IIA-CIA-Part2 Questions Bank

For internal audit findings and recommendations to be effectively implemented and to ensure that they receive adequate consideration, formal follow-up procedures are essential. According to IIA guidance, it is important that the internal audit activity not only reports the results to management but also ensures that corrective actions are taken or that management consciously accepts the associated risks.

IIA Standard 2500 – Monitoring Progress:

This standard requires that the chief audit executive (CAE) establish a process to monitor and ensure that management actions are effectively implemented or that risks are appropriately accepted. Follow-up is crucial for verifying that management has taken the recommended actions or has acknowledged and accepted the risk of not doing so.

Formal Follow-Up Procedures:

These procedures involve tracking the status of management's responses to audit recommendations, checking if actions were implemented as planned, and determining whether the intended outcomes were achieved. If management decides not to act, the CAE must ensure that the decision is documented and the associated risks are understood and accepted by senior management.

IIA Practice Advisory 2500-1:

This advisory emphasizes the importance of follow-up to ensure that significant audit findings and recommendations are addressed. Without this follow-up, there is a risk that important issues might be neglected or forgotten.

Option A (Reporting results with recommendations): While reporting is important, it does not ensure that recommendations are acted upon.

Option C (Quarterly reporting on audit plan focus): This is related to audit planning, not to ensuring that specific findings and recommendations are considered.

Option D (Discussing findings with independent auditors): This might be useful, but it does not directly influence whether management considers and acts on the internal audit findings.

Detailed Explanation:Why Not Other Options?

The primary purpose of implementing a program whereby employees are rotated from other parts of the organization into the internal audit activity is to provide an opportunity for the recruitment of employees as permanent internal auditors. This rotation program helps in identifying talented individuals who might have the aptitude and interest in internal auditing. It serves as a recruitment strategy by exposing employees from other departments to the internal audit function, potentially increasing the pool of candidates for permanent internal auditor positions. This approach also benefits the internal audit activity by bringing in fresh perspectives and diverse experiences from different areas of the organization.References: IIA's Practice Guide on Human Resources Management, specifically regarding staffing and career development within internal audit functions.

Before developing the audit work program, it is essential to review the contract for evidence of authorization. This step ensures that the contract is valid and approved by the appropriate parties, forming a critical basis for the compliance audit. By confirming authorization, the auditor can ascertain that the contract is legitimate and enforceable, and understand its key terms and conditions, which is necessary for planning and executing the audit effectively. Other steps, such as selecting a sample or assessing risks, are important but should follow after understanding the contract’s validity and scope.References:

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2201 – Planning Considerations.

To confirm the existence of a specific vehicle selected from the fixed asset register, the best indirect evidence would be to compare the registered details of the vehicle with a date-stamped photograph. This method provides a verifiable form of evidence that the vehicle exists and matches the details recorded in the asset register. It ensures that the vehicle is still in possession of the organization and can be indirectly verified without the need for physical presence at an off-site location.

References:

IIA Practice Guide: "Auditing Fixed Assets"

COSO Internal Control – Integrated Framework