IIA-CIA-Part1 IIA Internal Audit Fundamentals Free Practice Exam Questions (2026 Updated)

Including NGO members on an assurance team when auditing corporate social responsibility adds credibility to the audit findings, particularly when these findings are positive. NGOs are generally perceived as independent and dedicated to public interest, which can enhance the perceived impartiality and trustworthiness of the audit results in matters related to social responsibility.

Institute of Internal Auditors (IIA) - Advisory on Assurance Engagement for Corporate Social Responsibility

In the context of an assurance engagement, the auditor determines the scope of the engagement during the planning phase, which includes identifying the specific areas to be reviewed. In this case, if the engagement included a review of the security and privacy of payroll records, it means that during the planning phase, the auditor identified this area as part of the engagement scope. This step is crucial to ensure that the engagement objectives are met and that all relevant risks and controls are evaluated.

The IIA Standards: Standard 2200 – Engagement Planning: " Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. "

The IIA Practice Guide: " Engagement Planning: Establishing Objectives and Scope " : Emphasizes the importance of defining the scope during the planning phase.

Given the restrictions on in-person contact due to the global health crisis, a virtual meeting with management to discuss the automobile production process is the most direct and interactive alternative. This approach would allow the internal auditors to ask real-time questions and get insights directly from those who manage and understand the production process, thus compensating for the inability to conduct onsite inspections.

Institute of Internal Auditors (IIA) - Guidance on Alternative Training Methods during Disruptions.

The role of the board in organizational governance most accurately involves the responsibility for the outcome of the process. This encompasses overseeing the strategic direction of the organization, ensuring that corporate objectives are met, and that the management’s activities align with the overall strategic vision and risk appetite of the organization. The board ' s oversight role is crucial in ensuring effective governance and accountability throughout the organization.

The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

===============

The IIA guidance specifies that the chief audit executive (CAE) should communicate the results of the quality assurance and improvement program (QAIP) to senior management and the board. This includes providing a written conformance statement that indicates whether the internal audit activity conforms to the IIA’s International Standards for the Professional Practice of Internal Auditing. This practice ensures transparency and accountability in the internal audit function and helps stakeholders understand the level of adherence to professional standards.

IIA Standard 1320: Reporting on the Quality Assurance and Improvement Program

IIA Practice Guide: Quality Assurance and Improvement Program

The Global Reporting Initiative (GRI) is the most effective resource for an organization looking to improve how it informs stakeholders of its social responsibility performance. The GRI provides a comprehensive set of standards for sustainability reporting, which includes guidelines on how to communicate social responsibility efforts transparently and effectively to stakeholders.

Global Reporting Initiative (GRI) standards; literature on sustainability reporting.

Segregating duties between code development and migrating changes into production is a critical control to prevent fraudulent activities by developers. This control ensures that no single individual has the ability to develop code and deploy it to the production environment without oversight. Key benefits include:

Reducing the risk of unauthorized or malicious code changes.

Ensuring that changes are reviewed and tested by a different team before deployment.

Increasing accountability and transparency in the software development lifecycle.

By implementing this control, organizations can prevent developers from committing fraud or making unapproved changes to the ERP system, thereby protecting the integrity and security of the system.

The Institute of Internal Auditors (IIA) Standards and Practice Advisories.

COBIT (Control Objectives for Information and Related Technologies) framework.

" Internal Auditing: Assurance & Advisory Services " by IIA, Chapter on IT General Controls and Segregation of Duties.

Internal auditors can indeed provide assurance on reported sustainability results. This involves evaluating the accuracy and completeness of an organization ' s sustainability reporting and verifying that the reported information reflects actual performance. This role aligns with the broader assurance and advisory functions of internal audit, ensuring that CSR disclosures are reliable and credible.

The Institute of Internal Auditors (IIA) Standards and Practice Advisories.

Global Reporting Initiative (GRI) Standards.

" Internal Auditing: Assurance & Advisory Services " by IIA, Chapter on CSR and Sustainability Reporting.

Consulting engagements often involve providing advice or opinions at management ' s request. In this case, providing input on the accounting pronouncements falls under a consulting capacity, consistent with IIA definitions of consulting services​​.

According to IIA guidance, the chief audit executive (CAE) must obtain competent advice and assistance if the internal audit activity lacks the knowledge, skills, or other competencies needed to complete the audit engagement. This ensures that the internal audit activity can effectively carry out its responsibilities by supplementing its capabilities where necessary to maintain quality and effectiveness.

IIA Standard 1210 - Proficiency

Applying due professional care in planning an assurance engagement includes assessing the risks involved in the engagement area. An assessment of the risk of noncompliance with laws and regulations directly addresses the potential legal and regulatory exposures that could significantly impact the organization. This risk assessment helps ensure that the audit plan is appropriately focused and aligned with key risks, demonstrating due professional care.

IIA standards on planning, which stipulate that due professional care includes an appropriate risk assessment.

According to The IIA ' s Core Principles for the Professional Practice of Internal Auditing, one of the key principles is that internal auditors should be objective and free from undue influence (independence). The correct option that aligns with these principles is B, where final reports from consulting engagements provide a summary of findings and ensure that the auditor’s advice is distinctly separated from management ' s decisions. This separation supports the principle of objectivity and avoids conflicts of interest, which is fundamental in upholding the integrity and independence of the internal audit function.

The IIA ' s Core Principles for the Professional Practice of Internal Auditing

According to the Standards, internal audit professional development plans must ensure that staff development activities are based primarily on the skills and competencies needed to complete the audit plan. This requirement ensures that the internal audit staff possesses the necessary expertise and capabilities to effectively carry out the planned audit activities.

IIA Standards related to Continuing Professional Development and Staff Proficiency.

The most effective type of fraud test for looking for possible fictitious vendors would be running checks to uncover post office box addresses that match employee addresses. This test directly targets a common tactic used in vendor fraud schemes, where employees might set up fictitious vendor accounts and direct payments to themselves via P.O. boxes.

IIA resources on auditing for fraud, which often discuss various methods for detecting fictitious vendors, including address comparisons.

Evaluating organizational culture requires insights into ethics, values, and behavior. The combination of the ethics policy, structured employee interviews, and communicated organizational values provides a comprehensive view, as recommended by IIA standards for governance audits​​.

The role of internal control frameworks, such as COSO, is to provide guidance related to internal control design and implementation. They assist organizations in evaluating and benchmarking their business practices (Option B). These frameworks do not prescribe specific controls but offer principles and guidelines to help organizations design effective internal control systems tailored to their unique circumstances. This approach enables organizations to achieve their business objectives while managing risks effectively.

COSO Internal Control - Integrated Framework

IIA Standards, Standard 2130: Control

To prevent situations where an internal auditor’s impartiality could be questioned, it is essential to have a process in place that requires auditors to disclose any potential conflicts of interest. This helps to identify and address any relationships or circumstances that might compromise, or appear to compromise, the auditor’s objectivity and independence. Ensuring that such disclosures are made before assignments are accepted can prevent conflicts of interest from affecting the audit process.

IIA Code of Ethics: Objectivity Principle

IIA Standard 1120: Individual Objectivity

The IIA ' s mission for internal audit emphasizes the role of internal audit in enhancing and protecting organizational value by providing risk-based and objective assurance, advice, and insight. Assessing the effectiveness of internal controls over organizational assets directly aligns with this mission as it focuses on providing assurance on the control environment and operational effectiveness, which are crucial for protecting assets and ensuring reliable financial reporting and compliance.

The Institute of Internal Auditors (IIA) - Mission of Internal Audit

The board of directors is responsible for setting the risk appetite of the organization. They define the level and type of risk the organization is willing to accept in pursuit of its goals and objectives. This strategic role ensures that the organization ' s risk management framework aligns with its long-term vision and governance structure.

IIA guidance on governance and risk management

According to IIA guidance on the quality assurance and improvement program:

Monitoring of the internal audit activity’s performance must indeed be ongoing to ensure continuous improvement.

All aspects of the internal audit activity should be evaluated, not just selected parts.

IIA Standard 1300 - Quality Assurance and Improvement Program

Comparing vendor addresses to employee addresses is a common audit test to detect fictitious invoices. Fictitious invoices are often created by employees who use their addresses or addresses of associates as vendor addresses to facilitate fraud.

Option B: Matching cancelled checks to invoices ensures payment was made but does not specifically detect fictitious invoices.

Option C: Searching for duplicate payments addresses duplicate invoices but not necessarily fictitious ones.

Option D: Checking employee bank records could indicate fraud but is invasive and less direct than comparing addresses.

IIA Practice Guide: Fraud Detection.

COSO Fraud Risk Management Guide.

The qualifications of the assessors must be communicated to the board. This requirement ensures that the board is aware of the credibility and expertise of the external assessors, affirming that the quality assurance review is conducted by professionals with the necessary skills and experience. This is crucial for maintaining trust in the QAIP process and its outcomes.

IIA Standard on Quality Assurance and Improvement Program

===============

According to IIA guidance, any additional roles beyond traditional audit functions, such as being responsible for risk management and investigation, must be explicitly defined in the internal audit charter. This document, approved by senior management and the board, delineates the scope and responsibilities of the internal audit function, ensuring clarity and proper governance. Thus, if the internal audit charter stipulates such roles, it justifies the CEO’s decision.

IIA Standard 1000 - Purpose, Authority, and Responsibility

Internal auditors must remain independent and should not take on management responsibilities. Prioritizing risks for management crosses this line and constitutes assuming a management role, which compromises the auditor ' s independence and objectivity. References:

IIA Standard 1112 - Chief Audit Executive Roles Beyond Internal Auditing.

IIA Standard 1100 - Independence and Objectivity.

The current state of conformance with the Standards for the internal audit activity would be considered as " Nonconformance with the Standards. " This assessment is based on the most recent internal assessment, which showed nonconformance. According to IIA standards, the results of the latest quality assurance review are critical in determining conformance, and any finding of nonconformance indicates that the internal audit activity currently does not meet the Standards, despite previous external assessments to the contrary.

IIA Standard 1300: Quality Assurance and Improvement Program and related interpretation guidelines.

The authority of the internal audit activity, as outlined in the audit charter, includes having full access to the organization ' s records, physical property, and personnel necessary to conduct audit engagements. This access is critical for the internal audit activity to perform its duties effectively and independently, ensuring that auditors can obtain the information and resources they need to evaluate the organization ' s processes and controls comprehensively.

The IIA Standards: Standard 1000 – Purpose, Authority, and Responsibility: " The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter... The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval. "

The IIA Practice Guide: " Understanding the Importance of the Internal Audit Charter " : Emphasizes the necessity for the internal audit activity to have unrestricted access to organizational records, property, and personnel.

The most mature level of corporate social responsibility (CSR) is demonstrated by organizations that engage in proactive behaviors that exceed legal and economic requirements without expecting direct financial benefits in return. This includes making voluntary contributions to the community or environmental efforts that are not mandated by law or economic considerations, reflecting a commitment to ethical principles and long-term social and environmental sustainability.

Theoretical frameworks on CSR maturity levels, which emphasize voluntary actions for the greater good as the highest level of CSR maturity.

If a new internal auditor suspects fraud, the appropriate action is to document supporting information and recommend an investigation to the appropriate audit management, such as the chief audit executive (CAE). This approach maintains the auditor ' s objectivity and ensures that suspicions of fraud are handled by following the proper channels and procedures established within the organization for such matters.

IIA guidance on fraud and the auditor ' s role in fraud detection, which emphasizes the importance of documenting evidence and escalating fraud concerns through proper management channels.

According to IIA standards, assurance services are expected to be included in the risk-based audit plan as they are integral to the systematic evaluation and improvement of risk management, control, and governance processes. Consulting services, however, are typically requested by management and do not necessarily follow the structured inclusion in the risk-based plan, reflecting their more flexible and situational nature.

The IIA ' s International Standards for the Professional Practice of Internal Auditing, particularly distinctions between assurance and consulting activities.