IIA Updated IIA-CIA-Part1 Exam Questions and Answers by obi

The type of risk that an adequately designed and effectively operating system of internal controls should mitigate is "Residual" risk. Residual risk is what remains after internal controls are applied to inherent risk. This is the primary focus of most internal control systems, which are intended to reduce risks to an acceptable level.

Risk management frameworks and internal control literature, such as COSO and the Institute of Internal Auditors (IIA) guidance.

According to IIA guidance, an internal audit charter would likely include a statement that internal auditors will demonstrate competence, concern, and the dedication expected of a professional. This aligns with the IIA's Code of Ethics and Standards, which emphasize the professional demeanor and commitment required from internal auditors.

The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing and Code of Ethics.

When using the auditing-by-element approach to audit controls around corporate social responsibility (CSR), working conditions would be a relevant element for the internal audit activity to consider. This element is directly related to the social aspect of CSR, which focuses on the welfare and rights of employees within the organization.

IIA guidance on auditing corporate social responsibility initiatives.

The independence of the internal audit activity can be threatened if the annual budget for the internal audit activity is approved by the chief financial officer (Option B). This situation creates a potential conflict of interest because the CFO has a significant influence over the internal audit activity's resources, which may impact its ability to operate independently and objectively. According to the IIA Standards, Standard 1110: Organizational Independence, the internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results. Functional reporting to the board and administrative reporting to the CEO (Option A) supports independence, while outsourcing and providing consulting services (Options C and D) do not inherently threaten independence as long as proper safeguards are in place.

IIA Standards, Standard 1110: Organizational Independence

IIA Practice Guide: Independence and Objectivity