A bakery chain has a statistical model that can be used to predict daily sales at individual stores
based on a direct relationship to the cost of ingredients used and an inverse relationship to rainy
days. What conditions would an internal auditor look for as an indicator of employee theft of food
from a specific store?

In addition to the internal auditor, which of the following parties should be present at an exit or
closing conference?
1. Audit committee members.
2. The external auditor.
3. The management responsible for the areas covered by the engagement.
4. The chief executive officer.

During an audit of a contract for computer security, a governmental auditor finds that a contractor
has developed a system that could be the most advanced in the industry. If it seems that the
contractor is charging the government for developmental cost of a system that might be sold to
other organizations, what is the auditor's best course of action?

A company has recently incurred significant cost overruns on one of its construction projects.
Management suspects that these overruns were caused by the contractor improperly accounting
for costs related to contract change orders. Which of the following procedures would be
appropriate for testing this suspicion?
I. Verify that the contractor has not charged change orders with costs that have already been billed
to the original contract.
II. Determine if the contractor has billed for original contract work that was canceled as a result of
change orders.
III. Verify that the change orders were properly approved by management.

The use of standard operating procedure questionnaires in audit fieldwork can be beneficial
because.

New credit policies have been implemented in an automated order-entry system to improve the
collection of receivables. Sales management has compiled several examples that show decreased
sales and delayed order entry, and contends that these examples are a direct result of the new
credit-policy constraints. Sales management's data and information provide.

While reviewing the draft report of an audit engagement, the chief audit executive (CAE) is not in
agreement with management's acceptance of the potential risk exposure resulting from an
observed key control weakness. Which of the following actions by the CAE would be appropriate
for addressing this concern?
• Meet with the auditor-in-charge.
• Discuss with senior management.
• Monitor the result of the accepted risk.
• Report the matter to the board.

During a systems development audit, software developers indicated that all programs were moved from the development environment to the production environment and then tested in the
production environment. What should the auditor recommend?
I. Implement a test environment to ensure that testing is not performed in the production
environment.
II. Require developers to move modified programs from the development environment to the test
environment and from the test environment to the production environment.
III. Eliminate access by developers to the production environment.