IIA Certification in Risk Management Assurance Sample Questions:

1. Given the highly technical and legal nature of privacy issues, which of the following statements best describes the internal audit activity's responsibility with regard to assessing an organization's privacy framework?

A) The internal audit activity may delegate to nonaudit IT specialists the responsibility of determining whether personal information has been secured adequately and data protection controls are sufficient.
B) Because the audit committee is ultimately responsible for ensuring that appropriate control processes are in place to mitigate risks associated with personal information, the internal audit activity is C. required to conduct privacy assessments.
C) The internal audit activity should have appropriate knowledge and competence to conduct an asses
.......framework.
D) If an organization does not have a mature privacy framework, the internal audit activity should assist in developing and implementing an appropriate privacy framework.

2. According to IIA guidance, which of the following statements is true regarding the reporting of results from an external quality assessment of the internal audit activity?

A) The external assessment results are reported upon completion in confidence directly to the board, and senior management is advised only of the recommendations and improvement action plans.
B) The requirements for reporting quality assessment results are the same for external assessments and self-assessments with independent external validation.
C) The external assessment results are communicated upon completion to senior management and the board, but action plans for recommended improvements do not have to be reported.
D) The results of self-assessments with independent external validation are shared with the board upon completion, and monitoring of recommended improvements must be reported monthly.

3. Which of the following controls could an internal auditor reasonably conclude is effective by observing the physical controls of a large server room?

A) Adequate signs are in place to assist in locating safety equipment.
B) Swipe card access is required to gain access to the server room.
C) Foam fire extinguishers are operable to protect against electrical fires.
D) Servers are secured individually to their racks by locks.

4. Which of the following best ensures an internal audit activity has the ability to render impartial and unbiased assessments?

A) Supervision of the chief audit executive (CAE) by senior management.
B) Organizational knowledge and skills.
C) Organizational status and objectivity.
D) CAE certification.

5. According to IIA guidance, which of the following describes the primary reason to implement environmental and social safeguards within an organization?

A) To fulfill regulatory and compliance requirements.
B) To facilitate the conduct of risk assessment.
C) To enable Triple Bottom Line reporting capability.
D) To achieve and maintain sustainable development.

Solutions: