Free IIA-CHAL-QISA Practice Test

The internal audit activity is responsible for evaluating the effectiveness and efficiency of internal controls. A key component of evaluating efficiency is assessing whether the cost of implementing and maintaining a control is justified by the benefit it provides in terms of risk reduction. This cost-benefit analysis is a critical advisory function that helps the organization maintain a practical and economical control environment. This aligns with internal audit's role to add value and improve an organization's operations by providing objective advice and insight.

A. Mitigating risks affecting achievement of organizational objectives. This is a primary responsibility of management, which owns the risks and is responsible for designing, implementing, and maintaining controls to mitigate them.
B. Enabling opportunities affecting achievement of organizational objectives. This is a strategic and operational function belonging to management. Internal audit may advise on associated risks but does not own the pursuit of opportunities.
D. Attesting to fairness of financial statements. This is the primary responsibility of the independent external auditor, who provides an opinion on the financial statements for use by external stakeholders.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 2130: Control: "The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement."

Interpretation of Standard 2130: "Internal auditors’ evaluation of the effectiveness of the organization’s control processes may include, for example, determining whether the processes provide a reasonable level of assurance that risks are managed and that organizational objectives will be achieved efficiently and economically." The term "economically" directly implies a cost-versus-benefit consideration.

2. The Institute of Internal Auditors (IIA). (2017). Core Principles for the Professional Practice of Internal Auditing.

Principle: "Is insightful, proactive, and future-focused." Providing advice on the cost-benefit of controls demonstrates insight into the organization's operations and helps management make better decisions about resource allocation for control activities.

3. Pickett, K. H. S. (2011). The Internal Auditing Handbook (3rd ed.). John Wiley & Sons.

Chapter 4, Section 4.5.2, "Responsibility for Internal Control": This chapter clarifies the distinct roles, stating, "Management is responsible for internal control... The internal auditor’s role is to carry out an independent appraisal of the internal control system..." This appraisal includes assessing if controls are cost-effective. (Specific reference to cost-benefit analysis is a recurring theme in discussions of control efficiency).

The most effective strategy to prevent the exaggeration of sales reports combines a strong ethical directive with a robust, continuous monitoring control. Issuing a policy statement from top leadership (the president and the board) establishes a clear "tone at the top," which is a fundamental component of the control environment and a primary preventative measure against fraud. Assisting the controller in developing and monitoring correlated, independent business process indicators creates a powerful deterrent. Management is less likely to exaggerate sales if they know that the falsified data will not align with operational metrics (e.g., shipping volumes, raw material usage) and that these discrepancies will be flagged automatically and continuously.

1. Announcing a series of internal audit engagements focusing on compliance with corporate sales-reporting policies. This is a detective and deterrent control, but audits are periodic and sample-based, making them less effective for ongoing prevention than continuous monitoring.
3. Setting up a hotline for employees to report fraudulent behavior anonymously. While a valuable detective control, a hotline's preventative power is indirect, relying on a potential wrongdoer's fear of being reported by others, which is less certain than data-driven detection.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary.

Page 4, Control Environment: "The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control including expected standards of conduct." This supports the effectiveness of Option 2.

Page 6, Monitoring Activities: "Ongoing evaluations, built into business processes at different levels of the entity, provide timely information." This supports the continuous monitoring approach described in Option 4.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing.

Standard 2110 – Governance: "The internal audit activity must assess and make appropriate recommendations to improve the organization’s governance processes for... promoting appropriate ethics and values within the organization." This standard validates the CAE's role in advocating for the policy statement in Option 2.

Standard 2130 – Control: "The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement." This supports the CAE's advisory role in developing monitoring indicators as described in Option 4.

3. Gramling, A. A., & Schneider, A. (2018). The Role of the Internal Audit Function in the Corporate Governance of Fraud Prevention. Journal of Forensic and Investigative Accounting, 10(2).

This article discusses that a strong tone at the top and an ethical culture are critical deterrents to fraudulent financial reporting. It also emphasizes the value of internal audit's involvement in evaluating and recommending controls, such as analytical procedures (similar to Option 4), that can detect anomalies indicative of fraud. This publication supports the combined effectiveness of Options 2 and 4.

The primary role of the internal audit activity in an audit of risk management is to evaluate its effectiveness. According to the IIA's International Professional Practices Framework (IPPF), this evaluation must include assessing how the organization manages significant risks. Standard 2120.A2 specifically mandates that "The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk." Therefore, evaluating the management of fraud risk is a required and appropriate action when examining the effectiveness of risk management processes.

B. Establishing procedures for improving risk management processes is a management function. Internal audit's involvement in such activities would impair its independence and objectivity.
C. The primary benchmark for risk responses is the organization's own risk appetite and objectives, not necessarily industry standards, which serve as a reference point but are not prescriptive.
D. Verifying the alignment of objectives is a core part of a governance audit. While related, it is distinct from the direct examination of the processes for managing risks to those objectives.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2120: Risk Management. "2120.A2 – The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk."

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 2120: Risk Management. "To fulfill the requirements of Standard 2120, the chief audit executive and internal auditors consider the organization’s risk management framework, including its process for identifying, assessing, and managing fraud risk."

3. Fraser, J., & Simkins, B. (2016). The challenges of and solutions for implementing enterprise risk management. Business Horizons, 59(6), 689-698. https://doi.org/10.1016/j.bushor.2016.06.007. (This article discusses the role of internal audit in providing assurance over the ERM process, which includes evaluating controls for key risks like fraud, rather than establishing procedures (Option B) or enforcing external standards (Option C)).

4. Gramling, A. A., & Myers, P. M. (2019). Internal Auditing: Assurance & Advisory Services (4th ed.). The IIA Research Foundation. Chapter 6, "Risk Management," details that internal audit's role is to provide assurance on the risk management process, not to make risk management decisions or establish procedures, which would be a management responsibility.

Management's judgment is a cornerstone of an effective internal control system. It is essential for designing, implementing, and conducting internal controls that are tailored to the entity's specific objectives, risks, and environment. Judgment allows management to make informed decisions about the nature and extent of controls needed. However, because judgment is a human process, it is subject to biases, mistakes, and overrides. Therefore, while it enhances decision-making, it cannot provide absolute assurance or guarantee perfect outcomes, which is why internal control systems aim for reasonable assurance.

B. Introducing judgment is essential for an effective internal control system; it enhances, rather than diminishes, management's ability to make appropriate decisions tailored to the organization's specific risks.
C. Management is required to exercise significant judgment when selecting and applying suitable accounting principles that fairly present the entity's financial position and results, in accordance with relevant frameworks (e.g., GAAP, IFRS).
D. Assessing whether the five components and relevant principles of internal control are present, functioning, and operating together is a primary area that explicitly requires management's professional judgment.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary.

Page 4: "Applying internal control is a dynamic and iterative process. ... An effective system of internal control requires the use of judgment in determining the sufficiency of controls, in applying the proper controls, and in assessing their effectiveness." This supports the necessity and benefit of judgment.

Page 6: "An effective system of internal control provides reasonable assurance... It does not provide absolute assurance... [Limitations] result from... the reality that human judgment in decision making can be faulty and subject to bias." This directly supports the idea that judgment is beneficial but cannot guarantee perfect outcomes (Answer A).

2. Marks, N. (2013). The new COSO framework: A primer for audit committees. Deloitte Insights.

Page 2: "The 2013 Framework explicitly articulates the need for management judgment in designing, implementing, and conducting internal control and in assessing its effectiveness." This refutes options C and D, which claim judgment is inappropriate in these areas.

3. Ramos, M. (2004). Auditor's Responsibility for Internal Control: A Call for a More Precise Standard. The CPA Journal, 74(5), 50.

This academic article discusses the role of judgment in internal control assessments, stating, "The evaluation of internal control requires considerable professional judgment by management and the auditor." This reinforces that judgment is not inappropriate (refuting C and D) and is a critical part of the process (refuting B).

Risk appetite is a high-level statement that describes the broad amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. It provides overall guidance. Risk tolerance, in contrast, is the specific and measurable level of deviation from the risk appetite that is acceptable for a particular objective or risk category. It operationalizes the broader appetite by setting practical boundaries. Therefore, risk appetite is the general level of acceptance, and risk tolerance is a more specific concept that is subordinate to and aligned with the overall risk appetite.

A. This statement incorrectly reverses the definitions. Risk appetite is the general attitude, while risk tolerance applies to specific objectives or risks.
B. Risk tolerance is a threshold for acceptable risk-taking, not a risk management approach (which would be to accept, avoid, mitigate, or transfer risk).
D. This is incorrect. In formal risk management frameworks like COSO and ISO 31000, which are central to the IIA's guidance, the two terms have distinct and important meanings.

1. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance.

Reference: Page 95 (Appendix A: Definitions).

Quote/Concept: Defines Risk Appetite as "The types and amount of risk, on a broad level, an organization is willing to accept in pursuit of value." It defines Risk Tolerance as "The acceptable variation in performance relative to the achievement of objectives." This establishes appetite as broad and tolerance as a specific variation, supporting that tolerance is a more specific, subordinate concept.

2. The Institute of Internal Auditors (IIA). (2020). GTAG: Auditing Insider Threat Programs.

Reference: Page 10, Section "Risk Appetite and Tolerance".

Quote/Concept: "Risk appetite is the amount of risk an organization is willing to accept on a broad level... Risk tolerance is the acceptable level of variation an organization is willing to accept regarding the pursuit of its objectives." This source clearly distinguishes the broad nature of appetite from the specific, variational nature of tolerance.

3. Rittenberg, L., & Martens, F. (2012). Enterprise Risk Management: Understanding and Communicating Risk Appetite. COSO.

Reference: Page 6.

Quote/Concept: The paper clarifies the relationship: "Risk tolerances are the specific maximum risk that an organization is willing to take regarding each relevant risk... Risk tolerances need to be in alignment with the organization’s risk appetite." This explicitly frames tolerance as a specific measure that operates within the broader appetite.

New hire training is a fundamental preventive control. It establishes an ethical tone and control consciousness from the outset, clearly communicating expectations regarding misconduct and the consequences of fraudulent actions. By influencing employee behavior and fostering a culture of integrity, it addresses the root causes of fraud, making it the most effective measure for prevention among the options. The other options are primarily detective controls, which identify fraudulent activities after they have occurred or as they are occurring.

A. This is a detective control. The email alert is triggered after a large check has already been issued, aiming to detect potential irregularities.
B. This is primarily a detective control used to investigate theft after it happens, though it can have a secondary deterrent (preventive) effect.
D. This is a detective control. The report identifies unauthorized access attempts after they have occurred, not preventing them in the first place.

1. COSO, Fraud Risk Management Guide, 2nd Edition (2023). Principle 2, "The board of directors exercises oversight of the fraud risk management program," emphasizes the importance of a strong ethical culture. The guide states, "A strong 'tone at the top' and throughout the organization is the foundation for all other components of fraud risk management... communicated through training and other means" (p. 21). This highlights training as a core preventive measure.

2. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF), Standard 2120: Risk Management. The standard requires internal audit to evaluate risk exposures, including the risk of fraud. The implementation guidance (2120.A1) notes that internal auditors should evaluate the potential for fraud and how the organization manages fraud risk. Preventive controls, such as training and creating a culture of ethics, are the first line of defense in managing this risk.

3. Albrecht, W. S., Albrecht, C. O., Albrecht, C. C., & Zimbelman, M. F. (2011). Fraud Examination. Cengage Learning. In academic literature on fraud, creating a culture of honesty and high ethics is consistently cited as the single most important element in fraud prevention. The text states, "The first and most important step in preventing fraud involves creating a culture of honesty and high ethics... This is done through... communicating expectations through a code of conduct and fraud awareness training" (Chapter 5, "Fraud Prevention").

Incentive-based compensation structures can increase risks to the control environment by creating undue pressure on employees and management to meet specific performance targets. This pressure may motivate individuals to override internal controls, manipulate financial or operational data, or engage in unethical behavior to maximize their personal compensation. This directly conflicts with the core principles of a strong control environment, which are founded on integrity, ethical values, and a commitment to competence and accountability.

A. Strong board of directors oversight: This is a fundamental component that strengthens the control environment by ensuring accountability and challenging management's decisions, thereby reducing risk.
C. Lower than average employee turnover: Low turnover typically signifies a stable and experienced workforce that is familiar with control procedures, which reduces the risk of errors and control breakdowns.
D. Implementation of a fraud hotline: A fraud hotline is a detective and deterrent control mechanism that strengthens the control environment by promoting accountability and providing a secure channel for reporting misconduct. ---

1. COSO, Internal Control – Integrated Framework: Executive Summary (May 2013). The framework discusses factors influencing the control environment. It highlights that management's philosophy and operating style, including how they manage business risks and their attitudes and actions toward financial reporting, are critical. Aggressive incentive schemes can create pressures that lead to the intentional misstatement of financial information, undermining the control environment. (See Principle 1: Demonstrates Commitment to Integrity and Ethical Values, and the discussion on Fraud Risk Assessment).

2. The Institute of Internal Auditors (IIA), Practice Guide: Assessing the Control Environment (December 2012). This guide identifies "pressures to meet unrealistic performance targets, particularly for short-term results" as a factor that can weaken the control environment. It explicitly links such pressures to compensation structures. (See Section: "Factors to Consider," subsection on "Management’s Philosophy and Operating Style").

3. Beasley, M. S., Carcello, J. V., & Hermanson, D. R. (2010). Fraudulent Financial Reporting: 1998-2007, An Analysis of U.S. Public Companies. Commissioned by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). This research frequently identifies management incentives, such as stock options or performance-based bonuses, as a key motivation and red flag in cases of fraudulent financial reporting, directly implicating such structures as a risk to the control environment. (See Section IV: "Key Study Findings").

4. MIT OpenCourseWare, 15.219J Leadership and Corporate Accountability. Course materials on corporate governance and ethics often discuss the "fraud triangle," which consists of pressure, opportunity, and rationalization. Incentive-based compensation is a primary example of the "pressure" or "motivation" element that can drive individuals to commit fraud, thereby degrading the control environment. (See lecture notes on "The Causes of Fraud").

Forensic auditing is a specialized discipline applied when fraud is suspected or has been discovered. Its primary function is to conduct a detailed investigation to gather evidence in a manner that is legally admissible. This process provides a comprehensive understanding of the fraud scheme, including the perpetrators, methods used, timeline, and financial impact. This detailed evidence is crucial for supporting legal proceedings, disciplinary actions, and recovering losses. The other options describe secondary or subsequent benefits that arise from the findings of the forensic investigation, rather than the primary benefit of the technique itself.

A. Enhanced capability to prevent frauds from occurring. This is incorrect because prevention is a proactive control function. While forensic findings inform future prevention strategies, the immediate benefit of the technique is investigative, not preventative.
B. Greater assurance that procurement frauds will be detected in a timely manner. This is incorrect because the fraud has already been detected. Forensic auditing is a reactive, investigative process applied after detection, not a tool for ongoing, timely detection.
C. Improved capability of evaluating fraud risks within the organization. This is incorrect because while the investigation will reveal control weaknesses that inform future risk assessments, the primary, immediate goal is to investigate the specific, known fraud incident.

1. The Institute of Internal Auditors (IIA). (2015). Practice Guide: Internal Auditing and Fraud. In this guide, the IIA distinguishes the roles, stating, "When indicators of fraud are present... an investigation may be necessary to determine whether fraud has occurred and, if so, to what extent." It emphasizes that forensic auditors are trained to investigate and gather evidence, which directly supports the goal of understanding the fraud. (Section: "Investigating Fraud").

2. Singleton, T. W., & Singleton, A. J. (2010). Fraud Auditing and Forensic Accounting (4th ed.). John Wiley & Sons. Chapter 1, "The Forensic Accounting and Fraud Examination Profession," explains that forensic accounting's primary orientation is investigative and focused on gathering evidence for litigation. It states, "Forensic accounting is the action of identifying, recording, settling, extracting, sorting, reporting, and verifying past financial data or other accounting activities for settling current or prospective legal disputes or using such past financial data for projecting future financial data to settle legal disputes." (p. 4).

3. Bhasin, M. L. (2013). An Empirical Investigation of the Relevant Skills of Forensic Accountants: Experience of a Developing Economy. European Journal of Accounting, Auditing and Finance Research, 1(2), 11-52. The paper highlights that the core of forensic accounting is the "use of accounting, auditing and investigative skills to assist in legal matters," which underscores the focus on evidence collection for a greater understanding in a legal context. (p. 13).

Job enrichment is a job design technique that involves enhancing a job by adding more meaningful tasks and responsibilities to make the work more rewarding and motivating. This process, often called "vertical loading," focuses on increasing an employee's autonomy, control, and responsibility over their work. The manager's action of allowing a subordinate greater control and responsibility directly aligns with the core principles of job enrichment, which aims to increase intrinsic motivation by improving the quality of the work experience itself.

A. Job enlargement: This involves adding more tasks at the same level of skill and responsibility (horizontal loading), not increasing control or authority.
C. Horizontal loading of the job: This is another term for job enlargement and involves expanding the number of tasks, not the depth of responsibility.
D. Job rotation: This practice involves moving an employee between different jobs to develop a wider range of skills, not changing the responsibilities within a single job. ---

1. Herzberg, F. (1968). One More Time: How Do You Motivate Employees? Harvard Business Review, 46(1), 53–62. In this foundational article, Herzberg distinguishes "vertical job loading" (enrichment), which includes adding accountability and granting more authority, from "horizontal job loading" (enlargement).

2. Hackman, J. R., & Oldham, G. R. (1976). Motivation through the design of work: Test of a theory. Organizational Behavior and Human Performance, 16(2), 250–279. This paper introduces the Job Characteristics Model, where "autonomy"—the degree to which the job provides freedom, independence, and discretion—is a critical psychological state for motivation. The scenario directly describes an increase in autonomy. (DOI: https://doi.org/10.1016/0030-5073(76)90016-7)

3. MIT OpenCourseWare. (2004). 15.301 Managerial Psychology, Lecture Notes, Lecture 10: Motivation and Job Design. Massachusetts Institute of Technology. The lecture notes define job enrichment as "building motivators into the job" by increasing responsibility, autonomy, and control, contrasting it with job enlargement, which only adds more tasks.

The board's objective is to "gain a better understanding of the degree of ethics awareness." An organization-wide employee survey is the most direct and comprehensive method to assess the current state of ethical awareness, perceptions, and culture across the entire workforce. This diagnostic tool gathers baseline data directly from employees, helping to identify specific areas of weakness or confusion. The results can then inform more targeted actions, such as specialized training, policy revisions, or a formal assurance engagement.

A. Request the internal audit activity to perform an ethics-related assurance engagement. This is a valid but more intensive step. A survey provides a broader, initial understanding, which can then help scope a more focused assurance engagement.
B. Offer in-house ethics-related training seminars for employees to attend. This is a remedial action. It attempts to solve a problem without first fully understanding its scope and nature, which is the board's primary goal.
C. Reaffirm the importance of the organization's code of ethics to all employees. This is a communication or reinforcement tactic. It does not measure or provide an understanding of the current level of employee awareness. ---

1. The Institute of Internal Auditors (IIA). (2017). Practice Guide: Auditing Culture. In Section 3.3, "Data Collection and Analysis," the guide explicitly lists surveys as a primary method for gathering data on organizational culture. It states, "Surveys can be an efficient way to gather a large amount of data from a broad population... to gain an understanding of employees’ perceptions of the organization’s culture." (p. 17).

2. The Institute of Internal Auditors (IIA). (2012). Practice Guide: Auditing the Control Environment. This guide emphasizes the importance of assessing "soft controls," including ethical values and employee awareness. It notes that auditors can use tools like "questionnaires and surveys" to evaluate the attitudes and awareness of personnel, which directly aligns with the board's need to understand the current state. (Section: "Gathering Information on the Control Environment").

3. KPMG. (2018). An ethical compass: The board’s role in establishing and sustaining an ethical culture. This publication from a reputable source, while not an academic paper, reflects industry best practices. It discusses the board's oversight role and mentions using "employee surveys" and "culture assessments" as key tools to gauge the effectiveness of the ethics and compliance program and understand the prevailing culture. (p. 8).