1. In determining the adequacy of IT controls, which of the following is not applicable
A) Complexity of the IT infrastructure
B) The organization’s risk appetite
C) The benefits provided by the controls versus the costs
D) Whether the system is connected to the Internet
E) All are applicable
2. What is the primary benefit of having an internal auditor with expertise and experience in their business?
A) It is not possible to evaluate internal controls without this knowledge
B) An individual cannot be hired into an internal auditing department without this knowledge
C) The auditor will have difficulty establishing credibility with management without this knowledge
D) The IPPF prohibits an auditor working on an assignment without this knowledge
E) All of the above
3. What is a way management can gain assurance over controls when an activity is outsourced to a third party?
A) Obtain a report by an independent party on controls at the outsourcer
B) Have terms in the contract governing the nature of services and performance measures
C) Have an audit rights clause in the contract
D) Determine if the outsourcer has any relevant certifications
E) All of the above