Free IIA IIA-ACCA Practice Questions 2026 - Page 20

A code of business conduct should include which of the following to increase its deterrent effect?

1. Appropriate descriptions of penalties for misconduct.
2. A notification that code of conduct violations may lead to criminal prosecution.
3. A description of violations that injure the interests of the employer.
4. A list of employees covered by the code of conduct.

A. 1 and 2

B. 1 and 3

C. 2 and 4

D. 3 and 4

According to IIA guidance,which of the following is true about the supervising internal auditor's review notes?

• They are discussed with management prior to finalizing the audit.
• They may be discarded after working papers are amended as appropriate.
• They are created by the auditor to support her fieldwork in case of questions.
• They are not required to support observations issued in the audit report.

A. 1 and 3 only

B. 1 and 4 only

C. 2 and 3 only

D. 2 and 4 only

According to IIA guidance, which of the following would not be a consideration for the internal audit activity (IAA) when determining the need to follow-up on recommendations?

A. Degree of effort and cost needed to correct the reported condition.

B. Complexity of the corrective action.

C. Impact that may result should the corrective action fail.

D. Amount of resources required to conduct the follow-up activities.

After finalizing an assurance engagement concerning safety operations in the oil mining process, the audit team concluded that no key controls were compromised. However, some opportunities for improvement were noted. Which of the following would be the most appropriate way for the chief audit executive (CAE) to report these results?

A. The CAE should send the final report to operational and senior management and the audit committee.

B. The CAE should send the final report to operational management only, as there is no need to communicate this information to higher levels.

C. The CAE should notify operational and senior management that the audit engagement was completed with no significant findings to report.

D. The CAE should send the final report to operational management and notify senior management and the audit committee that no significant findings were identified.

The final internal audit report should be distributed to which of the following individuals?

A. Audit client management only

B. Executive management only

C. Audit client management, executive management, and others approved by the chief audit executive.

D. Audit client management, executive management, and any those who request a copy.

An internal auditor determines that certain information from the engagement results is not appropriate for disclosure to all report recipients because it is privileged. In this situation, which of the following actions would be most appropriate?

A. Disclose the information in a separate report.

B. Distribute the information in a confidential report to the board only

C. Distribute the reports through the use of blind copies.

D. Exclude the results from the report and verbally report the conditions to senior management and the board.

According to IIA guidance, which of the following statements best justifies a chief audit executive's request for external consultants to complement internal audit activity (IAA) resources?

A. The organization's audit universe is extensive and diverse.

B. There has been an increase in unanticipated requests for advisory work.

C. Previous work provided by the external service provider has been of great quality and value.

D. A recent benchmarking study found that using external service providers is a common practice of similarly-sized IAAs in other organizations.

For which of the following fraud engagement activities would it be most appropriate to involve a forensic auditor?

A. Independently evaluating conflicts of interests.

B. Assessing contracts for relevant terms and conditions.

C. Performing statistical analysis for data anomalies.

D. Preparing evidentiary documentation.

A large retail organization, which sells most of its products online, experiences a computer hacking incident. The chief IT officer immediately investigates the incident and concludes that the attempt was not successful. The chief audit executive (CAE) learns of the attack in a casual conversation with an IT auditor. Which of the following actions should the CAE take?

1. Meet with the chief IT officer to discuss the report and control improvements that will be implemented as a result of the security breach, if any.
2. Immediately inform the chair of the audit committee of the security breach, because thus far only the chief IT officer is aware of the incident.
3. Meet with the IT auditor to develop an appropriate audit program to review the organization's Internet-based sales process and key controls.
4. Include the incident in the next quarterly report to the audit committee.

A. 1 and 2

B. 1 and 3

C. 2 and 4

D. 3 and 4

Which of the following statements is true pertaining to interviewing a fraud suspect?

1. Information gathered can be subjective as well as objective to be useful.
2. The primary objective is to obtain a voluntary written confession.
3. The interviewer is likely to begin the interview with open-ended questions.
4. Video recordings always should be used to provide the highest quality evidence.

A. 1 only

B. 4 only

C. 1 and 3

D. 2 and 4