Free IIA-CIA-Part2 Practice Test Questions 2026

An internal auditor is planning an audit engagement of a subsidiary organization. The auditor learns that a corporate investigator from the holding organization is investigating the subsidiary regarding a fraud case. Which of the following is true regarding the scope of the internal auditor’s engagement?

A. As the fraud is already being investigated by the corporate investigator, it should be excluded from the scope of the audit engagement

B. The engagement should be framed as an advisory engagement to support the corporate investigator's work

C. The area under investigation should be excluded from the engagement scope if the auditor does not have the technical skills required to support a fraud investigation

D. The scope should consider the nature of the fraud risk and control weaknesses identified from the fraud case

Which of the following is the primary purpose of implementing a program whereby employees are rotated from other parts of the organization into the internal audit activity?

A. It provides the internal audit activity with more resourcing options to meet the audit plan

B. It offers internal auditors the opportunity to learn more about other work areas.

C. It gives nonauditors a better understanding of the control environment.

D. It provides an opportunity for the recruitment of employees as permanent internal auditors

A chief audit executive (CAE) a developing a work program for an upcoming engagement that will review an organization’s small contracting services. When of the following would the CAT need to consider most when developing the work program?

A. The contracting department's staffing changes within the last year

B. The certifications held by the internal auditors assigned to the engagement

C. The internal audit activity's increase n budget and staffing for the year

D. The organization's recent changes to how it processes payments

An internal auditor completed a test of 30 randomly selected accounts. For five of the accounts selected, the auditor was unable to find supporting documentation in the normal place of storage. Which of the following next steps would be most appropriate for the internal auditor to take?

A. Conclude that the test failed because at least 17 percent of the sample items were not supported.

B. Select five new accounts to replace the ones that were missing supporting documentation.

C. Expand the sample size to 60 to determine whether the error rate remains the same.

D. Contact management to determine whether the supporting documentation can be located elsewhere.

An internal auditor submitted a report containing recommendations for management to enhance internal controls related to investments. To follow up, which of the following is the most appropriate action for the internal auditor to take?

A. Observe corrective measures.

B. Seek a management assurance declaration.

C. Follow up during the next scheduled audit.

D. Conduct appropriate testing to verify management responses.

An internal auditor is planning to audit the organization's payroll function, which was recently outsourced. Which of the following is the most appropriate first step for the auditor?

A. Review management's organ nationwide risk assessment

B. Understand the objectives and strategies of the new arrangement

C. Revise the scope of the audit engagement

D. Form objectives for the audit engagement

Which of the following is an effective approach for internal auditors to take to improve collaboration with audit clients during an engagement?

1. Obtain control concerns from the client before the audit begins so the internal auditor can tailor the scope accordingly.

2. Discuss the engagement plan with the client so the client can understand the reasoning behind the approach.

3. Review test criteria and procedures where the client expresses concerns about the type of tests to be conducted.

4. Provide all observations at the end of the audit to ensure the client is in agreement with the facts before publishing the report.

A. 1 and 2 only

B. 1 and 4 only

C. 2 and 3 only

D. 3 and 4 only

In the following risk control map risks have been categorized based on the level of significance and the associated level of control. Which of the following statements is true regarding Risk C?

A. The level of control is appropriate given the level of risk

B. The level of control is excessive given the level of risk

C. The level of control is inadequate given the level of risk

D. There is not enough of information to determine whether the controls are appropriate or not

The audit plan of an internal audit function includes an assurance engagement of the organization’s cybersecurity protocols. However, the engagement supervisor assigned to execute the engagement identifies that the internal auditors with competencies in cybersecurity are scheduled for upcoming leave and are involved in other engagements. Those auditors would not be available to participate in the cybersecurity engagement. Which of the following would be the appropriate action for the engagement supervisor?

A. Reassign the competent auditors immediately.

B. Notify the board that the cybersecurity engagement cannot be performed due to a lack of competent resources.

C. Suspend the cybersecurity engagement due to the lack of internal auditors with relevant competencies.

D. Seek advice from the chief audit executive on appropriate actions related to the cybersecurity engagement.

A manager has allowed a subordinate employee to have greater control and responsibility over the tasks that he performs This is an example of which of the following?

A. Job enlargement

B. Job enrichment

C. Horizontal loading of the job.

D. Job rotation.

Which of the following would not be a typical activity for the chief audit executive to perform following an audit engagement?

A. Report follow-up activities to senior management.

B. Implement follow-up procedures to evaluate residual risk.

C. Determine the costs of implementing the recommendations.

D. Evaluate the extent of improvements.

The chief audit executive can illustrate the value of the internal audit activity by reporting which of the following to the board?

A. The overall performance resulting from the internal audit balanced scorecard

B. The number of outstanding and overdue management actions

C. The experience of the organization's internal auditors

D. The number of audits in the annual audit plan relative to similar organizations