IIA-CIA-Part3 Practice Questions

A.  

They help identify gaps and duplications in an organization’s assurance coverage

B.  

They allow the board to coordinate activities of internal and external assurance providers

C.  

They help identify which assurance provider is responsible for performing each audit listed in the annual internal audit plan

D.  

They allow internal auditors to map competencies and specialty areas of the assurance providers in an organization

A.  

Hot recovery plan

B.  

Warm recovery plan

C.  

Cold plan

D.  

Absence of recovery plan

A.  

Value-added network (VAN).

B.  

Local area network (LAN).

C.  

Metropolitan area network (MAN).

D.  

Wide area network (WAN).

A.  

Relationship with supervisor

B.  

Salary

C.  

Security.

D.  

Achievement

A.  

Using a jailbroken or rooted smart device feature.

B.  

Using only smart devices previously approved by the organization.

C.  

Obtaining written assurance from the employee that security policies and procedures are followed.

D.  

Introducing a security question known only by the employee.

A.  

Assign a team with a trained audit manager to plan each audit and distribute field work tasks to various staff auditors.

B.  

Assign a team of personnel who have different specialties to each audit and empower Team members to participate fully in key decisions

C.  

Assign a team to each audit, designate a single person to be responsible for each phase of the audit, and limit decision making outside of their area of responsibility.

D.  

Assign a team of personnel who have similar specialties to specific engagements that would benefit from those specialties and limit Key decisions to the senior person.

A.  

Follow-up activities must be performed on an ongoing basis, such as quarterly, rather than being scheduled as specific assignments in the internal audit plan

B.  

The primary purpose of the CAE’s follow-up activities is to verify whether the audit issues raised in the audit report are valid

C.  

The CAE may plan follow-up activities on a selective basis, depending on risk significance, to verify whether management action plans were completed

D.  

Where management believes certain action plans are no longer necessary, the CAE must resolve the matter with the board and if the matter remains unresolved, communicate to senior management

A.  

Reviewing the customer's wire activity to determine whether the request is typical.

B.  

Calling the customer at the phone number on record to validate the request.

C.  

Replying to the customer via email to validate the sender and request.

D.  

Reviewing the customer record to verify whether the customer has authorized wire requests from that email address.

A.  

Locked doors.

B.  

Firewalls.

C.  

Surveillance cameras.

D.  

Login IDs and passwords.

A.  

Create an action plan to mitigate the risk

B.  

Incorporate management acceptance of risk in the workpapers as internal audit evidence

C.  

Report deviations immediately to the board

D.  

Communicate the matter with senior management

A.  

Authentication logs.

B.  

Card key readers.

C.  

Biometric devices

D.  

Video surveillance.

A.  

The internal audit function used a risk-based approach to create the internal audit plan

B.  

The engagement supervisor considered requests from senior management regarding engagements to include in the internal audit plan

C.  

The CAE only accepted engagements that the internal audit function collectively had the knowledge to perform

D.  

The activity under review restricted the internal audit function's ability to access records, impacting the audit results

A.  

Visibility, validity, vulnerability

B.  

Velocity, variety, volume

C.  

Complexity, completeness, constancy

D.  

Continuity, control, convenience

A.  

Review the list of people with access badges to the room containing the workstation and a log of those who accessed the room.

B.  

Review the password length, frequency of change, and list of users for the workstation's login process.

C.  

Review the list of people who attempted to access the workstation and failed, as well as error messages.

D.  

Review the passwords of those who attempted unsuccessfully to access the workstation and the log of their activity

A.  

26 days.

B.  

90 days,

C.  

100 days.

D.  

110 days