Risk identification.

Risk appetite.

Risk capacity.

Risk tolerance.

Control environment.

Control activities.

Information and communication.

Monitoring activities.

Competent, corroborative evidence of future working capital requirements.

Sufficient, analytical evidence of the cash flow position at a given point of time in the future.

Competent, documentary evidence of future cash flow changes within the organization.

Sufficient, circumstantial evidence of the future solvency of the organization.

Postpone the audit until the CAE hires internal audit staff with the required knowledge.

Ask the audit committee to decide the course of action.

Select the most experienced auditors in the department to perform the engagement.

Hire consultants who possess the required knowledge to perform the engagement.

An internal auditor reports both functionally and administratively to the chief financial officer (CFO).

An internal auditor, who was an accounts receivable intern for the organization three years prior, performs an audit of the accounts receivable cycle.

According to policy, the internal auditor must obtain approval from the CFO prior to requesting information for internal audit purposes.

An internal auditor performs an audit in a department that is led by the auditor ' s close friend.

An employee includes a faked receipt in his expense claim, and the claim is signed by the employee ' s manager.

A vendor inflates the price of an item and remits a portion of the excess to the purchasing manager.

A vendor sends a duplicate invoice with a new invoice number, and the accounts payable system fails to detect the duplication.

An employee works with the IT manager to develop a program for identifying duplicate invoice payments.

Adequate signs are in place to assist in locating safety equipment.

Servers are secured individually to their racks by locks.

Foam fire extinguishers are operable to protect against electrical fires.

Swipe card access is required to gain access to the server room.

Usage of IT system policy.

Risk management framework.

Acceptance of gifts policy.

Personal responsibility policy.

The minimum resources and competencies needed for the internal audit activity.

Identification of the organizational units where engagements are to be performed.

Organizational relationships and reporting lines.

Assigned responsibilities for designing and implementing controls.

Requiring employees to attend ethics training.

Performing background checks on employees.

Implementing a control self-assessment.

Performing a surprise audit.

Assessing the risk factors.

Aligning risk appetite and strategy.

Enhancing risk response decisions.

Reducing operational surprises and losses.

Workshops.

Surveys.

Interviews.

Observation.

Fraud open on the books.

Fraud hidden on the books.

Fraud off the books.

Fraud on the balance sheet.

If an organization does not have a mature privacy framework, the internal audit activity should assist in developing and implementing an appropriate privacy framework.

Because the audit committee is ultimately responsible for ensuring that appropriate control processes are in place to mitigate risks associated with personal information, the internal audit activity is C. required to conduct privacy assessments.

The internal audit activity may delegate to nonaudit IT specialists the responsibility of determining whether personal information has been secured adequately and data protection controls are sufficient.

The internal audit activity should have appropriate knowledge and competence to conduct an asses .......framework.

1 and 4 only.

3 and 4 only.

2, 3, and 4 only.

1,2, 3, and 4.