View Full IIA IIA-CIA-Part2 Exam Dumps and Practice Test Dumps

 

Question 321.

What is the primary purpose of evaluating human resources controls during an internal audit engagement?

1. Determine whether hiring, compensation, performance, access, and termination processes are authorized, accurate, and appropriately controlled
2. Replace management responsibility for employees
3. Guarantee employee satisfaction
4. Eliminate the need for supervisory review

Correct Answer: 1. Determine whether hiring, compensation, performance, access, and termination processes are authorized, accurate, and appropriately controlled

Explanation:

Human resources processes affect payroll, system access, legal compliance, employee data, and organizational capability. Internal audit may assess hiring approvals, background checks where appropriate, compensation changes, performance management, training, leave administration, and termination procedures. Strong controls help ensure personnel actions are valid, documented, and aligned with policy while reducing risks of unauthorized access, payroll errors, and inconsistent employment practices.

Question 322.

Which control BEST reduces the risk of unauthorized employees being added to payroll?

1. Allow payroll personnel to create employees independently
2. Require approved HR records before new employees are activated in payroll
3. Permit managers to add employees directly without documentation
4. Eliminate payroll master-file reviews

Correct Answer: 2. Require approved HR records before new employees are activated in payroll

Explanation:

Independent HR authorization provides evidence that an employee is legitimate before payroll activation. Internal audit may compare payroll records with approved HR files and investigate unmatched employees. Segregating employee setup from payroll processing can reduce the risk of fictitious employees, unauthorized payments, and inappropriate changes to employee master data.

Question 323.

What is the primary purpose of reviewing employee master-file changes?

1. Determine whether changes to pay, bank information, job status, and other sensitive data are authorized and accurate
2. Replace payroll reconciliation
3. Eliminate all manual changes
4. Guarantee employees never change bank accounts

Correct Answer: 1. Determine whether changes to pay, bank information, job status, and other sensitive data are authorized and accurate

Explanation:

Employee master-data changes can directly affect payroll and access rights. Internal audit may review who can make changes, whether changes require approval, whether audit trails are retained, and whether unusual updates are monitored. Sensitive modifications such as salary or bank-account changes generally warrant stronger controls because they can create significant fraud and financial risk.

Question 324.

Which condition would MOST strongly indicate a payroll-control weakness?

1. Payroll is reconciled periodically
2. Salary changes require documented approval
3. One employee can create a worker, change compensation, and release payroll without independent review
4. Termination data is transmitted to payroll promptly

Correct Answer: 3. One employee can create a worker, change compensation, and release payroll without independent review

Explanation:

Combining employee creation, compensation maintenance, and payroll release gives one person excessive control over the process and creates opportunities for fictitious employees or unauthorized payments. Internal audit should evaluate segregation of duties and actual system permissions. Where staffing limitations prevent full segregation, strong independent review and monitoring may be necessary.

Question 325.

What is the primary purpose of reviewing payroll exception reports?

1. Identify unusual payments, changes, or records that may require investigation
2. Replace payroll approval
3. Guarantee every exception is an error
4. Eliminate normal payroll processing

Correct Answer: 1. Identify unusual payments, changes, or records that may require investigation

Explanation:

Exception reports may highlight unusually high payments, duplicate bank accounts, inactive employees receiving pay, unexpected overtime, or significant master-data changes. Internal audit should evaluate whether the reports are complete and whether responsible personnel investigate meaningful exceptions. Exception reporting is effective only when unusual items receive timely and appropriate follow-up.

Question 326.

Which analytical procedure would BEST help identify possible fictitious employees?

1. Reviewing total payroll expense only
2. Comparing payroll records with HR records and searching for duplicate bank accounts or addresses
3. Examining only employee performance reviews
4. Reviewing annual leave balances

Correct Answer: 2. Comparing payroll records with HR records and searching for duplicate bank accounts or addresses

Explanation:

Matching payroll data with independent HR records can identify employees who may not have valid employment records. Duplicate bank accounts, addresses, or identification information can provide additional risk indicators. Such matches are not proof of fraud and should be investigated using reliable supporting information before a conclusion is reached.

Question 327.

What is the primary purpose of testing overtime controls?

1. Determine whether overtime is authorized, accurately recorded, and consistent with policy and actual work performed
2. Eliminate all overtime
3. Replace timekeeping controls
4. Guarantee equal overtime for all employees

Correct Answer: 1. Determine whether overtime is authorized, accurately recorded, and consistent with policy and actual work performed

Explanation:

Overtime can create financial and fraud risks if employees can record excessive or unsupported hours. Internal audit may compare overtime claims with schedules, access records, production activity, approvals, and payroll data. Repeated unusual patterns should be investigated, especially when overtime is concentrated among particular employees, supervisors, or periods.

Question 328.

Which situation would MOST strongly warrant additional audit attention in payroll?

1. Routine salary payments consistent with approved records
2. Normal payroll deductions processed automatically
3. A properly approved annual salary adjustment
4. Repeated large manual payroll adjustments entered shortly before payment processing**

Correct Answer: 4. Repeated large manual payroll adjustments entered shortly before payment processing

Explanation:

Manual payroll adjustments can bypass normal automated controls and may create elevated risk when they are large, frequent, or made close to payment release. Internal audit should examine business purpose, authorization, supporting documentation, user access, and whether the same employees or administrators are repeatedly involved. Unusual timing and weak support increase the need for investigation.

Question 329.

What is the primary purpose of testing terminated-employee controls?

1. Confirm that payroll, system access, and other privileges are removed promptly when employment ends
2. Guarantee former employees return to the organization
3. Replace exit interviews
4. Eliminate all post-employment obligations

Correct Answer: 1. Confirm that payroll, system access, and other privileges are removed promptly when employment ends

Explanation:

Delayed termination processing can result in unauthorized salary payments, benefit continuation, or inappropriate access to systems and facilities. Internal audit may compare termination dates with payroll removal, identity-management records, badge deactivation, and asset-return information. Effective offboarding requires coordination among human resources, payroll, IT, security, and business management.

Question 330.

Which control BEST reduces the risk that terminated employees retain unnecessary system access?

1. Relying on managers to remember eventually
2. Automated or timely HR-triggered access removal supported by monitoring
3. Allowing accounts to remain active for several months
4. Removing only email access

Correct Answer: 2. Automated or timely HR-triggered access removal supported by monitoring

Explanation:

Linking termination information to identity-management processes can help ensure access is removed promptly and consistently. Internal audit may test whether accounts are disabled on or before the effective termination date and whether privileged, remote, cloud, and physical access are included. Delays should be investigated to determine whether they create material exposure.

Question 331.

What is the primary purpose of evaluating employee background-check controls where such checks are appropriate?

1. Determine whether required screening is completed consistently before individuals assume sensitive responsibilities
2. Guarantee that screened employees will never commit misconduct
3. Replace supervision
4. Eliminate the need for access controls

Correct Answer: 1. Determine whether required screening is completed consistently before individuals assume sensitive responsibilities

Explanation:

Background screening can reduce hiring risk for roles involving money, confidential information, safety, or other sensitive responsibilities. Internal audit may assess whether screening requirements are risk-based, legally appropriate, consistently applied, and completed at the correct stage. Screening provides only one layer of protection and does not replace ongoing controls, supervision, or monitoring.

Question 332.

What is the primary purpose of mandatory vacation or job-rotation controls in selected sensitive roles?

1. Improve employee morale only
2. Reduce dependency on one person and potentially expose irregularities that require continuous concealment
3. Replace segregation of duties
4. Guarantee detection of every fraud scheme

Correct Answer: 2. Reduce dependency on one person and potentially expose irregularities that require continuous concealment

Explanation:

Certain fraud schemes depend on one individual maintaining constant control over records or processes. Mandatory leave or rotation can interrupt that control and allow another person to perform the duties, potentially revealing irregularities. These controls are particularly relevant in sensitive financial or operational positions but should complement rather than replace segregation, reconciliation, and supervisory review.

Question 333.

What is the primary purpose of reviewing employee training records during an audit?

1. Determine whether personnel have completed required training relevant to their responsibilities and risks
2. Guarantee employees understand every subject perfectly
3. Replace performance management
4. Eliminate the need for documented procedures

Correct Answer: 1. Determine whether personnel have completed required training relevant to their responsibilities and risks

Explanation:

Training records help demonstrate whether employees received required instruction on compliance, safety, cybersecurity, operational procedures, or other significant responsibilities. Internal audit may compare required populations with completion records, review overdue training, and assess whether content remains current. For critical topics, completion alone may not establish that employees can perform responsibilities effectively.

Question 334.

Which factor is MOST important when evaluating whether an employee training program is effective?

1. Whether training materials are lengthy
2. Whether training improves relevant knowledge or behavior and addresses identified risks
3. Whether every course is delivered in person
4. Whether employees receive certificates

Correct Answer: 2. Whether training improves relevant knowledge or behavior and addresses identified risks

Explanation:

Training effectiveness should be evaluated by more than completion rates. Internal audit may consider assessment results, error rates, compliance incidents, observed behavior, or performance changes. A program can achieve high attendance but still fail if its content is irrelevant, outdated, or not understood. Training should be aligned with actual responsibilities and risk exposures.

Question 335.

What is the primary purpose of evaluating performance-management controls?

1. Determine whether performance expectations, evaluations, rewards, and corrective actions are applied consistently and support organizational objectives
2. Guarantee every employee receives the same rating
3. Replace management judgment
4. Eliminate incentive compensation

Correct Answer: 1. Determine whether performance expectations, evaluations, rewards, and corrective actions are applied consistently and support organizational objectives

Explanation:

Performance systems influence employee behavior and can strengthen or weaken the control environment. Internal audit may assess whether goals are clear, reviews are documented, ratings are supported, and incentives do not encourage excessive risk-taking or control circumvention. The audit should consider whether performance measures balance financial results with quality, compliance, and other important outcomes.

Question 336.

Which condition MOST strongly suggests an incentive-design risk?

1. Employees are rewarded for both results and compliance
2. Supervisors review performance periodically
3. Compensation strongly rewards sales volume while ignoring credit quality, returns, or compliance
4. Employees receive documented objectives

Correct Answer: 3. Compensation strongly rewards sales volume while ignoring credit quality, returns, or compliance

Explanation:

Incentives focused narrowly on one metric can encourage employees to maximize that measure while disregarding associated risks. Internal audit should assess whether compensation structures create pressure to circumvent controls, manipulate reporting, or take excessive risk. Balanced measures can help reduce unintended behavior by including quality, compliance, customer, and risk outcomes.

Question 337.

What is the primary purpose of reviewing employee conflict-of-interest declarations?

1. Identify relationships or interests that could improperly influence business decisions
2. Prevent employees from having any outside interests
3. Replace procurement controls
4. Guarantee that disclosures are always complete

Correct Answer: 1. Identify relationships or interests that could improperly influence business decisions

Explanation:

Conflict-of-interest declarations help management identify circumstances where personal relationships, investments, outside employment, or other interests could influence judgment. Internal audit may evaluate whether declarations are required for relevant employees, reviewed appropriately, updated periodically, and followed by mitigation where necessary. Disclosure alone does not resolve a conflict; management must evaluate and manage the risk.

Question 338.

Which audit procedure would BEST help identify undisclosed employee-vendor relationships?

1. Review only employee performance evaluations
2. Compare employee and vendor data for shared addresses, bank accounts, phone numbers, or other relevant identifiers
3. Examine only vendor invoices above a fixed amount
4. Review annual leave records

Correct Answer: 2. Compare employee and vendor data for shared addresses, bank accounts, phone numbers, or other relevant identifiers

Explanation:

Data matching can reveal relationships that may warrant further review. Shared information does not automatically indicate misconduct because legitimate explanations may exist. Internal audit should verify the reliability of the data and investigate significant matches using declarations, procurement records, ownership information, and other evidence before reaching a conclusion.

Question 339.

What is the primary purpose of reviewing succession planning for key personnel?

1. Determine whether critical responsibilities and knowledge can continue when important employees leave or become unavailable
2. Guarantee every position has an immediate internal replacement
3. Eliminate the need for recruitment
4. Replace knowledge documentation

Correct Answer: 1. Determine whether critical responsibilities and knowledge can continue when important employees leave or become unavailable

Explanation:

Key-person dependency can create significant operational risk when essential knowledge, authority, or technical capability is concentrated in one individual. Succession planning, cross-training, documentation, and development programs can reduce that exposure. Internal audit may assess whether critical roles have realistic succession arrangements and whether plans are kept current as organizational needs change.

Question 340.

Which approach BEST supports effective internal audit assurance over human resources and payroll processes?

1. Review only payroll totals
2. Rely solely on HR management representations
3. Evaluate hiring, employee master data, payroll changes, access, overtime, training, incentives, conflicts, termination, and succession controls using reliable evidence
4. Assume automated payroll systems eliminate employee-related risk

Correct Answer: 3. Evaluate hiring, employee master data, payroll changes, access, overtime, training, incentives, conflicts, termination, and succession controls using reliable evidence

Explanation:

Human resources and payroll risks span the full employee lifecycle. Internal audit should assess how employees are hired, maintained in systems, paid, trained, evaluated, and removed when they leave. It should also consider access, segregation of duties, conflicts of interest, incentives, and key-person dependency. Reliable evidence and risk-based testing provide stronger assurance than reviewing policies or relying solely on automated systems.