Free IIA-CIA-Part1 Practice Test Questions 2026

Explanation:
The core requirement of the Quality Assurance and Improvement Program (QAIP) is not only to conduct assessments but also to communicate assessment results. According to the Standards, the Chief Audit Executive (CAE) must report the results of internal and external assessments to senior management and the board. Option D directly reflects this mandatory communication obligation. Other options either misstate the subject of responsibility (board oversight), confuse the level of assessment (individual engagements), or mix up the time requirements for self-assessments with those for external assessments.

Correct Option:

D. Report the results of the QAIP to senior management

The Standards explicitly require the CAE to communicate the results of the QAIP to senior management and the board.

The communication content should include conformance with the Standards, achievement of performance objectives, and improvement action plans.

This is a mandatory requirement for "conformance," not an optional best practice; failure to report would constitute non-conformance.

Incorrect Option:

A. Require board oversight of the QAIP
Although the board is responsible for overseeing the QAIP, the subject of "requiring" board oversight is not the CAE; the CAE's responsibility is to establish and maintain the QAIP and report to the board.

B. Assess Standards conformance for each individual engagement
The QAIP focuses on the quality of the "internal audit function" as a whole, not on conducting separate Standards conformance assessments for each individual engagement. Engagement-level quality is assured through supervision and review mechanisms.

C. Conduct a self assessment at least once every five years
The "once every five years" frequency applies to "external quality assessments"; internal self-assessments should be ongoing or periodic (typically annual), and the time requirements for the two should not be confused.

Reference:
IIA Global Internal Audit Standards (2024) Standards 8.3, 12.1 and related guidance require the CAE to communicate QAIP results to the board and senior management; external assessments are required at least once every five years.

Explanation:

The internal audit activity's role regarding internal controls is to evaluate their design and effectiveness and to provide advice and insight—not to own or operate the controls. Analyzing and advising on the costs versus benefits of control activities falls squarely within this advisory and evaluative role. Options A and B describe responsibilities belonging to management (risk mitigation and enabling opportunities), while option D describes an assurance service typically performed by external auditors. Internal audit provides independent assurance and consulting, not attestation of financial statements.

Correct Option:

C. Analyzing and advising regarding costs versus benefits of control activities
Internal audit evaluates whether controls are designed and operating effectively, including whether the cost of a control is proportionate to the risk it addresses.

The CAE may advise management on the cost-benefit trade-offs of control activities without assuming management's responsibility for designing or implementing those controls.

This consulting/advisory activity is consistent with the internal audit activity's role of adding value while maintaining independence and objectivity.

Incorrect Option:

A. Mitigating risks affecting achievement of organizational objectives
Mitigating risk is a management responsibility; management owns the risk management process and implements controls to mitigate risks. Internal audit provides independent assurance on how well risks are managed, but does not itself mitigate risks.

B. Enabling opportunities affecting achievement of organizational objectives
Identifying and pursuing opportunities to achieve organizational objectives is a management function. Internal audit may offer advice, but enabling opportunities (making them happen) is an operating responsibility that would impair internal audit's independence if assumed.

D. Attesting to fairness of financial statements
Attestation of financial statements is normally performed by external auditors, not the internal audit activity. Internal audit may review financial reporting controls and provide assurance, but attesting to the fairness of financial statements would compromise independence and is outside its mandate.

Reference:
IIA Global Internal Audit Standards (2024), Principle 2 and Standards on independence and objectivity, together with the Definition of Internal Auditing, establish that internal audit evaluates and advises on controls and risk management while management retains responsibility for mitigating risks, enabling opportunities, and financial reporting.

Explanation:
The prerequisite for using the "conducted in conformance with the Standards" statement is that the results of the Quality Assurance and Improvement Program (QAIP) support this conclusion. The core of QAIP lies in assessing and confirming the internal audit activity's compliance with the Standards; only when assessment results show no material issues and generally demonstrate conformance can this statement be used in audit reports. Options B, C, and D involve workpaper retention, client feedback, and individual certifications, respectively—none of which constitute the compliance basis for using this statement.

Correct Option:

A. The result of a quality assurance and improvement program confirm there are no material issues.
The Standards explicitly require that the use of the conformance statement must be "supported by the results of the quality assurance and improvement program".

The QAIP results (including internal and external assessments) must demonstrate that the internal audit activity generally conforms with the Standards before the statement can be used.

If the QAIP reveals material nonconformance issues, the internal audit activity must cease using the conformance statement until the issues are rectified and conformance is validated.

Incorrect Option:

B. Engagement workpapers are retained by the internal audit activity according to the retention and deletion policy.
Workpaper retention policies are a document management requirement; while retaining workpapers is good practice, the act of retention itself does not constitute evidence of compliance with the Standards, nor can it support the use of the conformance statement.

C. The internal audit activity receives positive feedback from the managers of the areas that were under review.
Client satisfaction feedback reflects perceptions of service quality but is not equivalent to a QAIP compliance assessment. Positive feedback does not prove that the internal audit activity conforms with the Standards and cannot serve as a basis for using the conformance statement.

D. Internal auditors demonstrate proficiency by maintaining professional internal audit certifications.
Individual certifications (such as CIA) demonstrate the professional competence of individual auditors but do not equate to organizational-level compliance of the internal audit activity with the Standards. The conformance statement targets the internal audit activity as a whole, not the qualifications of individual auditors.

Reference:
IIA Standards Standard 2430 and Implementation Guide 1321: The conformance statement may be used only when QAIP results (including internal and external assessments) support a conclusion of conformance with the Standards; if the QAIP reveals nonconformance, the statement must be discontinued.

Explanation:
The board's decision to grant the internal audit activity greater access to different parts of the organization is essentially expanding its "authority." According to IIA Standards, authority is formally defined in the internal audit charter, which authorizes the internal audit activity to access records, personnel, and physical properties relevant to the performance of engagements. Restrictions on access constitute an impairment of independence. Therefore, improving access directly strengthens the authority granted to internal audit, enabling it to perform assurance work effectively. The other options refer to reporting lines, independence status, or board interaction frequency—none are directly strengthened by access expansion.

Correct Option:

A. Internal audit authority.
The internal audit charter establishes the internal audit activity's authority, which explicitly includes authorizing access to records, personnel, and physical properties relevant to the performance of engagements.

The board (or audit committee) is responsible for approving the charter and ensuring the internal audit function has unrestricted access to data, records, information, personnel, and physical properties necessary to fulfill its mandate.

The board's initiative to expand access is precisely exercising its responsibility to strengthen the internal audit activity's authority, thereby removing potential scope limitations that could impair independence.

Incorrect Option:

B. Internal audit reporting structure.
Reporting structure pertains to the organizational positioning and reporting lines of the chief audit executive (e.g., functional reporting to the board and administrative reporting to senior management). Expanding access does not alter who the CAE reports to or the nature of the reporting relationship.

C. Internal audit independence and objectivity.
While unrestricted access supports independence (because access restrictions are a form of impairment), the board's action directly strengthens "authority"—the right to access. Independence is a broader state of freedom from conditions that threaten objectivity; access is one enabling factor, not the independence itself.

D. Internal audit interaction with the board.
Interaction with the board refers to communication frequency, direct access to the board, and meeting participation (including private sessions without management present). Expanding access to organizational departments and personnel does not directly change the nature or frequency of the internal audit activity's interaction with the board.

Reference:
IIA Global Internal Audit Standards (2024): Standard 6.2 (Internal Audit Charter) requires the charter to authorize access to records, personnel, and physical properties; Standard 6.3 requires the board to work with senior management to enable the internal audit function's unrestricted access.

Explanation:
The core of business acumen lies in a deep understanding of the organization's operating environment, industry practices, and specific factors that may affect the organization. A newly hired internal auditor coming from an internal audit department in a different industry, while possessing audit skills, lacks precisely this industry-specific business context. In contrast, personnel transferred from other departments within the same organization already have a foundation in understanding the organization and its industry; even those from external audit backgrounds have usually accumulated industry knowledge through auditing the organization. Therefore, the auditor coming from a different industry is the most likely to require further education in business acumen.

Correct Option:

B. She was recruited from the internal audit activity of another organization that operates in a different industry.
Although this auditor has internal audit experience, business acumen is heavily context-dependent, varying by industry, business type, and organizational specificities.

IIA research indicates that the lowest confidence levels among internal auditors are precisely in areas such as business acumen, which require targeted learning and accumulation to develop.

Having switched from a different industry, she lacks understanding of the new organization's business model, industry risks, regulatory environment, and other key contexts, making this the area where further education is most needed.

Incorrect Option:

A. She was transferred from the managerial accounting department of the same organization.
Personnel transferred from within the organization are already familiar with the organization's operations, culture, and industry environment, and possess a good foundation in business acumen.

The transition from management accounting to internal audit mainly requires supplementing audit methodologies and standards knowledge, rather than business acumen.

C. She was offered a permanent position after she had worked with the organization for two years in a temporary auditor-in-training position.
Two years of auditor-in-training experience means she has already received systematic training in audit practice and organizational business, accumulating a certain level of business acumen.

The organization has already cultivated her for a long time, and her understanding of the business should have reached a level sufficient to perform her duties.

D. She previously served on the organization's external audit team and was recruited to the internal audit activity following the current year's financial audit.
External auditors, through the financial statement audit process, must gain an in-depth understanding of the organization's business operations, industry characteristics, and internal controls.

She has already developed a certain level of business acumen regarding this organization, and her main gap lies in the application of internal audit standards and the consulting role, rather than business acumen.

Reference:
The IIA Global Internal Audit Competency Framework defines business acumen as the deep understanding of the organization's environment, industry practices, and specific organizational factors that enable internal auditors to provide effective assurance and consulting services. The IIA emphasizes that business acumen is a core competency and requires continuous education and development.

Explanation:
The core reason a chief audit executive (CAE) engages a fraud specialist to assist with a major fraud investigation is that the specialist possesses the professional qualifications and experience to serve as an expert witness in legal proceedings. IIA guidance explicitly states that fraud investigations are best conducted by personnel with expertise in this area, as unqualified individuals risk compromising evidence or undermining subsequent legal actions. Fraud specialists, through their training and certification (such as CFE), can provide objective, credible testimony in court, which is a capability that ordinary internal auditors typically lack.

Correct Option:

B. Fraud specialists are better equipped to act as an expert witness in court.
When fraud cases enter legal proceedings, the investigation findings often need to be presented in court as evidence, requiring the investigator to possess the qualifications and experience to serve as an expert witness.

IIA guidance emphasizes that fraud investigations should be conducted by qualified professionals to reduce the risk of evidence being compromised, innocent parties being wrongly accused, or subsequent legal actions being undermined.

Certified fraud specialists (such as CFE) are trained in evidence collection, interviewing techniques, and legal procedures, and are able to provide objective and credible expert opinions in court.

Incorrect Option:

A. Fraud specialists are better at using computer-assisted audit techniques.
Computer-assisted audit techniques (CAATs) are a general audit tool, and proficiency in them does not depend on whether one is a fraud specialist. Many internal auditors are equally skilled in using data analysis tools; this is not the core reason for engaging a fraud specialist.

C. Fraud specialists are better able to properly apply due professional care.
Due professional care is a fundamental requirement for all internal auditors, not a unique advantage of fraud specialists. Internal auditors should exercise due professional care in all engagements; this is unrelated to whether a fraud specialist is engaged.

D. Fraud specialists are better at using crime scene investigation techniques.
Crime scene investigation techniques are primarily used in physical evidence collection scenarios (such as on-site evidence collection by law enforcement). Fraud investigations in corporate environments typically focus on financial records, electronic data, and interviews, and do not involve traditional "crime scene" handling.

Reference:
IIA Position Paper "Fraud and Internal Audit: Assurance Over Fraud Controls Fundamental to Success" (2019) points out that fraud investigations should be conducted by experienced qualified professionals to reduce the risk of evidence being compromised or legal actions being undermined; fraud specialists can provide expert witness testimony in legal proceedings.

Explanation:
When the head of risk management fails to address audit recommendations, this essentially constitutes management accepting a risk level that may be unacceptable to the organization. According to IIA Standard 2600, the Chief Audit Executive (CAE) must first discuss the matter with senior management; if it remains unresolved, the CAE must communicate it to the board. The internal audit activity's responsibility is to monitor and report, not to assume management's responsibilities or make decisions on management's behalf. Options A, C, and D all involve the internal audit activity overstepping its assurance and advisory role, infringing on management's authority and impairing independence.

Correct Option:

B. The chief audit executive (CAE) must discuss this matter with senior management and the board
The failure to address recommendations indicates that management has accepted a risk level that may be unacceptable to the organization; this is precisely the situation addressed by Standard 2600.

The CAE must first discuss the matter with senior management; if the matter remains unresolved, the CAE must then communicate it to the board.

This escalation mechanism ensures that high-risk matters receive attention at the appropriate governance level, while maintaining the internal audit activity's independence and objectivity.

Incorrect Option:

A. The internal audit activity should add value by implementing the recommendations on management's behalf
Implementing recommendations is management's responsibility. The internal audit activity's role is assurance and advisory; directly implementing controls or risk management measures would impair its independence and objectivity.

The interpretation of Standard 2600 explicitly states: "It is not the responsibility of the chief audit executive to resolve the risk."

C. The CAE should determine which recommendations to implement based on the severity of the associated risks
The CAE has no authority to decide which recommendations management should implement. The internal audit activity may assess risk severity and prioritize follow-up efforts, but the decision to implement rests with management.

The CAE's responsibility is to monitor the disposition of results and, when unresolved, escalate the matter; it is not to make implementation decisions on management's behalf.

D. The internal audit activity, led by the CAE, should assume responsibility for risk management function
Assuming responsibility for the risk management function would fundamentally undermine the internal audit activity's independence and objectivity, making it both executor and evaluator.

The internal audit activity may provide assurance and advice on risk management, but must not assume management's operational responsibilities.

Reference:
IIA Standard 2600 (Communicating the Acceptance of Risks) and its Implementation Guide: When the CAE concludes that management has accepted a risk level that may be unacceptable to the organization, the CAE must discuss the matter with senior management; if unresolved, the CAE must communicate it to the board. It is not the CAE's responsibility to resolve the risk.

Explanation:
For a manufacturing department with 200 people, the most efficient client-facilitated self-assessment approach is a facilitated workshop. The core advantage of workshops lies in gathering key personnel to discuss and reach consensus on control effectiveness in a structured format. This approach can quickly identify issues, clarify ambiguities, and generate improvement actions on the spot, while avoiding the inefficiency of conducting 200 individual interviews and the low response rate and superficial responses associated with surveys. In comparison, surveys are more suitable for large-scale, low-risk situations requiring rapid information gathering, and interviews are too time-consuming for assessing a large department.

Correct Option:

A. Workshops.
Workshops (facilitated team workshops) allow key personnel from the department to gather together to discuss and assess control effectiveness through structured facilitation, reaching consensus in a short period of time.

According to CSA practice guidance, workshops are suitable for complex processes, higher risk levels, and situations where management is willing to openly share risk information—these are precisely the typical characteristics of manufacturing departments' control self-assessments .

Workshops can generate dialogue and challenge on the spot, helping participants identify control gaps and propose improvement measures, making them more efficient than individual interviews or surveys in terms of outcomes .

Incorrect Option:

B. Surveys.
Surveys are suitable for large-scale, low-risk, situations requiring rapid access to basic information, but they lack interaction and follow-up questioning, making it easy to elicit superficial responses ("tick-box" responses) .

For a 200-person manufacturing department, while surveys could cover more people, they cannot delve into specific control issues or facilitate consensus among different roles.

C. Interviews.
Individual interviews require 2-3 hours per person, and conducting them for 200 people would consume enormous time and resources, making them extremely inefficient .

Interviews are more suitable for in-depth understanding of specific individuals' perspectives or for assessing soft controls, rather than for efficiently obtaining an overall assessment of a department's control effectiveness.

D. Observation.
Observation can verify whether controls are actually being implemented, but it cannot directly assess "overall control effectiveness"—effectiveness assessment requires collecting opinions and judgments from relevant personnel.

Observation is typically used to supplement or validate information obtained from other methods, and using it alone cannot achieve the objective of comprehensively self-assessing control effectiveness.

Reference:
IIA's Control Self-Assessment (CSA) guidance and related practices indicate that facilitated team workshops are the preferred form of CSA, suitable for complex processes and higher-risk situations, and can efficiently reach consensus on control effectiveness .

Explanation:
The core logic of internal control is to manage risks that affect the achievement of objectives. Without a risk assessment process, the organization cannot identify which risks need to be controlled, and therefore cannot design appropriate control activities. The COSO framework clearly establishes risk assessment as the foundation of internal control—management must first identify and analyze risks relevant to objectives before it can determine how to manage them. Monitoring, objective setting, and information and communication are all important components of internal control, but they are not the logical prerequisite for "developing" an effective internal control system.

Correct Option:

B. A risk assessment process.
COSO defines risk assessment as "the identification and analysis of risks relevant to the achievement of objectives, forming a basis for determining how risks should be managed".

Internal control is not an end in itself; it exists to manage risks that may prevent the organization from achieving its objectives. Without risk assessment, the organization cannot know which controls are needed or where resources should be allocated.

The COSO framework treats risk assessment as one of the five core components of internal control, positioned after the control environment and before control activities, serving as a connecting link.

Incorrect Option:

A. A monitoring process.
Monitoring is an ongoing evaluation of whether internal control is operating effectively; it is a "post-event" guarantee mechanism, not a prerequisite for designing internal control. Monitoring can only function after controls have been established.

C. A strategic objective-setting process.
Objective setting is indeed an important premise for risk identification (risks must be defined relative to objectives), but the question asks about a precondition for "developing an effective internal control system." Risk assessment directly determines which controls are needed, whereas objective setting is more of an upstream management activity.

D. An information and communication process.
Information and communication ensure that internal control-related information is transmitted and understood within the organization; it is a supporting mechanism for the operation of internal control, not a logical prerequisite for designing internal control.

Reference:
COSO Internal Control—Integrated Framework (2013) and related implementation guidance: Risk assessment is a core component of internal control, requiring the organization to identify and analyze risks relevant to the achievement of objectives, forming the basis for determining how risks should be managed.

Explanation:
According to IIA guidance, the internal audit activity may perform multiple roles in CSR evaluation. Consulting on CSR program design and implementation (1) is permissible, provided it does not involve assuming management responsibilities; serving as an advisor on CSR governance and risk management (2) falls within the scope of advisory services; and reviewing third parties for contractual compliance with CSR terms (3) is a conventional assurance activity. However, "identifying and mitigating risks" (4) includes mitigation measures, which are a management responsibility—the internal audit activity may identify and assess risks, but must not assume responsibility for risk mitigation, otherwise independence and objectivity would be impaired.

Correct Option:

A. 1, 2, and 3.
Consulting on CSR program design and implementation: IIA guidance allows the internal audit activity to provide consulting services on CSR programs, provided it does not assume management's design and implementation responsibilities, maintaining an advisory role.

Serving as an advisor on CSR governance and risk management: The internal audit activity may provide advice and recommendations on CSR governance structure and risk management processes, which is consistent with the advisory function of adding value and improving organizational operations.

Reviewing third parties for contractual compliance with CSR terms: Auditing whether suppliers or business partners comply with CSR-related contractual terms is a typical assurance activity that falls within the scope of internal audit's evaluation of controls and compliance.

Incorrect Option:

4. Identify and mitigate risks to help meet the CSR program objectives.
The internal audit activity may identify and assess risks, but mitigating risks is a management responsibility. Management is responsible for designing and implementing controls to mitigate risks, while the internal audit activity provides independent assurance and advice and must not assume operational responsibilities.

If the internal audit activity directly participates in risk mitigation, it would become the executor of risk management, compromising its independence and objectivity.

Reference:
IIA Practice Guide Evaluating Corporate Social Responsibility/Sustainable Development (2010) distinguishes among auditing, facilitating, and consulting roles for internal audit in CSR, while emphasizing that the internal audit activity must not assume management responsibilities; risk mitigation is a management function, and internal audit may only provide independent assurance and advice.

Explanation:
The core of the CAE's emphasis on objectivity is to establish institutional safeguards rather than imposing personal restrictions on auditors. IIA guidance explicitly states that reviewing internal audit work results before issuing relevant engagement communications helps provide reasonable assurance that the work was performed objectively. Through supervisory review, supervisors can evaluate whether auditors' judgments are affected by bias, whether evidence supports conclusions, and whether due professional care has been exercised. The other options either confuse objectivity with personal social avoidance or misunderstand the application of sampling techniques.

Correct Option:

B. Fieldwork completed by internal auditors should be appropriately reviewed.
IIA guidance clearly states that reviewing work results before issuing engagement communications helps provide reasonable assurance that the work was performed objectively.

Review is an institutional safeguard that can detect and correct individual biases, insufficient evidence, or hasty conclusions, directly supporting objectivity.

Standard 2340 (Engagement Supervision) requires appropriate supervision of engagements, including review of workpapers, results, and conclusions.

Incorrect Option:

A. Statistical sampling techniques should always be used to pull unbiased sampling for testing.
Sampling methods address sample representativeness, not the auditor's objectivity. Even with statistical sampling, auditors may still make biased judgments when interpreting results or selecting evaluation criteria.

The word "always" is overly absolute; the choice of sampling method should depend on engagement objectives and risk, not be mandated uniformly.

C. Internal auditors should avoid using the lunch room simultaneously with audit clients.
This is an overly restrictive and impractical suggestion. Normal and appropriate social interaction does not impair objectivity; IIA guidance only requires avoidance of actual or apparent conflicts of interest, not complete avoidance of contact.

Objectivity is a state of mind and institutional safeguard, not achieved by physically isolating auditors.

D. During the audit review period, there should be no nonaudit dialogues with the audit client.
Prohibiting all nonaudit dialogue is neither realistic nor necessary. Appropriate communication helps auditors understand the business and identify risks; the key is that communication does not affect independence of judgment.

IIA guidance only requires disclosure and management of conflicts of interest; it does not prohibit normal communication.

Reference:
IIA Practice Guide on Independence and Objectivity states that review of internal audit work results before issuing relevant engagement communications helps provide reasonable assurance that the work was performed objectively. Standard 2340 requires appropriate supervision of engagements to ensure quality and objectivity.

Explanation:
According to IIA standards, the core of organizational independence lies in the CAE's reporting relationship: functional reporting to the board (approving the charter, audit plan, budget, and CAE appointment/remuneration) and administrative reporting to the CEO (daily operations). Option B states that the CFO approves the CAE's compensation—this is a typical independence impairment, because the CFO's area is frequently subject to internal audit, and having the audited party control the auditor's compensation creates a conflict of interest. Option A (functional reporting to the CEO) and Option C (CAE appointment determined by the CEO) similarly place the CAE under management's control, lacking board oversight. Option D (administrative reporting to the COO) is somewhat better than the others, but the IIA explicitly recommends administrative reporting to the CEO, and reporting to the COO may still create an appearance of conflict because operations are also subject to audit.

Correct Option:

D. The CAE reports administratively to the chief operating officer.
Among the four options, only D aligns with the IIA's framework of "dual reporting": the CAE should report functionally to the board and administratively to senior management.

Administrative reporting primarily involves daily operations support (budget, human resources, office resources, etc.), and reporting to the COO is operationally feasible.

However, the IIA's best practice recommends administrative reporting to the CEO rather than the COO, because the COO's area is also subject to audit, and this reporting line may create an appearance of conflict. Therefore, D is "relatively optimal" rather than fully compliant.

Incorrect Option:

A. The CAE reports functionally to the CEO.
Functional reporting should be directed to the board/audit committee, not the CEO. If the CEO controls the CAE's functional reporting line, management can influence audit scope, resource allocation, and the reporting of results, thereby impairing independence.

B. The CAE's compensation is approved by the chief financial officer.
This is a clear independence impairment. The CFO's financial activities are a core area of internal audit, and having the audited party decide the auditor's compensation creates a direct conflict of interest. IIA standards explicitly list "board approval of CAE remuneration" as a key element of functional reporting.

C. The CAE's appointment is determined by the CEO.
CAE appointment and removal should be the responsibility of the board. If the CEO decides, the CAE may be constrained by management when reporting sensitive issues, compromising independence and objectivity.

Reference:
IIA Standard 1110 (Organizational Independence) and its Implementation Guide: The CAE should report functionally to the board (approving the charter, plan, budget, and CAE appointment/remuneration) and administratively to the CEO, so as to ensure the internal audit activity is free from management interference.