IIA Updated IIA-CIA-Part2 Exam Questions and Answers by kristian

The engagement scope outlines the specific boundaries, focus areas, and activities that the internal audit will examine. The analysis of wire transfers exceeding $10,000 within a specified timeframe is a clear, specific task that defines what will be reviewed during the engagement, making it a typical element of an engagement scope.

IIA References:

IIA Standard 2220: Engagement Scope states that the scope must be sufficient to satisfy the engagement ' s objectives and should outline specific areas and processes to be reviewed. Analyzing transactions over a certain threshold, like wire transfers exceeding $10,000, is a well-defined aspect of what the audit will cover.

The key issue here is the risk associated with non-compliance to document management policies, particularly in terms of legal exposure. If sales contracts are not stored systematically in the electronic document management database, it can lead to difficulties in retrieving these documents, especially in the case of litigation. This can pose significant legal risks because the organization might struggle to prove the agreed pricing terms and conditions, which could potentially result in financial losses or legal penalties. The consequence highlighted in option C directly addresses this critical risk. References:

" Internal Auditing: Assurance & Advisory Services " (The Institute of Internal Auditors)

" Document Management in Internal Auditing: Best Practices " (The Institute of Internal Auditors)

In this scenario, the most appropriate action for the internal auditor is to verify that the risk highlighted by the previous audit has indeed been addressed by the new IT system. This involves a detailed examination of the system documentation and possibly testing the controls within the new system. Once the auditor confirms that the new system adequately addresses the identified risk, they should report this finding to senior management and close the issue.

This approach ensures that the internal audit activity adheres to the IIA Standards regarding follow-up on audit findings, which requires auditors to ensure that agreed-upon actions have been implemented effectively.

IIA References:

IIA Standard 2500: Monitoring Progress mandates that the chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management. This includes ensuring that the risks identified are appropriately addressed.

The Practice Advisory 2500.A1-1: Follow-up Process advises that follow-up is a critical part of the audit process, and it is essential to confirm that management actions address the risks identified during the audit.

Given these considerations, the correct answer is A. The auditor examines the system documentation of the new system to verify that the risk has been addressed in the new system, then reports to senior management the closure of the issue.

If senior management decides to accept risks, such as doing business with a questionable vendor, and the chief audit executive (CAE) believes this poses a significant risk to the organization, the CAE should escalate the issue to the board. The board has the ultimate responsibility for overseeing risk management and can decide on the appropriate action to take in response to the risk.

IIA References:

IIA Standard 2600: Communicating the Acceptance of Risks states that when the CAE believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the CAE must discuss the matter with senior management. If the decision regarding risk remains unchanged, the CAE must inform the board.

The Practice Guide on Risk Management highlights the importance of the CAE keeping the board informed of significant risks that management has chosen to accept, particularly when these risks could have a material impact on the organization.