Session 5 IAP

A recent inventory shortage at XYZ Corp., an unaffiliated supplier, contributed to production failures at OPS Corp. in the current period. To avoid future production failures because of supplier inventory shortages, the most appropriate method is for OPS to

• Produce the inventory items instead of purchasing from suppliers.

• Increase the size of orders.

• Establish an inventory control framework at XYZ.

• Inform XYZ about its risk appetite regarding supply failures.

Risk management, at any level, consists of

1. Identifying potential events that may affect the entity

2. Managing the associated risk to be within the entity’s risk appetite

• 1 and 2.

• 1 only.

• Neither 1 nor 2.

• 2 only.

Determining whether risk management processes are effective is a judgment resulting from the internal auditor’s assessment that

1. Organizational objectives support and align with the organization’s mission

2. Significant risks are identified and assessed

3. Appropriate risk responses are selected that align risks with the organization’s risk appetite

4. Relevant risk information is captured and communicated in a timely manner across the organization

• 2 and 3 only.

• 1, 2, 3, and 4.

• 1, 2, and 4 only.

• 1 and 4 only.

Which of the following activities is outside the scope of internal auditing?

• Evaluating risk exposures regarding compliance with laws and regulations.

• Evaluating risk exposures regarding compliance with policies, procedures, and contracts.

• Safeguarding of assets.

• Ascertaining the extent to which management has established criteria to determine whether objectives have been accomplished.

If an organization has no formal risk management processes, the chief audit executive should

• Inform regulators that the organization is guilty of an infraction.

• Establish risk management processes based on industry norms.

• Formally discuss with the directors their obligations for risk management processes.

• Formulate hypothetical results of possible consequences resulting from risks not being managed.

Which of the following are part of the risk analysis process?

1. Assessing the significance of an event

2. Assessing the event’s likelihood

3. Considering the means to manage the risk

• 1 and 3 only.

• 1, 2, and 3.

• 2 and 3 only.

• 1 and 2 only.

Which of the following goals sets risk management strategies at the optimum level?

• Maximize market share.

• Minimize costs.

• Minimize losses.

• Maximize shareholder value.

A chief audit executive is reviewing the following enterprise-wide risk map:

Which of the following is the correct prioritization of risks, considering limited resources in the internal audit activity?

• Risk B, Risk C, Risk A, Risk D.

• Risk A, Risk B, Risk C, Risk D.

• Risk D, Risk B, Risk C, Risk A.

• Risk B, Risk C, Risk D, Risk A.

When a customer fails to pay his or her invoice within 2 months, a notification is sent to inform the credit manager of the situation. This is an example of which kind of event identification method?

• Loss event data methodologies.

• Process flow analysis.

• Threshold triggers.

• Internal analysis.

Risk management processes require risk analysis that includes

• Loss event data methods.

• Process flow analysis.

• Qualitative or quantitative methods.

• Identification of content.