IIA Updated IIA-CIA-Part1 Exam Questions and Answers by gloria

The control that would have likely prevented the fraudulent modification of vendors ' banking information is management ' s approval being required for updates to vendors ' banking information. This control would provide a layer of verification and oversight, significantly reducing the risk of unauthorized and fraudulent changes.

Best practices in vendor management and internal controls over payment processes, as advocated by The IIA.

The most likely potential red flag for fraud by the internal audit activity in the given scenarios is when monthly payroll reports are not vetted to ensure terminated employees have been removed from the payroll system. This situation can lead to payments to non-existent ( " ghost " ) employees, a common fraud scheme, and represents a significant control weakness that could be exploited for fraudulent purposes.

Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

Effective internal auditing requires ongoing communication with the board and senior management so the internal audit function remains informed about changes in objectives, strategies, risks, priorities, and stakeholder expectations. Continuous communication enables the CAE to determine whether planned engagements remain relevant and whether emerging risks require changes to audit priorities. Reporting responsibilities are normally formalized through the internal audit charter rather than simply established operationally by management. The Global Internal Audit Standards are authoritative professional requirements, but effective internal auditing may also consider applicable laws, regulations, frameworks, and organizational requirements. Planning engagements aligned with strategy is important, but option D alone does not capture the continuing interaction necessary to maintain relevance. Therefore, ongoing communication with senior management and the board is the most accurate statement.

The IIA ' s guidelines suggest that internal audit may provide support by coaching management on risk responses, but it should not take on management’s responsibilities, such as implementing risk responses or setting the risk appetite, as this would impair objectivity​​.