During an internal audit of a university's procurement process, it is discovered that there is no formal procedure for vendor selection, leading to inconsistent and potentially biased decisions. What should be the auditor's recommendation? ○ A. To select vendors based solely on the lowest bid to ensure cost-effectiveness. OB. To delegate vendor selection to an external agency. ○ C. To establish a formal, transparent, and criteria-based vendor selection process. OD. To continue with the current process as it allows flexibility.

Identify each of the following as relating to (a) the control environment, (b) risk assessment, or (c) control procedures. 1.  Mandatory vacations   2.  Personnel policies   3.  Report of outside consultants on future market changes

Internal auditors would most appropriately perform which of the following activities during a review of systems development activity?a. Serve on the MIS steering committee that determines what new systems are to be developed.b. Review the methodology used to monitor and control the system development function. c. Recommend specific automated procedures to be incorporated into new systems that will provide reasonable assurance that all data submitted to an application are converted to machine-readable form.d. Recommend specific operational procedures that will ensure that all data submitted for processing are converted to machine-readable form.

Q1. Based on Sarbanes-Oxley, who is ultimately responsible for the independence of the external auditor? (In your response, identify all of the requirements placed upon the Audit Committee by Sarbanes-Oxley, and why you think the Act placed these responsibilities with this group). Q2. Which of the following is an example of the appropriate implementation of a system of quality control? (in your response, describe the purpose of a system of quality control for an audit firm, and what the six elements of quality control are).

An IT auditor is performing an application development audit for a high risk web-based application.  In determining tests of controls, which of the following is a TRUE statement: 1. The IT auditor should limit testing to inquiry procedures with the lead developer. 2. Conduct inquiry procedures, corroborated by inspection of evidence. 3. Increase sample sizes due to the elevated risks associated with the application.  a) 1, 2, and 3 b) 1 and 2 only c) 1 only d) 2 and 3 only

The following questions concern quality control standards. Choosethe best response.a. The nature and extent of a CPA firm’s quality control policies and procedures dependon The CPA The Nature of the Cost-benefitFirm’s Size CPA Firm’s Practice Considerations(1) Yes Yes Yes(2) Yes Yes No(3) Yes No Yes(4) No Yes Yesb. Which of the following are elements of a CPA firm’s quality control that should beconsidered in establishing its quality control policies and procedures?Human Resources Monitoring Engagement Performance(1) Yes Yes No(2) Yes Yes Yes(3) No Yes Yes(4) Yes No Yesc . One purpose of establishing quality control policies and procedures for decidingwhether to accept a new client is to(1) enable the CPA firm to attest to the reliability of the client.(2) satisfy the CPA firm’s duty to the public concerning the acceptance of new clients.(3) provide reasonable assurance that the integrity of the client is considered.(4) anticipate before performing any field work whether an unqualified…

Q2. Consult Paragraphs 3-6 of Quality Control Standard No. 20 (QC 20). Considering the example in the Waste Management case, please explain why a review by the practice director and audit division head is important in the operations of a CPA firm. In your opinion, was this review effective at Waste Management? Why or why not? Q3. Consult Paragraph 7 of PCAOB Auditing Standard No. 13. Do you believe that Andersen’s final decision regarding the PAJE’s was appropriate, under the circumstances? Would your opinion change if you knew that all of the adjustments were based on subjective differences (such as a difference in the estimate of the allowance for doubtful accounts), as compared to objective differences (such as a difference in the account receivable balance of their biggest customer)? Q4. Refer to Sections 203 and 206 of SARBOX. How would these sections of the law have impacted the Waste Management audit? Do you believe that these sections were needed? Why or why not?

Many auditors assert that certain audit tests can be significantlyreduced for clients with adequate perpetual records that include both unit and cost data.What are the most important tests of the perpetual records that the auditor must makebefore reducing assessed control risk? Assuming the perpetuals are determined to beaccurate, which tests can be reduced?

The internal audit risk assessment process: [SELECT ALL THAT APPLY] a) Provides the Internal Audit function with an ability to prioritize risk areas based on objective and subjective evaluation criteria. b) Should be considered the foundation of the audit function. c) Leads to the creation of the annual audit plan and audit budget. d) Should leverage management's enterprise risk management assessment process, if appropriate.

Match the following terms and descriptions. 1. Audit planning 2. Preventive Controls 3. System Evaluation and Selection 4. Recovery Operations Centre (ROC) 5. The Sarbanes/Oxley Act Section 404 Identify optimal solution from alternatives. Involves feasibility study and cost-benefit analysis steps. In the event of a major disaster, a subscriber can occupy the premises and, within a few hours, resume processing critical applications. The auditor's objective is to obtain sufficient information about the firm to plan the other phases of the audit. Requires the management of public companies to assess the effectiveness of their organization's internal controls Passive techniques designed to reduce the frequency of occurrence of undesirable events.