The Internal Auditing Handbook 3rd Edition K. H. Spencer Pickett - Solutions

Discover the ultimate resource for mastering "The Internal Auditing Handbook 3rd Edition" by K. H. Spencer Pickett with our comprehensive online answers key. Access expertly crafted solutions, including a detailed solution manual and solutions PDF, featuring solved problems and questions with answers. Benefit from our test bank and chapter solutions, offering step-by-step answers tailored for both students and instructors. Enhance your learning with the instructor manual and textbook insights, all available for free download. Elevate your understanding with our unparalleled support, designed to provide clarity and confidence in your studies.

List and describe some of the matters that may fall under the guise ‘frequently asked questions’from users of the internal audit website.
Explain what makes a good auditor in terms of competencies, and describe what the chief audit executive may do to ensure these competencies are developed and maintained.
Prepare a presentation to the internal audit management team on the way an audit training strategy and programme may be developed and implemented.
Describe the concept of risk and suggest ways that this concept can be applied to business practice.
Discuss the implications of high levels of unmitigated risk in terms of both threats to the business and missed opportunities.
Describe the risk-management cycle and discuss each of the main stages.
Discuss the view that high levels of business risk may be addressed through a variety of methods.
Explain the concept of risk registers and how they are affected by the adopted risk appetite.
Describe the contents of a corporate risk policy and explain the role of a CRO in implementing this policy.
Explain what is meant by ‘enterprise-wide risk management’ and describe the way that this concept may be developed for an organization.
Explain how control self-assessment can be used to implement risk management.
Explain the steps that an organization may take to embed risk management into the business and the way people behave at work.
Prepare a presentation to the internal audit management team on the role of internal audit in the organization’s efforts to establish and validate business risk management.
Insert the missing words:David McNamee and Georges Selim argue that: The implications of this. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . are enormous. It turns the focus of the audit away from the past and present and toward the present and future. Focusing on controls over
Insert the missing word:The point is that success in business and the public sector is intimately tied into the act of risk taking. Risk arises from . . . . . . . . . . . . . . . . . . . . . . . . . . . . and controls are based on reducing this uncertainty where both possible and necessary.a.
Which is the most appropriate statement?a. Risk has no real form unless we relate it to our own direction, that is, what we are trying to achieve.b. Risk has no real form unless we relate it to known hazards, that is, what we are trying to achieve.c. Risk has no real form unless we relate it to our
Which is the most appropriate statement?a. The other concept that needs to be considered is that risk, in the context of achieving objectives has both an upside and downside. In our model we call these right and wrong directions.b. The other concept that needs to be considered is that risk, in the
Which is the most appropriate statement?a. This is why risk management is not really about building bunkers around the team to protect them from the outside world. It is more about staying within familiar areas and knowing when and where to take risks.b. This is why risk management is not really
Which is the most appropriate statement?a. The next point to address is the basic two dimensions of measuring risk. That is, as well as defining the nature of the risk, we need also to think about the extent to which the risk has already materialized.b. The next point to address is the basic two
Insert the missing words:Before we can delve into risk management we need to make a further point. That is, that risk management is mainly dependant on establishing the . . . . . . . . . . . . . . . . . . . . . . . . . , or the person most responsible for taking action in response to a defined
Which is the odd one out?The risk-management cycle includes the following stages:a. identificationb. assessmentc. migrationd. managemente. review
What is abc?The subject of abc has a very interesting past. Project managers have used them for a long time as they assess risks at an early stage in a large project and enter the details in a formal record that is inspected by the sponsors. The insurance industry again is well used to documenting
Insert the missing words:The majority of risk-management guides refer to tolerance, acceptance, appetite and other such measures of what we have called unmanaged . . . . . . . . . . . . . . . . . . . . . . . . . . . .a. negative riskb. key issuesc. marginal riskd. residual risk
Which is the most appropriate statement?a. Much confusion results from mixing gross and net risk. Risk before we have put in measures to deal with it, is net, or what we have called inherent risk. Risk that has been contained so far as is practicable is gross, or what we have called residual
Which is the most appropriate statement?a. The result of people buy-in is that we can get closer to a risk managed culture where people around the organization take responsibility for isolating risks and making sure they provide a criteria for making key decisions.b. The result of people buy-in is
Which is the odd one out?There is a useful model that can be applied to promoting successful seminars, by building several considerations into the planning phase of the communications project (via the seminars):a. understand nature of riskb. appreciate our risk policyc. accept the need for control
Insert the missing words:In future, new recruits will arrive at an organization with the key question. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . and feel quite comfortable working with whatever process has been developed and employed.a. ‘how do you avoid risk here?’b.
Insert an appropriate missing word:. . . . . . . . . . . . . . . . . . . . . . . management is another topical risk area and this tends to be the culmination of the way an organization has managed all the other risks to its business.a. Performanceb. Reputationc. Regulationd. Strategic
Which is the most appropriate statement?a. Quite often, communications strategies revolve around the subtle difference between warning people and protecting people.b. Quite often, communications strategies revolve around the subtle difference between assisting people and working with people.c.
Which is the odd one out:The Department of Health has established a guide to Communicating About Risk to Public Health which suggests that:a. messages are usually judged first by whether their source is trusted;b. intentional communication is often only a minor part of the message actually
Insert an appropriate missing phrase:Proponents of . . . . . . . . . . . . . . . . . . are convinced that the only way to get riskmanagement into the heart and minds of the organization is to get everyone involved in a participative manner.a. performance managementb. CRSAc. downsizingd. auditing
Insert the missing phrase:The need to balance independence and the assurance and consulting roles of internal audit is a growing feature of the new look internal auditor. The value add equation means we cannot ignore the need to . . . . . . . . . . . . . . . . . . . .a. assure as well as reviewb.
Insert the missing phrase:Riskmanagement is not really a management fad. It provides a platform for . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . by giving comfort to shareholders and other stakeholders that the risks to their investment (or services) are understood by their
Which is the most appropriate statement?a. The internal auditor’s push into an assurance role at board level is a major step that takes a great deal of courage, and a lifting of the veil of audit independence to help make risk management work properly.b. The internal auditor’s push into a
What is abc?Over the longer term, the only alternative to risk management is abc, and abc is much more embarrassing, expensive and time-consuming.a. crisis managementb. strategic managementc. contingency managementd. continuity management
Explain the importance of internal controls to a business and describe management’s responsibilities regarding these controls.
Describe the COSO control framework and discuss each of the five components.
Describe the CoCo control framework and discuss each of the components.
Discuss some of the issues addressed by other control standards such as BASLE and CobiT.
Explain the link between risk management and internal control.
Describe the different types and categories of controls that exist in most large organizations and explain what could go wrong, even where controls are meant to be in place.
Discuss the importance of good operational procedures and how such procedures might be established within an organization.
Describe some of the issues addressed in the control model used in this chapter and explain the way each component of the model contributes to promoting good controls.
Discuss the view that controls can only provide reasonable and not absolute assurances that objectives will be achieved.
Prepare a presentation to the internal audit management team on developing and implementing control awareness seminars for key staff across the organization.
Which statement is least appropriate?There are ways that we can move closer to developing good auditing standards:a. We must recognize the practicalities of real-life auditing and formulate standards that provide statements of intent rather than comprehensive procedures.b. Encourage each
Insert the missing words:Standards play a crucial role in internal auditing and support the concept of auditing as a professionally based discipline. It is however clear that published statements are of little use unless they have been fully implemented and subject to continual review. The. . . . .
Insert the missing words:A . . . . . . . . . . . . . . . . . attaches to the discipline and is to be mastered. This represents a minimum level of knowledge that is studied and understood.a. level of understandingb. common understandingc. basic level of knowledged. common body of knowledge
Which item is least appropriate?There are various hallmarks of professionalism:a. Training programmeb. Common body of knowledgec. Code of ethicsd. Sanctionse. Reports to regulatorsf. Control over services g. Qualified practitioners h. Morality i. Technical difficulty j. Examinations k. Journals l.
Which item is wrong?The IIA has described its original objectives in 1941 when it was first established:a. to cultivate, promote, and disseminate knowledge and information concerning internal auditing and subjects related thereto;b. to develop, promote, and disseminate knowledge and information
Indicate whether the listed services are assurance or consulting services:The definition of internal auditing makes it clear that it is an assurance and consulting activity including the following types of engagements:Assurance Consultinga. adviceb. compliancec. counseld. due diligencee.
Which statement is most appropriate?a. The primary players in assurance work are the auditor and the party to whom assurance is being provided, while for consulting work it is simply the auditor and the client.b. The primary players in assurance work are the auditor, the client and the third party
Which statement is least appropriate?Some of the barriers to good quality include:a. A failure by audit management to recognize (and/or understand) the importance of quality assurance systems.b. An emphasis on securing relevant audit evidence to support audit reports.c. Poor management information
Which statement is least appropriate?We would look to our systems to tell us whether internal audit is meeting the requirements of these standards. This entails the following:a. Adopt suitable professional standards (e.g. IIA) as part of the formal mission statement that drives and directs the
Insert the missing word:. . . . . . . . . . . . . . . . . . is fundamental to audit management that seeks to isolate potential problems before they arise. This requires ongoing involvement of senior auditors in their staff’s work, providing advice and guidance.a. Supervisionb. Professionalismc.
Which statement is least appropriate?The reviewer must ask questions such as:a. What were the procedures relevant to this audit?b. Have these procedures been fully communicated to the auditor who carried out the work?c. Is there sufficient evidence of compliance with these procedures?d. Is there
Which statement is least appropriate?Best practice concerning the use of procedures that have been breached should make them comply with several criteria before they may be used in disciplinary action against an employee:a. Procedures must be clear and concise.b. They must be fully communicated to
Which statement is most appropriate?a. Professionalism and quality is about giving the client what they both want and need. This simple concept becomes more involved for internal auditors because we have several different stakeholders and because we deliver both assurance and consulting
Which statement is least appropriate?a. Internal reviews involve an extensive review of overall audit strategy, staffing levels and budgets.b. Internal reviews may operate at a number of levels including reviewing the working papers and draft audit reports.c. One should develop a programme of audit
Relate the concepts 1–4 to the descriptions a–d There are various marketing concepts:1.The production concept 2.The product concept 3.The selling concept 4.The marketing approach There are four different descriptions that relate to the above concepts:a. will concentrate on the audit itself and
Which statement is most appropriate?A formal complaints procedure should be applied whereby management is advised of a clear process for submitting their concerns. The introductory memoranda to management may include the following paragraph:a. We hope that you will not experience any problems with
Insert the missing words:It is important to keep the audit shop up to date and vibrant. . . . . . . . . . . . . . . . . . is one way of avoiding stagnation and as we define new audit products, we need to ensure they are delivered in a way that promotes quality and value.a. Continuous learningb.
Which statement is least appropriate?Having the following mechanisms in place promotes continuous learning and success:a. clear role definition and service base that responds to changing needs of stakeholders.b. procedures that are efficient, flexible and focused on achieving service delivery
Which statement is most appropriate?a. One basic approach that has been discussed is risk-based systems auditing. This involves establishing the system objectives, finding out what risks should be addressed and then developing appropriate solutions to minimize all risks.b. One basic approach that
Insert the missing words:The preliminary survey seeks to accumulate relevant information regarding the operation under review so that a defined direction of the ensuing audit (if it goes ahead) may be agreed. The . . . . . . . . . . . . . . . . . . . . . . . . . will be the first point of call.a.
Insert the missing words:A feel for the audit can be gathered from impressions gained from . . . . . . . . . . . . . . . . . . . . , where the initial impression can be used to help direct the auditor towards particular problems.a. thinking about the risks involvedb. touring the work areac.
Which statement is most appropriate?a. The system selected by the auditor has to be tested before it can be audited and the preliminary survey comes to the rescue. Systems boundaries can only be determined after the necessary information has been accumulated and digested. This must happen before
Which statement is most appropriate?a. Systems audits emphasize transactions testing, and the audit programme is formulated at the preliminary survey stage. For compliance and probity audits this detailed testing programme can only be defined after the system has been documented and assessed.The
Which statement is least appropriate?The Preliminary Survey Report of one or two pages will cover the following:a. An outline of the system under review including systems objectives and boundaries.b. The work undertaken on detailed compliance testing.c. An initial opinion on the risk areas based on
Which statement is least appropriate?Factors to be addressed in the assignment plan are:a. The terms of reference for the audit by audit management and disclosed to the client management.b. The scope of work including areas for coverage and parts of the system not to be dealt with at this time.c.
Insert the missing words:One solution is to disallow budget extensions unless there is good reason such as to avoid the psychological dilemma of ‘ . . . . . . . . . . . . . . . . . . . . . . . . . ’. This occurs when the auditors become so engrossed in an operation that they see themselves as
Insert the missing word (? In the Figure):Interviewing is based around effective communications and it is a good idea to remember the basic communications model to appreciate where things could go wrong and how communicating may be improved using the following:a. confirmationb. clarificationc.
Select the most appropriate percentage (a,b, orc) for the three sources of first impressions(1, 2 and 3):This initial contact with management is quite important, since some estimate that around 90% of people will decide what they think and feel about someone within the first 10 - 40 seconds of
Which statement is most appropriate?a. Post-audit – These potentially difficult interviews bring the main findings to the client’s attention once the field work has been completed. If the client has been kept informed throughout the course of the audit then one may avoid confrontational closure
Which statement is least appropriate?It is generally advisable to structure the interview since this tends to assist the task of exchanging information. The process should involve the following key steps:a. Background preparation on the subject area. Whatever the interview it is always useful to do
Insert the missing words:The auditor poses a threat in terms of the potential for . . . . . . . . . . . . . . . . . . . . . . . . . to the working lives of everyone they meet.a. enforcing proceduresb. promoting changesc. causing problemsd. mitigating risk
Which statement is most appropriate?a. Even where the auditor is involved in investigations into irregularity, there is still a view that the auditor is primarily examining the circumstances at issue and not the people concerned. Where a name can be fitted to a problem, then this should be a
Which statement is least appropriate?Examples of non-verbal communication include:a. General body movement.b. Eye contact.c. Physical position and posture.d. Touching.e. Laughter.f. Hand movement and facial expression.g. Silences.
Select the most appropriate example (a,b, c,d, e,f, g, or h) for each type of interview question (1–8):Interviewees are guided by skilful use of questioning so that material issues are expanded on while specifics are dealt with more quickly. Types of question include:Question type: Example
Which two statements are least appropriate?There are several points regarding how audit interviews are conducted that should be noted:a. The interview should be planned.b. Auditors should familiarize themselves with the area under review and risk register that are in use.c. A structure should be
Which statement is least appropriate?Some of these rules for documenting interviews are:a. Apply the same documentation standard to all types of interview.b. Ensure that signatures applied are appropriate to the circumstances.c. Provide a front summary sheet that contains objectives, results and
Which two statements are least appropriate?The main options that the auditor has for documenting the system are:a. Narrative notes.b. Block diagrams.c. Contingency plans.d. Flowcharts.e. Testing programmes.f. Internal control questionnaire (ICQ).
Insert the missing word/s:Systems are set out by straightforward . . . . . . . . . . . . . . . . . . . . . . . . . where the main parts of the system are noted in bullet points. The processes are described from start to finish to convey the required information on which to base an evaluation. The
Which statement is least appropriate?The rules that are applied to audit flowcharts are:a. Provide clear headings and dates so that the system dealt with is clearly identified.b. Do not make them unnecessarily complicated as this consumes time and may not aid the audit process.c. Look for exception
Select the most appropriate description (1–12) for each symbol (a–l):Symbol Description (1–12)a.b.c.d.e.f.g.h.i.j.k.l.Select from the following descriptions:1. alternative process 2. book 3. computer disc 4. computer printout 5. computer process 6. connector 7. control 8. document 9. file 10.
Select the most appropriate description (a–d) for each stage of the flowchart (1–4):Descriptions:a. Order preparedb. Posted to purchase ledgerc. Requisition checked to ordersd. Requisitions passes weekly from main office Prepared by...............Reviewed by........ Date........ Narrative OP
Which statement is least appropriate?Flowcharts may be used in the following ways:a. Weak areas or waste of resources may be isolated so that audit attention may be directed towards these parts of the system, or problems can simply be referred to in the report.b. One can draw a second flowchart to
What is x?x . . . . . . . . . . . . . . . . . may be seen as the most important stage in any audit review since this provides an opportunity for auditors to apply professional creativity to the fullest. The audit opinion and recommendations should flow from the systems weaknesses identified during
Insert the missing words:We then have to turn to the model of the system that is being evaluated. The system may be conceivedasoneof severalmodels. Evaluationwillbe basedon . . . . . . . . . . . . . . . . . . . . . . . . .although reference will be made to developmenta. the prescribed systemb. the
Insert the missing words:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . are widely used to assist the control evaluation process and there are many standard packages. They consist of a series of questions applied to a particular operation and designed so that a ‘no’ answer
Which is least appropriate advantage and least appropriate disadvantage?ICQs have a number of specific advantages and disadvantages:Advantages 1. Provides a permanent record of the evaluation stage.2. A disciplined, systematic approach to evaluation not depending on the whims and fancies of the
Which is the least appropriate?The main headings may appear at the top of the internal control evaluation schedule as:a. Systems objectivesb. Control objectivesc. Risks to the achievement of control objectivesd. Initial assessment of control weaknesse. Available control mechanismsf. Existing
Which statement is the least appropriate?There are several advantages to the internal control evaluation schedule (ICES) approach:a. It treats controls as part of the process of mitigating risks to achieving objectives therefore it starts with what management is trying to achieve (i.e. the
Insert the missing words:During control evaluation the . . . . . . . . . . . . . . . . . . . . . . . . . is perhaps the single most important factor and this will be based on experience and training. The whole process of reviewing the system will arise throughout the audit and the formal evaluation
Which statement is least appropriate?The testing process involves the following stages:a. Define the test objective. There must be clear reason for performing the test.b. Define the testing strategy. How test objectives are achieved is determined by the testing strategy. Formulate an audit
There are various types of audit tests illustrated as A, B C and D in the Figure below. Select the best description for each of these tests from the choices 1–4:Descriptions:1. Dual purpose tests check for both compliance and actual error, abuse or inefficiency.2. Substantive tests seek to
There are various boxes illustrated as A, B C and D in the Figure below. Select the best description for each of these boxes from the choices 1–4:We restate the systems-based approach to auditing and how these tests fit into the audit process in the Figure below:Box Description (1, 2, 3, or
Which statement is least appropriate?Testing considerations include:a. The relative risks. The type of risks that arise where a system of control is inadequate or compliance is essential is the most important consideration in testing.b. Management needs. Where management has concerns about aspects
Which statement is least appropriate?Analytical review involves looking at two or more sets of comparable information, say two years’ balance sheets, and extracting new data that can be used to direct audit attention towards areas of particular interest. One would be looking for:a. Changes in key
Insert the missing words:There are many ways that one can gather the necessary evidence to support the testing objective. The number and types of techniques are limited only by the . . . . . . . . . . . . . . . . .a. imagination of the auditorb. time availablec. access to informationd. procedures

Showing 200 - 300 of 1134

The Internal Auditing Handbook 3rd Edition K. H. Spencer Pickett - Solutions

Step by Step Answers