Free IIA-CIA-Part2 Practice Test Questions 2026

An internal auditor examined a nostatistical sample of open accounts receivable balances and discovered that 10 out of 60 exceeded the approved unseated credit limit threshold defined by the organization's policy What should the auditor document in the workpapers?

A. Credit limit over drafts are not monitored in accordance with the organizations policy

B. Seventeen percent of customers' open balances in the sample exceed their approved unsecured credit rent

C. The threshold for credit limits defined by the organization's policy is not adequate

D. Management should perform monthly monitoring of open customer balances

Which of the following is an advantage of utilizing an external fraud specialist in a suspected fraud investigation?

A. Increased access to the organization’s employees.

B. Increased ability to preserve evidence and the chain of command.

C. Increased ability to scrutinize the organization's key business processes.

D. Increased access to the organization’s software and proprietary data.

To effectively communicate the acceptance of risk in an organization a chief audit executive must first consider which of the following?

A. The organization's view on risk tolerance

B. The organization's principal risk events.

C. The organization's risk response strategies

D. The organization's major control activities

Which of the following statements is false regarding roles and responsibilities pertaining to risk management and control?

A. Senior management is charged with overseeing the establishment risk management and control processes.

B. The chief audit executive is responsible for overseeing the evaluation risk management and control processes.

C. Operating managers are responsible for assessing risks and controls in their departments.

D. Internal auditors provide assurance about risk management and control process effectiveness.

The chief audit executive of an international organization is planning an audit of the treasury function located at the organization's headquarters. The current internal audit team at headquarters lacks expertise in the area of financial markets which is needed tor the engagement When of the following would be the most approbate solution considering the time constraint?

A. Outsource the engagement 10 tie organization's external auditor who has expertise in the area of financial markets

B. Hire additional internal auditors who have expertise in the area of financial markets.

C. Invite a guest auditor from one of the organization's affiliates who has expertise m the area of financial markets.

D. Limit the scope of the engagement to the knowledge and skills possessed by the internal audit team.

During follow-up, the chief audit executive (CAE) is having a discussion with management about the internal audit team's recommendations related to a significant issue Management accepted the issue but took no remedial action What is the next step for the CAE?

A. The CAE should reassess and validate the risk tolerance policy

B. The CAE should escalate the issue to senior management .

C. The CAE should reiterate the internal audit team's recommendations to management .

D. The CAE should grant management more time to implement the recommendation and check the status of the issue during the next scheduled follow-up.

During an organization’s management meetings, employees who report bad news and significant risks are treated as if they were to blame for those circumstances. As a result, employees tend to postpone delivering bad news to management for as long as possible. Which of the following should be addressed to improve this culture?

A. Tone at the top

B. Risk accountability

C. Risk leadership

D. Code of ethics

An internal auditor reviewed bank reconciliations prepared by management of the area under review. The auditor noted that the bank statements attached did not have the bank heading, logo, or address. Which of the following statements is true regarding this situation?

A. The evidence may not be reliable.

B. The evidence is not relevant.

C. The evidence may not be sufficient.

D. The information missing is not relevant to the audit.

The internal audit activity is currently working on several engagements, including a consulting engagement on the management process in the human resources department. Which of the following actions should the chief audit executive take to most efficiently and effectively ensure the quality of the engagement?

A. Assign an experienced manager to monitor the whole engagement process.

B. Employ fieldwork peer review to enhance the work quality.

C. Require internal auditors to follow a standardized work program.

D. Personally supervise the engagement

A multinational organization has asked the internal audit activity to assist in setting up the organization's risk management system The chief audit executive (CAE) agrees to take on the engagement as a consultant. Which of the following tasks is appropriate for the CAE to undertake?

A. Coordinate and facilitate risk workshops for management to attend

B. Establish the degree of risk appetite for management to accept.

C. Set risk Indicators and mitigation plans for management to Implement.

D. Determine the number of significant risks for management to report to the board

Following an audit, management developed an action plan to improve controls over the handling of scrap metal. Which of the following would be the most appropriate course of action for the auditor to follow up?

A. Conduct another audit engagement to ensure all risks related to the sales of scrap metal have been mitigated.

B. Ensure new procedures have been documented, approved, and distributed to the employees responsible.

C. Perform retesting to confirm that new procedures address the previously identified deficient control activities.

D. Analyze the new procedures, then report to senior management whether the associated risks have been managed.

Which of the following is not a direct benefit of control self-assessment (CSA)?

A. CSA allows management to have input into the audit plan.

B. CSA allows process owners to identify, evaluate, and recommend improving control deficiencies.

C. CSA can improve the control environment.

D. CSA increases control consciousness.