IIA-CHAL-QISA practice question 3 of 25

Which of the following actions should the internal audit activity take during an audit engagement when examining the effectiveness of risk management processes?

Full set: 150 questions

Answer options

A: Evaluate how the organization manages fraud risk. Correct answer

B: Establish procedures for improving risk management processes.

C: Ensure risk responses are aligned with industry standards

D: Verify that organizational objectives are aligned with each departments objectives.

Correct Answer:

A. Evaluate how the organization manages fraud risk.

Explanation

The primary role of the internal audit activity in an audit of risk management is to evaluate its effectiveness. According to the IIA's International Professional Practices Framework (IPPF), this evaluation must include assessing how the organization manages significant risks. Standard 2120.A2 specifically mandates that "The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk." Therefore, evaluating the management of fraud risk is a required and appropriate action when examining the effectiveness of risk management processes.

Why Incorrect

B. Establishing procedures for improving risk management processes is a management function. Internal audit's involvement in such activities would impair its independence and objectivity.
C. The primary benchmark for risk responses is the organization's own risk appetite and objectives, not necessarily industry standards, which serve as a reference point but are not prescriptive.
D. Verifying the alignment of objectives is a core part of a governance audit. While related, it is distinct from the direct examination of the processes for managing risks to those objectives.

References

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2120: Risk Management. "2120.A2 – The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk."

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 2120: Risk Management. "To fulfill the requirements of Standard 2120, the chief audit executive and internal auditors consider the organization’s risk management framework, including its process for identifying, assessing, and managing fraud risk."

3. Fraser, J., & Simkins, B. (2016). The challenges of and solutions for implementing enterprise risk management. Business Horizons, 59(6), 689-698. https://doi.org/10.1016/j.bushor.2016.06.007. (This article discusses the role of internal audit in providing assurance over the ERM process, which includes evaluating controls for key risks like fraud, rather than establishing procedures (Option B) or enforcing external standards (Option C)).

4. Gramling, A. A., & Myers, P. M. (2019). Internal Auditing: Assurance & Advisory Services (4th ed.). The IIA Research Foundation. Chapter 6, "Risk Management," details that internal audit's role is to provide assurance on the risk management process, not to make risk management decisions or establish procedures, which would be a management responsibility.

Question breakdown

Tests: Apply internal audit's responsibilities when evaluating risk management
Difficulty: Medium

Key idea: When evaluating risk management effectiveness, internal auditors must assess how the organization identifies and manages fraud risk.

How to reach the answer

The question concerns what auditors do when they examine the effectiveness of risk management processes.
The Standards explicitly require evaluating the potential for fraud and how the organization manages fraud risk.
Establishing improvement procedures is a management task and would impair objectivity.
Industry standards are not the required benchmark, and aligning objectives verifies strategy alignment rather than how risk is managed.

Each option

ACorrect. Assessing fraud risk management is an explicit expectation when internal audit evaluates risk management.
BIncorrect. Designing or establishing risk management procedures is a management responsibility, not an assurance activity.
CIncorrect. Risk responses should be aligned with the organization's own risk appetite, not necessarily with industry standards, and 'ensure' implies management ownership.
DIncorrect. Auditors assess whether objectives support and align with the mission, but checking department-level alignment is not the focus of a risk management effectiveness evaluation.

Common trap: Option D echoes a real evaluation point about objectives supporting the mission, so it sounds like a requirement even though it misstates the scope.

In practice: Auditors of ERM programs check whether fraud risk assessments exist, are refreshed regularly, and lead to anti-fraud controls.

Remember: Evaluating risk management always includes evaluating fraud risk management.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free IIA-CHAL-QISA practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test