Information Gathering, Analysis, and Evaluation

An internal auditor gathers a signed contract from the client's legal department, a verbal assurance from the process owner, and a copy of an invoice provided by the vendor being examined. When judging the reliability of this evidence, which principle should the auditor apply first?

• AEvidence obtained from a source independent of the client is generally more reliable than evidence supplied by an interested party.check_circle Correct
• BVerbal assurances from a process owner are the most reliable because they come directly from the person accountable for the control.
• CDocumentary evidence is reliable purely because it is written, regardless of who produced or supplied it.
• DThe most recently dated item is the most reliable because it reflects the current state of the process.

Why A is correct: Independence of source is a core determinant of reliability; evidence from a party with no stake in the outcome is less likely to be biased or manipulated.

Why B is wrong: Tempting because the owner is accountable, but oral evidence from an interested internal party is among the least reliable forms and needs corroboration.

Why C is wrong: Form of evidence matters, but written form alone does not confer reliability when the document originates from an interested source such as the vendor.

Why D is wrong: Recency can aid relevance, yet it says nothing about source independence or authenticity, so it is the wrong first test of reliability.

During a procurement audit, an internal auditor runs a routine that flags 340 invoices exceeding three standard deviations from the mean invoice value for their vendor category. The chief audit executive asks for the most defensible next step before drawing any conclusion about improper payments. What should the auditor do?

• AReport the 340 flagged invoices to the audit committee as suspected fraudulent transactions requiring recovery.
• BTreat the flagged population as immaterial and remove it, then re-run the routine only on invoices near the category mean.
• CLower the threshold to two standard deviations so the routine captures a larger sample for statistical confidence.
• DInvestigate the flagged items to establish whether each anomaly reflects a legitimate business reason, an error, or a control breakdown.check_circle Correct

Why A is wrong: A statistical outlier is not evidence of fraud. Reporting flags as confirmed fraud before corroboration misstates the finding and damages audit credibility.

Why B is wrong: Anomalies are the items of interest, not noise to be discarded. Excluding the outliers defeats the purpose of the anomaly-detection procedure.

Why C is wrong: Widening the net inflates the exception count without explaining the existing flags. It is premature to re-tune the model before understanding the current results.

Why D is correct: Anomaly detection isolates items warranting scrutiny; the anomaly is a signal, not a conclusion. Corroborating each exception against underlying records is the required next step.

An auditor observes that overtime payments exceeded budget by a wide margin. Which element of the finding does the resulting unnecessary labour cost to the organisation represent?

• AThe effect, because it is the consequence or impact that arises from the gap between the budget and the actual spending.check_circle Correct
• BThe criteria, because the approved budget is the benchmark that the overtime spending is compared against.
• CThe condition, because it describes the factual overtime spending that the auditor identified during the review.
• DThe cause, because the additional labour cost is the underlying reason the overtime control failed to operate.

Why A is correct: Correct: the effect is the impact of the difference between criteria and condition, here the unnecessary labour cost incurred.

Why B is wrong: Tempting because the budget is involved, but the budget is the criteria, whereas the resulting cost is the consequence of the gap.

Why C is wrong: Tempting because both concern spending, but the condition is the overspend itself, not the downstream financial impact it produces.

Why D is wrong: Tempting because cost feels causal, but the cost is a result of the gap, not the underlying reason the overspend occurred.

A management team runs automated tests on every purchase transaction as it posts, routing any exceptions to the relevant control owner in real time. In internal audit terminology, this ongoing management-run activity is best described as which of the following?

• AContinuous auditing, since the automated tests execute without any manual intervention by staff.
• BAn embedded audit module, since audit selection logic has been coded into the application itself.
• CRobotic process automation, since a software routine carries out the repetitive checking work.
• DContinuous monitoring, since management performs the automated testing as part of its own control responsibilities.check_circle Correct

Why A is wrong: Tempting because the process is automated and continuous, but continuous auditing is performed by the audit function, not by management operating its own controls.

Why B is wrong: Plausible because it involves automated in-system testing, but an embedded audit module is placed by auditors to capture data, not a management control routine.

Why C is wrong: Tempting because software performs the checks, but RPA describes rule-based task execution, not the ongoing control-testing purpose that defines continuous monitoring.

Why D is correct: Correct because continuous monitoring is a management-owned activity that tests controls or transactions on an ongoing basis as part of running the business.

An engagement produced several low-rated observations across procurement, payroll, and vendor onboarding. Individually each was rated minor, but all three trace to the same weak segregation of duties in the shared master-data function. When the internal auditor forms the engagement conclusion, what does correctly aggregating these findings mean?

• AThe auditor reports the three observations only as separate minor items, because each was individually rated minor against the engagement criteria.
• BThe auditor raises the rating of each of the three observations to significant so the totals reconcile to a single high-level finding.
• CThe auditor combines the related observations to assess whether their common root cause represents a more significant risk than any single observation implies.check_circle Correct
• DThe auditor discards the three minor observations and tests an entirely new population to obtain a single higher-rated finding.

Why A is wrong: Tempting because each item was scored minor, but reporting them in isolation ignores the shared cause and understates the combined significance that aggregation exists to surface.

Why B is wrong: Tempting because it acknowledges seriousness, but mechanically inflating individual ratings distorts each observation; aggregation assesses combined effect, it does not re-score the parts.

Why C is correct: Aggregation evaluates findings collectively so that a shared root cause producing several minor issues can be recognised as a more significant systemic weakness in the conclusion.

Why D is wrong: Tempting because fresh evidence sounds rigorous, but discarding valid observations wastes gathered evidence; aggregation synthesises existing findings rather than replacing them.