IIA-CIA-Part2 Practice Test

The internal audit activity can be involved with systems development continuously, immediately
prior to implementation, after implementation, or not at all. An advantage of continuous internal
audit involvement compared to the other types of involvement is that:

A.

The cost of audit involvement can be minimized.

B.

There are clearly defined points at which to issue audit comments.

C.

Redesign costs can be minimized.

D.

The threat of lack of audit independence can be minimized.

In a review of an electronic data interchange application using a third-party service provider, the
auditor should:
I. Ensure encryption keys meet International Organization for Standardization (ISO) standards.
II. Determine whether an independent review of the service provider's operation has been
conducted.
III. Verify that only public-switched data networks are used by the service provider.
IV. Verify that the service provider's contracts include necessary clauses, such as the right to
audit.

A.

 I and II only

B.

I and IV only

C.

 II and III only

D.

II and IV only

Once an audit report is drafted, the auditor's supervisor should review it primarily to ensure that all:

A.

Statements are supported and can be authenticated.

B.

Recommendations for corrective action are clear.

C.

Processes within the audited area were reviewed.

D.

Sample sizes appear appropriate for any issues found.

In preparing to facilitate a control self-assessment session, an auditor would be least likely to
ensure that:

A.

Key stakeholders are represented in the group.

B.

An independent content expert is available to help settle disagreements.

C.

Background research is completed to familiarize the auditor with relevant issues.

D.

Management is consulted on the issues and priorities

What decision-making approach should a facilitator initiate if a group addresses an unfamiliar
situation during a control self-assessment session?

A.

 Spontaneous agreement.

B.

Consensus building.

C.

Majority voting.

D.

Compromise.