Free IIA-CIA-Part2 Practice Test Questions 2026

Which of the following statements regarding the risk management process' support of the internal audit activity is true?

A. The risk management process can provide more extensive internal audit services to the organization if it does not have an internal audit department

B. The risk management process supports internal audit by evaluating whether critical controls are adequate and effective.

C. The risk management process can determine whether all significant risks have been identified and are being treated.

D. The risk management process establishes an organization-specific documented risk management framework.

According to IIA guidance, which of the following reflects a valid principle for the internal audit activity to rely on the work of internal or external assurance providers?

A. Elements of evaluation

B. Elements of organization

C. Elements of practice

D. Elements of confidentiality

Which of the following is true regarding the monitoring of internal audit activities?

A. The form and content of monitoring policies could vary by industry

B. The board of directors is responsible for the establishment of monitoring polities

C. Both large and small audit departments must have written policies on monitoring.

D. The chief audit executive must develop all monitoring policies related to the activity

According to IIA guidance, which of the following is most likely to become part of the engagement work program?

A. Information obtained from historic audits and memos.

B. Risk and control registers or matrices.

C. Resource deployment plans and sampling methodologies.

D. Prior findings and management responses.

While conducting an engagement in the procurement department, the internal auditor noticed that the department head’s travel reports showed minor travel expenses, and there were no charges for hotels, meals, or transportation However, the auditor knew that the department head frequently traveled worldwide to meet with suppliers and visit their production sites. Which of the following would be the most appropriate next step for the auditor?

A. The auditor should make a note of the issue for follow-up when employee travel expenses are audited.

B. The auditor should analyze trends and changes among the organization's suppliers over the past few years.

C. The auditor should investigate whether there are any special arrangements regarding senior management travel.

D. The auditor should analyze the list of destinations the department head visited to estimate typical costs

While performing fieldwork for an assurance engagement, a member of the internal audit team identified a key control that was not identified during the planning phase of the engagement Which of the following actions by the internal auditor would be most appropriate?

A. Promptly adjust the audit work program to include tests that address the newly identified control and notify the other audit team members of the change

B. Proceed with the current audit work program because the engagement scope has already been finalized but plan to address the newly identified control as part of the follow up engagement

C. Adjust the audit work program to account for the new control, but only with approval from the engagement supervisor

D. Discuss the control with management of the area under review and seek their approval prior to including the control in the current audit engagement

During an assurance engagement, an internal auditor noted that the time staff spent accessing customer information in large Excel spreadsheets could be reduced significantly through the use of macros. The auditor would like to train staff on how to use the macros. Which of the following is the most appropriate course of action for the internal auditor to take?

A. The auditor must not perform the training, because any task to improve the business process could impact audit independence.

B. The auditor must create a new, separate consulting engagement with the business process owner prior to performing the improvement task.

C. The auditor should get permission to extend the current engagement, and with the process owner's approval, perform the improvement task.

D. The auditor may proceed with the improvement task without obtaining formal approval, because the task is voluntary and not time-intensive.

While reviewing the workpapers and draft report from an audit engagement, the chief audit executive (CAE) found that an Important compensating control had not been considered adequately by the audit team when it reported a major control weakness Therefore, the CAE returned the documentation to the auditor in charge for correction Based on this Information, which of the following sections of the workpapers most likely would require changes?

1.Effect of the control weakness.

2.Cause of the control weakness

3.Conclusion on the control weakness.

4.Recommendation for the control weakness.

A. 1, 2, and 3.

B. 1.2. and 4

C. 1,3, and 4.

D. 2, 3, and 4.

According to IIA guidance, which of the following is least likely to be a key financial control in an organization's accounts payable process?

A. Require the approval of additions and changes to the vendor master listing, where the inherent risk of false vendors is high.

B. Monitor amounts paid each period and compare them to the budget to identify potential issues.

C. Compare employee addresses to vendor addresses to identify potential employee fraud.

D. Monitor customer quality complaints compared to the prior period to identify vendor issues.

Which of the following is an appropriate activity when supervising engagements?

A. During engagement planning, the audit work program should be discussed between auditors and the engagement supervisor with the supervisor approving the work program.

B. During fieldwork, scope changes made to the work program are at the auditor's discretion and should be supported adequately in the workpapers.

C. Engagement supervision is most critical to the fieldwork and reporting phases of the audit, as this is where the majority of the work takes place.

D. A degree of high supervision to no supervision may be provided to an auditor depending on his level of competence and the complexity of the engagement.

Which of the following statements generally true regarding audit engagement planning?

A. The best source tor detailed process information is senior management

B. Audit objectives should be general and do not change.

C. Computer-assisted audit techniques are typically not useful during engagement planning

D. Internal auditors should prepare a dented audit program for testing controls

According to IIA guidance, which of the following statements is true regarding the authority of the chief audit executive (CAE) to release previous audit reports to outside parties?

A. The CAE can release prior internal audit reports with the approval of the board and senior management.

B. The CAE can employ judgment and release prior audit results as they deem appropriate and necessary.

C. The CAE can only release prior information outside the organization when mandated by legal or statutory requirements.

D. The CAE can release prior information provided it is as originally published and distributed within the organization.