IIA-CIA-Part2 IIA Practice of Internal Auditing Free Practice Exam Questions (2025 Updated)

A risk that is deemed "unacceptable" to the organization is one where the residual risk (the remaining risk after controls are applied) exceeds the organization's risk tolerance level. This means that despite controls in place, the level of risk remains higher than what the organization is willing to accept. Identifying such risks is critical for ensuring appropriate management action to mitigate them further. References:

The IIA’s Practice Guide on Risk Management.

COSO’s Enterprise Risk Management – Integrating with Strategy and Performance.

To obtain a responsive action plan from management, the auditor is most likely to achieve this when both parties agree on the "Effect" attribute of the audit finding. The "Effect" refers to the impact or potential impact of the identified issue on the organization's operations, objectives, or risk profile. When management and the auditor agree on the significance and consequences of the finding, there is a shared understanding of the urgency and importance of addressing the issue. This alignment increases the likelihood that management will develop and commit to an effective action plan to remediate the finding.

IIA Practice Guide: "Formulating and Expressing Internal Audit Opinions"

COSO Internal Control – Integrated Framework

When an internal auditor identifies a potential control deficiency based on a preliminary survey, such as the lack of established procedures for adding and approving new vendors, the next appropriate step is to gather more detailed information. Interviewing personnel involved in the accounts payable function allows the auditor to understand the context, confirm the accuracy of the questionnaire responses, and gain insights into the potential risks and impacts associated with the observed deficiency. This step is crucial before documenting the issue or planning further audit procedures to ensure the information is accurate and complete.

The IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2201 - Planning Considerations.

Management's use of judgment in designing, implementing, and conducting internal control is crucial for adapting to unique circumstances and complexities within an organization.

Enhanced Decision-Making: Judgment allows management to tailor controls to the specific risks and operational realities of the organization, improving overall effectiveness.

Limitations: While judgment improves decision-making, it cannot eliminate all risks or guarantee perfect outcomes due to inherent uncertainties and limitations in predicting all possible scenarios.

Appropriate Use: It is appropriate for management to use judgment in applying accounting principles and assessing internal controls' presence and functioning.

Inappropriateness: It would be incorrect to say that judgment diminishes decision-making capabilities or is inappropriate for assessing internal control components.

According to IIA guidance, heat maps are tools used in risk assessment that visually represent the severity of risks by plotting them on a matrix based on their likelihood and impact. Heat maps are flexible and can be adjusted to prioritize either likelihood or impact depending on the specific context and the organization’s risk appetite and tolerance. This recognition that the priority of impact and likelihood can vary allows for a more nuanced and tailored risk assessment approach.

IIA Practice Guide: Assessing the Risk Management Process

IIA Standard 2120: Risk Management

A quality assurance and improvement program (QAIP) established by the chief audit executive (CAE) should ensure that the internal audit activity (IAA) adheres to the International Standards for the Professional Practice of Internal Auditing (Standards) and the IIA Code of Ethics. It should also aim to add value and improve the organization's operations. This comprehensive approach ensures that the internal audit function is not only compliant but also effective in enhancing the overall governance, risk management, and control processes within the organization.

IIA Standard 1300: Quality Assurance and Improvement Program.

IIA Standard 1320: Reporting on the Quality Assurance and Improvement Program.

According to IIA guidance, risk assessment is a critical step that precedes the development of audit engagement objectives. The risk assessment process helps internal auditors identify the key areas of risk within the organization, which then informs the setting of appropriate objectives for the audit engagement.

IIA Standard 2201 – Planning Considerations:

This standard requires internal auditors to consider risk when planning an engagement. The risk assessment process identifies the areas of highest risk, which allows the auditor to focus on the most critical issues during the engagement.

Role of Risk Assessment:

By assessing risks, the auditor can determine which processes or controls are most likely to affect the achievement of the organization’s objectives. This understanding is essential for setting the audit engagement’s objectives, ensuring that they are aligned with the areas of greatest concern.

IIA Practice Advisory 2210.A1-1:

The advisory suggests that auditors should use the results of the risk assessment to establish the scope, objectives, and priorities of the engagement. Without this risk assessment, the audit objectives may not fully address the most significant risks.

Option A (Identification of controls): This typically occurs after the objectives are set, as controls are evaluated based on the identified risks.

Option B (Scope establishment): The scope is determined after the objectives are set, which are based on the risk assessment.

Option D (Review of resources): This step is related to the allocation of resources after the objectives and scope are defined.

Detailed Explanation:Why Not Other Options?

A. Vouching vendor invoices to payments made:This verifies payment accuracy but does not confirm whether purchases were authorized.

B. Sorting invoices by purchase orders and comparing for successive duplicate invoices:This approach focuses on detecting duplicate invoices, not authorization.

C. Comparing a random sample of vendor invoices to purchase orders:Correct. This method directly matches invoices to purchase orders, confirming that purchases were authorized and appropriately documented.

D. Sorting payments by invoice to detect successive duplicate invoices:Similar to option B, this approach focuses on detecting duplicates rather than verifying authorization.

CIA Exam Syllabus Reference:

Domain V: Performing Internal Audit Services – Testing for Authorization and Validity.

During an inventory audit, the activity that would most benefit from the use of computerized audit tools (CAATs) is valuating the obsolete inventory from all the warehouse locations. CAATs can efficiently analyze large volumes of inventory data from multiple warehouses, identify patterns and trends, and automate the valuation process, making it more accurate and less time-consuming compared to manual methods.

IIA Standards: 1210.A3 - Proficiency in the Use of CAATs

IIA Practice Guide: Use of Technology in Auditing

Retained earnings represent the cumulative profits reinvested in the organization rather than distributed as dividends. They reflect the organization’s ability to generate resources internally, supporting working capital, expansion, and long-term sustainability.

Option A is incorrect: retained earnings are not the same as dividends.

Option B is incorrect: retained earnings are not equal to excess cash.

Option D is incorrect: rating agencies use broader financial measures, not retained earnings alone.

Thus, the best explanation is Option C: retained earnings show that the organization has been able to generate and reinvest resources from its own operations.

 Supervision in Internal Audit: Effective supervision ensures that the engagement is carried out according to plan, objectives are met, and quality standards are maintained. It involves guiding, mentoring, and reviewing the work of auditors throughout the engagement.

 IIA Standards:

Standard 2340 – Engagement Supervision: Internal audit engagements must be properly supervised to ensure objectives are achieved, quality is maintained, and staff are developed.

Proper supervision includes overseeing the engagement, providing direction, and ensuring that work complies with standards and achieves engagement objectives.

 Examples of Proper Supervision:

Reasonable Assurance: The auditor in charge providing reasonable assurance that engagement objectives were met is a fundamental aspect of effective supervision. It ensures that the engagement delivers the intended outcomes and adheres to quality standards.

Daily Records and Workpaper Review: Options A and B involve administrative tasks and peer review, which are supportive but do not alone constitute comprehensive supervision.

Accompanied Training: Option C involves on-the-job training, which is beneficial but not the primary aspect of engagement supervision.

According to the IIA's Standards, specifically Standard 1210 - Proficiency, internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. If the internal audit activity lacks the necessary skill set to conduct a requested consulting engagement, the most appropriate action for the CAE is to decline the engagement request. This ensures that the internal audit activity does not compromise the quality and effectiveness of its services.

When identifying specific processes to include in the scope of an assurance engagement, the most useful information for an internal auditor is recent area performance indicators against productivity metrics. This data helps the auditor identify areas with potential risks or inefficiencies that might warrant further examination.

IIA Standard 2200 – Engagement Planning:

This standard requires auditors to develop a plan for each engagement, including objectives and scope, based on a thorough understanding of the area under review. Performance indicators provide valuable insights into areas that may not be meeting productivity or efficiency targets.

Use of Performance Indicators:

Performance indicators allow the auditor to identify processes that may be underperforming or where there may be significant variances from expected outcomes. This helps in focusing the audit on areas with the greatest potential for improvement or risk.

IIA Practice Advisory 2201-2:

The advisory suggests that auditors should consider using performance data, such as productivity metrics, to determine where to focus their audit efforts. This data-driven approach ensures that the audit is relevant and adds value.

Option A (Recognition awards): Awards do not provide insight into risks or underperformance that might require audit attention.

Option B (Timing of the last audit): While useful, the timing alone does not indicate current risks or issues.

Option C (Management's presentation): This may provide some insights, but it is often more narrative and less data-driven than performance indicators.

Detailed Explanation:Why Not Other Options?Conclusion: Option D is correct because recent performance indicators against productivity metrics provide the most relevant information for identifying processes to include in the scope of an assurance engagement, ensuring that the audit is focused on areas of significant risk or opportunity for improvement, in line with IIA standards.

The IIA Code of Ethics sets forth principles and expectations for ethical behavior in internal auditing, particularly regarding the communication of results.

Integrity and Transparency: According to the IIA Code of Ethics, internal auditors are expected to exhibit integrity and transparency in their reporting, ensuring that material facts are disclosed accurately to avoid misrepresentation.

The risk-factor approach involves developing a list of internal and external risk considerations, creating a scale to assess each risk, and allocating the relative importance of each risk. This approach allows the auditor to systematically evaluate risks based on predefined criteria and weightings, ensuring a comprehensive risk assessment across the organization’s processes.

An assurance map is a tool that provides a visual representation of the coverage of risks by various assurance providers. It supports the auditor's decision by showing which risks are being addressed by internal audit and other functions, and which risks are not being tested. This can help justify the auditor's decision not to test a particular risk, by demonstrating that it has already been covered or deemed low priority. References:

"Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)

"Creating an Assurance Map" (IIA Practice Guide)

According to IIA guidance, if the internal audit team lacks the necessary skills and knowledge to perform an audit, the CAE should consider obtaining external expertise. Accepting the engagement and hiring an external expert allows the internal audit activity to leverage specialized knowledge while fulfilling the audit request. This approach ensures that the audit is conducted effectively and meets the required standards, while also addressing any competency gaps within the internal audit team.

Institute of Internal Auditors (IIA) Standards: Attribute Standards 1210: Proficiency

IIA Practice Guide: Obtaining External Assistance in the Conduct of Internal Auditing

When employees continue to violate segregation-of-duty controls despite previous recommendations, the most effective approach is to recommend appropriate awareness training. This training can help employees understand the importance of these controls and how to comply with them, addressing the root cause of the violations. References: = IIA Standard 2130 - Control and IIA Practice Guide: “Auditing Segregation of Duties”.

At the planning stage, auditors must organize and structure their work to ensure all necessary steps are covered. A checklist is the appropriate tool, as it provides a systematic list of tasks, reduces oversight, and helps manage workload. A control questionnaire (C) is used for assessing controls, and a fishbone diagram (D) is used for root cause analysis, not task management. Option A is irrelevant to planning execution.

Promoting objectivity in internal auditing involves ensuring that auditors avoid conflicts of interest and maintain independence in both fact and appearance. Policies that clearly define and give examples of inappropriate business relationships help auditors understand and avoid situations that could impair their objectivity.

IIA Standard 1120 (Individual Objectivity) emphasizes the importance of internal auditors maintaining an unbiased mindset and avoiding conflicts of interest.

A. To provide a status update on a short engagement to management of the area under review and to the audit supervisor:While useful, this is not the primary purpose of issuing interim reports.

B. To confirm agreement with preliminary observations and conclusions identified during the engagement:Interim reports are not primarily for reaching agreement but for prompt communication of actionable items.

C. To provide those responsible for the area under review with the opportunity to act on certain observations immediately:Correct. Interim reports are issued when there are observations that require immediate action or management’s attention before the final report is issued.

D. To verify that the corrective actions required by senior management are completed as agreed:Verifying corrective actions occurs after final recommendations are implemented, not through interim reporting.

CIA Exam Syllabus Reference:

Domain V: Performing Internal Audit Services – Reporting and Communication.

Introduction:

Heat maps are tools used in risk management to visualize the impact and likelihood of risks.

Limitations of Heat Maps:

Despite their usefulness, heat maps have several limitations, including difficulties in prioritizing risks when impact and likelihood are closely matched.

Options Analysis:

Option A: Impact can be represented qualitatively as well, not just in financial terms.

Option B: Differentiating the relative importance of impact versus likelihood can be challenging, leading to potential misinterpretation of risk priorities.

Option C: Heat maps can be used without a risk and control matrix, although such a matrix enhances their effectiveness.

Option D: Qualitative factors can be incorporated into heat maps, adding depth to the analysis.

Conclusion:

The limitation of a heat map is that at times, impact and likelihood cannot be differentiated as to which is more important, making it difficult to prioritize risks accurately.

Internal Audit Standards and Practice Guides .

Developing a tracking system to monitor the status of engagement recommendations ensures that the chief audit executive (CAE) can systematically track the progress and implementation of corrective actions. This approach provides continuous assurance that recommendations are being acted upon and allows the CAE to identify and address any delays or issues in the implementation process. It is a proactive strategy that enables regular follow-ups and reporting to senior management, thus maintaining accountability and transparency.

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2500 - Monitoring Progress

One of the primary drawbacks of using internal control questionnaires is the risk that management may not provide honest or accurate answers. This can occur due to a variety of reasons, including a lack of knowledge, intentional deception, or a misunderstanding of the questions. As a result, the responses may not accurately reflect the true state of the controls, leading to incomplete or misleading audit conclusions.

The Institute of Internal Auditors (IIA) Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000

IIA Standard 2310 - Identifying Information

The International Standards for the Professional Practice of Internal Auditing encourage auditors to acknowledge satisfactory performance to provide a balanced report. However, it is not a mandatory requirement. Including positive observations can help foster a constructive relationship with management and provide a more balanced view of the audited area.

The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards)

"Internal Auditing: Assurance and Advisory Services" by Urton L. Anderson et al.

The organization and content of workpapers should be based on the professional judgment of the internal auditor. Workpapers should provide sufficient detail to support the audit findings and conclusions but do not need to answer every conceivable question. Standard 2330 – Documenting Information states that internal auditors must document relevant information to support the conclusions and engagement results. This allows for flexibility and professional judgment in determining what is necessary and appropriate to include.

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2330 – Documenting Information.

According to the IIA Standards, particularly in the context of risk management consulting, internal audit activities may provide risk management consulting services under specific conditions. These conditions include:

There is a clear strategy and timeline to migrate risk management responsibility back to management.This condition ensures that the internal audit's involvement in risk management is temporary and transitional, emphasizing the principle that management retains ultimate responsibility for risk management.

The nature of services provided to the organization is documented in the internal audit charter.This condition ensures transparency and clarity about the internal audit's role in risk management, as outlined in the internal audit charter. This documentation is essential for defining the scope and limitations of the internal audit's consulting role.

In contrast, options 2 and 3 are inappropriate under the Standards:

The internal audit activity has the final approval on any risk management decisions (Option 2): This would compromise the independence and objectivity of the internal audit function, as internal auditors should not make management decisions.

The internal audit activity gives objective assurance on all parts of the risk management framework for which it is responsible (Option 3): This creates a conflict of interest because internal auditors cannot objectively audit areas where they have direct responsibility.

IIA References:

IIA Standard 2050: Coordination and Reliance emphasizes that internal audit should not assume management responsibilities, including final risk management decisions, to maintain objectivity and independence.

IIA Standard 1000: Purpose, Authority, and Responsibility and related guidance stress the importance of documenting the internal audit’s role in the audit charter, especially when the internal audit is involved in consulting activities like risk management.

The initial step the CAE should take is to discuss the issue with the members of management responsible for the risk area. This discussion allows the CAE to understand the reasons for the lack of action, provide an opportunity for management to explain their position, and encourage them to implement the necessary mitigation measures. If this discussion does not lead to satisfactory action, the CAE would then escalate the issue to senior management or the board as appropriate.

The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards)

"Internal Auditing: Assurance and Advisory Services" by Urton L. Anderson et al.

When proposing interim changes to the annual audit plan due to emerging risks, the most appropriate action for the CAE is to communicate with the CEO and present the revised audit plan to the board for approval. This ensures that senior management is informed and supportive of the changes, and that the board, which holds the ultimate oversight responsibility, formally approves the revised plan. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2020 - Communication and Approval.

The IIA’s Practice Guide on Engagement Planning.