IIA-CHAL-QISA Sample Questions & Answers

Control Activities are the policies and procedures that help ensure management directives are carried out. A core principle within Control Activities is the segregation of duties, which is designed to prevent one person from having control over multiple phases of a transaction. The manager submitting and approving their own expense report is a classic violation of segregation of duties, a key type of control activity.

A well-constructed audit observation should contain four key elements: Criteria (what should be), Condition (the current state), Cause (why the condition exists), and Effect (the risk or consequence). The statement 'poorly controlled' is a vague conclusion (condition) without explaining the standard (criteria), the reason for the failure (cause), or the potential impact (effect), making it unactionable and difficult to validate.

The statement is false. The IIA's Code of Ethics, specifically the principle of Confidentiality, requires internal auditors to be prudent in the use and protection of information acquired in the course of their duties. They should not disclose information without appropriate authority unless there is a legal or professional obligation to do so. The primary reporting line for fraud is within the organization, typically to senior management and the board/audit committee, not directly to external authorities unless legally compelled.

A strategic performance metric measures the achievement of the organization's strategic objectives, not just project or operational goals. While budget, schedule, and uptime are important operational metrics, a reduction in patient admission time directly reflects the strategic goals of improving patient care and operational efficiency. It measures the business value and outcomes delivered by the EHR system, which is the core of a strategic assessment.

Organizational independence is effectively achieved when the CAE reports functionally to the board. However, pressure from an administrative reporting line (the CFO) to limit the scope of an audit, especially in an area overseen by that executive, is a classic example of an impairment to independence. The CFO is interfering with the risk-based audit plan and attempting to restrict the internal audit activity's unrestricted access and scope.

Standard 2010.A2 requires that the risk-based plan must consider the organization’s risk appetite. When resources are insufficient to cover all high-risk areas, the CAE's responsibility is to communicate this resource gap to senior management and the board. This allows them to make an informed decision: either accept the residual risk of the unaudited areas, increase the internal audit budget, or re-evaluate strategic priorities. The CAE provides the information; management and the board make the final decision on risk acceptance.

The primary role of the second line of defense (e.g., risk management, compliance) is to provide expertise, frameworks, and oversight to help the first line (operational management) effectively manage risks. If the second line is weak and reactive, the first line loses a critical partner. This often leads to inconsistent risk management practices, unidentified risks, and a failure to embed risk awareness into daily operations, which is the model's primary goal.

The Cash Conversion Cycle (CCC) measures the number of days it takes for a company to convert its investments in inventory and other resources into cash flows from sales. It encompasses the entire process from purchasing raw materials to collecting cash from customers, making it the most comprehensive metric for assessing the efficiency of inventory management in relation to revenue generation.

The most effective way to verify the implementation of a control is through direct testing. Selecting and examining a sample of transactions provides direct evidence that the new control is not only designed correctly (as documentation might show) but is also operating effectively in practice. Inquiry (memo) and inspection of documents are less persuasive forms of evidence than reperformance or direct testing.

While all other options are issues, the root cause and most significant governance failure is the lack of a formal risk acceptance process. A project manager verbally accepting medium-risk security vulnerabilities without a documented analysis and approval from a senior stakeholder with the appropriate authority (e.g., a Chief Risk Officer or business unit head) demonstrates a breakdown in IT governance. This informal process circumvents proper oversight and accountability for managing risks to the bank's data and reputation.