Free IIA-ACCA Practice Test Questions 2026

According to IIA guidance, when preparing the charter for the internal audit activity, the chief audit executive (CAE), board, and senior management should agree on which of the following?

1. The standards to be used by the internal audit activity.
2. The internal audit activity's code of ethics.
3. The CAE's reporting line.
4. The internal audit activity's responsibilities.

A. 4 only.

B. 1 and 2 only.

C. 3 and 4.

D. 1,2, and 3.

Which of the following best explains why integrity is a necessary personal quality for internal auditors at all levels?

A. Internal auditor integrity enables stakeholders to constantly question the work of the internal audit activity.

B. Internal auditor integrity enables the internal auditor to avoid being challenged by any party in the organization.

C. Internal auditor integrity enables the internal audit activity to be able to demonstrate independence.

D. Internal auditor integrity enables users of internal auditors' work to make important business decisions.

What is the purpose of a secondary control?

A. It replaces primary controls that are either ineffective or cannot fully mitigate a risk.

B. It partially reduces the residual risk level when a key control does not operate effectively.

C. lt combines with other controls to help reduce significant risk exposures to an acceptable level.

D. It helps to ensure the completeness and accuracy of automated controls in a system environment.

According to IIA guidance, the results of a formal quality assessment should be reported to which of the following groups?

A. The audit committee and senior management.

B. The audit committee and the external auditors.

C. Senior management and management of the audited area.

D. Senior management and the external auditors.

Which of the following control activities is the most effective to ensure users' levels of access are appropriate for their current roles?

A. The human resources department generates a monthly list of terminated and transferred employees and requests IT to update the user access as required.

B. Standardized user access profiles are developed and the appropriate access profiles are automatically assigned to new or transferred employees.

C. System administrator rights are assigned to one user in each department who can update user access of terminated or transferred employees immediately.

D. Department managers are required to perform periodic user access reviews of relevant systems and applications.

Who is responsible for setting the risk appetite?

A. External auditors.

B. Chief risk officer.

C. Operations management.

D. Board of directors.

An internal auditor is using a spreadsheet application to review a cash flow forecast prepared by management.

Which of the following correctly identifies the type of evidence this information represents?

A. Competent, corroborative evidence of future working capital requirements.

B. Sufficient, analytical evidence of the cash flow position at a given point of time in the future.

C. Competent, documentary evidence of future cash flow changes within the organization.

D. Sufficient, circumstantial evidence of the future solvency of the organization.

A former line supervisor from the Financial Services Department has completed six months of a two-year development opportunity with the internal audit activity (IAA). She is assigned to a team that will audit the organization's payroll function, which is managed by the Human Resources Department. Which of the following statements is most relevant regarding her independence and objectivity with respect to the payroll audit?

A. She may participate, but only after she has completed one year with the IAA.

B. She may participate, because she did not previously work in the Human Resources Department.

C. She may participate, but she must be supervised by the auditor in charge.

D. She may participate for training purposes, to build her knowledge of the IAA.

According to the COSO enterprise risk management framework, which of the following best describes the activity that helps ensure risk responses are carried out effectively?

A. Objective setting.

B. Control activities.

C. Information and communication.

D. Event identification.

Which of the following situations is most likely to impair internal audit objectivity?

A. An internal auditor reports both functionally and administratively to the chief financial officer (CFO).

B. An internal auditor, who was an accounts receivable intern for the organization three years prior, performs an audit of the accounts receivable cycle.

C. According to policy, the internal auditor must obtain approval from the CFO prior to requesting information for internal audit purposes.

D. An internal auditor performs an audit in a department that is led by the auditor's close friend.

Which of the following is a weakness of observation as audit evidence?

A. It cannot be used to test the completeness assertion.

B. It cannot be used to test the existence assertion.

C. It cannot be used to test the occurrence assertion.

D. It cannot be relied upon because the evidence is not persuasive.

According to IIA guidance, which of the following is ultimately responsible for seeing that the internal control system of an organization's social responsibility program is effective?

A. Senior management.

B. Internal audit activity.

C. All employees.

D. Board of directors.