IIA IIA-CIA-Part2 Actual Questions

Intervening during an audit involving ethical wrongdoing (Option 1) and negotiating a settlement of an employee claim for personal damages (Option 4) represent significant ethical risks if exhibited by an organization’s board. These actions could indicate attempts to influence or undermine the audit process and the fair handling of ethical issues, leading to potential conflicts of interest and compromising the integrity of the organization’s governance processes. Discussing periodic reports of ethical breaches (Option 2) and authorizing an investigation of an unsafe product (Option 3) are appropriate and responsible board actions that do not pose ethical risks.

IIA Standard 1110: Organizational Independence.

IIA Code of Ethics.

A. Vendor contracts:While vendor contracts may reveal terms, they do not directly identify potential conflicts of interest.

B. Employee master list:Correct. Comparing the employee master list with vendor information can help identify conflicts of interest, such as vendor ownership or employee relationships.

C. Payment records:Useful for verifying transactions but not for identifying conflicts of interest.

D. Purchasing policy:Provides guidelines but does not assist directly in identifying conflicts.

CIA Exam Syllabus Reference:

Domain II: Risk Management and Control – Identifying and Mitigating Conflicts of Interest.

Internal control questionnaires are used to determine whether specific control procedures are in place within an organization. They help auditors identify the existence and implementation of controls designed to mitigate risks. These questionnaires can provide a preliminary understanding of the control environment and identify areas that may require further detailed testing.

The Institute of Internal Auditors (IIA) Practice Guide: Using Internal Control Questionnaires to Assess Risk

IIA Standard 2130 - Control

Comprehensive and Detailed Explanation:

Even though this is an advisory engagement, internal auditors must still evaluate significant control gaps discovered during the engagement (Standard 2120 – Risk Management). Since a key procurement control is missing, the auditor should not ignore the risk (D). Expanding the advisory engagement scope (C) would be outside the engagement mandate unless approved. Deferring review to next year’s plan (A) delays needed assurance. The most appropriate step is to perform a root cause analysis and test whether the approved workaround is effective (B). This ensures that risks are mitigated in the interim until a permanent control is implemented, providing management with actionable feedback.