Free IIA-CIA-Part1 Practice Test Questions 2026

Explanation:
According to IIA Standard 1230 and its Implementation Guide, internal auditors may demonstrate compliance with continuing professional development requirements by "retaining documentation or other evidence," which explicitly includes "completed training (e.g., continuing education credits, certifications, or certificates of completion)". Retaining continuing education credit records directly proves that auditors have actually completed professional development activities, constituting the most direct and compliant form of evidence. The other options either involve seeking external guidance, retaining performance review records, or considering specialized development planning—none directly prove that auditors have completed continuing professional development.

Correct Option:

A. Retaining evidence of training in the form of continuing education credits.
The IIA Implementation Guide explicitly lists "completed training (e.g., continuing education credits, certifications, or certificates of completion)" as acceptable evidence for demonstrating compliance with Standard 1230.

Retaining continuing education credit records can directly prove that auditors have completed specific training hours, meeting the requirement for "evidence of completed activities."

This is the most direct and verifiable method of proving compliance, as opposed to planning or considering development activities.

Incorrect Option:

B. Seeking guidance regarding internal audit best practices from The IIA.
Seeking guidance from The IIA is a method of "maintaining professional competence" and falls under the process of professional development activities, but it does not in itself constitute evidence of completed training.

The Implementation Guide mentions that maintaining IIA membership and subscribing to professional information sources can serve as supporting evidence, but this option merely describes "seeking guidance," not retaining records of completed training.

C. Retaining supervisory reviews conducted on the basis of the development plan.
Supervisory reviews and performance evaluations can reflect auditors' skill enhancement and may serve as supplementary evidence, but they are not the most direct evidence of compliance with continuing professional development.

The Implementation Guide lists performance evaluations as "likely to record" the results of on-the-job training, rather than as primary evidence of compliance with Standard 1230.

D. Giving consideration to certain areas of specialization as part of development planning.
Considering specialized development planning falls under the category of "professional development and training plans" in the Implementation Guide, and is a planning activity, not evidence that training has been completed.

Planning itself cannot prove that auditors have actually enhanced their knowledge and skills, and therefore cannot directly demonstrate compliance with Standard 1230.

Reference:
IIA Implementation Guide 1230 states that internal auditors may demonstrate compliance with Standard 1230 by retaining documentation or other evidence, including completed training (e.g., continuing education credits, certifications, or certificates of completion), professional development plans, and self-assessments.

Explanation:
A typical risk management framework requires that risks be assessed from two levels: inherent risk (the risk exposure before any management actions are taken) and residual risk (the risk remaining after management has implemented responses). This is a core practice of frameworks such as COSO ERM and ISO 31000, because decision-makers need to understand both "the risk if nothing is done" and "the risk after controls are implemented" in order to evaluate whether existing controls are adequate and whether residual risk falls within the organization's risk appetite.

Correct Option:

B. Risk is assessed on both an inherent and a residual basis.
Inherent risk refers to the risk to the entity in the absence of any actions management might take to alter either the likelihood or impact of the risk.

Residual risk refers to the risk remaining after management's response to the risk. Internal auditors must focus on residual risk when concluding on the adequacy of risk management and controls, because it is the residual level (rather than the inherent level) that must fall within the risk appetite approved by the board.

COSO ERM and ISO 31000 both incorporate this two-tier assessment as a standard component of the risk management process.

Incorrect Option:

A. Risk tolerance may or may not align with risk appetite depending on whether the assessment is quantitative or qualitative.
Risk tolerance is the acceptable variation in performance related to achieving objectives, and it should be set within the boundaries of risk appetite. The alignment between the two is a governance design issue and is not determined by whether the assessment method is quantitative or qualitative.

C. The framework addresses four organizational objective categories strategic, historical, operational, and investment.
COSO ERM categorizes objectives as strategic, operational, reporting, and compliance, rather than "historical" and "investment." This option misstates the standard objective categories of the framework.

D. External risks and internal opportunities are omitted from the risk assessment scope.
A complete risk management framework should encompass both internal and external risks, as well as both threats and opportunities. Omitting external risks contradicts the basic principles of enterprise risk management.

Reference:
COSO ERM and ISO 31000 both define inherent risk as the risk before management actions and residual risk as the risk remaining after management responses; IIA guidance emphasizes that internal auditors should focus on residual risk when evaluating the adequacy of risk management.

Explanation:
According to the definition in the IIA Global Internal Audit Standards, inherent risk refers to the combination of internal and external risk factors that exist in the absence of any management actions. An Initial Public Offering (IPO) itself carries multiple risks: the company typically has a limited operating history, there has been no prior public market for the stock, and future profitability is uncertain. These risks exist before any post-IPO management mitigation measures (such as establishing a stable investor relations mechanism, improving governance structure, etc.) are implemented, and therefore fall under the category of "inherent risk." The "residual risk" mentioned in the other options refers to the risk remaining after management actions have been taken, which does not fit the context of an IPO.

Correct Option:

C. Inherent risk.
The IIA Standards define inherent risk as "the combination of internal and external risk factors that exists in the absence of any management actions". The risks associated with an IPO—such as limited operating history, absence of a prior public market, and uncertain prospects for future profitability—are inherent to the offering itself.

These risks exist objectively prior to any mitigation actions by the company's management, and therefore constitute a typical example of inherent risk.

Incorrect Option:

A. Residual risk.
Residual risk refers to the portion of inherent risk that remains after management has implemented response measures. The risks of an IPO are not "remaining risks" that have already been addressed by management.

B. Net risk.
"Net risk" is not a standard term in IIA terminology. Even if understood as "net risk after mitigation," it similarly implies a post-management-action state, which does not fit the IPO context.

D. Underlying risk.
"Underlying risk" is not a defined term in the IIA Standards. The standard classification is inherent risk and residual risk; this option is merely a distractor.

Reference:
IIA Global Internal Audit Standards define inherent risk as the combination of internal and external risk factors that exists in the absence of any management actions, while residual risk is the portion that remains after management actions. IIA guidance emphasizes that internal auditors should consider both when assessing risk.

Explanation:
According to IIA Standard 2340 (Engagement Supervision), engagement supervision includes "identifying and resolving problems in a timely manner." When an internal auditor discovers during the review process an error that could affect the overall engagement results, the most appropriate action is to promptly report it to the engagement supervisor, who will determine the next steps—such as expanding testing, re-evaluating evidence, or adjusting conclusions. The internal auditor should not unilaterally decide to "proceed and correct later" (A), conceal the issue with a disclaimer (B), or ignore the error (C); all of these would compromise the quality of the engagement and the reliability of the conclusions.

Correct Option:

D. Inform the engagement supervisor of the error and allow the supervisor to determine the appropriate action to take.

IIA Standard 2340 requires engagement supervision to include "identifying and resolving problems in a timely manner." Reporting errors to the supervisor is the institutionalized approach to problem resolution.

The supervisor possesses a broader perspective and authority to determine whether to expand testing, revise workpapers, or adjust the engagement conclusion, ensuring the error is handled appropriately.

This approach aligns with supervisory review requirements (Standard 2340) and quality assurance requirements (Standard 1300).

Incorrect Option:

A. Proceed with addressing the error and report any corrections to the engagement supervisor during the scheduled exit meeting.
Waiting until the exit meeting to report is too late. If the error has already affected conclusions or the report, delaying reporting means the error may propagate through subsequent work and compromise the overall engagement results.

Issues should be resolved "in a timely manner," not deferred until the engagement is concluding.

B. Issue the audit report to senior management on schedule but include a disclaimer about the error.
Issuing a report containing known errors, even with a disclaimer, undermines the reliability and credibility of the engagement conclusion. Errors should be corrected before the report is issued, not disclosed through a disclaimer.

C. Proceed with the scheduled closing of the engagement without consideration of the identified error.
Ignoring a known error constitutes a failure to exercise due professional care and violates the requirements of Standard 2340, potentially leading to erroneous conclusions and inappropriate recommendations.

Reference:
IIA Standard 2340 (Engagement Supervision) requires that supervision include "identifying and resolving problems in a timely manner." Implementation guidance further clarifies that engagement supervisors are responsible for reviewing workpapers, evaluating conclusions, and ensuring engagement quality; errors affecting engagement results should be promptly reported to and resolved by the supervisor.

Explanation:
COSO's guidance on board risk oversight clearly states that one of the board's core responsibilities is to "review the entity's risk portfolio and consider it against the entity's risk appetite". Option A captures this monitoring and comparison responsibility. The board establishes risk appetite and risk tolerance, and on that basis oversees management's risk activities to ensure they remain within acceptable boundaries. Option C ("reviewing the risk portfolio") is similar in meaning but narrower, focusing only on the "portfolio" rather than ongoing "monitoring activities." Option B is an execution responsibility that belongs to management, and Option D incorrectly assigns responsibility for the effectiveness of the risk management framework to the board, whereas it is management that is responsible for designing and operating the framework.

Correct Option:

A. Monitor the organization's overall risk activities in relation to its risk appetite and other risk criteria.
The board's risk oversight responsibility includes establishing risk appetite and risk tolerance, and monitoring whether management's risk activities align with them. COSO lists "reviewing the entity's risk portfolio and considering it against the risk appetite" as one of the board's four core areas of responsibility. Option A emphasizes "monitoring" and "in relation to risk appetite," which accurately reflects the board's ongoing oversight role, rather than management's execution function.

Incorrect Option:

B. Guide the integration of risk management with other business planning and management activities.
Integrating risk management into business planning and daily management is a responsibility of management (the first line), not of the board. The board's role is oversight, not guidance on execution.

C. Review the portfolio of risk of the organization in relation to its risk appetite.
This option is close in meaning to A, but "reviewing the portfolio" is a component of the board's oversight activities, whereas A more completely expresses the board's ongoing "monitoring" responsibility and includes "other risk criteria." In single-choice questions, A is the more comprehensive and accurate expression.

D. Assume responsibility for the effectiveness and success of the risk management framework.
Management is responsible for the design and operational effectiveness of the risk management framework; the board is responsible for oversight, not for assuming responsibility for the framework's success. This option confuses the boundary between governance and management.

Reference:
COSO Effective Enterprise Risk Oversight: The Role of the Board of Directors (2009) states that board risk oversight responsibilities include: understanding and agreeing with risk appetite, understanding the extent to which management has established effective ERM, reviewing the risk portfolio against risk appetite, and being informed of significant risks and management's responses. IIA 2026 guidance also confirms that the board establishes risk appetite and oversees senior management.

Explanation:
According to IIA guidance and general corporate governance practice, the operational effectiveness of an organization's code of ethics requires supporting mechanisms, and an annual compliance attestation is one of the effective means to ensure that employees understand and commit to complying with the code. The IIA's "Insights to Quality" publication explicitly lists "internal auditors annually sign off on their commitment to ethical behavior" as a successful practice. The other options are incorrect: the code of ethics should prioritize a values-based rather than purely rule-based approach; there is no need to create two versions for internal and external use; and its operational effectiveness can indeed be tested through maturity models and other methods.

Correct Option:

D. It should require an annual attestation of compliance with the code of conduct by all employees.
Annual attestation is a specific mechanism for implementing the code of ethics, ensuring that employees periodically review and confirm their compliance obligations, rather than merely receiving the document once during onboarding.

IIA's Insights to Quality (2025) explicitly lists "internal auditors annually sign off on their commitment to ethical behavior" as a successful practice in the "Demonstrate Integrity" principle.

This mechanism provides auditable evidence of compliance, facilitating internal audit or compliance departments in testing the operational effectiveness of the code of ethics.

Incorrect Option:

A. It should be written with primary consideration given to using a rule-based approach.
Effective codes of ethics should prioritize values-based principles, rather than purely rule-based lists. A purely rule-based code is often too lengthy, difficult to understand, and cannot cover all ethical dilemmas. The IIA Code of Ethics itself establishes principles (integrity, objectivity, confidentiality, competency) and interprets them through rules of conduct, rather than being a purely rule-based document.

B. It should be of two variations: one applicable internally and one applicable for third parties.
This statement lacks a basis in the IIA framework. Organizations may have separate supplier codes of conduct, but the organization's code of ethics itself should embody unified core values and does not need to be split into two versions with different standards for internal and external parties.

C. Its operational effectiveness cannot be tested using traditional audit and rating systems such as maturity models.
The operational effectiveness of the code of ethics can be evaluated through various methods, including maturity models, compliance testing, training completion rates, attestation rates, and whistleblowing data analysis. IIA's quality assessment practices also include annual ethics training and attestation as evidence of effectiveness.

Reference:
IIA "Insights to Quality" (June 2025) lists annual ethics training and annual sign-off on ethical behavior commitment as successful practices under the "Demonstrate Integrity" principle. The IIA Code of Ethics establishes principles and rules of conduct, emphasizing values-based guidance.

Explanation:
According to IIA Standard 1220.A2, in exercising due professional care, internal auditors must consider the use of technology-based audit and other data analysis techniques. This is an explicit requirement of the Standards for the exercise of due professional care. Option B (undertaking necessary training) relates to professional competence and proficiency, which is a prerequisite for performing work, but does not directly demonstrate the exercise of due professional care. Option A (reporting to the board) relates to organizational independence, and Option C (assuming fraud exists) is a mindset of professional skepticism, neither of which directly corresponds to the provisions of Standard 1220.A2.

Correct Option:

D. Internal auditors consider the use of technology-based audit and other data analysis techniques.

IIA Standard 1220.A2 explicitly stipulates: "In exercising due professional care internal auditors must consider the use of technology-based audit and other data analysis techniques".

This is a concrete manifestation of the Standards' requirement for due professional care, reflecting the auditor's prudent consideration of the appropriateness of engagement methods.

The Implementation Guide for Standard 1220 also lists this as one of the key elements of due professional care.

Incorrect Option:

A. The internal audit activity reports directly to the board on the engagements it performs.
Reporting directly to the board reflects organizational independence (Standard 1110), which is unrelated to due professional care. Due professional care concerns the level of care and skill exercised by auditors in performing their work, not the reporting line.

B. Internal auditors undertake the necessary training to complete their audit work.
Training relates to professional proficiency (Standard 1210), which is a prerequisite for auditors to possess the skills necessary to perform their work. Although proficiency supports the exercise of due professional care, the act of "undertaking training" itself is not a direct demonstration of due professional care.

C. The completion of engagements is based on the assumption that fraudulent activities may exist.
This reflects professional skepticism, which is related to the consideration of fraud risk but is not equivalent to due professional care. Due professional care encompasses broader considerations, including the scope of work, materiality, cost-benefit, and the use of technology.

Reference:
IIA Standard 1220.A2 (2017) and its Implementation Guide explicitly require that internal auditors, in exercising due professional care, must consider the use of technology-based audit and other data analysis techniques; this is a mandatory element for demonstrating conformance with Standard 1220.

Explanation:
According to IIA Standard 2110.A2 and its implementation guidance, the core role of internal audit in IT governance is independent assessment and assurance, not participation in management execution. Internal audit should assess whether IT governance activities are aligned with the organization's risk appetite and whether they take emerging risks into consideration, which is precisely the appropriate positioning of internal audit as the "third line of defense" to provide independent assurance. Options A and C involve internal audit participating in decision-making or interpreting risks and formulating strategies on behalf of management, which would impair independence and objectivity; option B includes "developing policies," which is a management responsibility and likewise exceeds the assurance and advisory boundaries of internal audit.

Correct Option:

D. Assess whether governance activities are aligned with the organization's risk appetite and take into consideration emerging risks.
IIA Standard 2110.A2 requires internal audit to assess whether the organization's IT governance supports the organization's strategies and objectives, and to make recommendations for improvement.

IIA guidance explicitly states that internal audit assessments should include "assessing the degree to which IT governance activities and standards are consistent with the internal audit activity's understanding of the organization's risk appetite".

Considering emerging risks is a key element of effective governance assessment; internal audit should evaluate whether governance mechanisms can identify and respond to rapidly changing risk exposures.

Incorrect Option:

A. Independently evaluate the skills and experience of potential chief information officer candidates to assess the best fit based on the organization's risk appetite.
Evaluating candidates for senior management positions is a human resources and governance decision-making matter; having internal audit participate in selection assessments would compromise its independence and objectivity, because internal audit may later need to audit that CIO's area of responsibility.

B. Evaluate the organization's governance standards and assess IT-related activities to identify gaps and develop policies, ensuring alignment with the organization's risk appetite.
The first half of this option (evaluating governance standards and identifying gaps) falls within the scope of internal audit; however, "developing policies" is management's responsibility. Internal audit may recommend improvements but should not formulate policies on management's behalf.

C. Assist management in interpreting complex IT-related privacy and security risk exposures and evaluating potential mitigation strategies.
Internal audit may provide advisory services, but if it assumes the role of "interpreting risks on behalf of management" and participating in the selection of mitigation strategies, it would become a participant in management decisions, thereby impairing the independence of subsequent assurance activities.

Reference:
IIA Standard 2110.A2 requires internal audit to assess whether IT governance supports the organization's strategies and objectives; IIA GTAG "Auditing IT Governance" states that assessments should include the consistency of governance activities with the organization's risk appetite.

Correct Answer: C
C. An overall commitment of the organization to improve the quality of life for not only the employees but the community at large.
This is correct because Corporate Social Responsibility (CSR) represents an organization's commitment to considering its impact on society and improving the well-being of employees, their families, and the wider community. CSR also includes ethical business practices, environmental responsibility, and sustainable development.

Incorrect Options:
A. An organizational focus on improving the overall environment, even if it is to the detriment of the local community.
Incorrect. CSR considers the broader interests of society and stakeholders. Improving the environment should not come at the expense of the local community. Both social and environmental responsibilities are important.

B. A philosophy driven by employees that flows up to senior management and the board of directors.
Incorrect. CSR is an organization-wide commitment that should be championed by senior management and the board of directors. It is not exclusively an employee-driven, bottom-up philosophy.

D. A policy of ensuring that the organization is socially responsible, even if it leads to unprofitability due to increased costs.
Incorrect. CSR does not require an organization to operate at a loss. It involves balancing economic performance with social and environmental responsibilities to support long-term sustainability.

Official References:
1. CIA Part 1 Exam Syllabus – Domain V: Governance, Risk Management, and Control; Topic D: Corporate Social Responsibility.

Final Answer: C

Correct Answer: A
A. Outsource the engagement to an external audit firm that has appropriate skills.
This is correct because when the internal audit activity lacks the specialized knowledge and skills required to perform an engagement, the Chief Audit Executive (CAE) should obtain competent advice and assistance from qualified external professionals. Outsourcing the engagement to an experienced external audit firm ensures that the review is performed by individuals with the necessary expertise in international transfer pricing legislation and pricing methods.

Incorrect Options:
B. Recruit a lawyer with knowledge of the legislation to the audit team and ask the new auditor to perform the engagement.
Incorrect. Hiring a lawyer may provide legal expertise, but the engagement also requires specialized knowledge of international transfer pricing methods. A lawyer alone may not possess all the necessary competencies to perform the review.

C. Decline to perform the engagement, as the internal audit activity does not have the appropriate skill set.
Incorrect. The CAE should not immediately decline the engagement. The appropriate course of action is to obtain competent advice and assistance from qualified external professionals to address the competency gap.

D. Carry out the engagement using existing internal audit staff to help them gain the appropriate experience.
Incorrect. Internal auditors should not perform an engagement without the necessary knowledge and skills simply to gain experience. This could compromise the quality and reliability of the audit results.

Official References:
1. The IIA – Global Internal Audit Standards (2024), Standard 3.1: Competency.
2. The IIA – Global Internal Audit Standards (2024), Standard 13.5: Engagement Resources.
3. The IIA – Global Practice Guide: Internal Auditing Competency Framework.

Final Answer: A

Correct Answer: A
A. To recognize red flags that indicate fraud.
This is correct because according to The IIA's Internal Auditing Competency Framework, recognizing types of fraud, fraud risks, and red flags for fraud is classified under the General Awareness competency level. General Awareness represents the minimum level of competency expected from internal auditors. Evaluating fraud potential and recommending fraud controls require Applied Knowledge, while forensic auditing techniques require Expert-level competency.

Incorrect Options:
B. To recommend controls to prevent fraud.
Incorrect. Recommending controls to prevent and detect fraud falls under the Applied Knowledge competency level. It requires a deeper understanding of fraud risks and organizational fraud management beyond basic awareness.

C. To apply forensic auditing techniques to detect fraud.
Incorrect. Applying forensic auditing techniques in fraud prevention, deterrence, and investigation is classified under the Expert competency level. It requires specialized knowledge and advanced skills.

D. To evaluate the potential for fraud.
Incorrect. Evaluating the potential for fraud and how the organization detects and manages fraud risks falls under the Applied Knowledge competency level, not the minimum General Awareness level.

Official References:
1. The IIA – Internal Auditing Competency Framework (2020), Performance Competencies, Knowledge Area: Fraud, General Awareness.
2. CIA Part 1 – Internal Audit Fundamentals Exam Syllabus, Section D: Fraud Risks.

Final Answer: A

Correct Answer: C
C. Compensation programs
This is correct because improperly designed compensation programs, particularly those heavily linked to short-term financial performance targets, can create pressure on employees and management to manipulate results, engage in excessive risk-taking, or commit fraud to achieve financial rewards. Therefore, compensation programs must be designed carefully to encourage ethical behavior and align employee incentives with organizational objectives.

Incorrect Options:
A. Disclosure of outside business activities
Incorrect. Disclosing outside business activities helps identify potential conflicts of interest and promotes transparency. It is generally a preventive measure rather than a measure likely to trigger adverse behavior when properly implemented.

B. Ethics training programs
Incorrect. Ethics training programs promote ethical awareness, integrity, and appropriate workplace behavior. Their purpose is to reduce unethical conduct and strengthen the organization's ethical culture.

D. Exit interviews
Incorrect. Exit interviews help organizations identify workplace concerns, management weaknesses, and potential misconduct. They are generally used to obtain feedback and identify organizational risks rather than create incentives for fraudulent behavior.

Official References:
1. The IIA – Practice Guide: Auditing Executive Compensation and Benefits.
2. The IIA – Practice Guide: Internal Auditing and Fraud, 3rd Edition.

Final Answer: C