An auditor completes testing for a risk and its related cont…
An auditor completes testing for a risk and its related control but records the supporting test detail only as a narrative comment, without a workpaper reference linking the risk and control documentation to the underlying test and finding workpapers. Under Standard 14.6, why is this documentation practice inadequate?
Read DetailsThe audit team has access to the complete population of loan…
The audit team has access to the complete population of loan originations for the audit period through a data extraction tool. Rather than testing all originations for override-approval compliance, the team selects a sample of 40 files using traditional attribute sampling. Which statement BEST evaluates this choice against Standard 14.1?
Read DetailsThe audit team writes in its follow-up tracking documentatio…
The audit team writes in its follow-up tracking documentation: “Since management already monitors override rates monthly, internal audit does not need its own continuous-auditing indicator for this area.” What is the flaw in this reasoning?
Read DetailsInternal audit’s testing finds that a vendor patch managemen…
Internal audit’s testing finds that a vendor patch management policy, the design, requires critical patches within 30 days, and sampled evidence shows the population was patched within 30 days in 9 of 10 instances, with the tenth patched on day 34 due to a vendor delay outside the company’s control. What is the MOST defensible operating effectiveness conclusion?
Read DetailsFollow-up tracking documentation proposes tracking “model-dr…
Follow-up tracking documentation proposes tracking “model-drift and fair-lending outcome metrics, refreshed monthly” as an ongoing internal audit activity between engagements. Which distinction MOST accurately classifies this proposal?
Read Details