OpAudCh03 CBET 01 501E Toralde, Ma - Kristine E.
OpAudCh03 CBET 01 501E Toralde, Ma - Kristine E.
CBET-01-501E
1. What are the benefits of the internal audit function establishing a risk-based plan when
identifying the priorities of the internal audit activity?
2. Describe three ways that internal auditors can better identify the risks related to the
area under review.
There are multiple templates and lists available, often organized by industry.
COSO, ISO, Information Technology Infrastructure Library (ITIL), CVNET, and
others have prepared lists that can help to identify some of the key risks that should
be included in the assessment.
Some of the common risks that operational auditors should consider during
their risk assessments. Not all risks are applicable to every organization because
differences in industry, business activities, geographic location, and size of
organization make a difference. In addition, when performing operational reviews,
auditors must examine a wider assortment of risks, and not just financial ones.
3. What are three internal and three external factors affecting a typical organization? How
do these factors affect the future prospects of the organization?
Internal
Equipment.
The types of equipment available and the ways they are used limit the ability
of the process to produce more high quality goods and deliver services.
People.
Lack of skilled and motivated workers limits the productive capacity of any
process. Attitudes and other mental models (e.g., feeling defeated,
victimized, or hopeless) embraced by workers can lead to behaviors that
become a constraint on the process.
Policies.
Written and unwritten policies can prevent the process from producing more
of higher quality goods and services.
External
Economic.
Natural environment.
Technological factors.
Management must look into the past and the future to identify trends,
shifting demographics, new markets, and competitor activities, among others. In
many cases, these events are influenced by technological changes, economic
development, increases in literacy levels, higher education attainment, natural
events (e.g., floods and hurricanes), and demographic changes.
4. Describe an event that has transformed or disrupted an industry and include: (1) An
example of an organization that benefited from that opportunity and (2) an example of
another organization that mismanaged it and suffered losses as a result.
Events can have either a positive or negative impact representing risks and
opportunities. A warehouse without a fire sprinkler system could suffer a total loss,
or at least far more extensive damage than a building with a fire sprinkler system
that is professionally designed, installed, maintained, and inspected regularly.
5. List three organizations that provide lists of common vulnerabilities useful during a risk
assessment.
CSAs require managers to think about the design and condition of their areas
of responsibility, and assess the presence and quality of the related controls.
They consist of questionnaires and other forms that process owners complete
that identify the major activities in their programs and processes, the objectives,
risks and controls, the individuals that perform key tasks and controls, and the
major challenges affecting these programs and processes.
The information captured during the CSA process should also be subject to
audit review and comparison between what the process owner indicated in the
forms and what the internal audits identify in terms of risk and control effectiveness.
Discrepancies should be analyzed and discussed with the corresponding manager
and the initial assessment updated.
7. Describe three risks that are unique to each of the following two manufacturing
approaches: made to order (MTO) and made to stock (MTS).
Make to Order (MTO) is manufacturing product after the order is received. The
risk in this kind of manufacturing strategies is for example, there’s a lot of order
and there is a bottleneck or a slowdown in the steps of manufacturing that result
to inefficiency of production. Another risk is managers should have a reliable
suppliers, because if the supplies is not present in the time there’s an order it will
result to long cycle time and that decreases the customer satisfaction.
Made to Stock (MTS) products are manufactured in advance. The risk in this
kind of manufacturing strategies is for example, since the production is based on
demand forecast, it should accurate there will be a problem if the forecast is not
accurate. Another risk if for example you use past information to make forecast
and you thought it was accurate but because of unpredictable nature of consumer
trends it can be different.
8. Explain why internal auditors should consider bottlenecks, long cycle times,
redundancies, and reprocessing as operational risks.
9. What are the risk implications of outsourcing? Explain why management must remain
vigilant even if a process and related activities have been outsourced to another
organization.
10. What are some of the practices expected of organizations to fight corruption and
support efforts to decrease institutional corruption?