Understanding the Audit Management Process ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An internal audit of a manufacturing company has identified a significant control weakness in the inventory management system. The audit report is being prepared for two audiences: the plant manager, who is responsible for corrective actions, and the executive committee, who oversees governance. How should the auditor present the findings?

   • APresent the findings verbally to both audiences and do not issue a written report.
   • BIssue two separate reports: one with only the executive summary and one with only the technical details.
   • CPrepare a single report with an executive summary for the committee and detailed technical findings for the plant manager.
   • DSend the full technical report to the executive committee and a summary to the plant manager.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a method to ensure audit quality?

   • AHaving a senior auditor review the work performed by the audit team.
   • BEnsuring that all audit findings are positive to avoid conflict.
   • CLimiting the audit to areas where the team has the most experience.
   • DRelying solely on the auditee's self-assessment to reduce audit time.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An auditor is conducting a forensic audit and has collected digital evidence from a compromised server. The evidence includes system logs, memory dumps, and network captures. The auditor needs to ensure that the evidence is admissible in court. What is the most critical action to take?

   • AUse specialized forensic tools to analyze the evidence and generate a report.
   • BStore the evidence in a secure location with limited access.
   • CMake a copy of the evidence and analyze the copy, keeping the original safe.
   • DMaintain a clear chain of custody and document every interaction with the evidence, including who accessed it and when.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An external auditor is conducting a compliance audit of a cloud service provider. The auditor needs to collect evidence that the provider's data deletion process is effective. The provider offers a signed attestation report from a third-party auditor, but the auditor's client requires direct evidence. What should the auditor do?

   • AUse the attestation report as supplementary evidence but also request direct evidence, such as logs or a demonstration of the deletion process.
   • BRefuse to audit the provider because the attestation report is not direct evidence.
   • CAccept the attestation report as sufficient evidence because it was issued by a reputable third party.
   • DRely on the provider's self-assessment of the deletion process to supplement the attestation report.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An audit has been completed and the final report has been issued. The auditee has submitted a corrective action plan that addresses all findings, but the audit manager is concerned that the plan is not realistic given the organization's resource constraints. What should the audit manager do?

   • AAccept the plan as submitted because the auditee is responsible for remediation.
   • BReview the plan with the auditee to understand the resource constraints and work together to adjust the plan to be achievable while still addressing the findings.
   • CEscalate the plan to senior management and recommend that the auditee be penalized for not allocating enough resources.
   • DReject the plan and require the auditee to implement all corrective actions immediately.
   Reveal Solution Discussion Select an answer first