Question

1. The Committee of Sponsoring Organizations’ enterprise risk management (COSO ERM) framework calls for a formal and comprehensive approach to risk-based thinking and encourages internal auditors to give much more attention to risk management when planning for and performing many of their reviews. T/F
2. The chief audit executive should establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals. T/F
3. Internal audit departments always have sufficient time and resources to cover all their auditable entities. T/F
4. An internal audit report with its formal findings and recommendations, is the major output product from an internal audit function. T/F
5. The IIA maintains a set of periodically updated standards, the International Standards for the Professional Practice of Internal Auditing, but all internal auditors who are members of the IIA do not have to follow them. T/F
6. When an internal auditor encounters resistance to COSO ERM principles, the matter should not be discussed in audit reports or raised to the audit committee. T/F
7. The internal audit activity’s plan of engagements should be based on a risk assessment, undertaken at least annually, and the input of senior management and the board should be considered in this process. T/F
8. The internal audit activity should evaluate and contribute to the improvement of risk management, control, and governance processes using a systematic and disciplined approach. T/F
9. Areas of a company with significant internal control risks, such as IT applications security, general ledger balancing procedures, or the annual physical inventory, would receive relatively lower internal control significance ranking scores. T/F

Answer 1

1. The Committee of Sponsoring Organizations’ enterprise risk management (COSO ERM) framework calls for a formal and comprehensive approach to risk-based thinking and encourages internal auditors to give much more attention to risk management when planning for and performing many of their reviews. - True
2. The chief audit executive should establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals. - True
3. Internal audit departments always have sufficient time and resources to cover all their auditable entities. - False
4. An internal audit report with its formal findings and recommendations, is the major output product from an internal audit function. - True
5. The IIA maintains a set of periodically updated standards, the International Standards for the Professional Practice of Internal Auditing,but all internal auditors who are members of the IIA do not have to follow them._False
6. When an internal auditor encounters resistance to COSO ERM principles, the matter should not be discussed in audit reports or raised to the audit committee. - False
7. The internal audit activity’s plan of engagements should be based on a risk assessment, undertaken at least annually, and the input of senior management and the board should be considered in this process. - True
8. The internal audit activity should evaluate and contribute to the improvement of risk management, control, and governance processes using a systematic and disciplined approach. - True
9. Areas of a company with significant internal control risks, such as IT applications security, general ledger balancing procedures, or the annual physical inventory, would receive relatively lower internal control significance ranking scores. - False