An internal auditor wants to determine whether employees are complying with the information security policy, which prohibits leaving sensitive information on employee desks overnight. The auditor checked a sample of
90 desks and found eight that contained sensitive information. How should this observation be reported, if the organization tolerates 4 percent noncompliance?

The most common motivation for management fraud is the existence of:

Which two of the following considerations must an internal auditor take into account while planning an audit of an accounting system/application that has been in use for the last five years?
The level and manner of linkages between the business' mission, objectives, and structure and the accounting system/application.
Presence or absence of computerized and manual controls that address risks.
Identification of risks at the application level, e.g. availability and security of the system.
Testing of the system/application for bugs and errors.

While preparing the annual audit plan, the newly assigned chief audit executive (CAE) learns that the organization has not yet implemented a risk framework. Which of the following would be the most appropriate action for the CAE to take regarding potential engagements?

In a sampling application, the group of items about which the auditor wants to estimate some characteristic is called the: