Most Recent IIA-CIA-Part2 Exam Questions & Answers

Flowcharts are particularly effective for visualizing linear processes, as they clearly depict the sequence of steps, decision points, and flow of information. However, while they provide a useful representation of the process, they may not capture all risks, particularly those that are non-linear or involve complex interactions that are not easily represented in a flowchart format.

IIA Reference:

IIA Standard 2320: Analysis and Evaluation requires internal auditors to evaluate the design and implementation of processes. Flowcharts can help auditors visualize and understand process flows but may need to be supplemented with other tools (e.g., risk and control matrices) to capture the full range of risks.

The Practice Guide on Process Mapping indicates that flowcharts are valuable for mapping linear processes but should be used in conjunction with other tools when evaluating complex or non-linear processes.

Detective controls are designed to identify and detect errors or fraud after they have occurred. Receipts for employee expenses serve as a detective control by providing evidence of transactions, enabling verification and review of expenses to identify any fraudulent or unauthorized activities. Awareness of prior incidents of fraud (Option A) is more of a preventive control, contractor non-disclosure agreements (Option B) are preventive controls to mitigate risks of information leakage, and verification of currency exchange rates (Option C) is more of a transaction control. Reference: IIA Glossary -- Detective Controls, COSO Framework

When developing the work program for an engagement reviewing an organization's small contracting services, the chief audit executive (CAE) should consider the organization's recent changes to how it processes payments. Changes in payment processing can significantly impact the control environment and may introduce new risks or control gaps. Understanding these changes will help the CAE design appropriate audit procedures to evaluate the effectiveness of the controls over the new processes.

The Institute of Internal Auditors (IIA) Practice Guide: Developing the Internal Audit Strategic Plan

IIA Standard 2200 - Engagement Planning

When using benchmarking to test the employee turnover rate, the internal auditor should compare the organization's turnover rate to the published turnover rates of peer organizations. This method provides a relevant standard or point of reference to evaluate the organization's performance relative to similar entities. By using external benchmarks, the auditor can identify whether the turnover rate is above or below industry norms, which helps in assessing the effectiveness of the organization's HR practices.

The Institute of Internal Auditors (IIA) Practice Guide: Internal Audit and Organizational Performance

IIA Standard 1220 - Due Professional Care

The chief audit executive (CAE) should prioritize risks to be used for the audit plan. Although the CAE is not accountable for managing risks, he is responsible for ensuring that the internal audit activity provides assurance on the effectiveness of the risk management processes. The CAE must understand the organization's risk landscape and determine which areas require audit attention based on their significance and potential impact. Reference: IIA Standard 2010 -- Planning, IIA Practice Guide -- Coordinating Risk Management and Assurance