IIA Updated IIA-CIA-Part3 Exam Questions and Answers by franco

Since senior management is about to make a final investment decision, they must be made aware of the transparency issue with tenders before approving the project. The CAE should raise the issue with senior management immediately, even if the full report is not yet complete, to ensure that governance decisions are based on accurate risk information.

Option A (risk officer) may be informed later but does not replace informing decision-makers. Option C ignores urgent risk exposure. Option D is incorrect because halting the audit would suppress critical information.

Losing the only IT auditor in the internal audit function significantly impacts the ability to perform IT audits in the approved plan. This resource limitation requires the CAE to revise the plan and seek board approval for changes.

Option A does not change the plan. Option C was foreseeable and should already have been included in prior planning. Option D has no material impact since the vacancy was quickly filled with a qualified replacement.

In advisory engagements, internal audit may provide consulting support that enhances processes while maintaining objectivity. In this case, the most appropriate value-adding activity is to facilitate development of a checklist for documenting asset transfers. This addresses the identified gap directly and supports management in strengthening controls.

Option A identifies risks but does not resolve the gap. Option C (root cause analysis) is not as practical in this advisory setting. Option D (resource allocation) is a management responsibility, not internal audit’s role.

The CAE’s role is to provide assurance that risks are identified and managed appropriately. When residual risk appears to exceed the organization’s tolerance, the CAE should first communicate the matter with senior management to discuss the issue and understand management’s acceptance of risk. Only if the risk remains unresolved should it be escalated to the board.

Option A is management’s responsibility, not internal audit’s. Option B is incomplete as evidence alone does not fulfill the communication requirement. Option C is premature because immediate escalation to the board skips management dialogue.