Engagement Planning

Midway through planning, management refuses to grant the audit team access to a set of vendor payment records that fall squarely within the agreed engagement objectives. In internal audit terms, this situation is best described as which of the following?

• AA residual risk, because the missing records represent exposure that remains after controls have already been applied to payments.
• BAn engagement objective, because the records define what the team set out to evaluate at the start of the work.
• CA scope limitation, because a restriction is preventing the team from gathering evidence needed to meet the engagement objectives.check_circle Correct
• DA control deficiency, because withholding the records shows that a payment control has failed to operate effectively.

Why A is wrong: This borrows a real term, but residual risk describes leftover exposure after controls, not a restriction on the auditor's access to evidence.

Why B is wrong: This is tempting since the records relate to the objective, but the objective is the goal being tested, not the access restriction that impedes it.

Why C is correct: Correct because a condition that blocks access to information required to achieve the objectives is a scope limitation, which the chief audit executive should evaluate and often report.

Why D is wrong: This confuses two ideas; a refusal of access limits the audit, whereas a control deficiency is a weakness in management's own control operation.

A retailer's chief audit executive is asked by the audit committee to help the company design a new inventory-count control before it is implemented. The committee wants internal audit involved. Which approach best preserves independence while responding to the request?

• AAccept the work as an advisory engagement, advising on control options while leaving the design decision to management.check_circle Correct
• BDesign and document the new control on management's behalf, then plan to audit it once it is running.
• CDecline any involvement, since assisting with a control that audit may later assess is always prohibited.
• DTake temporary ownership of the control now and formally hand it to management after the first count cycle.

Why A is correct: Advising without deciding keeps internal audit from owning the control, so an advisory engagement with management retaining the decision preserves objectivity.

Why B is wrong: This looks helpful, but designing the control makes audit its owner and impairs objectivity for any later assurance work over it.

Why C is wrong: The absolute prohibition is overstated; advisory work is permitted when audit advises rather than decides and safeguards are applied.

Why D is wrong: Temporary ownership still means audit owned and operated a control, which is a management responsibility and impairs independence.

During planning for an assurance engagement over third-party data privacy, an internal auditor learns that the IIA has issued a Topical Requirement covering cybersecurity that applies to the area under review. What is the auditor's correct treatment of that Topical Requirement when setting engagement objectives and scope?

• ATreat the Topical Requirement as optional good practice that the team may apply if time and budget permit after the primary privacy objectives are met.
• BIncorporate the mandatory elements of the Topical Requirement into the engagement objectives and scope, as it prescribes matters the engagement must address for this subject.check_circle Correct
• CExclude the Topical Requirement because the engagement's stated subject is data privacy rather than cybersecurity, so a cybersecurity requirement falls outside scope.
• DDefer to the audit committee to decide whether the Topical Requirement should apply, since committee approval governs which standards bind a given engagement.

Why A is wrong: Tempting because much supplemental guidance is discretionary, but a Topical Requirement is mandatory when its subject is covered, not an optional add-on.

Why B is correct: Correct: a Topical Requirement is mandatory guidance for engagements covering its subject, so its required elements must shape the objectives and scope.

Why C is wrong: Tempting on a narrow reading of the title, but the requirement applies whenever its subject matter is present, and privacy of third-party data engages cybersecurity controls.

Why D is wrong: Tempting because the committee approves the plan, but conformance with mandatory guidance is a professional obligation the committee does not waive.

An internal auditor concludes that a monthly reconciliation control is well designed, but finds that it was not performed for several months during the period under review. Which conclusion is most accurate?

• AThe control's design is deficient, because a control that is skipped for months cannot have been properly designed in the first place.
• BBoth design and operating effectiveness are adequate, since the reconciliation would work correctly whenever it is actually performed.
• CThe control's design is adequate, but its operating effectiveness is deficient because it did not function as intended during the period.check_circle Correct
• DOperating effectiveness cannot be assessed until the design deficiency is first remediated by management and retested.

Why A is wrong: Tempting because both dimensions are weak in practice, but failing to perform a control is an operating issue and does not by itself mean the design was flawed.

Why B is wrong: Capability if performed speaks only to design; a control not performed for months cannot be operating effectively regardless of how well it is designed.

Why C is correct: Design concerns whether a control could achieve its objective if applied, while operating effectiveness concerns whether it actually ran, so a skipped but sound control fails on operation.

Why D is wrong: There is no design deficiency here, and operating effectiveness can be concluded directly from evidence that the control was not carried out during the period.