Certified Internal Auditor (IIA) 2 — Questions and Answers
Question 1: According to the IIA Standards, which element is required in the internal audit charter?
- The budget for the internal audit department
- The purpose, authority, and responsibility of internal audit (Correct answer)
- The names of all internal auditors
- The list of audits planned for the year
Correct answer: The purpose, authority, and responsibility of internal audit
The IIA Standards require the internal audit charter to define the purpose, authority, and responsibility of the internal audit activity.
Question 2: When assessing the adequacy of a risk management process, the internal auditor should PRIMARILY evaluate:
- Whether all risks have been eliminated
- Whether management has identified and responded to key risks (Correct answer)
- Whether the external auditors agree with the risk assessment
- Whether risks are documented in the annual report
Correct answer: Whether management has identified and responded to key risks
Internal auditors evaluate whether management has appropriately identified, assessed, and responded to significant risks facing the organization.
Question 3: Which type of engagement provides independent assessments of conformance with plans, policies, and regulations?
- Consulting engagement
- Assurance engagement (Correct answer)
- Advisory engagement
- Facilitation engagement
Correct answer: Assurance engagement
Assurance engagements involve objective assessments of evidence to provide independent opinions on governance, risk, and control processes.
Question 4: An internal auditor discovers a significant control deficiency during a consulting engagement. What should the auditor do?
- Ignore it because consulting engagements don't cover controls
- Report it only to the manager who requested the engagement
- Communicate it to senior management and the board (Correct answer)
- Document it only in personal notes
Correct answer: Communicate it to senior management and the board
The IIA Standards require internal auditors to communicate significant control deficiencies discovered during consulting engagements to senior management and the board.
Question 5: The IIA's Code of Ethics principle of 'objectivity' requires that internal auditors:
- Never discuss findings with auditees
- Not subordinate their judgment on audit matters to others (Correct answer)
- Rotate assignments every six months
- Avoid all social contact with company employees
Correct answer: Not subordinate their judgment on audit matters to others
Objectivity requires internal auditors to make independent assessments without subordinating their professional judgment to the influence of others.
Question 6: Which of the following BEST describes the concept of 'due professional care' in internal auditing?
- Guaranteeing that all errors will be detected
- Applying the care and skill expected of a reasonably prudent auditor (Correct answer)
- Performing every possible audit procedure
- Obtaining a second opinion on all findings
Correct answer: Applying the care and skill expected of a reasonably prudent auditor
Due professional care means applying the skill and diligence that a reasonably prudent and competent internal auditor would apply under similar circumstances.
Question 7: When planning an audit of a complex area where the internal audit team lacks expertise, the CAE should:
- Cancel the audit until expertise is developed
- Use external service providers to supplement the team's skills (Correct answer)
- Rely solely on management's representations
- Limit the audit scope to areas of existing competency
Correct answer: Use external service providers to supplement the team's skills
The IIA Standards allow the CAE to obtain competency through external service providers when internal expertise is insufficient.
Certified Internal Auditor (IIA) 2
According to the IIA Standards, which element is required in the internal audit charter?