Free IIA IIA-CIA-Part1 Practice Exam with Questions & Answers | Set: 5

The most appropriate action for the Chief Audit Executive (CAE) to take in the scenario where staff might mistakenly believe the new internal auditor is related to the procurement manager is to discuss the matter with the appropriate personnel to alleviate concerns. This action ensures that concerns about independence and objectivity are addressed transparently, maintaining trust in the internal audit function.

The IIA’s Code of Ethics and standards on objectivity, which stress the importance of maintaining and demonstrating impartiality in all audit engagements.

According to IIA guidance, an appropriate role for the internal audit activity includes coaching management in responding to risks. This involves advising, counseling, and providing insights based on analyses and assessments in a way that adds value and improves an organization's operations without assuming management's responsibilities. Implementing risk responses, imposing risk management processes, or setting the risk appetite would compromise the independence of the internal audit function.

Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

The primary reason a chief audit executive should dedicate time and resources to the continuing professional development of internal audit staff is to ensure they have the competency to address high-priority risks. Continuous professional development ensures that audit staff are equipped with up-to-date knowledge and skills necessary to effectively audit complex and evolving risk environments, thereby contributing directly to the effectiveness and reliability of the internal audit function.

IIA standards on continuing professional development and staff competencies.

To encourage and maintain internal audit objectivity, it is crucial for internal auditors to have an independent reporting line, preferably directly to the audit committee. This policy helps minimize potential biases or influences from management and ensures that audit findings are communicated openly and transparently without fear of repercussion or conflict of interest, thereby safeguarding the objectivity of the audit function.

Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

Segregation of duties is a preventive control designed to mitigate fraud by ensuring that no single individual has control over all phases of a financial transaction. This control reduces the risk of errors and fraud by requiring the involvement of multiple people in tasks such as authorization, custody of assets, and record-keeping.

Institute of Internal Auditors (IIA) - Practice Advisories on Fraud Prevention and Control

The first step for a newly hired chief audit executive (CAE) to build and maintain the proficiency of the internal audit activity should be to incorporate the basic criteria of internal audit competency into job descriptions. This foundational step ensures that all current and future hires are aligned with the required skills and competencies needed for effective internal audit functions. It sets a clear expectation of skills and knowledge right from the recruitment stage, thereby facilitating the development and maintenance of a competent audit team.

The Institute of Internal Auditors (IIA) - Practice Guides on Talent Management

When evaluating whether management has selected appropriate risk responses, an internal auditor should consider the organization's risk appetite—the amount and type of risk that an organization is prepared to pursue, retain, or take. Risk appetite sets the boundaries within which risk responses should be formulated. Risk tolerance and capacity are related concepts, but risk appetite is a more direct measure of whether a particular risk response aligns with organizational goals and strategy.

Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

If the recommendations made by the internal audit activity regarding the organization's risk management function remain unaddressed, the next step should be for the chief audit executive (CAE) to discuss this matter with senior management and the board. This discussion aims to ensure that senior leaders are aware of the unaddressed risks and can take necessary actions to address the internal audit's findings effectively.

The IIA's International Standards for the Professional Practice of Internal Auditing, which stipulate the CAE's responsibilities in communicating significant risk exposures and control issues to senior management and the board.

Internal auditors can indeed provide assurance on reported sustainability results. This involves evaluating the accuracy and completeness of an organization's sustainability reporting and verifying that the reported information reflects actual performance. This role aligns with the broader assurance and advisory functions of internal audit, ensuring that CSR disclosures are reliable and credible.

The Institute of Internal Auditors (IIA) Standards and Practice Advisories.

Global Reporting Initiative (GRI) Standards.

"Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on CSR and Sustainability Reporting.

By recommending revisions to the internal audit charter that include requirements regarding the hiring and compensation of the chief audit executive and the approval of the internal audit budget, the board is most likely defining the functional and administrative responsibilities of the internal audit activity. These aspects pertain to the organizational structure and resource management within the internal audit function, which are fundamental to its operation and effectiveness.

IIA guidance on internal audit charters and governance.

Having more bank accounts than necessary can be a red flag for fraud, especially in a subsidiary compared to its peers. This scenario (option B) might indicate complexity that is unnecessary and could be used to conceal improper transactions or facilitate unauthorized movements of funds. Excessive bank accounts can complicate tracking and reconciling of funds, which can be exploited for fraudulent purposes. This potential red flag should prompt further investigation by the internal auditor.

IIA guidance on fraud risk indicators

According to the IIA's guidance on independence and objectivity, an internal auditor who has been transferred from another department should not audit any function or process of their former department until a reasonable period has passed, typically around one year. Participating in such projects or audits could impair their objectivity because of familiarity or bias related to their former role and relationships within the department. In this case, providing an opinion on a project related to their former department could impair objectivity due to potential conflicts of interest.

The Institute of Internal Auditors (IIA) - Standards for Objectivity

IIA standards require that internal auditors avoid engagements in areas where they recently held operational responsibility, typically within a one-year period, to maintain independence and objectivity​​.

Requiring the matching of a purchase order (PO), receiving report, and invoice before payment is a robust control designed to prevent overpayment and other types of fraudulent activities related to vendor payments. This control ensures that:

The goods or services invoiced were actually ordered (verified by the purchase order).

The goods or services were received (verified by the receiving report).

The invoice amount matches the agreed-upon terms and quantities (verified by the invoice).

This three-way match process helps prevent discrepancies such as overpayments, duplicate payments, or payments for goods/services not received. By ensuring all three documents align, it mitigates the risk of fraud and errors in vendor payments.

The Institute of Internal Auditors (IIA) Standards and Practice Advisories.

COSO Internal Control – Integrated Framework, specifically on control activities.

"Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on Procurement and Accounts Payable Controls.

When an organization has a high level of risk maturity, the internal audit activity is less likely to provide consulting services related to risk management. In highly mature risk environments, organizations typically have well-established risk management processes and capabilities, thereby reducing the need for consulting services from internal audit in this area. Instead, internal audit may focus more on assurance services over the existing risk management processes to ensure they are functioning as intended.

Risk management and internal audit literature discussing the relationship between organizational risk maturity and the role of internal audit.