In internal auditing, evidence must meet certain criteria to support conclusions and recommendations. According to IIA guidance, evidence should be sufficient, reliable, relevant, and useful. In this scenario, the internal auditor concludes that additional staff are needed to fully utilize a fraud surveillance system based on an employee's statement. However, the conclusion may lack sufficient evidence to support it. Detailed Explanation: IIA Standard 2310 - Identifying Information: This standard requires that internal auditors identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives. "Sufficiency" refers to the quantity of evidence necessary to convince an informed person of the validity of the auditor's findings and recommendations. Sufficiency of Evidence: The auditor's conclusion about the need for additional staff is based on a single employee's remark, which is not sufficient evidence. The auditor would need to gather more evidence, such as analyzing workload data, reviewing system logs, or assessing staff capacity, to support the conclusion fully. IIA Practice Advisory 2310-1: This advisory emphasizes the need for auditors to obtain enough factual evidence to support their findings. Relying solely on anecdotal evidence from one employee does not meet the standard for sufficiency. Why Not Other Options? Option B (Reliability): Reliability refers to the accuracy and credibility of the evidence. The employee's statement might be credible but still insufficient in quantity. Option C (Relevancy): The employee's comment is relevant to the issue, but relevancy alone does not make the evidence sufficient. Option D (Usefulness): The information could be useful, but it lacks the sufficiency needed to justify the auditor's conclusion.
Question 397
如果專案主管發現工作底稿中的資訊不足以得出結論，她應該先採取什麼行動？
Correct Answer: C
Comprehensive and Detailed Explanation From Exact Extract: Standard 2340 - Engagement Supervision requires supervisors to review work performed and provide feedback to ensure sufficiency and appropriateness. The first step when finding insufficient information is to discuss the issue with the auditor who prepared the workpapers, clarify what was done, and guide improvements. Training material adjustments may follow later, but the immediate supervisory responsibility is to resolve the issue directly with the assigned auditor.
Question 398
初步意見文件的效果部分應聚焦於下列哪一項？
Correct Answer: A
The focus of the effect section of the preliminary observations document should be on residual risk. Residual risk is the remaining risk after management has taken action to mitigate the inherent risk with controls and other risk responses. Documenting the effect in terms of residual risk helps in understanding the potential impact of the observed issues on the organization if not addressed. References: * IIA Standards: 2310 - Identifying Information * IIA Practice Guide: Communicating the Results of an Audit
According to IIA guidance, the chief audit executive (CAE) has several appropriate options when the audit objectives are not complete despite the auditor having worked the full amount of budgeted hours. The CAE should determine if the work already completed is sufficient to conclude the engagement (2). The CAE should also provide feedback on areas of improvement for future engagements (3) and give instructions and directions to complete the audit (4). Allowing the auditor to decide whether to extend the audit engagement (1) is not typically an appropriate option as this decision should involve senior management or the CAE to ensure alignment with organizational priorities and resource allocation. References: = IIA Standard 2010 - Planning, IIA Standard 2020 - Communication and Approval, IIA Standard 2040 - Policies and Procedures.
Including the annual impact of the changed agreement on cash flows in the observation provides a clear quantification of the financial effect of the policy violation. This information is critical for understanding the significance of the issue and for decision-making regarding corrective actions. It shows the long-term implications of the unauthorized contract change, which is essential for management and the board to assess the severity of the non-compliance and its impact on the organization's financial health.References: * The Institute of Internal Auditors (IIA) - Practice Guide: Formulating and Expressing Internal Audit Opinions
