IIA Updated IIA-CIA-Part2 Exam Questions and Answers by anabia

Stratified sampling is the most suitable technique for selecting customers for testing the IT support department’s success in meeting service levels, as it involves dividing the population into distinct subgroups (strata) based on certain characteristics (in this case, customer size classification based on annual expenditures and service nature). This method ensures that each subgroup is adequately represented in the sample, providing more reliable and relevant results. References:

The IIA’s Global Technology Audit Guide (GTAG) on Data Analysis Technologies.

The IIA’s Practice Guide on Audit Sampling.

When an internal auditor discovers a significant issue, such as a manager’s spouse receiving paychecks without being employed, it’s essential to follow the appropriate protocols for reporting the finding.

IIA Standard 2060 – Reporting to Senior Management and the Board:

This standard mandates that the chief audit executive (CAE) must communicate significant risk exposures and control issues to senior management and the board. Following the normal chain of command ensures that the issue is escalated appropriately without bypassing necessary channels.

Ethical Considerations and Confidentiality:

According to the IIA’s Code of Ethics, internal auditors must respect the confidentiality of the information they handle. Reporting through the established chain of command ensures that sensitive issues are handled discreetly and appropriately.

IIA Standard 2440 – Disseminating Results:

This standard requires that the results of the audit, including significant findings, should be communicated to the appropriate parties. Reporting to senior management first allows for an initial review and appropriate action before escalating to higher levels, if necessary.

Option A (Contacting the external auditor): While external auditors may need to be informed, this step should follow internal reporting protocols, not precede them.

Option C (Meeting with the local manager): This could compromise the investigation, as the local manager may be involved in the issue.

Option D (Bypassing the chain of command): This should only be done in extreme circumstances, such as when senior management is directly involved in the wrongdoing, which is not indicated in this scenario.

Detailed Explanation:Why Not Other Options?

The engagement work program is primarily based on the scope and audit objectives of the engagement. The work program outlines the specific procedures to be followed during the audit to achieve the defined objectives within the scope of the engagement. It serves as a detailed plan that guides the audit team in their work, ensuring that all necessary areas are covered.

IIA References:

IIA Standard 2240: Engagement Work Program states that internal auditors must develop and document work programs that achieve the engagement objectives. These work programs are directly tied to the scope and objectives of the audit, which determine the nature and extent of audit procedures.

The Practice Guide on Engagement Planning explains that the work program should be designed to address the key risks and objectives identified during the planning phase, ensuring that the audit is comprehensive and focused on the most critical areas.

Adding invoices to the computer program to assess the reliability and effectiveness of the review process and whether controls work best describes an internal auditor's use of test data. This approach involves introducing test data into the system to evaluate how well the system processes invoices and whether it effectively identifies and prevents questionable invoices from being processed for payment.

References:

IIA Standards: 1220.A2 - Proficiency and Due Professional Care

IIA Practice Guide: Use of Technology in Auditin