ACC653 Ch 11

Which of the following is true?

• a. Continuous monitoring is the CAE’s responsibility.

• b. If a control breakdown is identified through continuous auditing, it should be reported to management on a timely basis.

• c. Data analytics technologies cannot be used for substantive testing.

• d. Continuous auditing routines developed by internal auditors should not be shared with management.

Answer explanation

B is the best answer. The purpose for continuous auditing is to identify control breakdowns sooner so

that management can take corrective actions. Continuous monitoring is a management responsibility

and internal auditors should encourage management to utilize the results of data analytics to improve

controls and processes throughout the organization.

Which of the following is not typically a barrier to internal auditors using data analytics in achieving the engagement objective?

• a. Knowing what data exists and where to find it.

• b. Poorly defining the scope of the intended use of data analytics.

• c. Data analytics software is limited by the number of records it can process.

• d. The effort required to cleanse and prepare data for import to the data analytics tool.

Answer explanation

C is the best answer. Generalized data analytics software, along with audit specific software, can handle

any number of records. As data sizes increase, depending on the technology, the processing times

may increase; however, the software can handle any volume of data.

Common uses for data analytics within internal audit functions may include all of the following except:

• a. Identify invalid expense report items.

• b. Identify ghosts on the payroll.

• c. Identify theft of inventory.

• d. Identify suspect timesheets.

Answer explanation

C is the best answer. This would require additional inventory observation to determine if inventory actually went missing.

Understanding “What data do I need” in the DAP (Data Analytics Program) framework requires the following key data attributes:

• a. Sufficient, reliable, relevant, and useful.

• b. Sufficient, numerical, reliable, and useful.

• c. Reliable, relevant, useful, and audited.

• d. Reliable, relevant, database-ready, and useful.

Answer explanation

A is the best answer. The DAP framework requires sufficient, reliable, relevant, and useful data.

The following represent examples of internal audit data analytics usage except for:

• a. Compliance.

• b. Operational performance.

• c. Tone at the top.

• d. Internal controls.

Answer explanation

C is the best answer. Measuring the tone at the top using audit data analytics would be challenging.

Generally, tone at the top represents culture or qualitative descriptions. The other three answers all

create ready data to analyze.

You are in the last part of an internal audit engagement that leveraged data analytics to test controls. The internal audit team is starting to wrap up fieldwork and is validating findings. You get a phone call from the auditee that they did not provide a complete data population for the period you are auditing. What would be your next step?

• a. Continue on with the dataset because it is close enough for audit work.

• b. Tell the auditee to compare the existing dataset with what they gave you and explain the difference. Because it was their fault, they are responsible for explaining why they gave you the wrong data.

• c. Take the new dataset and consult with your supervisor and CAE as to what to do next.

• d. Do nothing because you already found nothing wrong with the data.

Answer explanation

C is the best answer. Take the new dataset and consult with your supervisor and CAE as to what to do next. Not getting a complete data population for the period you are auditing represents a scope

restriction and potentially incorrect analysis. The internal auditor should consult with the supervisor

and CAE.

What key IIA Standard(s) does the DAP framework follow?

• a. Standards 2310 – Identifying Information and 2600 – Communicating the Acceptance of Risks.

• b. Standards 2310 – Identifying Information and 2320 – Analysis and Evaluation.

• c. Standards 1230 – Continuing Professional Development and 2320 – Analysis and Evaluation.

• d. Standards 2320 – Analysis and Evaluation and 2600 – Communicating the Acceptance of Risks.

Answer explanation

B is the best answer. The DAP framework follows Standards 2310 – Identifying Information and 2320 – Analysis and Evaluation.

The achieved upper deviation limit is 7 percent and the risk of assessing control risk too low is 5 percent. How should the internal auditor interpret this attribute sampling outcome?

• a. There is a 7 percent chance that the deviation rate in the population is less than or equal to 5 percent.

• b. There is a 5 percent chance that the deviation rate in the population is less than 7 percent.

• c. There is a 5 percent chance that the deviation rate in the population exceeds 7 percent.

• d. There is a 95 percent chance that the deviation rate in the population equals 7 percent.

Answer explanation

C is the best answer. Saying there is a 5 percent risk that the deviation rate in the population exceeds 7 percent is equivalent to saying, with 95 percent confidence, that the deviation rate in the population is less than or equal to 7 percent.

An internal auditor should consider the qualitative aspects of deviations found in a sample in addition to evaluating the number of deviations. For which of the following situations should the internal auditor be most concerned?

• a. There were fewer deviations in the sample than expected.

• b. The deviations found are similar in nature to those found during the last audit of the area.

• c. The deviations found appear to have been caused by an employee’s misunderstanding of instructions.

• d. The deviations found may have been caused intentionally.

Answer explanation

D is the best answer. The potential for fraud would be a significant concern.

If all other factors specified in a PPS sampling plan remain constant, changing the specified tolerable misstatement from $200,000 to $100,000 and changing the specified risk of incorrect acceptance from 10 percent to 5 percent would cause the required sample size to:

• a. Increase.

• b. Decrease.

• c. Remain the same.

• d. Change by 5 percent.

Answer explanation

A is the best answer. Decreasing the tolerable misstatement would increase sample size, all else

equal. Decreasing the risk of incorrect acceptance increases the sample size, all else equal. Thus,

both together would increase sample size.