IIA-CIA-Part2 IIA Exam Lab Questions

During planning, auditors gather information about processes and controls. While management (A) provides oversight and external auditors (C) focus on financial reporting controls, employees who perform the daily tasks (B) have the most accurate, detailed, and current knowledge of how processes and controls actually operate. The board (D) provides governance, not operational detail.

When a significant finding is noted early during a review of the accounts payable function, the best course of action for communicating the issue is to inform internal accounting management via an interim memorandum update. This allows for timely communication and potential early remediation actions, ensuring that management is aware of the issue and can address it promptly before the final audit report is issued.

One of the primary drawbacks of using internal control questionnaires is the risk that management may not provide honest or accurate answers. This can occur due to a variety of reasons, including a lack of knowledge, intentional deception, or a misunderstanding of the questions. As a result, the responses may not accurately reflect the true state of the controls, leading to incomplete or misleading audit conclusions.

The Institute of Internal Auditors (IIA) Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000

IIA Standard 2310 - Identifying Information

The primary weakness of internal control questionnaires (ICQs) is that the respondents, who are often managers or personnel responsible for specific areas, may have incentives to indicate that internal controls are in place, even when they might not be effective or fully operational. This can occur due to a desire to present their department in a positive light, avoid scrutiny, or because of misunderstandings about what constitutes a control. This bias in responses can lead to inaccurate assessments of the internal control environment.

IIA References:

IIA Standard 2310: Identifying Information and its accompanying guidance highlight the importance of obtaining accurate, reliable, and unbiased information when assessing controls. The potential for biased responses in ICQs is a known risk that can undermine the quality of the audit evidence gathered.

The Practice Guide on Evaluating Internal Controls notes that while ICQs are useful for gathering information, auditors should be aware of the limitations and potential biases inherent in this method.