Free IIA-CHAL-QISA sample questions

Correct answer: Listen to the manager's concerns, document the disagreement, and state that the finding will be included in the report with management's dissenting comments.

According to IIA guidance, auditors should seek to resolve disagreements during the engagement. The first step is to listen professionally to the auditee's perspective. If an agreement cannot be reached, the audit report must include the finding, supported by evidence, and should also present management's position. This ensures a balanced report for senior management and the board to review. Escalating immediately or removing the finding would be inappropriate.

Correct answers: Complexity in monitoring and troubleshooting distributed transactions.; Increased attack surface due to numerous inter-service communication endpoints.

Microservices break a large application into many small, independent services. This distribution dramatically increases the complexity of tracking a single business transaction as it may traverse multiple services, making logging, monitoring, and debugging significantly harder.

In a monolith, most communication is internal to the application process. In a microservices architecture, services communicate over a network via APIs. Each of these API endpoints represents a potential point of attack, significantly expanding the overall attack surface that must be secured.

Correct answer: Discuss the results and the resulting action plan with senior management and the board.

Standard 1320 requires communicating the results of the quality assurance and improvement program to senior management and the board. When a QA results in a rating of 'Partially Conforms' or 'Does Not Conform', the CAE must disclose the nonconformance and its impact, along with corrective action plans, to senior management and the board. This transparency is crucial for proper governance and oversight.

Correct answer: Control Activities

Control Activities are the policies and procedures that help ensure management directives are carried out. A core principle within Control Activities is the segregation of duties, which is designed to prevent one person from having control over multiple phases of a transaction. The manager submitting and approving their own expense report is a classic violation of segregation of duties, a key type of control activity.

Correct answer: It lacks the specific elements of criteria, condition, cause, and effect.

A well-constructed audit observation should contain four key elements: Criteria (what should be), Condition (the current state), Cause (why the condition exists), and Effect (the risk or consequence). The statement 'poorly controlled' is a vague conclusion (condition) without explaining the standard (criteria), the reason for the failure (cause), or the potential impact (effect), making it unactionable and difficult to validate.

Correct answer: False

The statement is false. The IIA's Code of Ethics, specifically the principle of Confidentiality, requires internal auditors to be prudent in the use and protection of information acquired in the course of their duties. They should not disclose information without appropriate authority unless there is a legal or professional obligation to do so. The primary reporting line for fraud is within the organization, typically to senior management and the board/audit committee, not directly to external authorities unless legally compelled.

Correct answer: A 15% reduction in patient admission processing time has been achieved.

A strategic performance metric measures the achievement of the organization's strategic objectives, not just project or operational goals. While budget, schedule, and uptime are important operational metrics, a reduction in patient admission time directly reflects the strategic goals of improving patient care and operational efficiency. It measures the business value and outcomes delivered by the EHR system, which is the core of a strategic assessment.

Correct answer: The internal audit activity's organizational independence.

Organizational independence is effectively achieved when the CAE reports functionally to the board. However, pressure from an administrative reporting line (the CFO) to limit the scope of an audit, especially in an area overseen by that executive, is a classic example of an impairment to independence. The CFO is interfering with the risk-based audit plan and attempting to restrict the internal audit activity's unrestricted access and scope.

Correct answer: Present the risk assessment results and resource constraints to senior management and the board to discuss risk appetite and priorities.

Standard 2010.A2 requires that the risk-based plan must consider the organization’s risk appetite. When resources are insufficient to cover all high-risk areas, the CAE's responsibility is to communicate this resource gap to senior management and the board. This allows them to make an informed decision: either accept the residual risk of the unaudited areas, increase the internal audit budget, or re-evaluate strategic priorities. The CAE provides the information; management and the board make the final decision on risk acceptance.

Correct answer: The first line (management) may not be adequately identifying and managing its own risks.

The primary role of the second line of defense (e.g., risk management, compliance) is to provide expertise, frameworks, and oversight to help the first line (operational management) effectively manage risks. If the second line is weak and reactive, the first line loses a critical partner. This often leads to inconsistent risk management practices, unidentified risks, and a failure to embed risk awareness into daily operations, which is the model's primary goal.