IIA-CIA-Part2 Premium Exam Questions

The primary weakness of internal control questionnaires (ICQs) is that the respondents, who are often managers or personnel responsible for specific areas, may have incentives to indicate that internal controls are in place, even when they might not be effective or fully operational. This can occur due to a desire to present their department in a positive light, avoid scrutiny, or because of misunderstandings about what constitutes a control. This bias in responses can lead to inaccurate assessments of the internal control environment.

IIA References:

IIA Standard 2310: Identifying Information and its accompanying guidance highlight the importance of obtaining accurate, reliable, and unbiased information when assessing controls. The potential for biased responses in ICQs is a known risk that can undermine the quality of the audit evidence gathered.

The Practice Guide on Evaluating Internal Controls notes that while ICQs are useful for gathering information, auditors should be aware of the limitations and potential biases inherent in this method.

The internal auditor should use a procedure that directly tests the theory that shutdowns are due to outdated purchasing requirements not reflecting changes in production techniques. By comparing the parts needed according to current production estimates and the updated MRP with the purchase orders generated by the system, the auditor can determine if there are discrepancies indicating that the system is not correctly updating for new production methods. This approach ensures that the investigation is focused on the root cause of the issue and provides evidence to support any findings related to the suspected problem.References:

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2310 – Identifying Information.

The most critical factor in determining which engagements should be included in the annual internal audit plan is the organization's annual risk management strategy. This strategy identifies the key risks facing the organization and ensures that the internal audit plan aligns with the areas of highest risk. This prioritization helps ensure that internal audit resources are focused on areas that could have the most significant impact on the organization. References:

"Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)

"Risk-Based Internal Auditing" (IIA Practice Guide)

An audit finding should include the standard(s) used by the auditor to make the evaluation (2) and the factual evidence found during the examination (4). These components provide the basis for the auditor's conclusions and ensure that the findings are well-supported and objective. The scope of the audit (1) and the engagement's objectives (3) are typically included in the overall audit report but are not components of individual audit findings.