IIA-CIA-Part1 Practice Test

How should management obtain assurance that employees are complying with
theorganization's security policy?

A.

Regularly conduct independent reviews of employees' security practices.

B.

Routinely survey staff so that information related to security practices can be submitted
anonymously.

C.

Rely on exception reports to identify errors.

D.

Enforce a policy that requires all employees to sign a statement that they will adhere to
the organization's security policies.

Which of the following risk factors is most subjective?

A.

Changes in staff,systems,or the environment.

B.

Prior audit findings.

C.

Size of the unit being audited.

D.

Competency of operating management.

A daily log of treasury dealers who exceeded their authorized limits serves as a:

A.

Preventive control.

B.

Detective control.

C.

Feed-forward control.

D.

Directive control.

An organization's chief audit executive (CAE) has been asked to conduct an assurance
engagement for an information technology system that was subject to a consulting
engagement in the prior year. How should the CAE respond?

A.

Decline the engagement because independence and objectivity would be impaired.

B.

Delay the assurance engagement to ensure that there is a two-year period between the
engagements.

C.

Accept the engagement and assign different auditors to conduct the assurance services.

D.

Facilitate a control self-assessment workshop instead of performing an assurance
engagement.

Which of the following topics would a chief audit executive most likely include with their
report to the board?

A.

The status of labor contract negotiations at the largest manufacturing plant.

B.

A significant level of senior management turnover throughout the organization.

C.

A recent management hire to oversee labor concerns.

D.

Analyses of recent increases in overtime.