IIA-CIA-Part2 IIA Practice of Internal Auditing Free Practice Exam Questions (2025 Updated)

The Chief Audit Executive (CAE) would be justified in reporting the situation to the organization's board if, in the opinion of the CAE, the level of residual risk assumed by senior management is too high (1). Even though the new process of obtaining written approval by the vice president of sales addresses the issue, if the CAE believes that the residual risk remains too high, it is their duty to report it to the board. The cost of implementing a preventive control or the compliance with the new process does not change the responsibility of the CAE to report significant residual risks to the board.

The primary objective of an internal auditor during an exit conference is to ensure that the engagement conclusions are accurate and that the facts presented in the audit report are correct. This involves discussing the audit findings with the engagement client, clarifying any misunderstandings, and ensuring that the conclusions are based on accurate and complete information.

IIA References:

IIA Standard 2440: Disseminating Results emphasizes the importance of accurate and clear communication of audit results. The exit conference is a key part of this process, ensuring that any discrepancies or concerns are addressed before finalizing the report.

The Practice Guide on Conducting Exit Conferences highlights the importance of using the exit conference to verify that the auditor’s conclusions are well-founded and that the client understands and agrees with the findings.

When planning the first audit of IT shared services, it is typical to evaluate entity-level controls first. Entity-level controls are overarching controls that affect the entire organization and are foundational for ensuring that specific application and transaction controls operate effectively. These controls include the organization's governance, risk management processes, and the overall control environment. Assessing entity-level controls provides a broad understanding of the control environment and highlights any pervasive issues that might impact more detailed areas of the audit.References: The IIA's Global Technology Audit Guide (GTAG) and COSO's Internal Control - Integrated Framework.

Preliminary communication with HR management is essential to ensure a smooth audit process. According to IIA guidance, the auditor in charge (AIC) should notify HR management before the planning stage begins to facilitate cooperation and alignment. Additionally, scheduling formal status meetings at the start of the engagement helps in setting expectations, clarifying the scope, and ensuring ongoing communication throughout the audit process. These steps foster transparency and collaboration. References:

IIA Standards - 2200: Engagement Planning

IIA Practice Advisory - 2200-1: Engagement Planning

To identify a personal conflict-of-interest situation affecting an organization’s procurement function, inspecting documents is the most effective engagement technique. This involves reviewing relevant documentation such as procurement records, conflict of interest disclosures, vendor contracts, and employee relationships with vendors. This technique provides concrete evidence and can reveal discrepancies or relationships that suggest a conflict of interest, offering a clear and objective basis for any findings.References:

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2310 - Identifying Information

Non-assurance engagements, such as consulting activities, involve providing advisory services that add value to management without the auditor expressing a formal opinion or providing assurance on the effectiveness of controls or processes.

IIA Definition of Non-Assurance (Consulting) Services:

Non-assurance services, as defined by the IIA, are advisory and related client service activities. These activities are intended to provide advice and insight into specific issues, such as potential risks in new initiatives, without the internal audit function expressing an assurance opinion.

Consulting Engagements:

In a consulting engagement, the internal audit activity provides information and recommendations to management, allowing them to make informed decisions. In this case, informing management about potential risks of moving the data warehouse to a cloud server is an advisory role, typical of a non-assurance engagement.

IIA Standard 2120 – Risk Management:

While this standard relates to risk management assurance, in a consulting role, the internal audit activity would inform management of risks, allowing them to manage these risks proactively.

Option A (Assessing effects of changes in maintenance strategy): This is more aligned with an assurance engagement where the auditor evaluates the impact of changes.

Option C (Ascertaining data center security compliance): This is an assurance activity focused on compliance.

Option D (Ensuring equipment downtime risks are managed): This implies an assurance role, as it involves verifying compliance with internal policy.

Detailed Explanation:Why Not Other Options?Conclusion: Option B is correct as it reflects a typical non-assurance engagement where the internal audit function provides advisory services on risk without providing formal assurance.

The most appropriate conclusion for the auditor to include in the audit report is that the organization had weaknesses in its review process which allowed questionable transactions with some vendors. This conclusion directly addresses the identified issue of questionable vendor documentation and implies that there are control deficiencies in the review process that need to be addressed to prevent such occurrences in the future.

An internal control questionnaire (ICQ) is a tool used by auditors to gather detailed information about the internal control system of an audited area. The primary purpose of an ICQ is to identify and assess risks that could prevent the area from achieving its objectives. By systematically covering various control points, the questionnaire helps the auditor evaluate the adequacy and effectiveness of controls in place and identify areas where controls may be lacking or need improvement.References:

The Institute of Internal Auditors (IIA) - Practice Guide: Internal Control Questionnaire

A survey with closed-ended questions can produce quantifiable evidence. Closed-ended questions limit responses to predefined options, making it easier to analyze and quantify the results. This type of survey is effective in gathering specific, comparable data from respondents.

In the context of internal auditing, activities that pose immediate and significant risks to health, safety, the environment, or that conceal inappropriate activities within an organization are of high importance and typically require formal communication to the chief audit executive (CAE). These activities could have severe legal, financial, and reputational consequences for the organization. While acts that favor one party to the detriment of another are concerning and may indicate ethical or procedural issues, they are generally considered less critical compared to the other options, as they do not necessarily imply immediate and severe risks to individuals or the organization as a whole.References:

The Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2060: Reporting to Senior Management and the Board.

IIA Practice Guide on Communicating Unacceptable Risk.

The request for new vendor information to be summarized weekly and for invoices to be flagged automatically in the processing system indicates the use of continuous auditing. Continuous auditing involves ongoing, real-time monitoring of transactions and controls, which allows for the early detection of anomalies or issues.

IIA References:

IIA Standard 2320: Analysis and Evaluation suggests that internal auditors should use appropriate technology to support their analysis. Continuous auditing tools are designed to monitor transactions continuously, enabling auditors to identify and address risks more proactively.

The Practice Guide on Continuous Auditing outlines the benefits of real-time monitoring and how it can be integrated into the audit process to enhance the timeliness and relevance of audit results.

To determine the projected misstatement for the population using ratio estimation, the following calculation can be used:

Projected Misstatement=(Sample MisstatementSample Book Value)×Population Book ValueProjected Misstatement=(Sample Book ValueSample Misstatement​)×Population Book Value

Given:

Sample Misstatement = $420,000

Sample Book Value = $12,000,000

Population Book Value = $20,000,000

Projected Misstatement=(420,00012,000,000)×20,000,000Projected Misstatement=(12,000,000420,000​)×20,000,000

Projected Misstatement=0.035×20,000,000=700,000Projected Misstatement=0.035×20,000,000=700,000

Therefore, the projected misstatement is $700,000.

The primary objective of an engagement supervisor’s review of key activities during the engagement is to ensure that all work performed meets acceptable quality standards. This includes verifying that audit procedures were appropriately executed, audit evidence is properly documented, and audit conclusions are supported. The supervisor's review is crucial for maintaining the integrity and reliability of the audit process, ensuring compliance with internal audit standards and protocols.References:

IIA Standard 2340: Engagement Supervision

IIA Practice Guide: Quality Assurance and Improvement Program

When developing the work program for an engagement reviewing an organization’s small contracting services, the chief audit executive (CAE) should consider the organization's recent changes to how it processes payments. Changes in payment processing can significantly impact the control environment and may introduce new risks or control gaps. Understanding these changes will help the CAE design appropriate audit procedures to evaluate the effectiveness of the controls over the new processes.

The chief audit executive (CAE) is responsible for the approval of the engagement objectives and scope in internal auditing. While senior management, the head of customer service, and the board of directors may provide input and have interests in the audit engagement, it is ultimately the CAE who has the final authority to approve the objectives and scope. This ensures that the internal audit activity remains independent and that the engagement aligns with the overall audit plan and organizational priorities.

Flowcharts are a valuable tool in internal auditing, particularly during the audit planning phase. They provide a visual representation of business processes, which helps internal auditors gain a comprehensive understanding of how these processes function.

Understanding Business Processes:

Flowcharts are used to depict the steps in a process, illustrating how inputs are transformed into outputs, the sequence of activities, and the points where decisions are made. This visual representation makes it easier for auditors to understand the flow of transactions, identify potential control points, and recognize areas where risks may arise.

IIA Standard 2201 – Planning Considerations:

According to this standard, internal auditors must consider the objectives, scope, and risks associated with the audit engagement during the planning phase. Understanding business processes is crucial for this, and flowcharts are an effective way to achieve this understanding.

IIA Practice Advisory 2210.A1-1:

This advisory suggests using various tools, including flowcharts, to enhance understanding of the area under review. Flowcharts help auditors see the process as a whole and identify where controls should be in place.

Option A (Understanding management's risk tolerance): Flowcharts focus on processes, not on management’s subjective risk tolerance.

Option C (Determining the size of the audit team): While flowcharts provide process insights, they do not directly inform team size decisions.

Option D (Understanding organizational objectives): Flowcharts focus on specific processes rather than high-level organizational objectives.

Detailed Explanation:Why Not Other Options?Conclusion: Option B is correct as it aligns with the purpose of flowcharts in audit planning, which is to understand business processes effectively.

According to IIA guidance, the internal audit plan should be based on an assessment of risks to the organization (1), designed to determine the effectiveness of the organization's risk management process (2), and aligned with the organization's goals (4). The development of the audit plan is typically the responsibility of the chief audit executive, often with input from senior management and the audit committee, rather than being solely developed by senior management (3). References: IIA Standard 2010 – Planning, IIA Practice Guide – Developing the Internal Audit Plan

An internal auditor's primary role is to evaluate and improve the effectiveness of risk management, control, and governance processes. To test the reliability of a customer database, the auditor would focus on identifying potential issues that could affect the accuracy and completeness of the data. This involves reviewing records, reports, and conducting data analysis to identify anomalies, inconsistencies, or patterns that suggest problems with the data. This step directly assesses the reliability of the database, which is crucial for ensuring that the information is accurate and reliable.

Physically inspecting a sample of completed processing cycles for defective products provides direct evidence of the effectiveness of the quality control process. This method allows the internal auditor to observe firsthand whether defective products are being identified and removed prior to shipment, ensuring that the process operates as intended. This approach is more reliable than survey results or management reports, which may be subject to bias or inaccuracies.

Reviewing survey results (A) relies on subjective employee opinions, which may not reflect actual process effectiveness.

Observing employees during inspections (C) provides insight into the process but does not confirm whether defective products are consistently removed.

Reviewing a management report (D) depends on the accuracy of the reported data, which may not be independently verified.