NO.104 An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which of the following statements about a common risk language is true?

NO.105 According to IIA guidance, which of the following is the best example of a system application control?

NO.106 An organization invests its savings in a volatile stock with the potential for high gains rather than a mutual fund with a lower expected return and lower volatility. This best describes which of the following risk concepts?

NO.107 Which of the following activities should the chief audit executive perform to ensure compliance with an organization’s code of conduct?

NO.108 What is the additional advantage of facilitated workshops, in comparison with structured interviews, used when testing the effectiveness of entity-level controls?

NO.109 An organization has implemented a new automated payroll system that contains a table of pay rates that are matched to employee job classifications. Which control should an internal auditor suggest in order to ensure that the table is updated correctly, and is used only for valid pay changes?

NO.110 Which of the following audit techniques is used to evaluate control design while also embodying auditing’s analytical process?

NO.111 In which of the following scenarios would a customer service hotline receive a high volume of complaints regarding payments not being applied to customers’ accounts?

NO.112 The manager for an organization’s accounts payable department resigned her post in that capacity. Three months later, she was recruited to the internal audit activity and has been working with the audit team for the last eight months. Which of the following assignments would the newly hired internal auditor be able to execute without any impairments to independence or objectivity?

NO.113 Which of the following best ensures an internal audit activity has the ability to render impartial and unbiased assessments?

NO.114 Which of the following risk management activities is most appropriate for an internal auditor to undertake?

NO.115 Which of the following are components of the ISO 31000 risk management process?
1. Setting the context.
2. Risk treatment.
3. Risk avoidance.
4. Communication.

NO.116 A credit card company detects potential errors in credit card numbers by checking whether all entered numbers contain the correct amount of digits. This is an example of which of the following IT controls?

NO.117 While performing an accounts payable engagement, a senior auditor wants to conduct several tests of controls for travel expenses. Which of the following actions are most appropriate for the senior auditor to undertake?
1. Ensure all tests use a random sampling technique.
2. Consider a judgmental approach for the sample size.
3. Assess testing errors through root cause analysis.
4. Ensure that the entire data set is tested.

NO.118 Which of the following are components of the COSO enterprise risk management framework?
1. Objective setting.
2. External environment.
3. Data collection.
4. Control activities.

NO.119 Which type of objectives can best be described as broad goals that promote the effective and efficient use of resources?

NO.120 As a matter of policy, the chief audit executive routinely rotates internal audit staff assignments and periodically interviews the staff to discuss the potential for conflicts of interest. These actions help fulfill which of the following internal audit mandates?

NO.121 If appropriate safeguards exist, which of the following is considered a legitimate internal audit role within risk management at an organization?

NO.122 According to IIA guidance, which of the following scenarios demonstrates an internal auditor exercising due professional care?
When auditing investments, the auditor identified instruments with which he was unfamiliar.

NO.123 According to IIA guidance, which of the following individuals would best be considered independent for the purpose of participating in an external assessment of the quality assurance and improvement program for an internal audit activity (IAA)?

NO.124 Which of the following is an activity that an internal auditor must not perform?

NO.125 An organization’s chief audit executive (CAE) determines that the internal audit staff does not have the requisite skills to conduct an audit of the financial derivatives area. Which of the following would be the best course of action for the CAE to follow?

NO.126 Which of the following offers the best evidence that the internal audit activity has achieved organizational independence?

NO.127 What is the primary benefit to the internal audit activity for undertaking an internal quality assessment?

NO.128 When developing the organization’s first risk universe, which of the following would the chief audit executive be least likely to consider?