Free IIA-CHAL-QISA sample questions

Correct answer: Supplement the internal audit team by engaging external specialists with serverless architecture expertise.

Standard 1210.A1 states that the CAE must obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement. Supplementing the team with external experts is the most effective and timely way to ensure the engagement is performed proficiently without causing undue delay or limiting the scope inappropriately. Postponing the audit may fail to provide timely assurance, while limiting the scope ignores the most critical technical risks of the migration.

Correct answer: Reviewing the results and lessons learned from the most recent full-scale BCP test.

While documentation, training, and infrastructure are important, the most critical procedure to assess effectiveness is to review the results of actual testing. A full-scale test simulates a real disaster and provides objective evidence of whether the plan works as designed, if recovery time objectives (RTOs) can be met, and what gaps exist. Without testing, the BCP is merely a theoretical document.

Correct answer: Listen to the manager's concerns, document the disagreement, and state that the finding will be included in the report with management's dissenting comments.

According to IIA guidance, auditors should seek to resolve disagreements during the engagement. The first step is to listen professionally to the auditee's perspective. If an agreement cannot be reached, the audit report must include the finding, supported by evidence, and should also present management's position. This ensures a balanced report for senior management and the board to review. Escalating immediately or removing the finding would be inappropriate.

Correct answers: Complexity in monitoring and troubleshooting distributed transactions.; Increased attack surface due to numerous inter-service communication endpoints.

Microservices break a large application into many small, independent services. This distribution dramatically increases the complexity of tracking a single business transaction as it may traverse multiple services, making logging, monitoring, and debugging significantly harder.

In a monolith, most communication is internal to the application process. In a microservices architecture, services communicate over a network via APIs. Each of these API endpoints represents a potential point of attack, significantly expanding the overall attack surface that must be secured.

Correct answer: Discuss the results and the resulting action plan with senior management and the board.

Standard 1320 requires communicating the results of the quality assurance and improvement program to senior management and the board. When a QA results in a rating of 'Partially Conforms' or 'Does Not Conform', the CAE must disclose the nonconformance and its impact, along with corrective action plans, to senior management and the board. This transparency is crucial for proper governance and oversight.

Correct answer: Control Activities

Control Activities are the policies and procedures that help ensure management directives are carried out. A core principle within Control Activities is the segregation of duties, which is designed to prevent one person from having control over multiple phases of a transaction. The manager submitting and approving their own expense report is a classic violation of segregation of duties, a key type of control activity.

Correct answer: It lacks the specific elements of criteria, condition, cause, and effect.

A well-constructed audit observation should contain four key elements: Criteria (what should be), Condition (the current state), Cause (why the condition exists), and Effect (the risk or consequence). The statement 'poorly controlled' is a vague conclusion (condition) without explaining the standard (criteria), the reason for the failure (cause), or the potential impact (effect), making it unactionable and difficult to validate.

Correct answer: False

The statement is false. The IIA's Code of Ethics, specifically the principle of Confidentiality, requires internal auditors to be prudent in the use and protection of information acquired in the course of their duties. They should not disclose information without appropriate authority unless there is a legal or professional obligation to do so. The primary reporting line for fraud is within the organization, typically to senior management and the board/audit committee, not directly to external authorities unless legally compelled.

Correct answer: A 15% reduction in patient admission processing time has been achieved.

A strategic performance metric measures the achievement of the organization's strategic objectives, not just project or operational goals. While budget, schedule, and uptime are important operational metrics, a reduction in patient admission time directly reflects the strategic goals of improving patient care and operational efficiency. It measures the business value and outcomes delivered by the EHR system, which is the core of a strategic assessment.

Correct answer: The internal audit activity's organizational independence.

Organizational independence is effectively achieved when the CAE reports functionally to the board. However, pressure from an administrative reporting line (the CFO) to limit the scope of an audit, especially in an area overseen by that executive, is a classic example of an impairment to independence. The CFO is interfering with the risk-based audit plan and attempting to restrict the internal audit activity's unrestricted access and scope.