IIA-CIA-Part2 IIA Internal Audit Engagement Free Practice Exam Questions (2026 Updated)

The best description of the organization ' s procedures in this context is that they represent a cause of the organization ' s accumulation of large travel advances. The lack of a requirement for justification for travel advances greater than a specific amount is a procedural gap that directly contributes to the accumulation of large travel advances. This gap in the procedure is the root cause that leads to the observed condition of large travel advances accumulating without sufficient oversight or justification.

IIA ' s International Standards for the Professional Practice of Internal Auditing, Standard 2310 – Identifying Information, and related practice advisories on root cause analysis in audit observations.

In the risk control map, Risk C is positioned in the upper left quadrant, indicating it is critical (high risk significance) but with a low level of control. This suggests that the current controls are insufficient to mitigate the high level of risk associated with Risk C. For critical risks, a higher level of control is necessary to ensure that the risk is properly managed and mitigated. References:

" Internal Auditing: Assurance & Advisory Services " (The Institute of Internal Auditors)

" Risk Management Framework " (COSO)

The five-attribute approach to documenting deficiencies typically includes the following attributes: condition (the current state or issue identified), cause (the reason for the condition), effect (the impact or potential impact of the condition), and recommendation (suggested actions to address the deficiency). These attributes provide a comprehensive framework for understanding the deficiency, its implications, and the steps needed to rectify it, ensuring clear and actionable audit findings.

The Institute of Internal Auditors (IIA) - Practice Guide: Documenting Information

A limitation of a heat map is that it can be challenging to differentiate between impact and likelihood as to which is more important. Heat maps visually represent risks based on their impact and likelihood, but they do not inherently provide a mechanism to weigh these factors against each other, which can make prioritizing risks difficult in some cases.

IIA References:

The IIA’s Practice Guide on Risk Assessment discusses the use of heat maps in visualizing risks but also highlights their limitations, particularly in how impact and likelihood are presented. While heat maps are useful for a high-level overview, they may not provide the nuanced understanding needed for decision-making when both factors are critical.

When reviewing the board of directors, internal auditors should consider testing the presence of an independent critical mass. This refers to the existence of a sufficient number of independent directors who can provide unbiased judgment and oversight. Independence is a cornerstone of effective governance, ensuring that decisions are made in the best interest of the organization without undue influence from management. This attribute is crucial for maintaining the integrity and objectivity of the board ' s decisions and actions.

IIA ' s Practice Guide on Assessing Organizational Governance.

Introduction:

The chief audit executive (CAE) must ensure that audit recommendations are appropriately addressed and that any disagreements with management’s decisions are resolved effectively.

Escalation Process:

If the CAE disagrees with management’s decision to not implement certain action plans, it is important to escalate the issue to the board to ensure that risks are properly managed and that there is accountability.

Options Analysis:

Option A: Discussing with senior management is a preliminary step but may not resolve the issue if there is still disagreement.

Option B: Discussing with key shareholders is not typically within the CAE’s direct line of reporting and may not be appropriate.

Option C: Legal counsel can provide advice, but the final decision on audit matters typically rests with the board.

Option D: The most appropriate step is for the CAE to discuss the matter with the board, as they have the ultimate oversight responsibility and can ensure that management’s decisions align with the organization’s risk management and governance frameworks.

Conclusion:

The CAE should discuss the matter with the board to ensure that management’s decision is aligned with the organization’s risk management strategy and to address any unresolved issues.

Internal Audit Standards and Practice Guides .

Reviewing and initialing internal audit workpapers ensures that the engagement has adequate supervision. This practice demonstrates that the supervisor has reviewed the work performed by the audit team, verified the accuracy and completeness of the documentation, and provided necessary guidance. It is a critical step in the quality assurance process, ensuring that the audit findings and conclusions are supported by sufficient and appropriate evidence.

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2340 – Engagement Supervision.

When an internal auditor identifies a major control weakness during a preliminary survey, the appropriate response is to bring it to the attention of the process owner for resolution. This approach aligns with the standards and guidelines provided by the Institute of Internal Auditors (IIA), particularly under the International Standards for the Professional Practice of Internal Auditing (Standards).

IIA Standard 2120 – Risk Management:

According to Standard 2120, the internal auditor must evaluate the effectiveness of the organization ' s risk management processes. Identifying and reporting control weaknesses is a key aspect of this evaluation. By bringing the issue to the attention of the process owner, the internal auditor ensures that those responsible for managing the process are aware of the risk and can take appropriate corrective actions.

IIA Standard 2060 – Reporting to Senior Management and the Board:

While it might seem logical to report directly to senior management (as option A suggests), the IIA recommends that the process owner be given the opportunity to address the issue first. Standard 2060 emphasizes that significant risk exposures and control issues should be reported to senior management and the board, but only after they have been discussed with the appropriate process owners.

IIA Standard 2440 – Disseminating Results:

According to Standard 2440, the communication of audit results should be consistent with the objectives of the audit engagement. It is good practice to inform the process owner promptly so they can address the issue before the audit report is finalized. This approach helps in mitigating the risk at an early stage and ensures that the control weaknesses are appropriately managed.

Ethical Considerations:

The IIA’s Code of Ethics requires internal auditors to act with integrity and to ensure that their communications are honest and constructive. Notifying the process owner immediately reflects a proactive and ethical approach to audit findings. It allows for timely corrective actions and demonstrates the auditor ' s commitment to improving the organization ' s control environment.

Option A (Issue a final report to senior management): This step is premature at this stage of the audit. Issuing a final report without allowing the process owner to address the issue could lead to unnecessary escalation and may undermine the collaborative nature of the audit process.

Option C (Note the control weakness for discussion during the exit meeting): While discussing the issue during the exit meeting is part of the process, it is more effective to address the control weakness immediately rather than waiting until the exit meeting, where valuable time might be lost.

Option D (Carry out an investigation for disciplinary action): This is beyond the internal auditor ' s scope unless the situation specifically warrants an investigation. The focus of the auditor should be on control improvements rather than disciplinary measures, which are typically managed by HR or legal departments.

Detailed Explanation:Why Not Other Options?

To determine if loans were granted in accordance with the organization ' s policies, the most effective approach is to validate a sample of loans against the applicable underwriting guidelines. This method allows the auditor to directly assess compliance with the specific criteria set out in the organization ' s loan granting policies, providing clear evidence on whether the loans meet the required standards.

The Institute of Internal Auditors (IIA) Practice Guide: Auditing Credit Risk Management

IIA Standard 2210 - Engagement Objectives

The expectations and objectives of an assurance engagement are often determined in conjunction with the engagement client, aligning with the client ' s needs and the scope of the engagement. In consulting engagements, internal auditors provide advice and services tailored to the client ' s requests, which may not always follow a preliminary risk assessment process like in assurance engagements.

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) provide detailed guidance on this aspect of engagement planning, particularly in Standards 2200 and 2201.

According to IIA Standard 2600: Communicating the Acceptance of Risks, the CAE must inform senior management and the board if management decides to accept a risk that may exceed the organization’s risk appetite. The branch manager ' s unilateral decision without consulting senior management constitutes a governance issue. Escalating the matter ensures proper oversight and adherence to the organization’s risk management framework. Options B, C, and D do not fulfill the CAE ' s responsibility to ensure appropriate communication and accountability at the senior management level.

Per Standard 2330 – Documenting Information, workpapers must provide sufficient, relevant, and reliable information to support audit conclusions. The best practice is to prepare workpapers cross-referenced to audit observations, which directly demonstrate how conclusions were reached. Option A is too broad, B is irrelevant, and D is not part of evidence.

Once an internal auditor has identified a business process, the next step is to understand the specific activities involved in that process. This includes mapping out each step or action taken within the process to gain a detailed understanding of how it operates. Identifying process activities helps in evaluating the efficiency, effectiveness, and potential risks associated with the process