ACCA CIA Challenge Exam IIA-ACCA Dumps Questions

dumps2022-01-04T03:12:58+08:00

ACCA CIA Challenge exam IIA-ACCA dumps questions are valuable for you to pass the test. In real IIA certification IIA-ACCA exam, there are 150 multiple choice questions, and you have 3 hours to finish the test. The required passing score of IIA-ACCA exam is 600. The avaiilable language is English. Free ACCA CIA Challenge exam IIA-ACCA dumps questions are available below.

Page 1 of 18

1. Documenting risk mitigation strategies and techniques.

4 and 5 only.

1.2, and 3 only.

1.2. 4. and 5 only.

2. 3. 4. and 5 only.

2. The extent of other ongoing services that the engineer may be performing for the organization.

1 and 4 only

2 and 3 only

3 and 4 only

1, 2, and 4 only

3. After finalizing an assurance engagement concerning safety operations in the oil mining process, the audit team concluded that no key controls were compromised. However, some opportunities for improvement were noted.

Which of the following would be the most appropriate way for the chief audit executive (CAE) to report these results?

The CAE should send the final report to operational and senior management and the audit committee.

The CAE should send the final report to operational management only, as there is no need to communicate this information to higher levels.

The CAE should notify operational and senior management that the audit engagement was completed with no significant findings to report.

The CAE should send the final report to operational management and notify senior management and the audit committee that no significant findings were identified.

4. The same individuals who receive the final report.

1 only

1 and 2 only

1, 2, and 3

1, 2, and 4

5. Which of the following actions best demonstrates that an internal auditor is exercising due professional care?

The auditor performs thorough reviews and provides absolute assurance of regulatory compliance.

The auditor is alert to the possibility of fraud and activities where irregularities are most likely to occur.

The auditor recommends improvements for all of the organization's procedures and practices.

The auditor is cognizant of reducing travel expenses by combining a personal vacation with a business trip.

6. Packaging and shipping costs

1 and 2

1 and 3

2 and 4

3 and 4

7. An internal audit activity is using the auditing-by-element approach to audit the organization's controls around corporate social responsibility.

Which of the following would be an element for the internal audit activity to consider?

Working conditions.

Employees' families.

Marketplace competition.

Shareholders and investors.

8. Which of the following price adjustment strategies encourages prompt payment?

Cash discounts.

Quantity discounts.

Functional discounts.

Seasonal discounts.

9. A chief audit executive (CAE) is reviewing the internal audit activity's performance and is concerned that the average number of revisions to findings is steadily rising, making it increasingly difficult to trace the finding to the supporting evidence and workpapers.

According to MA guidance, which of the following elements of the internal audit activity's quality assurance and improvement program would provide the CAE with the most helpful insight into the cause of this problem?

The overall effectiveness of the internal audit activity's periodic self assessments.

The type of audit productivity and performance statistics reported.

The adequacy of the day-to-day supervision and review process.

The scope and frequency of external assessments.

10. According to IIA guidance on IT. which of the following plans would pair the identification of critical business processes with recovery time objectives?

The business continuity management charter.

The business continuity risk assessment plan

The business impact analysis plan

The business case for business continuity planning

Page 2 of 18

11. Which of the following are the most common characteristics of big data?

Visibility, validity, vulnerability

Velocity, variety volume.

Complexity completeness constancy

Continuity, control convenience

12. The economic order quantity for inventory is higher for an organization that has:

Lower annual unit sales.

Higher fixed inventory ordering costs.

Higher annual carrying costs as a percentage of inventory value.

A higher purchase price per unit of inventory.

13. Which of the following is a product-oriented definition of a business rather than a market-oriented definition of a business?

We are a people-and-goods mover.

We supply energy.

We make movies.

We provide climate control in the home.

14. According to IIA guidance, which of the following would be a primary reason for an internal auditor to test the organization's IT contingency plan?

To ensure that adequate controls exist to prevent any significant business interruptions.

To identify and address potential security weaknesses within the system.

To ensure that tests contribute to improvement of the program.

To ensure that deficiencies identified by the audit are promptly addressed.

15. Ensure engagement objectives are reviewed for satisfactory achievement and are documented properly.

1, 2, and 3

1, 2, and 4

1, 3, and 4

2, 3, and 4

16. All of the following are true with regard to the first-in, first-out inventory valuation method except:

It values inventory close to current replacement cost.

It generates the highest profit when prices are rising.

It approximates the physical flow of goods.

It minimizes current-period income taxes.

17. Which of the following is an element of effective negotiating?

Ensuring that the other party has a personal stake in the agreement.

Focusing on interests rather than on obtaining a winning position.

Considering a few select choices during the settlement phase.

Basing the agreement on negotiating power and positioning leverage.

18. A manufacturing line supervisor joins the internal audit activity for a two-year rotational job assignment and is assigned to an accounts receivable audit.

With regard to this assignment, which of the following should be the primary concern of the audit manager?

Due professional care.

Individual independence.

Individual objectivity.

Organizational independence.

19. Which of the following local area network physical layouts is subject to the greatest risk of failure if one device fails?

Star network.

Bus network.

Token ring network.

Mesh network.

20. Preferred stock is less risky for investors than is common stock because:

Common stock pays dividends as a stated percentage of face value.

Common stock has priority over preferred stock with regard to earnings and assets.

Preferred dividends are usually cumulative.

Preferred stock with no conversion feature has a higher dividend yield than does convertible preferred stock.

Page 3 of 18

21. An internal auditor wants to determine whether employees are complying with the information security policy, which prohibits leaving sensitive information on employee desks overnight. The auditor checked a sample of 90 desks and found eight that contained sensitive information.

How should this observation be reported, if the organization tolerates 4 percent noncompliance?

The matter does not need to be reported, because the noncompliant findings fall within the acceptable tolerance limit.

The deviations are within the acceptable tolerance limit, so the matter only needs to be reported to the information security manager.

The incidents of noncompliance fall outside the acceptable tolerance limit and require immediate corrective action, as opposed to reporting.

The incidents of noncompliance exceed the tolerance level and should be included in the final engagement report.

22. An internal auditor has been asked to conduct an investigation involving allegations of independent contractor fraud.

Which of the following controls would be least effective in detecting any potential fraudulent activity?

Exception report identifying payment anomalies.

Documented policy and procedures.

Periodic account reconciliation of contractor charges.

Monthly management review of all contractor activity.

23. Which of the following statements is true regarding the use of public key encryption to secure data while it is being transmitted across a network?

Both the key used to encrypt the data and the key used to decrypt the data are made public.

The key used to encrypt the data is kept private but the key used to decrypt the data is made public.

The key used to encrypt the data is made public but the key used to decrypt the data is kept private.

Both the key used to encrypt the data and the key used to decrypt the data are made private.

24. Providing knowledge, motivating organizational members, controlling and coordinating individual efforts, and expressing feelings and emotions are all functions of:

Motivation.

Performance.

Organizational structure.

Communication.

25. Which of the following risks is best addressed by encryption?

Information integrity risk.

Privacy risk

Access risk

Software risk

26. According to IIA guidance, which of the following statements describes one of the similarities between assurance and consulting services?

When planning assurance and consulting engagements, internal auditors must consider the strategies and objectives of the activity being reviewed.

Internal auditors determine the engagement objectives, scope, and work program for both assurance and consulting services.

Internal auditors must not provide assurance or consulting services for an activity for which they had responsibility within the previous year.

Both assurance and consulting services generally involve the internal auditor, the area under review, senior management, and the board.

27. An organization has started allowing employees to use their personal smart devices to accept vendor payments.

What should the organization's bring-your-own-device (BYOD) policy include to specifically address security and privacy required by the Payment Card Data Security Standard (PCI DSS)?

Approved devices

Mobile applications

Data storage.

Backups and transfers

28. The board has requested that the internal audit activity be involved in all phases of the organization's outsourcing of its network management.

During which of the following stages is the internal auditor most likely to verify that the organization's right-to-audit clause is drafted effectively?

Implementation and transition phase.

Monitoring and reporting phase

Decision-making and business-case phase.

Tendering and contracting phase.

29. Evidence of strong access controls ensuring that authorized individuals have access only to the functions related to their responsibilities.

1 and 3.

1 and 4.

2 and 3.

2 and 4.

30. A manager has difficulty motivating staff to improve productivity, despite establishing a lucrative individual reward system.

Which of the following is most likely the cause of the difficulty?

High degree of masculinity.

Low uncertainty avoidance.

High collectivism.

Low long-term orientation.

Page 4 of 18

31. During an audit, the client questions the internal audit activity's authority to perform procedures over fraud allegations.

According to HA guidance, which of the following would provide the most relevant support to respond to the client's concerns?

Definition of Internal Auditing.

MA Standards.

Internal audit charter.

The IIA's Code of Ethics.

32. Negotiating a settlement of an employee claim for personal damages.

1 and 2

1 and 4

2 and 3

3 and 4

33. The organization makes exclusive arrangements with the channels.

1 and 3 only

1 and 4 only

2 and 3 only

2 and 4 only

34. An internal auditor is using a spreadsheet application to review a cash flow forecast prepared by management.

Which of the following correctly identifies the type of evidence this information represents?

Competent, corroborative evidence of future working capital requirements.

Sufficient, analytical evidence of the cash flow position at a given point of time in the future.

Competent, documentary evidence of future cash flow changes within the organization.

Sufficient, circumstantial evidence of the future solvency of the organization.

35. Which of the following data analytics tools would be applied by an internal audit activity positioned at the lowest level of maturity?

Workflow and data capture technology

Data visualization applications.

Software integrated with central data warehouse

Spreadsheets.

36. Which of the following is most likely to be considered a control weakness?

Vendor invoice payment requests are accompanied by a purchase order and receiving report.

Purchase orders are typed by the purchasing department using prenumbered forms.

Buyers promptly update the official vendor listing as new supplier sources become known.

Department managers initiate purchase requests that must be approved by the plant superintendent.

37. Which of the following is an appropriate responsibility for the internal audit activity with regard to the organization's risk management program?

Identifying and managing risks in line with the entity's risk appetite.

Ensuring that a proper and effective risk management process exists.

Attaining an adequate understanding of the entity's key mitigation strategies.

Identifying and ensuring that appropriate controls exist to mitigate risks.

38. Which of the following would be the most appropriate first step for the board to take when developing an effective system of governance?

Determine the organization's overall risk appetite.

Establish a governance committee.

Delegate authority to members of senior management.

Identify key stakeholders and their expectations.

39. The most important reason to use risk assessment in audit planning is to:

Identify redundant controls.

Improve budgeting accuracy.

Enhance assurance provided to management.

Assist in developing audit programs.

40. Which of the following is the most common method of fraud detection?

Analytical reviews of high-risk areas.

Detective controls built into the daily processes.

Unannounced audits or reviews of programs or departments.

Tips received from employees or citizens.

Page 5 of 18

41. Which of the following is the best example of a compliance risk that is likely to arise when adopting a bring-your-own-device (BYOD) policy?

The risk that users try to bypass controls and do not install required software updates.

The risk that smart devices can be lost or stolen due to their mobile nature.

The risk that an organization intrusively monitors personal information stored on smart devices.

The risk that proprietary information is not deleted from the device when an employee leaves.

42. An organization is facing a financial downturn and needs to impose major budget reductions to all departments.

According to MA guidance, which of the following actions is most appropriate for the board to take to evaluate the potential impact on the internal audit activity?

Ask management to determine which internal audit engagements are lower risk and could be considered for removal from the annual audit plan.

Ask appropriate stakeholders for their opinion on the potential impacts of reducing the scope of the internal audit plan.

Ask the chief audit executive to determine whether budgetary limitations impede the ability of the internal audit activity to execute its responsibilities.

Ask The human resources department to determine how the annual compensation and salary of the audit staff could be adjusted to achieve savings.

43. Which of the following is an example of a physical control?

Providing fire detection and suppression equipment

Establishing a physical security policy and promoting it throughout the organization

Performing business continuity and disaster recovery planning

Keeping an offsite backup of the organization's critical data

44. Probability of significant errors, fraud, or noncompliance.

1 and 2 only

1, 2, and 3 only

1, 2, and 4 only

2, 3, and 4 only

45. Which of the following statements about COBIT is not true?

COBIT helps management understand and manage the risks associated with information technology (IT) processes.

Management needs to determine the cost-benefit ratio of adopting COBIT control objectives.

COBIT control objectives are specific to various IT platforms and help determine minimum controls.

COBIT provides management with the capability to conduct self-assessments against industry best practices.

46. A multinational organization has asked the internal audit activity to assist in setting up the organization's risk management system. The chief audit executive (CAE) agrees to take on the engagement as a consultant.

Which of the following tasks is appropriate for the CAE to undertake?

Coordinate and facilitate risk workshops for management to attend.

Establish the degree of risk appetite for management to accept.

Set risk indicators and mitigation plans for management to implement.

Determine the number of significant risks for management to report to the board.

47. Which of the following is the primary purpose of financial statement audit engagements?

To assess the efficiency and effectiveness of the accounting department.

To evaluate organizational and departmental structures, including assessments of process flows related to financial matters.

To provide a review of routine financial reports, including analyses of selected accounts for compliance with generally accepted accounting principles.

To provide an analysis of business process controls in the accounting department, including tests of compliance with internal policies and procedures.

48. For an engineering department with a total quality management program, important elements of quality management include all of the following except:

Basing performance evaluations on the number of projects completed.

Comparing results with those of other engineering departments.

Creating a quality council within the engineering department.

Conducting post-project surveys on performance.

49. According to IIA guidance, which of the following corporate social responsibility (CSR) activities is appropriate for the internal audit activity to perform?

Determine the optimal amount of resources for the organization to invest in CS

Align CSR program objectives with the organization's strategic plan.

Integrate CSR activities into the organization's decision-making process.

Determine whether the organization has an appropriate policy governing its CSR activities.

50. Which of the following evaluation criteria would be the most useful to help the chief audit executive determine whether an external service provider possesses the knowledge, skills, and other competencies needed to perform a review?

The financial interest the service provider may have in the organization.

The relationship the service provider may have had with the organization or the activities being reviewed.

Compensation or other incentives that may be applicable to the service provider.

The service provider's experience in the type of work being considered.

Page 6 of 18

51. Which of the following techniques would provide the most compelling evidence that a safety hazard exists within a manufacturing facility?

Observation of the facility during operations.

Questioning of facility management, including the facility safety officer.

Analysis of facility operating reports, focusing on instances when breakdowns occurred.

Review of records involving safety violations, filed by facility production employees.

52. 5

Based on this data, which of the following describes the value of Cost X in relation to the value of Output Produced?

Cost X is a variable cost.

Cost X is a fixed cost.

Cost X is a semi-fixed cost.

Cost X and the value of Output Produced are unrelated.

53. Non-statistical sampling does not require which of the following?

The sample to be representative of the population.

The sample to be selected haphazardly.

A smaller sample size than if selected using statistical sampling.

Projecting the results to the population.

54. According to IIA guidance, which of the following is a typical risk associated with the tender process and contracting stage of an organization's IT outsourcing life cycle?

The process is not sustained and is not optimized as planned.

There is a lack of alignment to organizational strategies.

The operational quality is less than projected.

There is increased potential for loss of assets.

55. According to IIA guidance, which of the following statements is true regarding analytical procedures?

Data relationships are assumed to exist and to continue where no known conflicting conditions exist.

Analytical procedures are intended primarily to ensure the accuracy of the information being examined.

Data relationships cannot include comparisons between operational and statistical data

Analytical procedures can be used to identify unexpected differences but cannot be used to identify the absence of differences

56. The recession.

1 and 3 only

1 and 4 only

2 and 3 only

2 and 4 only

57. Which of the following is a characteristic of an emerging industry?

Established strategy of players.

Low number of new firms.

High unit costs.

Technical expertise.

58. Which of the following is the best reason for considering the acquisition of a nondomestic organization?

Relatively fast market entry.

Improved cash flow of the acquiring organization.

Increased diversity of corporate culture.

Opportunity to influence local government policy.

59. Providing a vehicle driver handbook is an example of a detective control.

1 and 2.

1 and 4.

2 and 3.

3 and 4.

60. Organization X owns a 38 percent equity stake in Organization Y.

Which of the following statements is true regarding the financial treatment for this relationship?

Y should be listed as an investment asset on X's balance sheet

X must consolidate the financial statements for both organizations

Y should be reported as a footnote to X's financial statements

Y should not be reported by X as X does not have a controlling interest

Page 7 of 18

61. Identify the business impact if the network services cannot be performed

1, 2, 3, 4

2, 1, 4, 3

2, 4, 1, 3

4, 2, 1, 3

62. Which of the following is a typical example of structured data?

Production information maintained in relational tables.

Tweets and posts of users on social media.

Photos and videos stored in hard drive catalogs.

Sales reports documented in word processing software.

63. Which of the following statements about matrix organizations is false?

In a matrix organization, conflict between functional and product managers may arise.

In a matrix organization, staff under dual command is more likely to suffer stress at work.

Matrix organizations offer the advantage of greater flexibility.

Matrix organizations minimize costs and simplify communication.

64. The chief audit executive (CAE) has assigned an internal auditor to an upcoming engagement.

Which of the following requirements would most likely indicate that the internal auditor was assigned to an assurance engagement?

The assigned internal auditor must determine the objectives, scope, and techniques of the engagement.

The CAE must personally obtain the needed skills, knowledge, or other competencies if the internal auditor does not have them.

The assigned internal auditor must not assume management responsibilities while performing the engagement.

The assigned internal auditor must maintain objectivity while performing the engagement.

65. Which of the following is true regarding the COSO enterprise risk management framework?

The framework categorizes an organization's objectives to distinct, non overlapping objectives.

Control environment is one of the framework's eight components.

The framework facilitates effective risk management, even if objectives have not been established.

The framework integrates with, but is not dependent upon, the corresponding internal control framework.

66. Which of the following is most likely to function as a directive control?

Security dogs.

Alert employees.

Insurance claims.

Cycle counts.

67. Due to a recent system upgrade, an audit is planned to test the payroll process.

Which of the following audit objectives would be most important to prevent fraud?

Verify that amounts are correct.

Verify that payments are on time.

Verify that recipients are valid employees.

Verify that benefits deductions are accurate.

68. Sales trends.

1 only

4 only

1 and 4 only

1, 2, and 3 only

69. Which of the following is the most common way that occupational fraud is detected?

Internal audits.

Whistleblower hotline.

Key controls.

External audits.

70. Which of the following does not provide operational assurance that a computer system is operating properly?

Performing a system audit.

Making system changes.

Testing policy compliance.

Conducting system monitoring.

Page 8 of 18

71. According to the COSO enterprise risk management (ERM) framework, which of the following is not part of the new paradigm in ERM?

Assessing the risk factors.

Aligning risk appetite and strategy.

Enhancing risk response decisions.

Reducing operational surprises and losses.

72. CORRECT TEXT

According to IIA guidance, which of the following scenarios demonstrates an internal auditor exercising due professional care?

When auditing investments, the auditor identified instruments with which he was unfamiliar. He decided not to select that type of investment in his sample, as he did not have the knowledge needed to

perform a proper assessment.

An auditor was reviewing inventory counts conducted by the warehouse staff. One truck containing an immaterial amount of inventory was off-site and wasn't verified by the auditor.

An auditor visited a plant that produces a significant portion of the organization's inventory. The day he arrived, the plant manager was out sick, so the auditor issued the report without interviewing the manager.

An auditor in charge needed to have testing completed by the end of the month, but was behind schedule. He identified a junior auditor to conduct the work for him on a complex area of the organization.

73. Which of the following statements pertaining to a market skimming pricing strategy is not true?

The strategy is favored when unit costs fall with the increase in units produced.

The strategy is favored when buyers are relatively insensitive to price increases.

The strategy is favored when there is insufficient market capacity and competitors cannot increase market capacity.

The strategy is favored when high price is perceived as high quality.

74. Senior management has decided to implement the Three Lines of Defense model for risk management.

Which of the following best describes senior management's duties with regard to this model?

Ensure compliance with the model.

Identify management functions.

Identify emerging issues.

Set goals for implementation.

75. Cost focus.

2 only

3 and 4 only

1, 3, and 4 only

1, 2, 3, and 4

76. Which stage in the industry life cycle is characterized by many different product variations?

Introduction.

Growth.

Maturity.

Decline.

77. Which of the following is based on the concept that there is not one best leadership style and that successful leadership depends on a match between the leader, the situation, and the subordinate?

Attribute theory.

Path goal model

Life cycle model

Contingency theory

78. Which of the following best describes the four components of a balanced scorecard?

Customers, innovation, growth, and internal processes.

Business objectives, critical success factors, innovation, and growth.

Customers, support, critical success factors, and learning.

Financial measures, learning and growth, customers, and internal processes.

79. Under a value-added taxing system:

Businesses must pay a tax only if they make a profit.

The consumer ultimately bears the cost of the tax through higher prices.

Consumer savings are discouraged.

The amount of value added is the difference between an organization's sales and its cost of goods sold.

80. Which of the following is a detective control strategy against fraud?

Requiring employees to attend ethics training.

Performing background checks on employees.

Implementing a control self-assessment.

Performing a surprise audit.

Page 9 of 18

81. A capital investment project will have a higher net present value, everything else being equal, if it has:

A higher initial investment level.

A higher discount rate.

Cash inflows that are larger in the later years of the life of the project.

Cash inflows that are larger in the earlier years of the life of the project.

82. Click the Exhibit.

Internal auditors are asked to keep track of how many hours per day they spend planning the audit, conducting the engagement, and writing the audit report.

The data for two days has been collected as follows:

Day 1

Day 2

Planning the audit

2 hours

3 hours

Conducting the engagement

1 hour

1 hour

Writing the audit report

2 hours

4 hours

Which of the following graphs depicts the data accurately?

Graph A only

Graph B only

Both A and

Neither A nor

83. They are helpful but limited in value in a rapidly changing environment.

1 and 2 only

1 and 4 only

2 and 3 only

3 and 4 only

84. A department purchased one copy of a software program for internal use. The manager of the department installed the program on an office computer and then made two complete copies of the original software.

Copy 1 was solely for backup purposes.

Copy 2 was for use by another member of the department.

In terms of software licenses and copyright law, which of the following is correct?

Both copies are legal.

Only copy 1 is legal.

Only copy 2 is legal.

Neither copy is legal.

85. Which of the following activities should the chief audit executive perform to ensure compliance with an organization's code of conduct?

Act as an adviser to the committee responsible for reviewing violations of the code.

Review and adjudicate all violations of the code of conduct.

Lead the committee responsible for the oversight of the code.

Implement a system of procedures to inform all employees of the code.

86. According to IIA guidance, which of the following statements is true when an internal auditor performs consulting services that improve an organization's operations?

The services must be aligned with those defined in the internal audit charter.

The services must not be performed by the same internal auditor who performed assurance services, in order to maintain objectivity.

The services may preclude assurance services from the consulting engagement.

The services impose no responsibility to communicate information other than to the engagement client.

87. Reduction.

1 only. |

1 and 4 only.

1, 3, and 4 only.

1,2, 3, and 4.

88. Which of the following techniques is the most relevant when an internal auditor conducts a valuation of an organization's physical assets?

Observation.

Inspection.

Original cost.

Vouching.

89. Upon joining the internal audit activity, each new auditor receives a copy of the audit handbook.

Which of the following handbook policies has the greatest risk of compromising audit objectivity?

Internal auditors should obtain 80 hours of continuing professional education every two years, 20 of which should be audit-related, and the remainder may be operations-related.

Internal auditors should rotate to other areas of the organization for nonaudit assignments to gain an understanding of the organization's operations.

Internal auditors should have direct and unrestricted access to personnel and information throughout the organization and the governing board.

Internal auditors should undergo annual performance appraisals conducted by the chief audit executive, who reports administratively to the chief financial officer.

90. Which of the following is a disadvantage of selecting a commercial software package rather than developing an application internally?

Lack of flexibility.

Incompatibility with client/server technology.

Employee resistance to change.

Inadequate technical support.

Page 10 of 18

91. Refer to the exhibit.

Presented below are partial year-end financial statement data (000 omitted from dollar amounts) for companies A and B:

If company A has a quick ratio of 2:1, then it has an accounts receivable balance of:

$100

$200

$300

$500

92. Where complex problems need to be addressed, which of the following communication networks would be most appropriate?

Chain.

All-channel.

Circle.

Wheel.

93. Ability to empathize with other people.

1 and 2 only

1 and 3 only

2 and 3 only

1, 2, and 3

94. A large investment organization hired a chief risk officer (CRO) to be responsible for the organization's risk management processes.

Which of the following people should prioritize risks to be used for the audit plan?

Operational management, because they are responsible for the day-to-day management of the operational risks.

The CRO, because he is responsible for coordinating and project managing risk activities based on his specialized skills and knowledge.

The chief audit executive, although he is not accountable for risk management in the organization.

The CEO, because he has ultimate responsibility for ensuring that risks are managed within the agreed tolerance limits set by the board.

95. An organization invests its savings in a volatile stock with the potential for high gains rather than a mutual fund with a lower expected return and lower volatility.

This best describes which of the following risk concepts?

Risk identification.

Risk appetite.

Risk capacity.

Risk tolerance.

96. According to IIA guidance, which of the following would not be a consideration for the internal audit activity (IAA) when determining the need to follow-up on recommendations?

Degree of effort and cost needed to correct the reported condition.

Complexity of the corrective action.

Impact that may result should the corrective action fail.

Amount of resources required to conduct the follow-up activities.

97. Which of the following documents is most appropriate in promoting the objectivity of the internal audit activity?

Usage of IT system policy.

Risk management framework.

Acceptance of gifts policy.

Personal responsibility policy.

98. Which of the following must be in existence as a precondition to developing an effective system of internal controls?

A monitoring process.

A risk assessment process.

A strategic objective-setting process.

An information and communication process.

99. Which of the following controls could an internal auditor reasonably conclude is effective by observing the physical controls of a large server room?

Adequate signs are in place to assist in locating safety equipment.

Servers are secured individually to their racks by locks.

Foam fire extinguishers are operable to protect against electrical fires.

Swipe card access is required to gain access to the server room.

100. When developing an effective risk-based plan to determine audit priorities, an internal audit activity should start by:

Identifying risks to the organization's operations.

Observing and analyzing controls.

Prioritizing known risks.

Reviewing organizational objectives.

Page 11 of 18

101. An internal audit charter, approved by the board, restricts the internal audit activity to providing assurance only on the reliability of financial information and the effectiveness of internal accounting controls.

Which of the following statements is true regarding the extent to which the external auditor may rely on the internal audit activity's work?

The external auditor may make full use of the work, as the audit charter is very specific as to the work the internal audit activity may undertake.

The external auditor may use the work, as the board has approved the charter, thus taking responsibility for any deficiencies.

The external auditor must disregard the work, as the scope of the charter may introduce bias and result in a lack of due professional care.

The external auditor may use the work with caution, due to the internal audit activity's scope and responsibility restrictions.

102. What is the additional advantage of facilitated workshops, in comparison with structured interviews, used when testing the effectiveness of entity-level controls?

During facilitated workshops, people more openly say things to internal auditors than during private interviews.

Internal auditors do not need other sources of information, as the data gathered during facilitated workshops is sufficient.

Facilitated workshops create a synergy of discussion that can bring multiple perspectives to the same issue.

The testimonial evidence obtained during facilitated workshops is generally considered more reliable.

103. A chief audit executive (CAE) is determining which engagements to include on the annual audit plan. She would like to consider the organization's attitude toward risk and the degree of difficulty in achieving objectives.

Which of the following resources should the CAE consult?

The corporate risk register.

The strategic plan.

Internal and external audit reports.

The board's meeting records.

104. According to IIA guidance, which of the following statements is true regarding periodic internal assessments of the internal audit activity?

Internal assessments are conducted to benchmark the internal audit activity's performance against industry best practices.

Internal assessments must be performed at least once every five years by a qualified assessor.

An internal auditor may perform a peer review of a colleague's workpapers, as long as the auditor wasn't involved in the audit under review.

Follow-up to ensure appropriate improvements are implemented is a recommended, but not mandatory, element of internal assessments.

105. An organization had three large centralized divisions: one that received customer orders for service work; one that scheduled the service work at customer locations; and one that answered customer calls about service problems. These three divisions were restructured into seven regional groups, each of which performed all three functions.

One advantage of this restructuring would be:

Better internal controls.

Greater economies of scale.

Improved work flow.

Increased specialization.

106. Which of the following best illustrates the primary focus of a risk-based approach to control self-assessment?

To evaluate controls regarding the computer security of an oil refinery.

To examine the processes involved in exploring, developing, and operating a gold mine.

To assess the likelihood and impact of events associated with operating a finished goods warehouse.

To link a financial institution's business objectives to a work unit responsible for the associated risk.

107. Which of the following standards would be most useful in evaluating the performance of a customer-service group?

The average time per customer inquiry should be kept to a minimum.

Customer complaints should be processed promptly.

Employees should maintain a positive attitude when dealing with customers.

All customer inquiries should be answered within seven days of receipt.

108. Data encryption is an example of which of the following controls?

Application control.

IT general control

Data input control

Data output control

109. Evaluate whether the procedures for program change management are adequate.

1 only

1 and 3 only

2 and 4 only

1, 3, and 4 only

110. What is the purpose of a secondary control?

It replaces primary controls that are either ineffective or cannot fully mitigate a risk.

It partially reduces the residual risk level when a key control does not operate effectively.

lt combines with other controls to help reduce significant risk exposures to an acceptable level.

It helps to ensure the completeness and accuracy of automated controls in a system environment.

Page 12 of 18

111. An audit identified a number of weaknesses in the configuration of a critical client/server system. Although some of the weaknesses were corrected prior to the issuance of the audit report, correction of the rest will require between 6 and 18 months for completion. Consequently, management has developed a detailed action plan, with anticipated completion dates, for addressing the weaknesses.

What is the most appropriate course of action for the chief audit executive to take?

Assess the status of corrective action during a follow-up audit engagement after the action plan has been completed.

Assess the effectiveness of corrections by reviewing statistics related to unplanned system outages, and denials of service.

Reassign information systems auditors to assist in implementing management's action plan.

Evaluate the ability of the action plan to correct the weaknesses and monitor key dates and deliverables.

112. For employees, the primary value of implementing job enrichment is which of the following?

Validation of the achievement of their goals and objectives.

Increased knowledge through the performance of additional tasks.

Support for personal growth and a meaningful work experience.

An increased opportunity to manage better the work done by their subordinates.

113. The geographical dispersion of audit staff across the organization.

1 and 3

1 and 4

2 and 3

2 and 4

114. An employee frequently uses a personal smart device to send and receive work-related emails.

Which of the following controls would be most effective to mitigate security risks related to these transmissions?

Hardware encryption.

Software encryption

Data encryption.

Authentication.

115. Which audit approach should be employed to test the accuracy of information housed in a database on an un-networked computer?

Submit batches of test transactions through the current system and verify with expected results.

Use a test program to simulate the normal data entering process.

Select a sample of records from the database and ensure it matches supporting documentation.

Evaluate compliance with the organization's change management process.

116. Request a copy of the report from a purchasing audit conducted last year by an external service provider.

1 and 2.

1 and 3.

2 and 4.

3 and 4.

117. Which of the following statements is true regarding the resolution of interpersonal conflict?

Unrealized expectations can be avoided with open and honest discussion.

Reorganization would probably not help ambiguous or overlapping jurisdictions.

Deferring action should be used until there is sufficient time to fully deal with the issue.

Timely and unambiguous clarification of roles and responsibilities will eliminate most interpersonal conflict.

118. Role of the company's leadership in ensuring IT supports the organization's strategies and objectives.

1 and 2 only

3 and 4 only

1, 2, and 4 only

2, 3, and 4 only

119. According to IIA guidance on IT auditing, which of the following would not be an area examined by the internal audit activity?

Access system security.

Policy development.

Change management.

Operations processes.

120. The main reason to establish internal controls in an organization is to:

Encourage compliance with policies and procedures.

Safeguard the resources of the organization.

Ensure the accuracy, reliability, and timeliness of information.

Provide reasonable assurance on the achievement of objectives.

Page 13 of 18

121. Which of the following statements is false regarding audit criteria?

Audit criteria should be consistent across audit assignments.

Audit criteria should represent reasonable standards against which to assess existing conditions.

Audit criteria should provide flexibility but allow identification of nonadherence.

Audit criteria should equate to good or acceptable management practices.

122. Listening effectiveness is best increased by:

Resisting both internal and external distractions.

Waiting to review key concepts until the speaker has finished talking.

Tuning out messages that do not seem to fit the meeting purpose.

Factoring in biases in order to evaluate the information being given.

123. The critical path for any project is the path that exhibits which of the following characteristics?

Has the longest duration in time.

Costs the most money.

Requires the largest amount of labor

Is deemed most important to the project.

124. According to The IIA's Code of Ethics, which of the following is true?

Confidentiality requires that auditors disclose all material facts known to them.

Integrity requires that auditors perform internal audit services in accordance with the Standards.

Objectivity requires that auditors perform their work with honesty, diligence, and responsibility.

Confidentiality requires that auditors be prudent in the use and protection of client information.

125. Which of the following factors is considered a disadvantage of vertical integration?

It may reduce the flexibility to change partners.

It may not reduce the bargaining power of suppliers.

It may limit the organization's ability to differentiate the product.

It may lead to limited control of proprietary knowledge.

126. Disaster recovery planning is a type of detailed control.

1 and 4 only

2 and 3 only

2, 3, and 4 only

1, 2, and 4 only

127. According to the HA Code of Ethics, which of the following statements best describes the principle of competency?

Internal auditors shall perform their work with honesty, diligence, and responsibility.

Internal auditors shall perform their work in accordance with the Standards.

Internal auditors shall perform their work in accordance with the law and make disclosures expected by the law.

Internal auditors shall be prudent in the use of information acquired while performing their work.

128. The chief risk officer (CRO) of a large manufacturing organization decided to facilitate a workshop for process managers and staff to identify opportunities for improving productivity and reducing defects.

Which of the following is the most likely reason the CRO chose the workshop approach?

It minimizes the amount of time spent and cost incurred to gather the necessary information.

Responses can be confidential, thus encouraging participants to be candid expressing their concerns.

Workshops do not require extensive facilitation skills and are therefore ideal for nonauditors.

Workshop participants have an opportunity to learn while contributing ideas toward the objectives.

129. According to The IIA's Code of Ethics, which of the following actions violates the principle of confidentiality?

Accepting a consulting request in the IT department without possessing the requisite experience.

Providing personal tax preparation services for a fee for several employees during the lunch hour.

Providing a friend with the marketing strategic plan, which she will use to prepare her university thesis.

Agreeing to reword an observation to avoid the client complaining directly to the auditor's supervisor.

130. The internal audit activity may accept requests from management to perform advisory services regarding how the IT governance of the organization supports the organization's strategies and objectives.

1 only.

4 only.

2 and 4.

3 and 4.

Page 14 of 18

131. The factual evidence that the internal auditor found in the course of the examination.

1 and 2

1 and 3 only

2 and 4

1, 3, and 4

132. Organizational activities that complement each other and create a competitive advantage are called a:

Merger.

Strategic fit.

Joint venture.

Strategic goal.

133. At what point during the systems development process should an internal auditor verify that the new application's connectivity to the organization's other systems has been established correctly?

Prior to testing the new application.

During testing of the new application.

During implementation of the new application.

During maintenance of the new application.

134. According to IIA guidance, which of the following strategies would add the least value to the achievement of the internal audit activity's (IAA's) objectives?

Align organizational activities to internal audit activities and measure according to the approved IAA performance measures.

Establish a periodic review of monitoring and reporting processes to help ensure relevant IAA reporting.

Use the results of IAA engagement and advisory reporting to guide current and future internal audit activities.

Establish a format and frequency for IAA reporting that is appropriate and aligns with the organization's governance structure.

135. Which of the following statements best describes the frameworks set forth by the International Standards Organization?

Globally accepted standards for industries and processes.

Bridging the gaps among control requirements, technical issues, and business risks.

Practical guidance and benchmarks for all organizations that use information systems.

Frameworks and guidance on enterprise risk management, internal control, and fraud deterrence.

136. Overall system costs are lower.

1 and 2 only

1 and 3 only

2 and 4 only

3 and 4 only

137. Which of the following techniques would be least effective in resolving the conflict created by an internal audit client's perception of the audit report as a personal attack on his management performance?

The auditor should focus on the audit client as a person and understand him, rather than just concentrating on the problem.

The auditor should make recommendations based on objective criteria, rather than based on a subjective assessment.

The auditor should explore alternative solutions to address the audit problem, so the audit client has options.

The auditor should take a flexible position on the recommendations and focus on resolving the issue by addressing the interests of the people concerned.

138. Which of the following is an example of a directive control?

Segregation of duties.

Exception reports.

Incentive compensation plans.

Automated reconciliations.

139. Which of the following is an example of collusion?

An employee includes a faked receipt in his expense claim, and the claim is signed by the employee's manager.

A vendor inflates the price of an item and remits a portion of the excess to the purchasing manager.

A vendor sends a duplicate invoice with a new invoice number, and the accounts payable system fails to detect the duplication.

An employee works with the IT manager to develop a program for identifying duplicate invoice payments.

140. An internal auditor and engagement client are deadlocked over the auditor's differing opinion with management on the adequacy of access controls for a major system.

Which of the following strategies would be the most helpful in resolving this dispute?

Conduct a joint brainstorming session with management.

Ask the chief audit executive to mediate.

Disclose the client's differing opinion in the final report.

Escalate the issue to senior management for a decision.

Page 15 of 18

141. Which of the following scenarios best illustrates a rationalization as the root cause of potential fraud?

Managers who have been with the organization for several decades become aware that newly hired, younger managers are being moved more quickly into senior positions.

The controller at a nationwide manufacturing company recently opted to no longer require two-week mandatory vacations for accounting staff.

Security cameras that monitor cash handling at the register are not functioning.

The organization is slowly phasing out three mature products that produce the highest commissions for the sales staff.

142. Which of the following is always true regarding the use of encryption algorithms based on public key infrastructure (PKI)?

PKI uses an independent administrator to manage the public key.

The public key is authenticated against reliable third-party identification.

PKI's public accessibility allows it to be used readily for e-commerce.

The private key uniquely authenticates each party to a transaction.

143. If appropriate safeguards exist, which of the following is considered a legitimate internal audit role within risk management at an organization?

Imposing risk management processes.

Providing consolidated reporting on risks.

Taking accountability for risk management.

Making decisions on risk responses.

144. The final internal audit report should be distributed to which of the following individuals?

Audit client management only

Executive management only

Audit client management, executive management, and others approved by the chief audit executive.

Audit client management, executive management, and any those who request a copy.

145. Information regarding assumptions and procedures to be employed.

1 and 4 only

2 and 3 only

1, 2, and 3 only

1, 2, 3, and 4

146. Level of audit risk.

1 and 4

2 and 3 only

1, 2, and 3

2, 3, and 4

147. Which of the following statements is true regarding assurance services provided to clients outside of the organization?

Assurance services for outside clients are not covered under the internal audit charter.

Assurance services for outside clients must be approved on a case-by-case basis by the board of directors.

The nature of assurance services for outside clients should be defined in the internal audit charter.

The nature of assurance services for outside clients is the same as for internal clients.

148. Which of the following statements is true regarding reversing entries in an accounting cycled

Reversing all previous closing adjustments is a mandatory step in the accounting cycle

Reversing entries should be completed at the end of the next accounting period after recording regular transactions of the period

Reversing entries are identical to the adjusting entries made in the previous period.

Reversing entries are the exact opposite of the adjustments made in the previous period.

149. Which of the following statements is true with regard to information protection?

All personal information, by definition is considered to be sensitive, requiring specialized controls.

Information is not considered personal if it can only be linked to or used to identify an individual indirectly.

Individuals who provide personal information to organizations share in the risk of inappropriate disclosure.

Good protection controls remove any restrictions on the quantity of personal information that can be collected

150. The decision to implement enhanced failure detection and back-up systems to improve data integrity is an example of which risk response?

Risk acceptance.

Risk sharing.

Risk avoidance.

Risk reduction.

Page 16 of 18

151. Which of the following would be a risk in the development of end-user computing (EUC) applications, compared to traditional information systems?

Management might place the same degree of reliance in reports produced by EUC applications as it does in reports produced under traditional systems development procedures.

The organization may incur higher application development and maintenance costs for EUC systems.

Since development time is typically longer for EUC applications, management may not be able to respond quickly to competitive pressures

Management may not be able to make quick and accurate decisions due to a diminished capacity to respond to managerial requests for computerized information

152. Which of the following statements is most accurate with respect to various forms, elements, and characteristics of business contracts?

A contract is a tool used by both suppliers and customers, the model and complexity of which generally remains constant

Collaboration during contract negotiation encourages stakeholders to develop consensus but typically increases cycle times and the likelihood that the contract will fail

Differing legal requirements affect the attitudes of contracting parties as well as the length content and language of contracts

A contract is a tool used by both suppliers and customers though it offers commercial assurance of the relationship, purely from a customer perspective

153. Provide assurance that the internal audit activity conforms with the IIA Code of Ethics.

1 only

1 and 2 only

1 and 3 only

1, 2, 3, and 4

154. For which of the following fraud engagement activities would it be most appropriate to involve a forensic auditor?

Independently evaluating conflicts of interests.

Assessing contracts for relevant terms and conditions.

Performing statistical analysis for data anomalies.

Preparing evidentiary documentation.

155. Which of the following performance measures would be appropriate for evaluating an investment center, which has responsibility for its revenues, costs, and investment base, but would not be appropriate for evaluating cost, revenue, or profit centers?

A flexible budget.

Variance analysis.

A contribution margin income statement by segment.

Residual income.

156. Which of the following budgets must be prepared first?

Cash budget.

Production budget.

Sales budget.

Selling and administrative expenses budget.

157. To use the information obtained as evidence in the current engagement.

4 only

1 and 3 only

1 and 4 only

2, 3, and 4 only

158. If observed during fieldwork by an internal auditor, which of the following activities is least important to communicate formally to the chief audit executive?

Acts that may endanger the health or safety of individuals.

Acts that favor one party to the detriment of another.

Acts that damage or have an adverse effect on the environment.

Acts that conceal inappropriate activities in the organization.

159. The IAA may accept requests from management to perform advisory services regarding how the IT governance of the organization supports the organization’s strategies and objectives.

1 only

4 only

2 and 4

3 and 4

160. According to IIA guidance, which of the following statements is false regarding a review of the controls in place to prevent fraud?

The review should focus on the efficiency of the controls in place to prevent fraud.

The scope of the review does not need to include all operating areas of the organization.

The cost of the control should be compared to the benefit of mitigating the related risk.

The review should assess whether the internal controls can be circumvented.

Page 17 of 18

161. Which of the following is an activity that an internal auditor must not perform?

Establish and provide continuing assurance on an anti-money laundering program for new hires.

Survey employees for their understanding of anti-money laundering practices.

Provide assurance for the effectiveness of anti-money laundering training.

Assess the risk of being fined for ineffective anti-money laundering practices.

162. Which of the following statements describes impairment to the internal auditor's objectivity?

An internal auditor reviews a purchasing agent's contract drafts prior to their execution.

An internal auditor reduces the scope of an audit engagement due to budget restrictions.

An internal auditor receives a promotional gift that is available to the organization's employees.

An internal auditor performs an assessment of the operations for which he was recently responsible.

163. Which of the following professional organizations sets standards for quality and environmental audits?

The Committee of Sponsoring Organizations of the Treadway Commission.

The Board of Environmental, Health, and Safety Auditor Certifications.

The International Organization of Supreme Audit Institutions.

The International Standards Organization.

164. Which of the following types of social responsibilities is voluntary and guided purely by the organization's desire to make social contributions?

The bottom of the pyramid responsibility.

Innovative responsibility.

Ethical responsibility.

Discretionary responsibility.

165. Innovation and learning measures

1 only.

2 and 4 only.

3 and 4 only.

2, 3, and 4 only

166. An internal control questionnaire would be most appropriate in which of the following situations?

Testing controls where operating procedures vary.

Testing controls in decentralized offices.

Testing controls in high risk areas.

Testing controls in areas with high control failure rates.

167. The chief audit executive (CAE) of a small internal audit activity (IAA) performs all high-risk engagements on the annual audit plan to make use of his knowledge and experience and to maximize the efficient use of audit resources.

Which of the following statements is most relevant regarding this practice?

The CAE's work may be reviewed by any other experienced staff member within the IA

The CAE's work should be reviewed by an individual with the appropriate background and knowledge.

The CAE may self-review his work, provided he discloses this practice in the final report.

The CAE should avoid performing engagements to ensure he is able to review all audit work objectively.

168. If a just-in-time purchasing system is successful in reducing the total inventory costs of a manufacturing company, which of the following combinations of cost changes would be most likely to occur?

169. Which of the following must be adjusted to index a progressive tax system to inflation?

Tax deductions, exemptions, and tax filings.

Tax deductions, exemptions, and tax brackets.

Tax brackets, tax deductions, and tax payments.

Tax brackets, exemptions, and nominal tax receipts.

170. An auditor identifies three errors in the sample of 25 entries selected for review (a 12 percent error rate). Based on this result, the auditor assumes that approximately 59 of the total population of 492 entries are incorrect.

To reach this assumption, the auditor has used a technique known as which of the following?

Variability tolerance.

Ratio estimation.

Stratification.

Acceptance sampling.

Page 18 of 18

171. Which of the following describes a typical desktop workstation used by most employees in their daily work?

Workstation contains software that prevents unauthorized transmission of information into and out of the organization's network.

Workstation contains software that controls information flow between the organization's network and the Internet.

Workstation contains software that enables the processing of transactions and is not shared among users of the organization's network.

Workstation contains software that manages user's access and processing of stored data on the organization's network.

172. Identify and prioritize the resources required to support critical business processes.

1 only

2 and 4 only

1, 3, and 4 only

1, 2, 3, and 4

173. Which of the following is not a barrier to effective communication?

Filtering.

Communication overload.

Similar frames of reference.

Lack of source credibility.

174. Organizational structure.

1 and 3 only

2 and 4 only

1, 2, and 3 only

1, 2, and 4 only

175. Which of the following types of data analytics would be used by a hospital to determine which patients are likely to require readmittance for additional treatment?

Predictive analytics

Prescriptive analytics

Descriptive analytics

Diagnostic analytics

ACCA CIA Challenge Exam IIA-ACCA Dumps Questions

ACCA CIA Challenge Exam IIA-ACCA Dumps Questions

Share this post

Leave a Reply Cancel reply

Related Posts