Chapter 4 Answers Multiple Choice (Questions 1-21)

Internal Audit Roles and Responsibilities

1. Choice (d) is the correct answer. This alternative describes the basic role concept of internal
auditing (IIA Standard 1000 Purpose, Authority, and Responsibility). Choice (a) is incorrect
because reduction of external audit fees is a result of audit work, but not a role. Choice (b) is
incorrect because this does not represent a complete description of the proper role. Choice (c) is
incorrect because this role is too limited for internal auditing. It also serves operations
management and top management.
2. Choice (d) is the correct answer. The external auditor can offer better service in other
geographical areas because of its dispersion of offices (IIA Standard 1000 Purpose, Authority,
and Responsibility). Choice (a) is incorrect. The internal audit staff, not the external auditor,
though its continuous auditing gains an in-depth knowledge of the organization. Choice (b) is
incorrect. The internal audit staff is able to maintain an experienced knowledgeable and certified
(CIA) staff, without the potential threat of staff reassignment. Choice (c) is incorrect. The
internal staff is continuously available and not subject to greater priority work with other clients.
3. Choice (a) is the correct answer. Approval of the charter by the board of directors will protect
the internal auditing function from management actions, which could weaken the status of the
internal auditing department (IIA Standard 1000 Purpose, Authority, and Responsibility).
Choice (b) is incorrect. While adoption of the Standards serves as a guide and a measure of
internal auditing performance it will not protect and preserve the department's status. Choice (c)
is incorrect. The establishment of an audit committee does not ensure the status of internal
auditing without its involvement in areas such as approval of the charter. Choice (d) is incorrect.
Written policies and procedures serve to guide the audit staff but have little impact on
management.
4. Choice (b) is the correct answer. Auditor is not responsible for acting as an ensurer or
guarantor against fraud (IIA Standard 1220 Due Professional Care). Choice (a) is incorrect.
Internal auditing is responsible for evaluating the organization's control consciousness. Choice
(c) is incorrect. Auditor should be aware of activities where fraud is likely to occur. Choice (d) is
incorrect. Deterrence of fraud is the responsibility of management; evaluating the effectiveness
of management efforts is the responsibility of internal auditing.
5. Choice (b) is the correct answer. Since auditors alone cannot implement audit
recommendations, auditee participation and involvement makes it better (IIA Standard 1220
Due Professional Care). Choice (a) is incorrect. Imposition implies adversarial relationship.
Choice (c) is incorrect. Requirement of auditing that is unique and not participative in a

congenial manner. Choice (d) is incorrect. Due to the requirement for independence auditors
should never implement policies and procedures.
6. Choice (b) is the correct answer. In this type of situation, management is highly averse to
analysis or possible criticism of their actions and will inhibit the internal audit department's
effectiveness (IIA Standard 1000 Purpose, Authority, and Responsibility). Choice (a) is
incorrect. An operating budget variance report is a control device used to monitor actual
performance versus budget. Management foot-dragging could cause unfavorable variances, but
favorable variances could also occur if many audits were cut short due to scope impairments.
Choice (c) is incorrect. An unbiased evaluation of audit staff would not be affected by lack of
cooperation on the part of non-audit management. Choice (d) is incorrect. Policies and
procedures of the internal audit function are developed by the internal audit department and
should not be affected by non-audit management.
7. Choice (c) is the correct answer. Due to the focus on technology, audit time spent reviewing
systems development should be increased (Item I). More testing is needed at the central location
due to concentration of functions (Item III). (IIA Standard 2030 Resource Management and IIA
Standard 2200 Engagement Planning). Item II is incorrect. While a small incremental increase
in audit time may be feasible, the benefit derived would be minimal. Item IV is incorrect. Change
to business goals, processes, and focus will also require proactive change by the internal auditing
department.
8. Choice (b) is the correct answer. Independence is less likely to be impaired if the internal
auditing department reports to the Board (IIA Standard 1100 Independence and Objectivity).
Choice (a) is incorrect. Independence is impaired because the president is responsible for the
areas to be audited. Choice (c) is incorrect. Independence may be impaired in financial audits as
well as audits of line functions. Choice (d) is incorrect. Independence may be impaired for all
audits of operational areas.
9. Choice (d) is the correct answer. Two-way communication is important in fostering a
cooperative relationship (IIA Standard 2010 Planning). Choice (a) is incorrect. Control has
negative connotations and breeds antagonism with line personnel. Choice (b) is incorrect.
Interpersonal skills are more important to fostering a cooperative relationship. Choice (c) is
incorrect. Participation and cooperation are paramount in trying to improve auditor-auditee
relations, especially in audits that require intense investigation.
10. Choice (d) is the correct answer. A consultative attitude leads to two-way communication
(IIA Standard 2010 Planning). Choice (a) is incorrect. An objective attitude is desirable, but by
itself will not lead to a more positive relationship. Choice (b) is incorrect. An investigative
attitude is not likely to enhance the relationship. Choice (c) is incorrect. An interrogatory attitude
is not likely to enhance the relationship.

11. Choice (b) is the correct answer. This is the proper role of the internal auditor, and to report
the results to management (IIA Standard 2010 Planning). Choices (a), (c), and (d) are incorrect
because they are the role of management.
12. Choice (d) is the correct answer. Audit committees should be made up of external members
of the board of directors or other similar oversight committees (IIA Standard 1111 Direct
Interaction with the Board). Therefore, choices (a), (b), and (c) would be incorrect.
13. Choice (b) is the correct answer. Education and communication, although lengthy and costly,
are the only way to achieve long-term results (IIA Standard 1000 Purpose, Authority, and
Responsibility). Choice (a) is incorrect. Manipulation is not an option since it can be done only if
the party manipulating has power. Its effects are also short-lived and do not lead to long-term
commitment. Choice (c) is incorrect. Negotiation is not an alternative since the two parties do
not have equal power. Furthermore, internal auditors often do not have immediate rewards
available to them to offer management. Choice (d) is incorrect. Involving top management in this
manner is not appropriate.
14. Choice (c) is the correct answer. The audit committee should be made up of independent
directors (IIA Standard 1111 Direct Interaction with the Board). Choices (a), (b), and (d) are
incorrect because these are strengths since they prevent the IT operation from being dominated
by a user.
15. Choice (a) is the correct answer. This is a major limitation that has hampered the effective
operation of audit committees (IIA Standard 1111 Direct Interaction with the Board). Choice
(b) is incorrect. Audit committee members are usually composed of outside directors. Many of
these directors have a broad viewpoint and are not limited to a stockholder's view. Choice (c) is
incorrect. Audit committees devote considerable time to the external audit function, but the
evidence is that they are increasingly devoting time to internal audit reports. Choice (d) is
incorrect. A committee member need not have an accounting degree to understand most reporting and control issues.
16. Choice (a) is the correct answer. The controller is an auditee, and as such should have the
least influence. The highest levels of management and the audit committee are directly involved
in the CAE appointment. The external auditor has influence on the appointment because the
external auditor requires an appropriate level of expertise and independence in order to rely on
the work of the internal auditor (IIA Standard 1110 Organizational Independence). Choice (b)
is incorrect because the audit committee participates in approving the selection and dismissal of
the CAE. Choice (c) is incorrect because the external auditor is consulted on the appointment of
the CAE. Choice (d) is incorrect because the CAE administratively should report to the Chief
Executive Officer (CEO). Therefore, the CEO should have some say in the appointment of the
CAE.

17. Choice (a) is the correct answer. This is an operating decision to facilitate the budgeting
process and improve information (IIA Standard 2010 Planning). Choice (b) is incorrect. The
CAE will need to ensure that the new marketing process and the centralized advertising
department are recognized and monitored in risk assessment and planning activities. Choice (c)
is incorrect. The addition of joint-venture partners will add new or additional concerns for risk
assessment and planning in the internal auditing department. Choice (d) is incorrect. Both the
assumptions and ongoing activities related to human resources database would require
consideration in the planning and programming of audit activity.
18. Choice (d) is the correct answer. The independence of the internal auditing department is
enhanced when the audit committee participates in naming its chief audit executive (CAE) (IIA
Standard 1110 Organizational Independence). Choice (a) is incorrect. The company's CAE is
responsible for staff promotions. Choice (b) is incorrect. The company's CAE is responsible for
approving internal audit reports. Choice (c) is incorrect. This is a part of the internal auditing
department's planning function.
19. Choice (c) is the correct answer. This is an oversight activity. It will ensure that internal
auditors are carrying out their responsibilities (IIA Standard 1110 Organizational
Independence). Choice (a) is incorrect. The audit committee should exercise an active oversight
role. The actual decision, however, should be left to appropriate senior management of the
organization. Choice (b) is incorrect. Developing the internal audit plan and budget is the
responsibility of the chief audit executive (CAE). Choice (d) is incorrect. Selecting the
independent accountants is the responsibility of senior management of the organization.
However, the audit committee approves the (1) selection of the CAE and independent
accountants, and (2) audit plan and budget.
20. Choice (d) is the correct answer because it is the action the CAE should take to avoid conflict
between the CEO and the audit committee (IIA Standard 1000 Purpose, Authority, and
Responsibility). Choice (a) is incorrect. The CEO and audit committee most likely should
receive summary reports. Top management and the board ordinarily are not involved in the
details of audit work. Choice (b) is incorrect. Independence is not sufficient to avert conflict
unless reporting relationships are well defined. Choice (c) is incorrect because of choice (a).
21. Choice (d) is the correct answer. Audits may be conducted in the member's area of control
and responsibility. Thus, the potential member is not independent of the audit function. The
potential member is also not an outside director (IIA Standard 1000 Purpose, Authority, and
Responsibility). Choices (a), (b), and (c) are incorrect because they are normally independent of
the firm's internal operations and external to the firm.