1. The status of the internal audit function should be free from the impact of irresponsible policy changes by management. The most effective way to make sure of that freedom is to:

a. Develop written policies and procedures to serve as standards of performance of the internal audit function.
b. Have the internal audit charter approved by both management and the board of directors.
c. Adopt the policy that the audit function follows the Standards for the Professional Practice of Internal Auditing.
d. Require that the external auditor approve any policy change by management regarding internal audit.
e. Establish an audit committee within the board of directors.

2. A chief audit executive (CAE) has been requested by the audit committee to conduct an engagement at one of the company's chemical factories as soon as possible. The engagement will include reviews of health, safety, and environmental management and processes. The CAE knows that the internal audit department does not have the necessary technical knowledge to conduct such an engagement. What should the CAE do?

a. Ask the audit committee for additional resources to obtain appropriate support from a health, safety and environmental professional for the engagement.
b. Suggest to the audit committee that the factory's own health, safety and environmental staff conduct the engagement.
c. Begin the engagement and incorporate the necessary technical training into next year's training program so as to be prepared for a follow-up engagement.
d. Defer the engagement and tell the audit committee that it will take six months to train internal audit staff for such an engagement.
e. Conduct the engagement but limit its scope to cover only those areas where the internal audit staff has the necessary skills.

3. In the case of an efficient system of internal control, in which quadrant would you expect to find the lowest investment in controls?

a. I
b. II
c. III
d. IV
e. The investment woudl be equal in each of the four quadrants.

4. During an audit, an employee with whom you have developed a good working relationship informs you that she has some information about top management which would be damaging to the organization and may concern illegal activities. The employee does not want her name associated with the release of the information. Which of the following actions would be considered inconsistent with the IIA Code of Ethics and Standards?

a. Suggest the person consider talking to legal counsel.
b. Inform the employee of other methods of communicating this type of information.
c. Inform the individual that you will attempt to keep the source of the information confidential and will look into the matter further.
d. Assure the employee that you can maintain her anonymity and listen to the information.
e. Suggest that she talk with the organization's compliance officer.

5. Which of the following is an element of sampling risk?

a. Selecting and audit procedure that is inconsistent with the audit objective.
b. Failing to perform audit procedures that are required by the sampling plan.
c. Forgetting to apply the finite correction factor in deterring sample size.
d. Failing to detect an error on a document that has been inspected by an auditor.
e. Concluding that internal controls are not effective when in fact they are effective based on a sample that had multiple cases of control failure.