IIA-CIA-Part1

IIA-CIA-Part1 practice questions, page 33 of 47, with answer review and explanations.

Question 161

In addition to data protection, which of the following is a control that is typically used by companies to safeguard the privacy rights of their customers? I. End-user computing. II. Encryption of data. III. Spyware. IV. Intrusion detection.

  1. II only
  2. I and III only
  3. II and IV only
  4. I, II, and IV only

Question 162

According to the International Professional Practices Framework, a primary purpose of evaluating the adequacy of an organization's risk management, control, and governance processes is to determine if it:

  1. Was designed to ensure compliance with policies, plans, procedures, laws, and regulations.
  2. Provides reasonable assurance that the organization's objectives will be met.
  3. Mitigates inherent risk.
  4. Assures the reliability and integrity of information used by management.

Question 163

Which of the following statements, if true, could justify an auditor's decision not to report governance-related control deficiencies to the audit committee?

  1. Management plans to initiate corrective action.
  2. The board of directors has a separate corporate governance committee.
  3. The amounts and the potential risks associated with the deficiencies are not material to the overall organization.
  4. Governance issues are complex and the auditor should rely on management's analysis of the extent of the problem.

Question 164

The primary role of the internal audit activity in regard to an organization's ethical climate is to:

  1. Participate as chief ethics officer.
  2. Periodically assess the ethical climate.
  3. Utilize surveys to evaluate employee ethics.
  4. Demonstrate ethical behavior.

Question 165

A chief audit executive (CAE) is obtaining information required by a regulatory oversight body and discovers a situation that requires management to take immediate corrective action. What is the best course of action for the CAE to take?

  1. Wait until all of the information has been gathered and reported to the oversight body before reporting the situation to management.
  2. Check with legal counsel to determine whether the situation can be reported to management before all information has been submitted to the oversight body.
  3. Report the situation to management immediately.
  4. Schedule an engagement to explore the situation in depth, before reporting to either management or the oversight body.