Selected IIA-CIA-Part2 CIA Questions Answers

When creating a risk and control matrix to understand a complex manufacturing process, the internal auditor should start by conducting a walk-through of all related activities. This approach allows the auditor to observe the processes in action, understand the flow of transactions, and identify key controls and risks. A walk-through provides a comprehensive understanding of the operational context, which is essential for developing an accurate and effective risk and control matrix.

References:

The Institute of Internal Auditors (IIA) Practice Guide: Auditing the Control Environment

IIA Standard 2210 - Engagement Objectives

A risk that is deemed "unacceptable" to the organization is one where the residual risk (the remaining risk after controls are applied) exceeds the organization's risk tolerance level. This means that despite controls in place, the level of risk remains higher than what the organization is willing to accept. Identifying such risks is critical for ensuring appropriate management action to mitigate them further. References:

The IIA’s Practice Guide on Risk Management.

COSO’s Enterprise Risk Management – Integrating with Strategy and Performance.

To investigate unusually high employee turnover at the organization's primary manufacturing plant, the internal auditor is likely to use benchmarking. Benchmarking involves comparing the organization’s turnover rates with those of similar organizations or industry standards to identify deviations and potential issues. This approach helps in understanding whether the turnover rate is indeed unusually high and what factors may be contributing to it.

References:

IIA Practice Guide: Benchmarking in Internal Audit

IIA Standards: 1220 - Due Professional Care

If senior management decides to accept risks, such as doing business with a questionable vendor, and the chief audit executive (CAE) believes this poses a significant risk to the organization, the CAE should escalate the issue to the board. The board has the ultimate responsibility for overseeing risk management and can decide on the appropriate action to take in response to the risk.

IIA References:

IIA Standard 2600: Communicating the Acceptance of Risks states that when the CAE believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the CAE must discuss the matter with senior management. If the decision regarding risk remains unchanged, the CAE must inform the board.

The Practice Guide on Risk Management highlights the importance of the CAE keeping the board informed of significant risks that management has chosen to accept, particularly when these risks could have a material impact on the organization.