1. An internal auditor is concerned that fraud, in the form of payments to fictitious vendors, may exist. Company purchasers, responsible for purchases of specific product lines, have been granted the authority to approve expenditures up to $10,000. Which of the following applications of generalized audit software would be most effective in addressing the auditors concern?

a.List all purchases over $10,000 to determine whether they were properly approved.

b.Take a random sample of all expenditures under $10,000 to determine whether they were properly approved.

c.List all major vendors by product line. Select a sample of major vendors and examine supporting documentation for goods or services received.

d.List all major vendors by product line. Select a sample of major vendors and send negative confirmations to validate that they actually provided goods or services.

----

2. Which of the following statements is not true about business objectives?

a.Business objectives represent targets of performance.

b.Establishing meaningful business objectives is a prerequisite to effective internal control.

c.Establishing meaningful business objectives is a key component of the management process.

d.Business objectives are managements means of employing resources and assigning responsibilities.

----

3.Comprehensive risk assessment involves analysis of both causes and effects. Which of the following statements concerning the analysis of causes and effects is false?

a.Analyzing the causes and effects of a particular risk should only be performed after the internal auditor has first obtained evidence that a problem has occurred.

b.Analyzing the causes and effects of a particular risk provides insights about how to best manage the risk.

c.Analyzing the effects of a particular risk provides insights about the relative size of the risk and the relative importance of the business objective threatened by the risk.

d.Analyzing the root causes of a particular risk helps the internal auditor formulate recommendations for reducing the risk to an acceptable level.