Ethics and Professionalism

An internal auditor is scheduled to audit a business unit led by a close personal friend of many years, with whom the auditor socialises regularly outside work. Which impairment to individual objectivity does this situation most directly illustrate?

• AFamiliarity bias, because a close and long-standing personal relationship may cause the auditor to be unduly trusting or sympathetic when weighing the unit's evidence.check_circle Correct
• BSelf-review bias, because the auditor would be assessing operational decisions and controls that the auditor personally designed for the business unit.
• CA scope limitation, because the friendship means management is effectively restricting the records and personnel the auditor may examine during the engagement.
• DA loss of the internal audit function's organisational independence, because the audit committee no longer provides oversight of the function as a whole.

Why A is correct: Correct: familiarity bias arises when a close relationship inclines the auditor to accept explanations too readily, eroding the unbiased mental attitude objectivity demands.

Why B is wrong: This is tempting because both are objectivity impairments, but self-review bias needs the auditor to be reviewing their own prior work; here the concern is a personal relationship, not past involvement.

Why C is wrong: This is tempting because scope limitations do impair audit work, but nothing here restricts access; the risk is the auditor's own biased mindset, not a barrier imposed by management.

Why D is wrong: This is tempting because independence and objectivity are linked, but organisational independence is a structural property of the function, not one auditor's personal relationship with an auditee.

At Calder Foods, an internal auditor testing a low-value expense reconciliation is pressed by a stakeholder to examine every one of the year's 40,000 individual transactions at significant cost, even though prior work shows the control is well designed and the residual exposure is minor. Exercising due professional care, how should the auditor decide the extent of testing?

• ASet the extent of testing by weighing the cost of the additional work against its likely benefit and the low probability of a significant error given the minor residual exposure.check_circle Correct
• BExamine all 40,000 items regardless of cost, because due professional care requires the auditor to detect every possible error in the population.
• CDecline any further testing and issue the conclusion at once, since the control was already judged well designed during the planning phase.
• DHand the decision on testing extent to the stakeholder who asked for it and adopt whatever scope that person considers appropriate.

Why A is correct: Due professional care is the care a reasonably prudent, competent auditor would exercise, which includes balancing cost against benefit and the probability of a significant error, so scaling the work to the low residual risk is correct.

Why B is wrong: This is tempting because thoroughness looks diligent, but it mistakes due care for infallibility and ignores that the Standards require weighing cost against benefit rather than pursuing exhaustive certainty.

Why C is wrong: A sound design assessment is not evidence of operating effectiveness, so concluding on the strength of design alone stops short of the work a prudent auditor would perform.

Why D is wrong: Deferring to a stakeholder feels accommodating, but surrendering the judgement on scope abandons the auditor's own exercise of due care and independence.

At Aldermoor Freight, an internal auditor has evidenced a material weakness in the payment-approval controls. Just before the report goes to the audit committee, the chief financial officer asks the auditor to reword it as a minor observation, hinting that internal audit will get more cooperation in future if it does. What should the auditor do?

• AReword the finding as a minor observation and let the chief financial officer preview the report before the audit committee receives it, to keep the working relationship positive.
• BHold the finding out of this report and raise it privately with the chief financial officer alone, giving management time to fix it before the audit committee is told anything.
• CReport the control weakness accurately and at its true severity to the audit committee, standing behind the evidence despite the pressure from the chief financial officer.check_circle Correct
• DDowngrade the finding's rating to reflect the chief financial officer's assurance that a fix is planned, recording that verbal commitment in place of the underlying evidence.

Why A is wrong: This looks pragmatic because it preserves goodwill, but it misrepresents the true severity of the weakness and lets an auditee edit an assurance conclusion, breaching integrity and objectivity.

Why B is wrong: Quiet remediation sounds cooperative, but withholding a material finding from those charged with governance conceals the true position and trades honest reporting for a comfortable relationship.

Why C is correct: Integrity requires honesty and the professional courage to raise difficult findings; the conclusion is set by the evidence, not by the comfort of the auditee relationship.

Why D is wrong: A planned fix does not change the current severity, and substituting a promise for evidence lets pressure reshape the conclusion, which integrity does not permit.

At Kelder Freight, an internal auditor reviewing the payroll system learns that a planned redundancy programme will affect several named employees before it is publicly announced. At a weekend gathering, a friend who works in that department asks the auditor whether any layoffs are coming. What is the BEST action for the auditor to take?

• AConfirm only the general fact that changes are coming without naming any individuals, since the friend will hear the news soon anyway.
• BShare the information privately so the friend can prepare, treating helping a colleague as part of acting with integrity.
• CReport the friend's question to the board as a deliberate attempt to obtain confidential engagement information.
• DDecline to disclose anything and keep the redundancy information confidential, using it only for the purposes of the engagement.check_circle Correct

Why A is wrong: It feels like a safe compromise because no names are given, but revealing even the general plan discloses confidential engagement information without authority, so it still breaches the duty of confidentiality.

Why B is wrong: This misreads integrity, which never licenses breaching another principle; disclosing engagement information to an unauthorised person is a clear confidentiality violation, not an act of integrity.

Why C is wrong: A casual social question is not an escalation matter, and treating it as a board-level incident overreacts; the auditor simply needs to withhold the information rather than raise an alarm.

Why D is correct: The confidentiality principle requires auditors to respect the ownership of information they receive and to use it only for the engagement, so declining and keeping the plan confidential is the correct response.