Free IIA-CIA-Part2 Practice Test Questions 2026

According to IIA guidance, which of the following statements best justifies a chief audit executive's request for external consultants to complement internal audit activity (IAA) resources?

A. The organization's audit universe is extensive and diverse.

B. There has been an increase in unanticipated requests for advisory work.

C. Previous work provided by the external service provider has been of great quality and value.

D. A recent benchmarking study found that using external service providers is a common practice of similarly-sized IAAs in other organizations.

During planning, the chief audit executive submits a risk-and-control questionnaire to management of the activity under review. Which of the following statements is true regarding the questionnaire?

A. It would be an inefficient way for internal auditors to address multiple controls in the activity under review.

B. It would limit certain members of the internal audit team from being fully involved in the engagement.

C. It would be the most effective way for the internal audit team to obtain a detailed understanding of the processes and controls in the activity to be audited.

D. It would be an efficient way for the internal audit team to determine whether specified control activities are in place.

An internal auditor reviewed the tender documents for the procurement of manufacturing equipment and observed the following:

Tender technical specifications were compliant with internal policies.

The sole assessment criterion of the tender was economic feasibility.

All bids were submitted to a designated software and could not be opened before the submission deadline.

The winner was approved by senior management.

The winner was selected based on which bidder offered the newest technology.

Which of the following is the most appropriate conclusion?

A. Key controls of the procurement process operate as intended based on the analysis of the specific tender documents.

B. IT controls implemented to ensure confidentiality of submitted bids seem to have several deficiencies.

C. Management's selection of the winner should be positively acknowledged for focusing on innovative technological solution.

D. The principles of transparency and equal treatment of bidders seem to be impaired.

According to IIA guidance, which of the following statements is false regarding a review of the controls in place to prevent fraud?

A. The review should focus on the efficiency of the controls in place to prevent fraud.

B. The scope of the review does not need to include all operating areas of the organization.

C. The cost of the control should be compared to the benefit of mitigating the related risk.

D. The review should assess whether the internal controls can be circumvented.

Which of the following actions is the most appropriate response for an internal auditor to take when a significant risk is identified during a consulting engagement?

A. Report the risk identified from the consulting engagement to senior management.

B. Do not include the risk in the assessment of risk management processes, as that is management's responsibility.

C. Do not report the risk, as it is out of scope for the consulting engagement.

D. Include the risk identified from the consulting engagement in the next annual risk assessment only if it is part of the consulting engagement objectives.

Which of the following is the best option for the chief audit executive to consider for effective coordination of assurance coverage?

A. Create an assurance map to illustrate each provider's level of assurance and planned activities for each area of the organization

B. LIMIT© ricks inventory to identify the risks and controls in place and the relevant control owners.

C. Rely on the risk and control and management testing information maintained for compliance with the regulatory framework

D. Prepare a risk likelihood and impact heal map to prioritize assurance coverage coordination.

In which of following scenarios is the internal auditor performing benchmarking?

A. The auditor compares information from one period with the same information from the poor period

B. The auditor compares new information to his general knowledge of the organization

C. The auditor compares information he collected with simmer information from another source

D. The auditor compares expected outcomes with actual results

An internal auditor notes that employees continue to violate segregation-of-duty controls in several areas of the finance department, despite previous audit recommendations. Which of the following recommendations is the most appropriate to address this concern?

A. Recommend additional segregation-of-duty reviews.

B. Recommend appropriate awareness training for all finance department staff.

C. Recommend rotating finance staff in this area.

D. Recommend that management address these concerns immediately.

Which of the following best describes external benchmarking using trend analysis for a subsidiary of an international company?

A. Comparing the current ratio of the subsidiary with the current ratio of another company for the same period

B. Comparing common-size financial statements of the subsidiary with the averages of the industry for the last two periods

C. Comparing the sales of the subsidiary with the sales of another subsidiary for the last two periods.

D. Comparing the sales of the subsidiary with the budgeted figures for the last two periods

An internal auditor at a bank informed the branch manager of a malfunctioning lock on one of the vaults. The risk associated with this issue was deemed significant by the chief audit executive (CAE), and immediate remediation was recommended. However, during a followup engagement, the branch manager told the CAE that the risk was actually not significant,hence no action was taken. What is the most appropriate next step for the CAE?

A. Inform senior management that the branch manager decided to cancel the committed action plan without any previous communication.

B. Discuss the issue with the board, which has ultimate responsibility to resolve this risk.

C. Have another discussion with the branch manager, attempt to change his view, and encourage him to implement the recommendations.

D. Document the branch manager’s decision to accept the risk; otherwise, no other specific course of action is required.

An organization must maintain a current ratio of at least 1.2 to comply with debt covenants. Its current ratio is now 0.9. Which year-end transaction can increase the current ratio?

A. Paying off an overdraft debt using funds from another bank current account.

B. Purchasing inventory using funds from long-term bank loans.

C. Acquiring a new car through leasing.

D. Factoring short-term accounts receivable in exchange for cash.

A chief audit executive (CAE) identifies that the internal audit activity lacks a necessary skill to perform a management request for a consulting engagement. According to IIA guidance, which of the following Is the most appropriate action the CAE should take regarding the request?

A. Assign the engagement to a more senior internal auditor.

B. Decline the engagement request.

C. Allow the internal auditors to acquire the needed skills while performing the engagement.

D. Supervise the assigned internal auditors throughout the engagement.