Question 1

Y Company wishes to recruit an employee who will have responsibility for the receipt and handling of
cash
From the point of view of the internal auditor which THREE of the following would be most likely to
provide useful information about the candidate"?

• A. Confirmation that the candidate does not have a criminal record
• B. The candidate's personal referees
• C. The candidate's membership of a professional body
• D. The candidate's academic qualifications.
• E. References from previous employers of the candidate.

Question 2

HGY is a major global corporation that has decided to implement the COSO Enterprise Risk
Management Framework and integrate management practices throughout the organisation
Which THREE of the following would be appropriate for HGY?

• A. Authorise managers and supervisors to respond immediately to any risks that emerge
• B. Make risk management an element of everyone's responsibility
• C. Recruit a Director of Risk, who will lead risk management procedures.
• D. Identify risk as an element of HGY's overall strategy.
• E. Create a risk management team that will take responsibility for identifying and mitigating risk

Question 3

UJK manufactures garden machinery. The company is dependent upon another manufacturer for the
motors that power its products.
One of the factors that is being considered in a stress test requested by UJK's Board is the possibility
that the motor manufacturer increases its selling prices by 10% The motor accounts for a significant
proportion of the overall manufacturing cost of UJK's products
Which of the following are correct?

• A. The motor manufacturer should be contacted and told that a substantial increase in selling prices would have a drastic impact on UJK
• B. The possibility of an increase in selling prices due to increased costs should be noted in the stress test report
• C. UJK should estimate the impact on demand of increasing selling prices to pass on the increased cost of the motors.
• D. The impact of absorbing the increased cost of motors on UJK's profits should be calculated.
• E. UJK should identify an alternative vendor of suitable motors as part of its stress test

Question 4

TDC is a company which runs gas-fired power stations in western Europe. The Risk Committee has
just received a report that a power station built to the same design and specification in a developing
country has recently collapsed. The causes of the collapse are unclear but the consequences for TDC
would be catastrophic if something similar were to happen in Europe
Which of the following actions being considered by the Risk Committee are ethical?
Select ALL that apply

• A. Commission a reputable firm of structural engineers to carry out a review of all power stations owned by TDC
• B. Send experts employed by TDC to the site of the collapse so that they can gather information first hand on what happened
• C. Draw up contingency plans in case some of TDC's power stations need to be shut down
• D. Decide that the information available to date is too uncertain to take any action for now
• E. Attempt to increase the level of insurance cover against this type of eventuality
• F. Issue a press release confirming that all TDC's power stations are "entirely safe'.

Question 5

JHG manufactures inexpensive cars that compete largely on price Its cars have very basic equipment
and small but economical engines JHG's Board is considering launching a luxury brand of cars that
will be far better equipped, more comfortable and have much better performance
Which THREE of the following would be relevant factors to incorporate into the stress testing of this
new strategy to create a luxury brand?

• A. Reductions m motorway speed limits
• B. The need for consumer research
• C. Increased tax on vehicle emissions
• D. The cost of designing new cars.
• E. Potential changes in interest rates.
• F. Sales of JHG's existing range of cars

Question 6

DFR is an online retailer that sells picture frames The software running on DFR's website enables
customers to log in and make purchases by inputting an email address as a user name and a
password that must contain at least eight characters, including upper and lower case letters,
numbers and punctuation marks (e.g. £, $ or!) Once logged in, customers can check previous orders
that they have placed.
Customers can also use DFR's website to change personal details, including credit card numbers and
delivery addresses Whenever they wish to use those facilities, the software sends a text message
containing a six-digit number to their mobile phones They must input that number before the system
will accept changes to their personal details
Which TWO of the following statements are correct?

• A. It is illogical to have different security measures in place for orders and for access to personal details.
• B. The software treats customers' personal details as being more sensitive than their ordering histories
• C. The arrangement with the text message will have no effect on the security associated with changing personal details
• D. Customers should be able to update the mobile phone numbers in their DFR accounts using only their email addresses and passwords for access
• E. The software should never show the whole of a customer's credit card number on screen, even if the customer has logged in and input the six-digit number.

Question 7

A junior sales clerk at BCD, a wholesale jewellers, received an email which appeared to be from a
well known parcel delivery company informing her that a delivery had been attempted outside office
hours and had consequently failed She was asked to click on a link and complete some seemingly
innocent but logical questions to effect the delivery on the next day She thought no more about it
but was very surprised the next month to be awarded salesperson of the month as her sales had
doubled
Unfortunately, on investigation it was found that this was as a result of several fraudulent orders for
high-value items that had seemingly been placed by an existing customer but delivered to a new
address, which turned out to be a temporary box number The existing customer's credit card had
been fraudulently charged for these orders
Which of the following types of cyber-attack had the sales clerk been a victim of?

• A. Botnets
• B. Malvertising
• C. Trojan
• D. Ransomware

Question 8

C is an accounts clerKwho is supposed to sign each invoice as evidence that she has conducted
checks against supporting documents Sometimes C signs invoices without making these checks
D is a member of the internal audit team He has been told to conduct compliance tests on whether C
is checking the invoices property
Which of the following would grve D a false sense of assurance that C's checks have been in
operation?
Select ALL that appry

• A. D reviewed a sample of invoices for purchases of plant and equipment and found that C had not signed them C explained that she believed that those were authonsed by someone else although the accounts manual indicates that it was her responsibility
• B. asked C a series of open-ended questions about the operation of the purchases system She did not mention anything about detailed checks of invoices against documents
• C. D examined a sample of invoices to make sure that they had been signed by C AH had been signed selected a sample of purchase invoices and compared each to the supporting documents that C is supposed to review Every one of D's invoices was supported by the related documents
• D. D worked at a spare desk in the accounts department and quietly watched C without telling her She checked every invoice carefully while D was present

Question 9

HWG is a large company which grows and processes coffee The coffee is sold to supermarkets,
branded with their names for sale as "own brand" products HWG brands and packages the coffee
using the supermarkets' own designs
HWG's directors are considering a strategic proposal to develop a range of coffees to be sold under a
brand that HWG will develop
Which TWO of the following should the directors consider as part of their strategic analysis?

• A. The design of packaging for the new brand
• B. The reaction of the supermarkets who currently buy coffee from HWG
• C. The sales volume forecast for the new coffee
• D. The choice of name for the new brand
• E. Recruiting a marketing firm to advertise the new coffee

Question 10

JC is a car manufacturing company in country C and manufactures diesel cars It is facing a number of
serious risks Which TWO of the following nsk factors are external?

• A. JC's marketing director is considering an attractive job offer from one of J's main competitors
• B. Country F, JC's main market, is threatening to impose tariffs on car imports
• C. JC is facing court action arising from injuries to customers caused by an alleged brake failure in one of its cars
• D. Diesel cars are being criticised by experts because it is believed they cause more harmful pollution than petrol
• E. JC's production staff are complaining that their wages are too low compared to wages paid to other employees.

Question 11

DRAG DROP
E purchases parts for one of the machines it manufactures from Country X Place the risk classification
next to the risk it relates to:

Question 12

The Board of Directors of VCX, a state-owned electricity company, includes four executive directors
the Chief Executive Officer, the Finance Director the Operation Director and the Technical Director
All of the shares in the company vest in the Office of the Minister for Energy, who is entitled to
appoint two non-executive directors to the Board It has been alleged that the Minister appoints
political "insiders" who have no particular knowledge of. or interest in. the electricity industry
There are three further non-executive directors
• L, who spent seven years as Chief Executive of VCX, but retired from that role two years ago,
• M, who spent several years on the Board of a state electricity company in a different country to VCX
but who resigned from it before accepting the position with VCX: and
• N, who is a qualified and experienced professional accountant
In relation to best practice in respect of Corporate Governance, which of the following statements
are valid? Select ALL that apply

• A. None of the executive directors should be allowed to sit on the Remuneration Committee
• B. M is unsuitable to be part of the Board because his previous involvement with a similar company in another country is a conflict of interest.
• C. L can now be considered to be an independent non-executive director
• D. M and N are both suitable appointees to the Audit Committee
• E. The Finance Director should be part of the Audit Committee because of her expertise
• F. Non-executive directors should be responsible for monitoring the performance of executive management especially with regard to company strategy and objectives

Question 13

The Head of IT Security has been asked to conduct a detailed forensic analysis of a suspected data
breach that ted to customer credit card details being intercepted.
Which TWO of the following would be suitable objectives for such a forensic analysis?

• A. Recovering the stolen credit card details before they can be abused by criminals
• B. Developing an understanding of the vulnerabilities that led to the breach
• C. Identifying customers whose details have been stolen
• D. The collection of evidence that can be used to convict the perpetrators of the breach.
• E. Preventing the credit card companies from blaming the entity for fraudulent charges

Question 14

JKL is a retailer with more than 45 shops around the country. The directors suspect that a serious
fraud has occurred at one of the branches and a team of internal auditors has been sent to
investigate
An analytical review investigation shows that sales revenue is in line with budget, but overtime
payments to shop staff exceed budget by 20%.
How should the internal audit team proceed?

• A. Increase the evaluation of control risk
• B. Conduct additional detailed testing on overtime payments
• C. Increase the evaluation of inherent risk
• D. Conduct additional detailed testing of all figures.

Question 15

Company directors who exercise executive share options generally resell the shares immediately,
rather than holding them Which of the following best explains this behavior?

• A. The directors receive a risk-free gain
• B. Shareholders become nervous when the directors hold shares
• C. The shares are out of the money at the exercise date
• D. It is a conflict of interest for directors to be shareholders.