Reference no: EM133417030
Question 1) At lunch during an IIA ERP (Enterprise Resource Planning) conference, an internal auditor discusses with the seven people at his table their experiences with ERP software implementations at their respective companies. At his company, the ERP implementation is still in progress. Would discussing this information be considered a violation of the Code of Ethics?
Question 2) The in-charge auditor is conducting a meeting with a VP and her staff at the end of the audit. The VP does not believe one of the findings is factually correct. The VP is upset about it and requests this finding not appear in the final audit report. Would it be appropriate to comply with the VP's request?
Question 3) The in-charge auditor is conducting a meeting with a VP and her staff at the end of the audit. For one of the audit comments, the VP asks if the audit can "write it differently since this is a very sensitive issue." Would it be appropriate to comply with the VP's request?
Question 4) The internal audit is doing a follow-up audit to verify that all corrective actions promised in the initial audit have been implemented. The internal audit found that one material audit issue has not been thoroughly addressed. Management's response is, "We probably could do more to remediate that issue, but it would take resources away from our other projects, which we deem to be more important. Also, we believe the corrective actions implemented thus far are good enough." Would it be appropriate for the internal audit to accept management's explanation and close the comment? (I suggest referring to Attribute Standards 2500 and 2600 in addition to the Code of Ethics.)
Question 5) After every audit, a survey about the audit work is sent to key management involved. 10% of each auditor's annual bonus is determined based on the results of these surveys. Does this practice violate the Code of Ethics?
Question 6) An internal auditor is assigned to work on an application security audit of NetSuite (an extensive ERP application). The auditor has done several application security audits but has no experience with NetSuite. The audit will be starting in two weeks. Should the auditor be allowed to participate in the audit?