Foundations of Internal Auditing

A chief audit executive joins Calder Utilities and finds the internal audit function has operated for years with no charter of any kind. What is the best first action to put the function on a proper footing?

• ABegin engagements at once and defer preparing any charter until a stakeholder specifically asks for one to be written and filed.
• BPrepare a charter setting out the purpose, authority and responsibility of internal audit, then present it to the board for formal approval.check_circle Correct
• CAdopt another organisation's published charter unchanged and file it internally without seeking any board involvement at all.
• DAsk the chief executive to issue the charter under executive authority so that formal board approval can be bypassed entirely.

Why A is wrong: Auditing without a charter leaves internal audit's authority and responsibility undefined; waiting for a request delays the very document that legitimises the work, so this is wrong.

Why B is correct: Drafting the charter with its three core components and taking it to the board for approval establishes the function's mandate in the way the Standards require, so this is the correct first action.

Why C is wrong: A borrowed charter may not fit the organisation and, more importantly, filing it without board approval leaves the mandate unauthorised, so this fails the approval requirement.

Why D is wrong: Bypassing the board removes the approval the charter depends on for its authority; the board's formal approval cannot be substituted by an executive issuance, so this is wrong.

Halbrook Group is redesigning its internal audit reporting lines. One proposal would have the chief audit executive report functionally to the chief financial officer, who would approve the audit plan and budget, and report administratively to the audit committee. Advising on the design, which arrangement best preserves the function's independence?

• AThe proposed arrangement is sound, because having the chief financial officer approve the plan and budget keeps internal audit close to the finance activities it audits.
• BThe chief audit executive should report both functionally and administratively to the chief financial officer, so that one accountable executive oversees the whole function.
• CThe chief audit executive should report functionally to the board or audit committee, which approves the plan and mandate, and administratively to senior management.check_circle Correct
• DThe chief audit executive should report functionally to senior management and drop the audit committee relationship in order to simplify the governance structure.

Why A is wrong: Proximity to the business can aid understanding, which makes this tempting, but a functional line to the chief financial officer places approval with an executive internal audit reviews, impairing independence, so it is wrong.

Why B is wrong: A single line looks tidy, which makes this plausible, but routing both lines through a reviewed executive removes the board's functional oversight and impairs independence, so it is incorrect.

Why C is correct: Functional reporting to the board or audit committee, with administrative reporting to management, is the arrangement that preserves independence, so recommending this design is the correct advice.

Why D is wrong: Simplicity is appealing, which makes this tempting, but severing the functional link to the board or audit committee removes the independent oversight the mandate relies on, so this weakens rather than preserves independence.

At Marlow Insurance, the chief executive instructs the chief audit executive to exclude the sales division entirely from this year's audit plan, even though the board approved coverage of that division. The chief audit executive judges the exclusion a significant scope limitation. What is the most appropriate next action?

• ADiscuss the scope limitation and its potential effect on internal audit's independence with the board, so that the board can decide whether to accept the resulting risk to assurance.check_circle Correct
• BComply with the chief executive's instruction and drop the sales division from the plan, since senior management directs the resources and administrative support the function depends on daily.
• CReplace the sales-division assurance work with an advisory engagement requested by the chief executive, so that the division still receives some internal audit attention during the year.
• DProceed to audit the sales division anyway without informing anyone, treating the board's approved plan as automatically overriding the chief executive's later instruction to exclude it.

Why A is correct: A management-imposed exclusion of board-approved coverage is a scope limitation that impairs independence, so raising it and its effect with the board for the board to accept or reject is the correct action.

Why B is wrong: Management does provide administrative support, which makes this plausible, but administrative reliance does not give the chief executive authority to overrule board-approved coverage, so complying silently is wrong.

Why C is wrong: Keeping some contact with the division sounds constructive, which makes this tempting, but swapping in advisory work does not cure the assurance scope limitation or inform the board, so it is incorrect.

Why D is wrong: The board's approval does carry weight, which makes this tempting, but acting unilaterally without communicating the conflict denies the board its oversight role and mishandles the impairment, so it is wrong.

Aster Retail's audit committee wants internal audit to provide a high level of confidence that the year-end revenue controls are operating effectively, and it has allocated ample time for extensive testing. Which type of engagement matches this request?

• AA reasonable assurance engagement, which performs more extensive procedures to support a positively expressed conclusion at a high though not absolute level of confidence.check_circle Correct
• BA limited assurance engagement, which performs reduced procedures and conveys a lower level of confidence through a negatively expressed conclusion.
• CAn advisory engagement, because testing controls at the audit committee's request is simply advice provided to the client on demand.
• DA reasonable assurance engagement, which guarantees the revenue controls are free from any deficiency because the testing was so extensive.

Why A is correct: Reasonable assurance uses deeper procedures to underpin a positively worded conclusion at a high but not absolute level of confidence, which is exactly what the committee has asked for and resourced.

Why B is wrong: Limited assurance is tempting shorthand for any controls review, but its reduced procedures and negative wording give lower confidence than the high assurance requested, so it does not fit.

Why C is wrong: Concluding on whether controls operate effectively for stakeholders is assurance, not advice; labelling it advisory misclassifies the service and is therefore wrong.

Why D is wrong: Reasonable assurance is high but not absolute, so promising a guarantee of no deficiency overstates what the engagement can deliver and makes this option incorrect.

The Global Internal Audit Standards state that internal auditing fulfils its purpose through work that is both independent and objective. What do these two qualities mean in this context?

• AIndependence is the function's freedom from conditions that threaten its ability to act without bias, while objectivity is the individual auditor's unbiased mental attitude.check_circle Correct
• BIndependence means the individual auditor keeps an unbiased mindset, while objectivity means the function is positioned to report outside the chain of command it audits.
• CIndependence and objectivity both refer simply to the function's freedom from any responsibility for the organisation's financial reporting duties.
• DIndependence means the auditor holds a professional certification, while objectivity means the auditor rotates across different engagements during the year.

Why A is correct: This states the accepted distinction: independence is an attribute of the function's organisational status, and objectivity is the unbiased mental attitude of the individual auditor performing the work.

Why B is wrong: This is tempting because both terms are correct concepts, but it swaps their meanings; the unbiased mindset is objectivity and the organisational positioning is independence.

Why C is wrong: Freedom from financial reporting duties is not the definition of either term; independence concerns organisational positioning and objectivity concerns mental attitude, so this narrows both incorrectly.

Why D is wrong: Certification and rotation may support quality but neither defines these terms; independence is about organisational freedom and objectivity is about an unbiased attitude.