IIA-IAP Practice Questions

Comprehensive and Detailed Step-by-Step Explanation:

Reference to IIA Standards:

Standard 2210 - Engagement Objectives: Internal auditors must establish objectives for each

engagement to align with the organization's goals and address identified risks.

Reasoning:

Option A is correct because engagement objectives focus on ensuring audit procedures target and

mitigate identified risks effectively.

Option B (common understanding) is important for team alignment but is secondary to risk-focused

objectives.

Option C (considering work of other assurance providers) is part of planning but not the primary

purpose of setting objectives.

Importance of Objectives:

Engagement objectives drive the audit’s focus, ensuring that procedures are purposeful and tailored

to mitigate relevant risks.

Comprehensive and Detailed Step-by-Step Explanation:

Risk Assessment in Planning: Conducting a risk assessment typically follows documentation of the

process, as understanding the process provides the necessary context for identifying and evaluating

risks.

Reference: IIA Standard 2210: Engagement Objectives highlights the importance of risk assessment

in defining engagement objectives.

Other Options:

Option A: Resource allocation happens after risk assessment determines the scope and focus of the

engagement.

Option B: Determining objectives usually occurs after assessing risks.

Thus, the correct answer is C.

Comprehensive and Detailed Step-by-Step Explanation:

Risk Acceptance: By deciding that transactions below $50 do not require authorization, management

is consciously accepting the low-level risk associated with this decision to streamline processes and

reduce administrative burdens.

Reference: IIA Practice Guide on Risk Management explains that risk acceptance involves tolerating

risks that fall within the organization’s risk appetite.

Other Options:

Option A: Risk avoidance would involve eliminating the activity altogether, which is not the case

here.

Option C: Risk reduction would involve implementing controls to mitigate the risk, not eliminating

authorization requirements.

Thus, the correct answer is B. Accept.

Comprehensive and Detailed Step-by-Step Explanation:

Reference to Internal Control Assessment:

Standard 2130 - Control: Internal auditors must evaluate the adequacy and effectiveness of controls

in mitigating risks.

COSO Framework: Proper segregation of duties is essential for preventing unauthorized transactions

and fraud.

Reasoning:

Option B is correct because the lack of management review and approval for creating vendors

indicates a control weakness, as it creates opportunities for unauthorized vendors or fraud. The

auditor should investigate whether mitigating controls exist (e.g., periodic review of vendor lists) or

recommend redesigning the process to include managerial oversight.

Option A dismisses the observation without considering its impact on control adequacy. Prompt

payment alone does not address risks related to unauthorized vendors.

Option C incorrectly assumes the observation reflects adequate controls, which is not the case given

the lack of management approval.

Actionable Next Steps:

Document the observation as a control deficiency.

Perform additional testing to identify whether compensating controls mitigate the risk or

recommend enhancements to strengthen controls.

Comprehensive and Detailed Step-by-Step Explanation:

Reference to IIA Standards:

Standard 1110 - Organizational Independence: Internal audit must be independent of the activities it

audits to maintain objectivity.

Standard 1130 - Impairment to Independence or Objectivity: Internal audit’s independence is

compromised if auditors take on roles that involve making decisions or implementing controls, as

this may bias their findings.

Reasoning:

Option B is correct because setting the organization’s risk appetite is a management decision and

represents a strategic role that compromises the internal audit's independence.

Option A (championing the establishment of risk management) and Option C (coordinating risk

management) do not directly impair independence, though care should be taken to avoid direct

involvement in risk management decisions. These activities can be part of advisory services and not

necessarily a threat to independence if appropriately managed.

Maintaining Independence:

Internal auditors should provide assurance on risk management but not take on roles that involve

decision-making or implementing risk management processes.

Comprehensive and Detailed Step-by-Step Explanation:

Opportunity Element: This element of the Fraud Triangle refers to situations where weaknesses in

controls provide the ability for someone to commit fraud without being detected. Poor segregation

of duties, as described in Option C, creates such opportunities.

Example: Allowing an executive assistant to authorize payments without oversight significantly

increases the risk of fraud.

Reference: IIA Practice Guide on Fraud Risk Management identifies segregation of duties as a critical

control to mitigate opportunities for fraud.

Other Options:

Option A: This describes potential pressure rather than opportunity.

Option B: This describes setting challenging performance objectives, which could lead to

rationalization or pressure but not directly opportunity.

Thus, the correct answer is C.

Comprehensive and Detailed Step-by-Step Explanation:

Compliance Audit Criteria: The objective of a compliance audit is to assess adherence to applicable

laws, regulations, and internal policies. Considering current governance laws and regulations ensures

the audit is aligned with mandatory requirements.

Reference: IIA Standard 2210: Engagement Objectives mandates that objectives must be sufficient to

address the risks associated with compliance.

Other Options:

Option A: A list of items acquired might provide context but is not directly relevant for establishing

compliance objectives.

Option C: Location data is useful for audit planning but does not define compliance criteria.

Thus, the correct answer is B.

Comprehensive and Detailed Step-by-Step Explanation:

Reference to IIA Standards:

Standard 2330 - Documenting Information: Workpapers must be sufficient, reliable, relevant, and

useful to support audit findings and conclusions.

Practice Advisory: Clear and complete documentation enhances understanding and ensures

consistency in audit conclusions.

Characteristics of Quality Workpapers:

They should clearly articulate audit procedures, results, and conclusions in a way that another

auditor or stakeholder can understand and rely on them.

While electronic and indexed workpapers (Option B) are desirable for organization, they are not

defining characteristics of quality.

Comprehensive and Detailed Step-by-Step Explanation:

Lost Payment Discounts: By paying all invoices after 30 days, regardless of terms, the organization

risks losing early payment discounts offered by vendors, leading to poor cash management.

Reference: IIA Practice Guide on Control Activities highlights the importance of adhering to payment

terms to optimize cash flow.

Other Options:

Option B: Fraudulent invoice risks arise from weak verification processes, but the primary issue here

relates to missed discounts.

Option C: Paying the wrong vendors is less likely tied to the observation about standard payment

timing.

Thus, the correct answer is A.

Comprehensive and Detailed Step-by-Step Explanation:

Diamond Shape: In process mapping, a diamond typically represents a decision point where a choice

must be made based on conditions or criteria (e.g., "Yes" or "No").

Example: "Is the invoice valid?" If yes, the process continues to payment; if no, it is rejected.

Reference: IIA Practice Guide on Process Mapping emphasizes standard symbols such as diamonds

for decisions, rectangles for processes, and arrows for flow lines.

Other Options:

Option A: A process or operation is typically represented by a rectangle.

Option C: A flow line (arrow) indicates the direction of process flow, not a decision.

Thus, the correct answer is B. Decision.