6) In the Three Lines of Defense Model, the primary responsibility for managing risks belongs to

A) The CEO

B) Internal auditing

C) The risk management function

D) Operational management

E) The board of directors

7) Which of the following components of the IPPF is not considered to be mandatory?

A) The Code of Ethics

B) Definition of Internal Auditing

C) Implementation Guidance

D) Mission of Internal Auditing

E) Standards

8) Which of the following best describes internal auditings primary purpose in reviewing the organizations existing governance, risk management and controls processes?

A) To ensure all weaknesses in the internal control system are corrected

B) To develop the audit plan

C) To provide reasonable assurance that the processes will enable the organizations

objectives and goals to be met

D) To offer an opinion as to whether the financial statements are fairly stated

E) To comply with the IPPF Code of Ethics

9) Which of the following is true about internal vs. external auditing?

A) External auditors and internal auditors are prohibited from sharing information

B) The tool and techniques used by internal and external auditing are different

C) Both follow the same code of ethics

D) Internal auditing is less focused on the financial statements than external auditing

E) All of the above

10) In which situation does the internal auditor lack objectivity?

A) The internal auditor recommends standards of performance for an outsourcing contract

B) The internal auditor discusses the status of a system implementation over lunch at a vendor conference

C) The internal auditor provides assurance services for a function in which the auditor had responsibility for eleven

months ago.

D) The internal auditor reviews audit findings with the CAE prior to issuing the final audit report

E) All of the above