Free IIA-CIA-Part2 Practice Test Questions 2026

Acceding to IIA guidance, which of the following statements is true regarding the risk assessment process performed by the internal audit activity?

A. The assessment of high-level risks is typically a linear process.

B. Management should create the preliminary risk matrix

C. The analysis should begin with ne identification of objectives

D. Likelihood should receive greater consideration than impact

An audit observation states the following:

"Despite the rules of the organization there is no approved credit risk management policy in the subsidiary. The subsidiary is concluding contacts with clients who have very high credit ratings. The internal audit team tested 50 contacts and 17 showed clients with a poor credit history"

Which of the following components are missing in the observation?

A. Cause and effect.

B. Effect and criteria

C. Condition and cause

D. Criteria and condition.

Considering the five-attribute approach to documenting deficiencies in an area under review which of the following answers the question. "What should be in place?’’

A. Action plan

B. Recommendation

C. Condition

D. Criteria

An engagement supervisor obtains facilities maintenance reports from a contractor during an audit of third-party services. Which of the following is the source of authority for the engagement supervisor to make such contact outside the organization?

A. The policies and procedures of the internal audit activity.

B. The provisions of the internal audit charter.

C. The authority of the CEO.

D. The IIA's Code of Ethics.

The chief audit executive (CAE) determined that the internal audit activity lacks the resources needed to complete the internal audit plan Which of the following would be the most appropriate action tor the CAE to take?

A. Use guest auditors from within the organization, and leverage their experience by assigning them to lead engagements m areas where they previously worked

B. Outsource some of the audits to the organization s external auditor who is already familiar with the organization

C. Invite nonauditors to join the internal audit activity for a two-year rotational position, and assign them to join audit teams that are reviewing areas where they have no previous management responsibility

D. Recruit recent college graduates and employ them as audit interns with an aim to offer permanent employment

An internal auditor wanted to determine whether company vehicles were being used for personal purposes She extracted a report that listed company vehicle numbers business units to which the vehicles are allocated travel dates, travel duration and mileage She then filtered the data for weekend dates Which of the following additional information would the auditor need?

A. Names and work titles of employees

B. Description of responsibilities of business units.

C. Average fuel consumption data of vehicles

D. Location and route data of vehicles

According to IIA guidance, which of the following typically serves as the basis for an engagement work program?

A. Past audit findings.

B. Scope and audit objectives.

C. Techniques and resources.

D. Stakeholders' expectations.

In an organization with a large internal audit activity that has several audit teams performing engagements simultaneously which of the following tasks is an engagement supervisor most likely to perform during the planning phase of a new engagement?

A. Establish a means for resolving any professional judgment differences over ethical issues that may arise during the engagement.

B. Approve the engagement work program to ensure the program is designed to achieve the engagement objectives

C. Evaluate whether the testing and results support the engagement results and conclusion

D. Review the sample testing results for exceptions.

Which of the following is the most important determinant of the objectives and scope of assurance engagements?

The organizational chart, business objectives, and policies and procedures of the area to be reviewed

A. The most recent risk assessment conducted by management of the area to be reviewed.

B. The requests of operational and senior management throughout the organization.

C. The preliminary risk assessment performed by internal auditors planning the engagement.

During which phase of the contracting process are contracts drafted for a proposed business activity’

A. Initiation phase.

B. Bidding phase.

C. Development phase.

D. Management phase

Which of the following is required to classify, label, organize, and search big data stored and used in an organization?

A. Metadata

B. Data security

C. A business application

D. Data owner

Which of the following sources of audit evidence is most reliable?

A. Evidence obtained directly from an untested third party.

B. Uncorroborated audit evidence obtained indirectly from an employee.

C. Undocumented audit evidence obtained directly from a manager.

D. Timely audit evidence obtained directly from a customer.