Lead Inspector/Risk Assessor (LIRA)

Correct: Conducting a surprise physical verification or payroll distribution is the most effective method for detecting ghost employees. By requiring government-issued identification, the auditor ensures that a real person exists for every paycheck issued, directly mitigating the risk of fraudulent entries created by payroll staff or managers who might use shared bank accounts to divert funds.

Incorrect: Relying solely on the examination of personnel files is insufficient because a fraudster can easily create fictitious documents to support a ghost employee record. The strategy of reconciling general ledger entries to IRS tax filings confirms that the numbers match for reporting purposes but fails to validate the legitimacy of the individual payees. Opting for inquiries with supervisors provides weak evidence, as the supervisors might be complicit in the scheme or may not have sufficient personal knowledge of every staff member in a large organization.

Takeaway: Physical verification with independent identification is the most reliable audit procedure for confirming the existence of employees and detecting payroll fraud.

Correct: A walkthrough is a fundamental technique for understanding how a process actually functions versus how it is documented in manuals. By tracing a single transaction through the entire system, the auditor can observe the actual application of controls, identify potential gaps, and confirm the accuracy of existing documentation through direct observation and inquiry. This aligns with the COSO Internal Control – Integrated Framework, which emphasizes understanding the flow of transactions to identify risks and relevant controls.

Incorrect: Relying solely on questionnaires completed by management can lead to a biased or incomplete understanding, as it reflects management’s perception of what should happen rather than the actual operational reality. Simply conducting substantive testing at this stage is premature because the auditor has not yet identified the specific control points or risks that the testing should address, leading to an inefficient audit. The strategy of adopting external audit papers without independent verification fails to account for recent changes in the business environment or the specific risk-based objectives of an internal audit, which often differ from the materiality-focused objectives of a financial statement audit.

Takeaway: Performing a transaction walkthrough is the most reliable method to validate process understanding and identify where key controls are situated.

Correct: Scheduling a pre-audit meeting to discuss scope and objectives aligns with professional standards for communication and relationship building. Establishing a ‘no-surprises’ protocol ensures that management is informed of findings in real-time, which builds trust and transparency without compromising the auditor’s independence or the integrity of the audit process.

Incorrect: The strategy of allowing management to approve the audit program is a violation of independence, as the internal audit activity must remain free from interference in determining the scope of auditing. Focusing only on low-risk areas to build trust ignores the fundamental requirement of risk-based planning and may leave significant exposures unaddressed. Providing a draft report before fieldwork begins is logically impossible and undermines the professional skepticism and evidence-based nature of the audit function.

Takeaway: Effective relationship building relies on transparent communication and alignment of objectives while strictly maintaining auditor independence and objectivity.

Correct: The CAE should prioritize engagements by evaluating inherent risks and the effectiveness of controls within the audit universe. This systematic approach, combined with a resource contingency, ensures the plan addresses the most significant risks while maintaining flexibility for emerging United States regulatory mandates or environmental shifts. This alignment with risk-based principles ensures that the most critical areas, such as the new cloud-based lending platform, receive appropriate attention.

Incorrect: Allocating resources equally across all units through a fixed rotation cycle ignores the varying risk levels of different business activities and fails to adapt to the bank’s new risk profile. Relying solely on historical loss data is a reactive strategy that fails to address new risks introduced by technological changes like cloud-based lending. Focusing only on management and board requests risks neglecting high-risk areas that are not currently a management priority and may impair the perceived objectivity and independence of the audit plan.

Takeaway: Effective audit planning prioritizes resources based on dynamic risk assessments rather than fixed cycles or historical data alone.

Correct: In the United States regulatory environment, network segmentation is a fundamental control for mitigating the risks associated with Internet of Things (IoT) devices. By verifying the use of an isolated Virtual Local Area Network (VLAN), the auditor ensures that a compromise of an IoT device does not allow for lateral movement into the core financial network. Furthermore, reviewing patch management agreements addresses the critical need for ongoing vulnerability remediation in third-party managed hardware.

Incorrect: The strategy of disabling all wireless capabilities is impractical as it defeats the purpose of the IoT deployment and ignores the operational requirements of the business. Focusing only on physical security is insufficient because it fails to address the significant cyber-risk and network vulnerabilities inherent in connected devices. Opting to accept the risk based on an indemnity clause is a failure of due professional care, as legal protections do not mitigate the actual operational, regulatory, or reputational impact of a security breach.

Takeaway: Effective IoT auditing requires verifying network segmentation and ensuring robust third-party vulnerability management to protect core organizational assets.

Correct: Assessing the flow of threat intelligence ensures that the Information and Communication component of COSO is functioning by providing relevant, high-quality information to those charged with governance. This allows for proactive risk management and alignment with the organization’s strategic objectives.

Correct: Implementing continuous monitoring using data analytics is a proactive strategy that aligns with the COSO framework’s monitoring component. It allows internal auditors to identify patterns and anomalies in real-time, significantly increasing the likelihood of detecting fraud early and deterring potential perpetrators by increasing the perceived risk of discovery. This approach fulfills the auditor’s responsibility to evaluate the potential for the occurrence of fraud and how the organization manages fraud risk.

Incorrect: The strategy of delegating risk assessment entirely to another department fails because internal audit must independently evaluate the effectiveness of risk management processes according to professional standards. Focusing only on physical asset verification is too narrow and misses sophisticated fraud schemes like financial statement manipulation, payroll fraud, or electronic skimming. Choosing a purely reactive strategy based on hotlines ignores the auditor’s responsibility to design tests that proactively search for indicators of fraud during regular engagements and fails to address the prevention aspect of the fraud management lifecycle.

Takeaway: Proactive fraud management requires internal auditors to integrate continuous data monitoring and independent risk assessments into their regular audit activities.

Correct: Facilitating stakeholder engagement and demonstrating the value proposition of change aligns with the internal auditor’s role as a change agent. By identifying the root causes of resistance and linking improvements to strategic benefits like cost reduction and operational efficiency, the auditor influences management to adopt sustainable solutions. This approach follows the COSO Internal Control framework’s emphasis on the importance of the control environment and the communication of information to drive accountability.

Incorrect: Choosing to mandate pre-approvals by the audit team is a significant violation of professional standards regarding independence and objectivity, as it involves auditors in performing management functions. The strategy of 100% substantive testing is a resource-intensive detective measure that fails to address the systemic root cause or influence the necessary process improvement. Opting for outsourcing as a way to remove the deficiency from the audit universe is flawed because management retains the risk of the outsourced process and the auditor must still evaluate the vendor’s controls.

Takeaway: Internal auditors drive improvement by addressing root causes and demonstrating the strategic value of change to stakeholders.

Correct: Under the Sarbanes-Oxley Act and related PCAOB standards, any identified control failure must be evaluated to determine its severity. This involves assessing the likelihood that a misstatement could occur and the magnitude of that potential misstatement. Categorizing the finding as a deficiency, significant deficiency, or material weakness is essential because it dictates the required level of reporting to management, the audit committee, and external stakeholders.

Incorrect: The strategy of automatically classifying any IT lapse as a material weakness is incorrect because severity depends on the specific risk and potential impact on financial reporting. Reporting directly to the Securities and Exchange Commission bypasses the established internal governance and reporting protocols. Focusing only on substantive testing to prove no fraud occurred is insufficient because the Sarbanes-Oxley Act requires an assessment of the effectiveness of the controls themselves, not just the absence of errors. Choosing to delegate the evaluation to external auditors is inappropriate because management is legally responsible for its own assessment of internal controls.

Takeaway: Internal auditors must evaluate the severity of control deficiencies based on likelihood and magnitude to satisfy Sarbanes-Oxley reporting requirements.

Correct: Under the COSO Internal Control – Integrated Framework, segregation of duties is a critical control activity designed to reduce the risk of error or fraud. When a significant control deficiency like this is identified, the auditor must not only report the finding but also perform substantive procedures to determine if the lack of control resulted in actual financial misstatements or unauthorized activity.

Incorrect: Reporting to federal regulators like the OCC before completing the internal reporting process and validating the impact is inconsistent with standard audit protocols and professional standards. Focusing only on automation ignores the immediate need to verify the integrity of past transactions that occurred while the control was absent. Relying on a background check as a substitute for control testing is inappropriate because even ethical employees can make errors or be pressured into misconduct, and it does not provide evidence regarding the accuracy of the financial records.

Takeaway: Internal auditors must respond to control deficiencies by assessing the risk of impact and performing substantive procedures to ensure financial integrity.

Correct: Attribute sampling is the primary statistical method used in internal auditing to estimate the rate of occurrence of a specific quality or attribute in a population. In the context of US regulatory compliance, such as SEC Rule 15c3-3, it allows the auditor to reach a mathematically defensible conclusion about the frequency of control deviations within a defined confidence interval.

Incorrect: Relying on monetary unit sampling is incorrect because this technique prioritizes items with larger dollar values and is used to estimate total financial misstatement rather than error frequency. The strategy of using classical variables sampling is better suited for determining the total value of an account balance or inventory rather than the rate of control failures. Selecting discovery sampling is inappropriate for this specific objective because it is designed to identify at least one instance of a rare event, such as fraud, rather than estimating a population’s overall error percentage.

Takeaway: Attribute sampling is the standard statistical method for estimating the frequency of control deviations or compliance failures within a population.

Correct: Risk sharing involves reducing risk impact by transferring or otherwise sharing a portion of the risk with another party. By purchasing mortgage insurance, the bank transfers the financial risk of borrower default to the insurance provider, which is a primary example of sharing under the COSO ERM framework.

Incorrect: Focusing only on internal controls like stricter underwriting standards would be considered risk reduction because it aims to decrease the likelihood of default. The strategy of stopping all lending to borrowers with high loan-to-value ratios would be classified as risk avoidance since it eliminates the activity giving rise to the risk. Opting for keeping the loans on the books without any insurance or additional collateral would constitute risk acceptance.

Takeaway: Risk sharing involves shifting a portion of the potential financial loss to a third party, such as an insurer or guarantor.

Correct: According to professional internal auditing standards and the COSO framework, auditors must evaluate the adequacy and effectiveness of management’s response to audit findings. This involves ensuring that the Management Action Plan (MAP) addresses the root cause of the issue—in this case, the automated system failure—rather than just the symptoms, such as the backlog. The auditor must also verify that the proposed resources and timelines are sufficient and achievable to mitigate the risk to an acceptable level.

Incorrect: The strategy of assuming responsibility for the remediation project is incorrect because it directly violates the principle of independence and objectivity by involving the auditor in management functions. Simply accepting the plan without a critical evaluation fails to fulfill the auditor’s duty to monitor the disposition of results and ensure risks are appropriately addressed. Opting to mandate a specific software vendor oversteps the auditor’s authority, as management is responsible for selecting the specific tools and methods used to mitigate risks within their operations.

Takeaway: Internal auditors must evaluate if management action plans address root causes and monitor their implementation without compromising their own independence or objectivity.

Correct: Strategic thinking in auditing requires the CAE to align the audit plan with the organization’s long-term goals and strategic direction. By prioritizing emerging risks associated with the digital-first pivot, such as cloud governance and digital transformation, the internal audit function provides proactive assurance on the initiatives most critical to the company’s future success and risk profile.

Incorrect: The strategy of maintaining a schedule focused on legacy systems fails to address the shifting risk landscape and may leave the organization’s most critical new initiatives unexamined. Simply expanding compliance audits for traditional segments ignores the strategic risks inherent in the new digital platform and cloud migration. Choosing to allocate resources based on historical revenue is a mechanical approach that does not account for the risk-based needs of new, strategically important business lines that may not yet be high-revenue generators.

Takeaway: Strategic auditing requires aligning the audit plan with organizational objectives to address emerging risks and provide forward-looking assurance on key initiatives.

Correct: According to professional standards for due professional care and audit evidence, the reliability of any data analytics output is fundamentally dependent on the quality of the underlying data. By validating the completeness and accuracy of the source data from the core banking system, the auditor ensures that the conclusions drawn from the analysis are based on a sound foundation. This is particularly critical in a United States regulatory environment where BSA compliance requires high levels of data precision and auditability.

Incorrect: The strategy of prioritizing advanced modeling over basic data validation risks producing ‘garbage in, garbage out’ results that lack credibility during regulatory examinations. Relying on IT extracts without independent verification fails to satisfy the auditor’s responsibility to obtain sufficient and competent evidence regarding the data’s origin. Choosing to restrict the analysis to a small judgmental sample for the sake of manual ease defeats the primary advantage of data analytics, which is the ability to analyze entire populations for systemic risks.

Takeaway: Data integrity validation is the essential prerequisite for any audit data analytics project to ensure reliable and defensible results.

Correct: According to the IIA International Standards for the Professional Practice of Internal Auditing, specifically Standard 1130.A1, objectivity is presumed to be impaired if an auditor provides assurance services for an activity for which the auditor had responsibility within the previous year. Since only six months have passed since the auditor worked in Mortgage Servicing, they must disclose the impairment to the CAE and should not perform the assurance engagement to maintain professional objectivity.

Incorrect: The strategy of using a secondary reviewer is insufficient because the standards explicitly prohibit performing assurance for recent prior responsibilities regardless of the level of oversight provided. Focusing only on technical proficiency is a mistake because professional standards require both competence and objectivity; one cannot replace the other. Choosing to seek a waiver from the department head is an invalid approach because independence and objectivity are professional requirements that cannot be waived by the management of the area being audited.

Takeaway: Internal auditors must wait at least one year before performing assurance services for activities they were previously responsible for to maintain objectivity.

Correct: In accordance with COSO Internal Control frameworks and US regulatory standards such as those from the OCC, maintaining a strict separation between development and production environments is a fundamental control. This prevents unauthorized or untested code from being deployed, which protects the integrity of financial data and ensures operational stability during the transition to new systems.

Incorrect: Simply confirming that requirements were signed off at the start of the project is a necessary planning control but does not address the risk of unauthorized changes during the deployment phase. Opting to focus on budget alignment addresses fiscal responsibility but fails to mitigate the technical and operational risks associated with system changes. Relying on regression testing of decommissioned legacy systems is a secondary concern compared to the immediate risk of introducing errors or fraud into the new production environment through poor access controls.

Takeaway: Internal auditors must verify that segregation of duties exists between development and production to prevent unauthorized code deployment during the SDLC process.

Correct: The CAE is responsible for ensuring that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan. When the internal team lacks specific competencies required for high-risk areas like cybersecurity or BSA compliance, co-sourcing is a recognized method to obtain necessary skills. This ensures the audit activity collectively possesses the expertise required to perform its responsibilities and address significant risks to the organization.

Incorrect: Relying solely on self-study for generalist staff to handle complex technical audits fails to meet the requirement for due professional care and technical proficiency. Postponing critical audits based on current staffing levels leaves the organization exposed to significant unmitigated risks in high-priority areas identified during the risk assessment. Choosing to reduce the audit scope to match existing staff skills undermines the risk-based planning process and fails to provide the board with an accurate assessment of the control environment.

Takeaway: The CAE must ensure the internal audit activity possesses the collective knowledge and skills needed to perform its responsibilities effectively.

Correct: Under the COSO framework, Monitoring Activities require that internal control deficiencies be identified and communicated in a timely manner to those parties responsible for taking corrective action. This includes senior management and the board of directors as appropriate to ensure that the organization can address weaknesses before they lead to significant financial or regulatory failures.

Incorrect: Relying solely on automated alerts without a reporting structure fails to address the systematic evaluation of the control’s effectiveness. Simply conducting a one-time assessment ignores the COSO requirement for ongoing or separate evaluations to ensure controls continue to function over time. The strategy of delegating oversight to a single department like IT overlooks the need for independent reporting lines and the responsibility of management to oversee the entire internal control system.

Takeaway: Effective monitoring requires systematic evaluation and reporting of control deficiencies to senior leadership to ensure timely remediation.

Correct: Utilizing Lean Six Sigma allows the organization to systematically reduce waste and process variation, which directly supports the Control Activities and Information and Communication components of the COSO framework. By mapping these improvements back to the framework, the auditor ensures that efficiency gains do not come at the expense of the internal control environment or compliance with US banking regulations and the Sarbanes-Oxley Act requirements for maintaining effective internal controls.

Incorrect: Focusing on automation through Rapid Application Development without updating the risk assessment fails to address whether the automated process introduces new vulnerabilities or bypasses critical checkpoints required by the COSO framework. The strategy of allowing front-line staff to bypass standard procedures under a Kaizen model violates the principle of the Control Environment and undermines the consistency required for effective internal controls. Opting for the removal of supervisory layers through Business Process Reengineering without a compensatory control analysis creates significant gaps in oversight and increases the risk of undetected errors or fraud in the lending process.

Takeaway: Process improvements must enhance efficiency without compromising the established COSO internal control components or the organization’s risk appetite.