Free IIA-CIA-Part2 Practice Test Questions 2026

While reviewing warehouse inventory records, an internal auditor noticed that the warehouse has a surprisingly high number of products in storage. Over the past three years, the auditor had visited this particular warehouse numerous times for previous engagements and remembered that the warehouse was rather small. The auditor then decided to compare the square footage of the warehouse to the recorded number of products in storage. The auditor’s action is an example of which of the following?

A. Performing a reasonableness test.

B. Conducting a fraud investigation.

C. Conducting trend analysis.

D. Operating with impaired objectivity.

An organization's healthcare insurance costs have been rising approximately 10 percent per year for several years. Which of the following analytical review procedures would best evaluate the reasonableness of the increase in healthcare costs?

A. Develop a comparison of the costs incurred with similar costs incurred by other organizations.

B. Obtain the government index of healthcare costs for the comparable period of time and compare the rate of increase with that of the cost per employee incurred by the organization.

C. Obtain a bid from another healthcare administrator to provide the same administrative services as the current healthcare administrator.

D. Review all claims and compare with appropriate procedures to ensure that overpayments have not occurred.

Which of the following is most appropriate for internal auditors to do during the internal audit recommendations monitoring process?

A. Report the monitoring status to senior management when requested.

B. Assist management with implementing corrective actions.

C. Determine the frequency and approach to monitoring.

D. Include all types of observations in the monitoring process.

What is the primary purpose of issuing a preliminary communication to management of the area under review?

A. To build good relations with management

B. To help management develop more responsive and timely action plans

C. To formally report medium- and high-risk observations in writing

D. To improve the internal audit key performance indicators

According to IIA guidance, which of the following statements about analytical procedures is true?

A. Analytical procedures compare information against expectations.

B. Analytical procedures begin after the engagement’s planning phase.

C. Analytical procedures provide internal auditors with explainable results.

D. Analytical procedures are computer-assisted audit techniques.

When constructing a staffing schedule for the internal audit activity (IAA), which of the following criteria are most important for the chief audit executive to consider for the effective use of audit resources?

1. The competency and qualifications of the audit staff for specific assignments.

2. The effectiveness of IAA staff performance measures.

3. The number of training hours received by staff auditors compared to the budget.

4. The geographical dispersion of audit staff across the organization.

A. 1 and 3

B. 1 and 4

C. 2 and 3

D. 2 and 4

During an audit of the accounts receivable (AR) process, an internal auditor noted that reconciliations are still not performed regularly by the AR staff, a recommendation that was made following a previous audit. Monitoring by the financial reporting function has failed to detect the shortcoming. Both the financial reporting function and AR report to the controller, who is responsible for implementing action plans. Which of the following supports the internal auditor's decision to combine both observations into one reported finding?

A. The observation was made during the same audit, and the action plan has a common owner.

B. The observation relates to the same control activity within a common process.

C. The observation has a common control, and it was noted in a prior audit.

D. The observation has a common process, and the action plan for the observation has a common owner.

While conducting an information security audit, an internal auditor learns that the existing disaster recovery plan is four years old and untested. The auditor also learns that in the four years since the recovery plan was implemented, the information systems have undergone extensive changes. Which of the following actions is most appropriate for the auditor to take?

A. Inform management and request that the plan be tested immediately.

B. Update the recovery plan for management, as part of the review.

C. Evaluate the recovery plan and report weaknesses to management.

D. Recommend that management and users update and test the recovery plan.

Which of the following is the most important determinant of the objectives and scope of assurance engagements?

A. The organizational chart, business objectives and policies and procedures of the area to be reviewed.

B. The most recent risk assessment conducted by management of the area to be reviewed.

C. The requests of operational and senior management throughout the organization.

D. The preliminary risk assessment performed by internal auditors planning the engagement

According to IIA guidance, which of the following practices by the chief audit executive (CAE) best enhances the organizational independence of the Internal audit activity^

A. CAE reviews and approves the annual audit plan.

B. CAE meets privately with the CEO at least annually

C. CAE meets privately with the board at least annually.

D. CAE reports to the board regarding audit staff performance evaluation and compensation.

Which of the following could increase risks to the organization’s control environment?

A. Strong board of directors oversight.

B. Incentive-based compensation structures

C. Lower than average employee turnover.

D. Implementation of a fraud hotline

Which of the following evaluation criteria would be the most useful to help the chief audit executive determine whether an external service provider possesses the knowledge, skills, and other competencies needed to perform a review?

A. The financial interest the service provider may have in the organization.

B. The relationship the service provider may have had with the organization or the activities being reviewed.

C. Compensation or other incentives that may be applicable to the service provider.

D. The service provider's experience in the type of work being considered.