Internal Audit Operations

At Kelmscott Water the chief audit executive discovers that the finance director alone sets the annual objectives, salary and performance appraisal for the chief audit executive role, and that the board has no involvement in these decisions. The chief audit executive is concerned about the reporting relationship. What should the chief audit executive do?

• ARaise the matter with the board so that it takes responsibility for approving the chief audit executive's objectives and evaluation as part of its functional oversight.check_circle Correct
• BAccept the finance director's oversight because that executive controls the internal audit operating budget and day-to-day resourcing.
• CAsk the finance director to keep setting the objectives but to copy the appraisal to the board afterwards as a courtesy notification.
• DEscalate immediately to the external auditor to arbitrate the reporting dispute before informing the board or the finance director.

Why A is correct: The board's functional oversight of internal audit includes approving the chief audit executive's performance evaluation and objectives; restoring that role protects the function's independence and the reporting line to the board.

Why B is wrong: This is tempting because administrative reporting to a senior manager over budgets and logistics is legitimate, but it wrongly extends that administrative line to cover appraisal and objectives, which weakens the functional reporting relationship to the board.

Why C is wrong: This looks reasonable because it appears to give the board visibility, but a courtesy copy after the fact does not give the board its required functional oversight role in approving the evaluation and objectives of the chief audit executive.

Why D is wrong: This is tempting because an outside party seems neutral, but the external auditor has no authority over internal audit's reporting relationships, and bypassing the board misroutes a matter that belongs to the board's own oversight responsibility.

The board asks the chief audit executive for a periodic report on the overall effectiveness of the internal audit function. A junior auditor assumes this report should contain the same content as an individual engagement report. Which content correctly distinguishes the periodic report on the function's effectiveness from an engagement report?

• AIt lists only the detailed observations and the agreed management action plans that arose from the most recent engagement completed by the function.
• BIt is confined to the audit fees, travel costs and staff timesheets recorded by the function across the period under review.
• CIt reports on the function's performance against its approved plan, its conformance with the professional requirements, and the adequacy of its resources, rather than the findings of any one engagement.check_circle Correct
• DIt substitutes for the annual audit plan by setting out, engagement by engagement, the specific work the function intends to perform in the year ahead.

Why A is wrong: This is tempting because engagement observations are the most visible output, but those belong in engagement communications, not in a function-level report on overall effectiveness.

Why B is wrong: This is tempting because cost data is administrative and easy to report, but reducing an effectiveness report to fees and timesheets omits performance, conformance and resourcing.

Why C is correct: Correct: periodic reporting on effectiveness addresses delivery against the approved plan, conformance with the Standards through the quality programme, and resource adequacy, giving the board a view of the whole function rather than a single engagement.

Why D is wrong: This is tempting because both are forward-looking board documents, but the audit plan is a separate approval item and is not the same thing as reporting on effectiveness.

The board of Tarnbrook Logistics receives a quarterly performance pack from internal audit. One figure tracks the percentage of the approved plan completed against schedule. A separate figure tracks a leading measure of the organisation's exposure, such as the number of overdue high-risk remediation actions, which the function watches because a rising value signals emerging risk before it crystallises. A director asks how to label each figure correctly. Which characterisation fits?

• APlan completion against schedule is a key performance indicator, while overdue high-risk remediation actions is a key risk indicator that gives an early signal of emerging exposure.check_circle Correct
• BPlan completion against schedule is a key risk indicator, while overdue high-risk remediation actions is a key performance indicator of the function's throughput.
• CBoth figures are key performance indicators because both are expressed as measurable numbers reported to the board each quarter.
• DBoth figures are key risk indicators because internal audit reports them to help the board oversee organisational risk.

Why A is correct: Correct: a KPI measures how well the function is performing against its objectives, and a KRI is a forward-looking metric whose movement warns that risk exposure is building.

Why B is wrong: This swaps the labels; it is tempting because both are numeric measures, but completion measures the function's own performance while overdue actions is a forward-looking risk signal.

Why C is wrong: Being numeric and board-reported does not make a measure a KPI; the overdue-actions figure signals emerging exposure rather than the function's performance, so it functions as a KRI.

Why D is wrong: Reporting a figure to support risk oversight does not make it a KRI; plan completion measures the function's own delivery, which is a performance indicator.

The chief audit executive at Selby Water is explaining to the audit committee how the internal audit function's vision statement differs from its mission statement. Which statement best describes the purpose of the vision statement?

• AIt defines the function's present-day purpose and the value it currently delivers to the organisation's stakeholders.
• BIt describes the aspirational future state the function seeks to achieve, giving long-term direction to its strategy.check_circle Correct
• CIt specifies the budget, headcount and tools the function will use to deliver next year's approved audit plan.
• DIt documents the escalation route the function follows when management accepts a risk beyond the organisation's tolerance.

Why A is wrong: That describes the mission statement; the vision looks ahead rather than setting out current purpose, so the two roles are being swapped.

Why B is correct: A vision statement expresses where the function aspires to be in future, supplying the long-term direction that its strategy and resource plans then work towards.

Why C is wrong: Those are resource-planning details for a single cycle, not the aspirational long-term direction a vision statement is meant to express.

Why D is wrong: An escalation protocol is an operational procedure and has no bearing on the forward-looking purpose a vision statement serves.

A chief audit executive at Kelmscott Water is building next year's programme of work. She has drawn up a full inventory of every auditable entity, process, and system across the organisation, and separately a list of the specific engagements she intends to resource and schedule over the coming twelve months. A new manager treats these two documents as the same thing. How should the chief audit executive distinguish the audit universe from the annual audit plan?

• AThe audit universe is the risk-prioritised set of engagements approved for the year, while the audit plan is the broader catalogue of everything that could be audited.
• BThe audit universe and the audit plan are alternative names for the same risk-ranked schedule, differing only in whether the audit committee has formally approved it.
• CThe audit universe lists only the engagements requested by management, while the audit plan lists only the engagements requested by the audit committee.
• DThe audit universe is the full inventory of auditable areas across the organisation, while the audit plan is the risk-prioritised subset the function will actually resource and perform in the period.check_circle Correct

Why A is wrong: This inverts the two terms; it is tempting because both concepts involve lists, but the universe is the full catalogue and the plan is the selected, scheduled subset.

Why B is wrong: Approval status does not turn one document into the other; the two are genuinely different artefacts, so treating them as synonyms misses the population-versus-selection distinction.

Why C is wrong: Both artefacts are owned and shaped by the internal audit function using a risk assessment, not split by who requested each engagement, so this mischaracterises how both are built.

Why D is correct: Correct: the universe is the complete population of potential engagements, and the plan is the prioritised selection scheduled and resourced for the period, informed by a risk assessment.