Free IIA-ACCA Practice Test Questions 2026

A fraud investigation was completed by management, and a proven fraud was communicated to relevant authorities. According to MA guidance, which of the following roles would be most appropriate for the internal audit activity to undertake after the investigation?

A. Plan employee sessions and team building strategies for the organization to improve awareness of fraud among employees.

B. Review the investigation and implement any improvements to the process.

C. Conduct lessons learned sessions to ascertain how the fraud occurred and which controls failed.

D. Determine why The fraud was not detected earlier and design controls to strengthen early detection.

The chief audit executive (CAE) is planning to conduct an internal assessment of the internal audit activity (IAA). Part of this assessment will include benchmarking. According to IIA guidance, which of the following qualitative metrics would be appropriate for the CAE to use?

1. Average client customer satisfaction score for a given year.
2. Client survey comments on how to improve the IAA.
3. Auditor interviews once an audit has been completed.
4. Percentage of audits completed within 90 days.

A. 1 and 2.

B. 1 and 3.

C. 2 and 3.

D. 3 and 4.

Which of the following best ensures the independence of the internal audit activity?

1. The CEO and audit committee review and endorse any changes to the approved audit plan on an annual basis.
2. The audit committee reviews the performance of the chief audit executive (CAE) periodically.
3. The internal audit charter requires the CAE to report functionally to the audit committee.

A. 3 only

B. 1 and 2 only

C. 2 and 3 only

D. 1, 2, and 3

According to the COSO internal control framework, which of the following best describes the use of continuous auditing programs by the internal audit activity?

A. Control environment.

B. Control activities.

C. Risk assessment.

D. Monitoring.

Which of the following activities should the chief audit executive perform to ensure compliance with an organization's code of conduct?

A. Act as an adviser to the committee responsible for reviewing violations of the code.

B. Review and adjudicate all violations of the code of conduct.

C. Lead the committee responsible for the oversight of the code.

D. Implement a system of procedures to inform all employees of the code.

An auditor in charge was reviewing the workpapers submitted by a newly hired internal auditor. She noted that the new auditor's analytical work did not include any rating or quantification of the risk assessment results, and she returned the workpapers for correction. Which section of the workpapers will the new auditor need to modify?

A. Condition section.

B. Criteria section.

C. Effect section.

D. Cause section.

According to IIA guidance, which of the following statements about working papers is false?

A. They assist in the implementation of recommendations.

B. They provide support for communication to third parties.

C. They demonstrate compliance with auditing standards.

D. They contribute to development of the internal audit staff.

Which of the following would not be considered part of preliminary survey of an engagement area?

A. Interviews with individuals affected by the entity.

B. Functional walk through test.

C. Analytical reviews.

D. Sampling scope.

According to IIA guidance, which of the following statements is true regarding the reporting of results from an external quality assessment of the internal audit activity?

A. The external assessment results are reported upon completion in confidence directly to the board, and senior management is advised only of the recommendations and improvement action plans.

B. The results of self-assessments with independent external validation are shared with the board upon completion, and monitoring of recommended improvements must be reported monthly.

C. The external assessment results are communicated upon completion to senior management and the board, but action plans for recommended improvements do not have to be reported.

D. The requirements for reporting quality assessment results are the same for external assessments and self-assessments with independent external validation.

Forty-five percent of an organization's customer payments are submitted online. Eight percent of online payments are rejected. Executive management decides to outsource its online payment services to a contractor that will assume 75 percent of the total value of rejected payments. The organization estimates $1.25 million customer payments due during the contract period.
Which of the following represents the organization's residual risk for online customer payments due?

A. $11, 250

B. $25, 000

C. $33, 750

D. $45, 000

Which of the following must be in existence as a precondition to developing an effective system of internal controls?

A. A monitoring process.

B. A risk assessment process.

C. A strategic objective-setting process.

D. An information and communication process.

Which of the following is not an objective of internal control?

A. Compliance.

B. Accuracy.

C. Efficiency.

D. Validation.