal audit activity.

D.

Provide information to senior management that pertains only to completed audit
engagements and observations available in published engagement final communications.

A bank uses a risk analysis matrix to quantify the relative risk of auditable entities. The
analysis involves rating auditable entities on risk factors using a scale of 1 to 10,with 10
representing the greatest risk. A partial list of risk factors and the ratings given to three of
the bank's departments is provided below:
Department
Risk Factor
A
B
C
Control structure
9
5
7
Nature of assets in department

2
7
9
Dollar value of assets
6
6
8
Complexity of transactions

3
4
8
Which of the following statements regarding risk in the departments is true?

A.

As compared to departments A and C,department B has a stronger control system to
compensate for the greater complexity of the department's transactions and dollar value of its assets.

B.

The internal audit activity should schedule audits of department B more often than audits
of department C because of the relative control strength of department C as compared to
department B.

C.

The nature of department A's control structure may be justified by the nature of the
department's assets and the complexity of its transactions.

D.

The relative ranking of the departments in order of their risk,from greatest to least risk,is:A; C; B.

Which of the following audit findings would have the least impact (either positive or
negative) on a department's control environment?

A.

The department makes long-term investment risk decisions to maximize return on investment.

B.

The department manager sets and demonstrates a tone of honesty and integrity in all business dealings.

C.

Many department functions are duplicated or verified by other department employees.

D.

Deficiencies were found in the appropriate authorization of transactions.

When developing the annual audit plan and reviewing risk assessment priorities,a chief
audit executive should always identifythe:

A.

Potential recommendations for each auditable activity.

B.

Persons to whom engagement reports will be communicated.

C.

Engagement procedures to be used during the engagements.

D.

Internal audit resources required to achieve the audit plan.

Which of the following is the most important limitation on the effectiveness of audit committees?

A.

Audit committees may be composed of independent directors; however,those directors
may have close personal and professional friendships with management.

B.

Audit committee members are compensated by the organization and thus favor a stockholder view.

C.

Audit committees devote most of their efforts to external audit concerns and do not pay
much attention to internal auditing and the overall control environment.

D.

Audit committee members do not normally have degrees in the accounting or auditing fields.

Which of the following internal controls is likely to prevent pollution from waste disposal
before it occurs,rather than detect it after it occurs?

A.

Identification of large budget variances in disposal costs for hazardous chemicals.

B.

Restricted access to environmental department files.

C.

Formal on-the-job training program conducted by the environmental staff.

D.

Samples of water and solid waste taken daily with the results recorded in a log.