Free IIA-CIA-Part2 Practice Test Questions 2026

While conducting a review of the logistics department the internal audit team identified a crucial control weakness. The chief audit executive (CAE) decided to prepare an audit memorandum for management of the logistics department followed by an informal meeting What is the most likely reason the CAE decided to prepare the audit memorandum?

A. To report up-to-date audit progress to management

B. To ensure that the internal audit team and the CAE are aligned with regard to the identified weakness

C. To allow management to address the identified weakness timely

D. To obtain management's agreement with regard to the identified weakness

A bank uses customer departmentalization to categorize its departments. Which of the following groups best exemplifies this method of categorization?

A. Community, institutional, and agricultural banking

B. Mortgages, credit cards, and savings.

C. South, southwest and east.

D. Teller, manager, and IT specialist

The internal auditors available to perform the engagement do not have sufficient skills related to the area under review. Which of the following iss an appropriate action for the chief audit executive to take?

A. Continue the engagement with the available staff, providing more hands-on supervision than usual

B. Limit the objectives and scope of the engagement to align them with the skills available among the current staff.

C. Cosource the performance of the engagement using personnel in the area that will be reviewed to supplement the knowledge of the staff and complete the engagement

D. Supplement the internal auditors assigned to the engagement by bringing onto the engagement team a consultant who is independent of the area under review and has the missing expertise

During a review of the organization's waste management processes, the internal auditor discovered that wastewater is being disposed of inappropriately. The auditor's recommendations, suggested to mitigate the risk of regulatory sanctions and reputational damages, were accepted and timelines for implementation were agreed. However, during the internal audit activity's periodic follow-up exercise, management indicated that the recommendation was too expensive to implement and the current disposal method has been cost-effective. What should the chief audit executive do in this case?

A. Nothing, as the internal audit activity has fulfilled its responsibility of providing recommendations to mitigate the risks to which the organization is exposed.

B. Contact the regulatory agency responsible for monitoring such matters in order to convince management to implement the recommendations.

C. Convene a meeting with senior management and discuss the issue and the potential impact it may have on the organization.

D. Highlight the current exposure to the external auditors so they too can highlight the issue and further pressure management to address the concern.

The internal auditor and her supervisor are in dispute about a risk that was not tested during an audit of the procurement function. Which of the following tools would best support the auditor's decision not to test the risk?

A. A spaghetti map

B. A heat map.

C. A process map

D. An assurance map

During follow-up. the internal auditor discovered that operational management did not implement effective actions to address a significant control breach If the issue is left unresolved it may result in regulatory sanctions and damage the organization's reputation What is the most appropriate next step for the chief audit executive to lake?

A. Report the matter to the board

B. Implement the recommended control to address the exposure

C. Discuss the matter with senior management

D. Ask the regulatory agency to persuade management to address the issue

An internal auditor determined that the organization's accounting system was designed to reject duplicate invoices if they were issued with identical invoice numbers. However, if an invoice number was changed by at least one digit, the system would accept the duplicate invoice as new. Which of the following would be the most appropriate criteria to refer to in the audit observation?

A. Each invoice for goods or services acquired by the organization must be recorded only once in the accounting system.

B. The accounting system lacks efficient controls for the identification of duplicate invoices.

C. Disbursements may be made inappropriately, and liabilities may be overstated.

D. The accounting system is at the end of its lifetime and is no longer developed by the provider.

When forming an opinion on the adequacy of management's systems of internal control, which of the following findings would provide the most reliable assurance to the chief audit executive?

• During an audit of the hiring process in a law firm, it was discovered that potential employees' credentials were not always confirmed sufficiently. This process remained unchanged at the following audit.

• During an audit of the accounts payable department, auditors calculated that two percent of accounts were paid past due. This condition persisted at a follow up audit.

• During an audit of the vehicle fleet of a rental agency, it was determined that at any given time, eight percent of the vehicles were not operational. During the next audit, this figure had increased.

• During an audit of the cash handling process in a casino, internal audit discovered control deficiencies in the transfer process between the slot machines and the cash counting area. It was corrected immediately.

A. 1 and 3 only

B. 1 and 4 only

C. 2 and 3 only

D. 2 and 4 only

An internal audit team leader is having difficulties completing the planning phase of an assurance engagement because the business unit lacks a system of internal controls. Which of the following is the most appropriate course of action for the internal audit team leader?

A. Defer the engagement until a system of internal control has been established

B. Change the scheduled engagement from assurance to consulting to help correct the shortcomings

C. Add a consulting component to the already scheduled assurance engagement

D. Seek the involvement of the external auditor to assist with improving the internal controls

In an assurance engagement focused on the adequacy of organizationwide risk management practices, which of the following best describes a primary area of interest for the engagement?

A. The effectiveness of process-level and transaction-level controls.

B. Conflicts of interest within the organizational structure of the senior management.

C. The alignment of management decisions with the level of risk the organization is willing to accept.

D. The actions of upper management in response to the internal audit acth/lty's reporting

Which of the following is the primary reason the chief audit executive should consider the organization's strategic plans when developing the annual audit plan?

A. Strategic plans reflect the organization's business objectives and overall attitude toward risk.

B. Strategic plans are helpful to identify major areas of activity, which may direct the allocation of internal audit activity resources.

C. Strategic plans are likely to show areas of weak financial controls.

D. The strategic plan is a relatively stable document on which to base audit planning.

During a review of data privacy an internal auditor is tasked with testing management's identification and prioritization of critical data collected by the organization. Which of the following steps would accomplish this objective?

A. interview management to determine what types of data are collected and maintained

B. Trace data from storage to the collection sources to determine how critical data is collected and organized

C. Review a sample of data to determine whether the risk classification is reasonable

D. Document and test a data inventory and classification program by determining the data classification levels and framework