IIA-CHAL-QISA Exam Practice Test Instant Access

Question 1

Applying ISO 31000; which of the following is part of the external context for risk management?

ARisk treatment method based on risk evaluation.

BOrganizational culture, objectives, and processes.

CThe regulatory and competitive environment.

DThe method of determining the risk level

Answer : C

ISO 31000 Context: ISO 31000 provides guidelines on risk management, emphasizing the importance of understanding the external context.

External Context: This includes external factors such as regulatory and competitive environments that can impact the organization's risk profile.

Regulatory Environment: Understanding regulations helps the organization ensure compliance and avoid legal risks.

Competitive Environment: Analyzing the competitive environment allows the organization to anticipate market changes and manage competitive risks.

ISO 31000 Risk Management Guidelines.

Question 2

While auditing an organization's credit approval process, an internal auditor learns that the organization has made a large loan to another auditors relative. Which course of action should the auditor take?

AProceed with the audit engagement, but do not include the relative's information.

BHave the chief audit executive and management determine whether the auditor should continue with the audit engagement.

CDisclose in the engagement final communication that the relative Is a customer

DImmediately withdraw from the audit engagement

Answer : B

Identify the Conflict of Interest: The internal auditor learns about a large loan made to another auditor's relative, which represents a conflict of interest.

Refer to Professional Standards: According to the Institute of Internal Auditors' (IIA) standards, an internal auditor must maintain objectivity and avoid conflicts of interest (IIA Standard 1100 -- Independence and Objectivity).

Escalate the Issue: The appropriate course of action is to escalate this matter to the chief audit executive (CAE) and management, as they are responsible for determining the impact of the conflict and the appropriate response.

Decision Making: The CAE and management will assess whether the conflict of interest could impair the auditor's objectivity and decide whether the auditor should be removed from the engagement or if additional oversight is needed.

Documentation: It is important to document the conflict and the decision-making process in the audit documentation for transparency and accountability.

The IIA's International Standards for the Professional Practice of Internal Auditing, specifically Standard 1100 on Independence and Objectivity.

Question 3

Which of the following processes does the board manage to ensure adequate governance?

AEstablish and measure performance objectives for the internal audit activity

BSelect board members with necessary knowledge and skills.

CDevelop, approve, and execute the strategic plan of the organization

DDevelop strategies to mitigate the risks to achieving the organization's objectives

Answer : C

The board manages several key processes to ensure adequate governance within an organization, one of which is the development, approval, and execution of the strategic plan. This process is critical because it defines the organization's direction, goals, and the actions required to achieve these goals.

Strategic Planning: The board plays a pivotal role in setting the organization's strategic direction, which includes establishing long-term goals and defining the means to achieve them.

Performance Measurement: While the board may establish and measure performance objectives for the internal audit activity, this is part of a broader governance framework.

Risk Management: The board also develops strategies to mitigate risks, ensuring that the organization can achieve its objectives effectively.

Thus, the most comprehensive governance-related process managed by the board involves strategic planning

Question 4

An internal auditor believes that the internal audit activity's independence is impaired Which of the following actions should the internal auditor take first?

AReport the impairment to senior management

BDiscuss the impairment with the audit manager.

CAscertain the best approach to disclose the impairment.

DDecide on the extent of impact of the impairment

Answer : B

Strategic Planning: The board plays a pivotal role in setting the organization's strategic direction, which includes establishing long-term goals and defining the means to achieve them.

Performance Measurement: While the board may establish and measure performance objectives for the internal audit activity, this is part of a broader governance framework.

Risk Management: The board also develops strategies to mitigate risks, ensuring that the organization can achieve its objectives effectively.

Thus, the most comprehensive governance-related process managed by the board involves strategic planning

Question 5

When using cost-volume-profit analysis, which of the following will increase operating income once the break-even point has been reached?

AFixed costs per unit for each additional unit sold.

BVariable costs per unit for each additional unit sold.

CContribution margin per unit for each additional unit sold.

DGross margin per unit for each additional unit sold

Answer : C

Contribution Margin: Contribution margin is the amount by which the sales price of a product exceeds its variable costs. After reaching the break-even point, each additional unit sold contributes directly to operating income.

Operating Income: At the break-even point, fixed costs are covered, so additional units sold increase operating income by the contribution margin per unit.

Fixed Costs: Fixed costs per unit (option A) do not change with additional units sold.

Variable Costs: Variable costs per unit (option B) remain constant and are deducted from sales price to calculate contribution margin.

Gross Margin: Gross margin per unit (option D) includes fixed costs and is less directly relevant than the contribution margin.

Question 6

An engagement supervisor obtains facilities maintenance reports from a contractor during an audit of third-party services. Which of the following is the source of authority for the engagement supervisor to make such contact outside the organization?

AThe policies and procedures of the internal audit activity.

BThe provisions of the internal audit charter.

CThe authority of the CEO.

DThe IIA's Code of Ethics.

Answer : B

Authority Source: The internal audit charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility. It grants internal auditors the right to access all records, personnel, and physical properties relevant to the performance of engagements.

Facilities Maintenance Reports: When an engagement supervisor contacts a third-party contractor for maintenance reports, the authority is derived from the internal audit charter, which ensures auditors have the necessary access to perform their duties.

Importance of the Charter: This ensures the independence and objectivity of the internal audit activity, providing a clear mandate for auditors to obtain information from external parties as needed.

Question 7

A multinational organization has asked the internal audit activity to assist in setting up the organization's risk management system The chief audit executive (CAE) agrees to take on the engagement as a consultant. Which of the following tasks is appropriate for the CAE to undertake?

ACoordinate and facilitate risk workshops for management to attend

BEstablish the degree of risk appetite for management to accept.

CSet risk Indicators and mitigation plans for management to Implement.

DDetermine the number of significant risks for management to report to the board

Answer : A

Role of CAE as Consultant: The chief audit executive (CAE) can act as a consultant to help management establish a risk management system. Their role should be facilitative rather than directive, ensuring that management owns the risk management process.

Appropriate Tasks:

Risk Workshops: Coordinating and facilitating risk workshops (option A) helps management identify and assess risks, allowing them to develop appropriate responses. This is a suitable task for the CAE.

Risk Appetite and Indicators: Establishing risk appetite (option B) and setting risk indicators and mitigation plans (option C) are management's responsibilities.

Reporting Risks: Determining the number of significant risks to report (option D) should also be a management function.

IIA Qualified Info Systems Auditor CIA Challenge Exam Practice Test