IIA-CHAL-QISA Exam Questions

Identify the Conflict of Interest: The internal auditor learns about a large loan made to another auditor's relative, which represents a conflict of interest.

Refer to Professional Standards: According to the Institute of Internal Auditors' (IIA) standards, an internal auditor must maintain objectivity and avoid conflicts of interest (IIA Standard 1100 -- Independence and Objectivity).

Escalate the Issue: The appropriate course of action is to escalate this matter to the chief audit executive (CAE) and management, as they are responsible for determining the impact of the conflict and the appropriate response.

Decision Making: The CAE and management will assess whether the conflict of interest could impair the auditor's objectivity and decide whether the auditor should be removed from the engagement or if additional oversight is needed.

Documentation: It is important to document the conflict and the decision-making process in the audit documentation for transparency and accountability.

The IIA's International Standards for the Professional Practice of Internal Auditing, specifically Standard 1100 on Independence and Objectivity.

ISO 31000 Context: ISO 31000 provides guidelines on risk management, emphasizing the importance of understanding the external context.

External Context: This includes external factors such as regulatory and competitive environments that can impact the organization's risk profile.

Regulatory Environment: Understanding regulations helps the organization ensure compliance and avoid legal risks.

Competitive Environment: Analyzing the competitive environment allows the organization to anticipate market changes and manage competitive risks.

ISO 31000 Risk Management Guidelines.

Verification of Controls: The auditor should verify that the new IT system addresses the previously identified risks. This involves reviewing the system documentation and ensuring that the controls in the new system effectively mitigate the risks.

Reporting: Once the auditor has confirmed that the new system controls address the risks, they can report to senior management and close the outstanding issue, ensuring that all audit recommendations are appropriately resolved.

Other Options:

Accepting Management's Explanation: Without verification (option B) is not appropriate as it may leave risks unmitigated.

Escalating Without Verification: Advising management and escalating (option C) is premature if the new system may already address the issues.

Detailed Process Evaluation: Requiring additional details about the process (option D) may be unnecessary if the auditor can verify the controls directly.

Audit workpapers are essential documents that provide evidence of the audit work performed and the conclusions reached.

Option A: While review notes can be useful, they do not need to be retained if they do not add value to the audit evidence.

Option B: Audit workpaper documentation policies are typically established by the internal audit department, not reviewed or approved by the audit committee.

Option C: Management should not review the workpapers for accuracy as this could compromise the independence of the audit.

Option D: Preparing workpapers helps auditors document their work thoroughly, facilitating learning and professional development.

Professional Responsibility: Internal auditors are expected to demonstrate their commitment to professional standards and ethics.

Code of Ethics: The IIA's Code of Ethics outlines principles that internal auditors must follow, including integrity, objectivity, confidentiality, and competency.

Annual Declaration: Signing an annual declaration reinforces the auditor's commitment to these principles and ensures ongoing adherence to the professional standards.

Demonstration of Due Care: By signing this declaration, auditors formally acknowledge their responsibility to uphold ethical standards, which is a demonstration of due professional care.

The IIA's Code of Ethics.

The IIA's International Standards for the Professional Practice of Internal Auditing.