Which of the following statements is true with regard to the adequacy of a control design?

• A. Even if a control is effective, it may not achieve the control objective due to an inadequate design.
• B. Control designs are considered adequate as long as secondary controls will effectively mitigate the risk.
• C. Regardless of the adequacy of control design, it is important to evaluate the operating effectiveness of all key controls to justify the integrity of the internal audit process.

Which of the following scenarios would be the strongest indicator of fraud in an accounts payable process?

• A. The address on one of the vendor invoices matches an employee's residential address.
• B. The accounts payable manager was unable to provide documentation relating to travel expenses on one of the samples selected.
• C. The invoices submitted by one of the organization's vendors are more than six months old.

An internal auditor is performing an internal control assessment at a manufacturing company. The auditor observed that the accounts payable clerks have the ability to create new vendors without management's review and approval. How should the auditor document this observation?

• A. The observation doesn't affect the adequacy of the internal controls because the existing process controls ensure that invoices are promptly and accurately paid.
• B. The observation is an internal control weakness; therefore, additional testing should be performed to determine whether secondary mitigating controls exist or whether the control should be redesigned.
• C. The observation is a sign of adequate internal controls; however, effectiveness testing should be performed to ensure that the controls are operating as designed and intended.

Which of the following conditions involving the chief audit executive (CAE) is most likely to impair the independence of the internal audit activity?

• A. The CAE regularly attends and participates in critical executive management meetings for the organization.
• B. The CAE has direct access to records, personnel, and physical properties throughout the organization.
• C. The CAE reports directly to the controller for the organization, and the internal audit activity resides in the office of the comptroller.

As part of the annual training plan, the chief audit executive (CAE) has arranged for a local audit training institute to provide an in-house training session for the internal audit team. Which of the following best explains the primary purpose of this approach?

• A. It helps the internal audit activity attain an appropriate organizational status to maintain independence.
• B. It helps the internal auditors maintain a required level of proficiency.
• C. It assists the CAE with assessing the results of the internal audit team's development efforts.