Essentials: Quality Assurance

Question 1

A chief audit executive (CAE) has established several internal controls to monitor the conduct of internal audits and consulting projects performed in the department. This includes a monthly dashboard report depicting audit start dates, completion dates, budgeted hours, and actual hours. What is the CAE trying to accomplish by having the dashboard?

1. The CAE is trying to assure the department’s own efficiency and effectiveness.
2. The CAE is using the dashboard for project management, but this is not the best tool for such a task.
3. The CAE is generating documentation for the internal auditors’ annual performance evaluations.
4. The CAE is creating a mandatory record for the performance of audits.

Answer 1

1 - The CAE is trying to assure the department’s own efficiency and effectiveness.

Rationale
In order to perform its assurance role in the areas of governance, risk management, and operational effectiveness and efficiency, the internal audit activity must assure its own efficiency and effectiveness and report its performance to senior management and the board at agreed-upon intervals. For internal assessments, the CAE may share the results, necessary action plans, and their successful implementation with stakeholders such as senior management and the board. A monthly dashboard report depicting audit start dates, completion dates, budgeted hours, and actual hours would assist in monitoring that.

Question 2

An experienced chief audit executive (CAE) takes over the internal audit operations at a company. The department has 12 auditors, and it reports to the internal audit committee and administratively to the chief executive officer. The previous CAE retired after 10 years with the company, in good standing. As part of the quality assurance and improvement program (QAIP), a external quality assurance review was performed six months ago, and it concluded that the department was in full conformance with the International Professional Practices Framework. The new CAE is considering having another external quality assurance review performed in the upcoming months. What would be the CAE’s best approach?

1. Have a quality assurance review performed with an independent validator.
2. The CAE should wait the full five years for the next quality assurance review, since the internal audit department was in full compliance with the IPPF.
3. Have another quality assurance review performed immediately. Since the previous CAE is no longer there, the earlier quality assurance review is disqualified.
4. Evaluate the performance of the department before deciding to conduct another quality assurance review sooner than the usual five years between reviews.

Answer 2

4- Evaluate the performance of the department before deciding to conduct another quality assurance review sooner than the usual five years between reviews.

Rationale
It would be best to evaluate the performance of the department over the next several months and determine whether a quality assurance review should be performed sooner than the usual five years between external reviews.

Question 3

A chief audit executive (CAE) of a small department with two auditors wants to have an external quality assurance review performed to ensure conformance with the International Professional Practices Framework as part of a quality assurance and improvement program. The department does not have any resources to fund the review, nor is it likely that it would be able to obtain such funds. What should the CAE do?

1. Request that the company’s top external auditor perform the review.
2. Have a quality assurance function within the company perform the review.
3. Perform an internal assessment that is validated by an independent internal auditor.
4. Document the limitation of funds and the likely consequences of not performing such a review.

Answer 3

3 - Perform an internal assessment that is validated by an independent internal auditor.

Rationale
Performing an internal assessment that is validated by an independent internal auditor requires fewer resources and enables the department to comply.

Question 4

Which of the following is true of quality assessments that are implemented according to IIA guidance?

1. Company managers or members of the board may be members of the external quality assessment team if they are qualified, since they are independent of the internal audit activity.
2. The results of a quality assessment can be shared with the board but not senior management.
3. The quality assessment process may include feedback from engagement clients through interviews and questionnaires or surveys.
4. A quality assessment team would not be expected to review the internal audit activity’s efficiency and effectiveness.

Answer 4

3 - The quality assessment process may include feedback from engagement clients through interviews and questionnaires or surveys.

Rationale
Implementation Guide 1311 recommends feedback from audit customers and other stakeholders (the clients). Implementation Guide 1312 explicitly states that assessment team members must be from outside of the organization being assessed. Therefore, use of company managers or members of the board is not permitted. Efficiency and effectiveness are among the recommended key components of an external assessment’s scope, per Implementation Guide 1312. Reporting results to senior management and the board is the final step of a quality assessment.

Question 5

An audit department of 12 staff members undergoes an internal assessment of their compliance to the Standards annually. An audit manager and Certified Internal Auditor (CIA) in the department performs the review under the direction of the chief audit executive (CAE). Who must the internal audit assessment be communicated to?

1. CAE
2. Audit committee of the board of directors
3. Chief executive officer, executive management, and key users receiving the internal audit services
4. There is no requirement to communicate the results of an internal quality assessment.

Answer 5

2 - Audit committee of the board of directors

Rationale
Results of quality assurance and improvement program assessments, which indicate the internal audit activity’s level of conformance, must be communicated to senior management and the board, per Attribute Standard 1320, “Reporting on the Quality Assurance and Improvement Program.” Reporting to key users receiving the internal audit services is optional rather than mandatory.

Question 6

An internal audit department of 12 persons reports administratively to the chief financial officer (CFO) and functionally to a seven-person audit committee. The department is currently undergoing an external quality assurance review as part of a quality assurance and improvement program (QAIP). In his interview with the quality assurance team, the chief audit executive (CAE) states that the internal audit committee meets six times a year and that prior to each meeting the CFO meets with the CAE to review the agenda and the details of discussions that will be conducted. The CFO requests that the CAE prepare a script for the meeting and provides comments and revisions to it. What is the best action for the quality assurance team to take with this information?

1. Do nothing, since a quality assurance team should not get involved in this situation.
2. Mention the scripting of the meeting to the audit committee chair but do not include it in the report unless the chair finds it to be noteworthy.
3. Discuss the situation with CFO and the audit committee and include best practices in the audit report to improve the independence of the internal audit function.
4. Use the nonconformance statement in the audit report.

Answer 6

3 - Discuss the situation with CFO and the audit committee and include best practices in the audit report to improve the independence of the internal audit function.

Rationale
The CAE must have free and unencumbered access to the audit committee. The best action for the CAE is to discuss the situation with CFO and the audit committee. The quality assurance team should also include best practices in the audit report, in this case, suggestions to improve the independence of the internal audit function.

Question 7

According to Standard 1312, external assessments “must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.” Which of the following best describes a situation where a more frequent review may be appropriate?

1. There is a merger of two audit functions in an acquisition.
2. There was recent extensive benchmarking with industry best practices.
3. The organization is in an industry subject to extensive regulation and/or supervision.
4. The organization is subject to extensive external oversight and direction relating to governance and internal controls.

Answer 7

1 - There is a merger of two audit functions in an acquisition.

Rationale
The chief audit executive must discuss with the board the need for more frequent external assessments. More frequent reviews may be appropriate, particularly when there have been significant changes in the internal audit function or the organization itself. Implementation Guide 1312 recognizes the other alternatives shown here as circumstances where a full external assessment by an independent team may not be necessary.

Question 8

An internal audit department for a large bank performs assurance reviews in the areas of governance, risk management, and operational effectiveness and efficiency. According to the Standards, how should the internal audit activity address matters related to its own efficiency and effectiveness?

1. The Standards direct the internal audit department to include an audit in its annual audit plan to achieve this type of assurance and report the results to senior management and the board annually.
2. The Standards do not make reporting on the operational effectiveness and efficiency of internal audit operations mandatory, and interpretation states that this would rarely be an efficient and effective use of resources.
3. The Standards indicate that an audit activity must assure its own efficiency and effectiveness and report its performance to senior management and the board at agreed-upon intervals.
4. The Standards address effectiveness. However, efficiency is an operational issue, and management can decide whether or not to address it.

Answer 8

3 - The Standards indicate that an audit activity must assure its own efficiency and effectiveness and report its performance to senior management and the board at agreed-upon intervals.

Rationale
In order to perform its assurance role in the areas of governance, risk management, and operational effectiveness and efficiency, the internal audit activity must assure its own efficiency and effectiveness and report its performance to senior management and the board at agreed-upon intervals. The Standards and various Implementation Guides identify specific reporting requirements for both internal and external assessments.

Question 9

Who is the main beneficiary of quality assurance and improvement program (QAIP) internal and external assessments?

1. Internal audit staff
2. Audit committee
3. Senior management
4. Chief audit executive

Answer 9

4 - Chief audit executive

Rationale
Both internal and external QAIP assessments of the internal audit activity are performed to evaluate and express an opinion on the activity’s conformance with the International Professional Practices Framework and The IIA’s Code of Ethics. The chief audit executive is the main beneficiary of these internal and external assessments.

Question 10

What is the first step in establishing an effective performance measurement process for an internal audit activity?

1. Propose specific measures of effectiveness and efficiency.
2. Interview key internal and external stakeholders.
3. Align the internal audit process with performance measurement processes used throughout the organization.
4. Define internal audit effectiveness.

Answer 10

4 - Define internal audit effectiveness.

Rationale
The first step is to define internal audit effectiveness, based on the Core Principles, the Definition of Internal Auditing, the Code of Ethics, the Standards, existing charters, internal audit deliverables that the activity has agreed to produce, and internal consensus.

Question 11

Periodic review of internal audit activity compliance with the activity charter, the Standards, and the Code of Ethics is primarily achieved through

1. routine self-assessment.
2. feedback from audit customers and other stakeholders.
3. automated working paper procedures.
4. analysis of performance metrics.

Answer 11

1 - routine self-assessment.

Rationale
Internal audit departments can fulfill this type of periodic review by routinely conducting self-assessments.

Question 12

Which audit step is the best example of innovation in internal auditing to promote growth and to meet the ever-changing needs of stakeholders?

1. Sending a purchased product to an independent lab to ensure that it meets contract specifications
2. Recommending what components should be considered in a balanced scorecard for the department subject to the audit
3. Using existing audit software to perform 100% sampling of the population
4. Developing a redundant duplicate payment test in an accounts payable audit

Answer 12

2 - Recommending what components should be considered in a balanced scorecard for the department subject to the audit

Rationale
Innovation in internal auditing is both crucial for its growth and necessary in meeting the ever-changing needs of stakeholders. Internal audit should find ways to be more forward-looking by embracing change and driving improvement and innovation. Recommending what components should be considered in a balanced scorecard for the department subject to the audit would be an innovative step.

Question 13

Which is the final part of an external quality assessment report of the internal audit activity as prepared by an external assessor?

1. Responses to recommendations
2. Recommendations
3. Action plan
4. Agreement on the reporting medium and format

Answer 13

2 - Recommendations

Rationale
An external assessment report concludes with recommendations, if any. The chief audit executive is responsible for responding to the recommendations and providing an action plan for remediation.

Question 14

Which statement applies to the 1300 series of standards on quality assurance and improvement?

1. Internal assessments must include both ongoing monitoring of internal audit performance as well as periodic self-assessments or assessments by those with sufficient knowledge of internal audit practices.
2. The review process is designed to improve the operations of major, well-established internal audit activities and should be limited in scope for small or new internal audit activities.
3. The review process must assess the degree to which consulting, but not assurance, engagements add value to the organization and improve operations.
4. The standards focus on the client and the ability of the internal audit activity to communicate with impact.

Answer 14

1 - Internal assessments must include both ongoing monitoring of internal audit performance as well as periodic self-assessments or assessments by those with sufficient knowledge of internal audit practices.

Rationale
Attribute Standard 1311 states, “Internal assessments must include ongoing monitoring of the performance of the internal audit activity and periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices.” The 1300 series of standards dictates specific activities that must be part of quality assurance and improvement programs, whether the internal audit activity is small or large or basic or well-established. The standards require that any quality program cover all aspects of the internal audit activity and that the process must assess the degree to which the activity (both assurance and consulting) is adding value to the organization and improving operations.

Question 15

The chief audit executive (CAE) believes that since he has over 40 years of internal audit experience, he has the competency to determine whether the department conforms to the International Professional Practices Framework (IPPF). If the internal audit activity is in conformance with the Standards in all other respects, what statement regarding conformance should the CAE include in the audit report regarding conformance to the Standards?

1. No statement on conformance is required.
2. The department performs its audits in accordance with the Code of Ethics and the Standards, except for conducting an external quality assurance review.
3. The audit report should state that the department conforms with the IPPF.
4. The audit report should state that the department does not conform to the Standards.

Answer 15

2 - The department performs its audits in accordance with the Code of Ethics and the Standards, except for conducting an external quality assurance review.

Rationale
Since an external quality assurance review has not been performed, a partially conforms statement is required.

Question 16

Evidence that ongoing monitoring activities are being performed in accordance with the internal audit activity’s quality assurance and improvement program (QAIP) is required to support conformance with Standard 1311. Which of the following is an example of such evidence?

1. Quality assessment manual for internal audit activity
2. Key performance indicators (KPIs)
3. Code of ethics
4. Due professional care

Answer 16

2 - Key performance indicators (KPIs)

Rationale
Multiple items may indicate conformance with Standard 1311, including any evidence that ongoing monitoring activities have been completed according to the internal audit activity’s QAIP. Examples may include completed checklists that support workpaper reviews, survey results, and KPIs related to the efficiency and effectiveness of the internal audit activity, such as an analysis of budget-to-actual engagement hours. In addition, conformance may be demonstrated by documentation of completed periodic assessments, which include the scope of the review and approach plan, workpapers, and communication reports. Finally, presentations to the board and management, meeting minutes, and the results of both ongoing monitoring and periodic self-assessment—including corrective action plans and corrective actions taken to improve conformance, efficiency, and effectiveness—may indicate conformance.

Question 17

External assessments must be conducted at least once every ____ years by a qualified, independent assessor or assessment team from outside the organization.

1. 2
2. 5
3. 10
4. 3

Answer 17

2 - 5 years

Rationale
According to Standard 1312, “External Assessments,” external assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

Question 18

An external quality assessment as part of a quality assurance and improvement program (QAIP) of an internal audit department provides reasonable assurance of what?

1. Conformance of audit work with all mandatory guidance including Code of Ethics and the Standards
2. Auditor training that addresses all gaps in auditor knowledge needed to satisfy the annual audit plan
3. Audit program continual improvement, including auditors delivering assurance and consulting services at or above the requirements in the charter
4. Senior management’s and board of directors’ level of satisfaction with assurance and consulting services

Answer 18

1 - Conformance of audit work with all mandatory guidance including Code of Ethics and the Standards

Rationale
The mandatory element of an external quality assessment as part of a QAIP is to assess conformance to the mandatory guidance and provide an opinion as to whether the internal auditing activity generally conforms to the Code of Ethics and all of the Standards.

Question 19

The requirements for a quality assurance and improvement program indicate that the chief audit executive (CAE) is responsible for ensuring that the internal audit activity conducts an internal assessment that includes both ________ monitoring and ________ self-assessments.

1. efficient; effective
2. operational; information technology
3. ongoing; periodic
4. internal; external

Answer 19

3 - ongoing; periodic

Rationale
As Standard 1311 indicates, the CAE is responsible for ensuring that the internal audit activity conducts an internal assessment that includes both ongoing monitoring and periodic self-assessments. Internal assessments validate that the internal audit activity continues to conform with the International Standards for the Professional Practice of Internal Auditing and The IIA’s Code of Ethics. The CAE understands that the internal assessments focus on continuous improvement of the internal audit activity and involve monitoring its efficiency and effectiveness.

Question 20

Quality is achieved more economically if the company focuses on

1. prevention costs.
2. internal failure costs.
3. external failure costs.
4. appraisal costs.

Answer 20

1 - prevention costs.

Rationale
Prevention costs prohibit poor-quality services from being performed in the first place. Appraisal and internal and external failure costs are corrective actions that are costly.

Question 21

Which of the following can be part of an internal audit activity’s quality assurance program rather than just being included as part of other responsibilities of the chief audit executive (CAE)?

1. Each individual internal auditor’s performance is appraised at least annually.
2. The CAE provides information about and access to internal audit working papers to the external auditors to enable them to understand and determine the degree to which they may rely on the internal auditors’ work.
3. Supervision of an internal auditor’s work is performed throughout each audit engagement.
4. Management approves a formal charter establishing the purpose, authority, and responsibility of the internal audit activity.

Answer 21

3 - Supervision of an internal auditor’s work is performed throughout each audit engagement.

Rationale
Supervision is one method of ongoing review, which is part of the internal assessment aspect of quality assurance.

Question 22

What is an important way to ensure that the ongoing monitoring requirements of an internal assessment for a quality assurance and improvement program (QAIP) are fulfilled?

1. Incorporate requirements into routine policies and practices.
2. Provide assessment criteria such as checklists to all pending internal audit clients.
3. Enlist the help of persons within the organization with sufficient knowledge of internal audit practices.
4. Ensure that the charter references The IIA’s Code of Ethics and the Standards.

Answer 22

1 - Incorporate requirements into routine policies and practices.

Rationale
Interpretation of Standard 1311 tells us: “Ongoing monitoring is an integral part of the day-to-day supervision, review, and measurement of the internal audit activity. Ongoing monitoring is incorporated into the routine policies and practices used to manage the internal audit activity and uses processes, tools, and information considered necessary to evaluate conformance with the Code of Ethics and the Standards.”

Question 23

A small company has an internal audit department of one auditor, and she both serves as the chief audit executive (CAE) and performs all audit work. She performs an independent risk assessment of the company and attends executive meetings. While she reports administratively to the chief financial officer (CFO), she reports functionally to a three-person audit committee. What should she do in regard to adherence to the quality assurance and improvement program (QAIP) standard?

1. The QAIP standard indicates that her superior, the CFO in this case, should perform the assessment.
2. The QAIP standard is waived for a department of one person.
3. It would be acceptable for the CAE to perform the internal assessment of her own work since there is no one else in the department.
4. As the CAE, she will have to request resources from the audit committee to have an external assessment performed.

Answer 23

4 - As the CAE, she will have to request resources from the audit committee to have an external assessment performed.

Rationale
The size of the internal audit department has no effect on the evaluation of the internal audit activity’s conformance with Code of Ethics, the Standards, and its charter along with the extent of its use of current best practices and its program of continuous improvement. These evaluations may also include recommendations to enhance conformance to the Standards.

Question 24

From the organization’s perspective, the external assessment reporting process typically includes which step?

1. The external assessor(s) determine whether or not to include an assessment of degree of conformance in the report.
2. A draft report is sent to the chief audit executive, who is asked to respond to the recommendations and provide an action plan.
3. The chief audit executive reviews the final report and decides which parts to present to the board and senior management.
4. The board and senior management receive the report before the chief audit executive gets to see it for the first time.

Answer 24

2 - A draft report is sent to the chief audit executive, who is asked to respond to the recommendations and provide an action plan.

Rationale
External assessment results in draft report form are provided to the chief audit executive so that this person can form a plan to address deficiencies or opportunities.

Question 25

Which is considered an element of a quality assurance and improvement program (QAIP)?

1. Internal reviews of audits completed
2. Annual appraisals of individual internal auditors’ performance
3. Conformance with communication restrictions of senior management
4. Total objectivity of internal quality assessments

Answer 25

1 - Internal reviews of audits completed

Rationale
Ongoing internal evaluations of the internal audit activity are performed in part by doing internal reviews of audits completed. Because the CAE supervises internal quality assessments, this involvement precludes total objectivity. Individual appraisal is part of personnel management.

Question 26

Which would constitute the simplest acceptable peer review team relationship formed from members of one or more outside organizations (denoted A, B, C, D, etc.) for purposes of an external quality assessment as part of a quality assurance and improvement program (QAIP)?

1. A reviews B, and B reviews A.
2. A reviews B, B reviews C, C reviews D, and D reviews A, but all rotate to new assignments the next time.
3. All teams do a self-assessment, and A provides independent validation for B, C, and D, with B taking over independent validation the next time, and so on.
4. A reviews B, B reviews C, and C reviews A.

Answer 26

4 - A reviews B, B reviews C, and C reviews A.

Rationale
External quality assessment reviews may be performed by a peer review team formed using members from one or more outside organizations. Note that reciprocal arrangements such as peer A providing audit services for peer B and then peer B doing the same for peer A would compromise independence, but A auditing B, B auditing C, and C auditing A would be the simplest acceptable method of those listed.

Question 27

A department conducts internal assessments annually and communicates results to the board. They recently underwent an external quality assessment, and it was determined that the department conforms to all aspects of the Standards. The quality assurance (QA) team noted, however, that the auditors were allowed to accept gifts of nominal value, went to golf outings with management, and lunched with executives quite often. The chief audit executive (CAE) believes this is important, as it builds strong relationships with management and allows the department to get better cooperation. What should the conformance statement in the QA team’s report say in relation to the International Professional Practices Framework (IPPF) and The IIA’s Code of Ethics?

1. Regardless of what it says in the organization’s policy about gifts, outings, and lunches, the department conforms to the IPPF and The IIA’s Code of Ethics.
2. Since the department complies with the Standards, no statement is required.
3. While the department conforms to the IPPF, it does not conform to The IIA’s Code of Ethics.
4. If the auditors’ actions related to gifts, outings, and lunches are allowed under current organizational policy, then the report can indicate that the department conforms to the IPPF and The IIA’s Code of Ethics.

Answer 27

3 - While the department conforms to the IPPF, it does not conform to The IIA’s Code of Ethics.

Rationale
Both internal and external assessments of the internal audit activity are performed to evaluate and express an opinion on the activity’s conformance with the IPPF and The IIA’s Code of Ethics. In this case, the behavior goes beyond what would be considered reasonable in The IIA’s Code of Ethics and results in the appearance of lack of objectivity (or actual conflict of interest).

Question 28

A quality assessment team that is part of a quality assurance and improvement program has selected ten sets of workpapers to be reviewed for conformance to the Standards. The department uses manual workpapers because there are only five team members. The chief audit executive is unable to provide one set of workpapers because they have been lost. The review of the remaining nine sets of workpapers demonstrates conformance. What points should the quality assessment team include in its report?

1. The department “does not conform” to the Standards due to professional skepticism regarding the missing workpaper.
2. The department “partially conforms” to the Standards due to professional skepticism regarding the missing workpaper.
3. The department “generally conforms” to the Standards. No mention of the missing workpaper is needed.
4. The department “generally conforms” to the Standards, but it would be best if the department migrates to the use of automated workpapers, as this is a best practice and could prevent loss of future workpapers.

Answer 28

4 - The department “generally conforms” to the Standards, but it would be best if the department migrates to the use of automated workpapers, as this is a best practice and could prevent loss of future workpapers.

Rationale
According to The IIA’s Quality Assessment Manual, the most important aspect of an assessment is the evaluation of the internal audit activity’s conformance to the Standards and its charter along with the extent of its use of current best practices and its program of continuous improvement. These evaluations should also include recommendations to enhance conformance to the Standards.

Question 29

In relation to a quality assurance and improvement program (QAIP), what is required for internal auditors to assert that the internal audit activity conforms with the Code of Ethics and the Standards?

1. Both internal and external assessment results must support such a statement.
2. Management, the chief executive officer, and the audit committee must express satisfaction (in writing) with the results of an internal or external QAIP.
3. The department must have an internal audit charter that specifies using a QAIP and is signed by the chair of the audit committee.
4. All that is required is that an external review was passed within the last five years.

Answer 29

1 - Both internal and external assessment results must support such a statement.

Rationale
Internal auditors may assert that the internal audit activity conforms with Code of Ethics and the Standards only if the results of the QAIP, including both internal and external assessment results, support such a statement.

Question 30

A quality assurance and improvement program (QAIP) requires what two types of assessments to be performed?

1. Efficient and effective
2. Internal and external
3. Code of ethics and standards
4. Operational and information technology

Answer 30

2 - Internal and external

Rationale
Standard 1310 communicates the requirements that make up the QAIP, which covers all aspects of the internal audit activity. Specifically, the standard indicates that both internal and external assessments are required.

Question 31

Which of the following is an essential component of an effective quality assurance and improvement program (QAIP)?

1. Code of ethics
2. Proficiency
3. Communication of results
4. Due professional care

Answer 31

3 - Communication of results

Rationale
To implement Standard 1300, the chief audit executive must consider the requirements related to the five essential components of a QAIP:
* Internal assessments (Standard 1311)
* External assessments (Standard 1312)
* Communication of QAIP results (Standard 1320) (The CAE must communicate the results of the QAIP to senior management and the board.)
* Proper use of a conformance statement (Standard 1321)
* Disclosure of nonconformance (Standard 1322)

Question 32

A quality assurance and improvement program (QAIP) requires ongoing and periodic assessments of the entire spectrum of audit and consulting work performed by the internal audit activity. These assessments are validations of ________ the Definition of Internal Auditing, the Code of Ethics, and the Standards.

1. compliance with
2. observance of
3. conformance with
4. adherence to

Answer 32

3 - conformance with

Rationale
“Conformance with standards” is a technical term borrowed from the quality management discipline. It is not about complying with the letter of the standard. Someone who is in conformance with a standard is expected to achieve the spirit of the standard.

Question 33

Who should be the direct recipient of reports that show the results of periodic reviews for internal assessment of the internal audit function?

1. Senior management
2. Process owners
3. Chief audit executive (CAE)
4. Board of directors

Answer 33

3 - Chief audit executive (CAE)

Rationale
Typically, those individuals conducting ongoing and periodic reviews should report to the CAE while performing the reviews and should communicate their results directly to the CAE.

Question 34

A quality assurance and improvement program (QAIP) rating of “Generally conforms” is one of the results possible from the ___________________ rating scale.

1. DIIR (IIA-Germany) Guideline for Conducting a Quality Assessment
2. IIA’s Capability Model for the Public Sector
3. IIA’s Quality Assessment Manual
4. IIA’s Assessment

Answer 34

3 - IIA’s Quality Assessment Manual

Rationale
A QAIP should include a rating scale to assess the level of conformance of the internal audit activity with the Standards. Different options are available when deciding which assessment scale better suits particular needs. An example is the scale in The IIA’s Quality Assessment Manual.

Question 35

A mineral extraction organization is subject to heavy government regulation. Which of the following is primarily an internal audit activity that should provide timely periodic validation of compliance with applicable laws, regulations, and government or industry standards?

1. Compliance monitoring
2. Internal assessments
3. External assessments
4. Balanced scorecard for internal auditing departments

Answer 35

2 - Internal assessments

Rationale
Internal assessments, as part of a quality assurance and improvement program, should include periodic validations of compliance with applicable laws, regulations, and government or industry standards. External assessments generally focus on other things than laws, regulations, and standards, and even if they do address these things, they would not be timely, since they are done only every five years or so. Compliance monitoring is usually conducted by compliance officers outside of internal auditing.