A senior auditor in an organization with a well-established risk management program is planning an audit of the accounts payable department. According to IIA guidance, which of the following strategies would be the most effective way to help ensure all key controls are managed effectively?

a. Conduct facilitated sessions with business process users to identify key controls

b. Obtain the prior years work program and compare the key controls previously identified

c. Review managements identification and assessment of key controls for adequacy

d. Engage IT audit resources to ensure key system controls are identified

An organization requires all employees to furnish the payroll department with a bank account number to be used for direct deposit of their biweekly pay. During an audit of the payroll system, an internal auditor most likely would sort the payroll file by bank account number to identify which of the following?

1. Invalid account numbers

2. Unauthorized changes to individual accounts

3. Fictitious employees

4. Excessive individual pay amounts

a. 1 and 2

b. 1 and 3

c. 2 and 4

d. 3 and 4