Market Scheme for Fundamentals of Internal Audit Test 1 – March

2024

Answer to Question 1 (a) should include the following:

(a)
Internal auditing is an independent, objective assurance and consulting
activity designed to add value and improve an organization’s operations.
Ithelps an organization accomplish its objectives by bringing a
systematic, disciplined approach to evaluate and improve the
effectiveness of risk management, control, and governance processes.2
the key components of this definition:
❑ Helping the organization accomplish its objectives.
❑ Evaluating and improving the effectiveness of risk
management, control, and governance processes.
❑ Assurance and consulting activity designed to add value and
improve operations.
❑ Independence and objectivity.
❑ A systematic and disciplined approach (specifically, the
engagement process).

(b)
i. Assurance Services -services which internal auditors provide
independent assessment to their organisations to help improve governance,
risk management and control.
ii. Consulting services - services which internal auditors provide for their
organisations by agreeing on specific interventions (i.e. the terms and scope)
which the management intend the internal audit department to do. In
consulting activities, the internal auditor should be careful not to assume the
role of management.

(c) Responsibilities of the Board of Directors in respect of Governance

i. The Board provide strategic direction and guidance in respect of key business
objectives which are consistent with the key business model and stakeholders’
priorities.
ii. The Board is responsible for oversight which entails managing and monitoring
the organisation’s operations.

Page 1 of 3
 Answer to Question 2
(a) Assertions are claims that are made by management to establish if the financial
statements are true and fairly represented in the process of auditing

(b) The three multiple lines of defence in organisations are as follows:

• The first line of defence represents the internal control activities conducted
by individuals and management who are partly involved in designing and
implementing controls (least independent and objective).
• The second line of defence represents other assurance activities such as
those conducted by individuals reporting through different lines of
management and the the level of independence and objectivity is considered
to be greater than the first-line of defence.
• The third line of defense represents the most independent and objective
form of assurance. Internal audit activities typically are the only activities that
report functionally to the board and have no other management
responsibilities. Hence, the third line of defense is the most independent and
objective of the three fines

(c)
i. The Chief Executive Officer (CEO) -The CEO is ultimately responsible for the
effectiveness and success of ERM
ii. The CEO influences the composition and conduct of the board, provides
leadership and direction to senior managers, and monitors the organization’s
overall risk activities in relation to its risk appetite

Answer to Question 3
(a) the explanation should include the following:
• internal control that describe a process that provides reasonable assurance
for achieving the objectives of an organization in three specific categories:
• effectiveness and efficiency of operations,
• reliability of reporting, and
• Compliance

(b) Components of internal control are as follows:

• Control Environment -standards, processes and structures put in place by
the board and monitored by senior management to set the tone for internal
controls.
• Risk Assessment - involves a dynamic and iterative process for identifying
and assessing risks to the achievement of objectives in line with the risk
appetite and risk tolerance level of the organisation.

Page 2 of 3
• Control Activities - these are actions taken by management, the board, and
other parties to mitigate risk and increase the likelihood that established
objectives and goals will be achieved.
• Information and Communication, and Monitoring – the regular sharing of
information and communication through various channels to ensure
continuous feedback on activities of the organisation to keep all informed.

Page 3 of 3