IIA-CIA-Part2

IIA-CIA-Part2 practice questions, page 28 of 39, with answer review and explanations.

Question 136

The following are potential sources of evidence regarding the effectiveness of a division's total quality management program. The least persuasive evidence would be a comparison of:

  1. Employee morale before and after program implementation.
  2. Scrap and rework costs before and after program implementation.
  3. Customer returns before and after program implementation.
  4. Manufacturing and distribution costs per unit before and after program implementation.

Question 137

A chief audit executive (CAE) of a major retailer has engaged an independent firm of information security specialists to perform specialized internal audit activities. The CAE can rely on the specialists' work only if it is:

  1. Performed in accordance with the terms of the contract.
  2. Carried out in accordance with the Standards.
  3. Performed under the supervision of the information technology department.
  4. Carried out using standard review procedures for retailers.

Question 138

When conducting a performance appraisal of an internal auditor who has been a below-average performer, it is not appropriate to:

  1. Notify the internal auditor of the upcoming appraisal several days in advance.
  2. Use objective, impartial language.
  3. Use generalizations.
  4. Document the appraisal.

Question 139

An organization contracted a third party to construct a new facility that was estimated to cost $25 million. Which of the following is the most pertinent reason for the organization to audit the contractor's records?

  1. The contract includes a right-to-audit clause.
  2. The contractor will be paid on a cost-plus basis.
  3. The estimated cost is high.
  4. The contractor has subcontracted much of the work.

Question 140

Which of the following would not be an appropriate step for an internal auditor to perform during an assessment of compliance with an organization's privacy policy?

  1. Determine who can access databases containing confidential information.
  2. Evaluate the organization's privacy policy to determine if appropriate information is covered.
  3. Analyze access to permanent files and reports containing confidential information.
  4. Evaluate the government's security measures related to confidential information received from the organization.