Free IIA-CIA-Part2 Practice Test Questions 2026

Explanation:

This question evaluates your understanding of the practical strengths and inherent limitations of flowcharts as a process-mapping tool used during internal audit engagements. While flowcharts are excellent for visually documenting linear sequences, they are not a standalone solution for comprehensive risk identification.

✔️ Correct Option:

C. Flowcharts are best applied to linear process flows but cannot address all risks related to the process.
This statement is accurate because flowcharts visually map sequential steps and decision points but do not inherently analyze or flag risks such as fraud, control gaps, or human errors. They are a diagnostic starting point, not a complete risk-assessment solution.

❌ Incorrect options:

A. Flowcharts are typically not well suited to support information provided by a risk and control matrix.
This is false. Flowcharts directly support risk and control matrices by visually mapping where controls are located, making them highly complementary and useful tools.

B. Flowcharts are preferred to narratives, as they can provide much greater detail on the design and operation of a process.
This is misleading. Narratives often provide richer descriptive detail, especially for complex processes with exceptions, while flowcharts offer visual clarity but not necessarily greater detail.

D. Flowcharts describe process steps but cannot provide the level of detail needed to adequately assess the design of the process.
This is incorrect. Flowcharts can provide sufficient detail—including decision points, documents, and handoffs—to effectively assess process design; they are a standard and accepted tool for this purpose.

🔧 Reference:
→ Institute of Internal Auditors (IIA) Practice Guide: Flowcharting – Confirms flowcharts are used to document process flows and identify control points but are not a substitute for risk analysis.

Explanation:

This question tests the auditor's understanding of engagement planning tools used to manage workload and ensure operational efficiency. It requires identifying the most practical tool to help an individual auditor organize multiple required tasks and track the completion of planned work without omitting key steps.

✅ Correct Option:

B. Create a checklist
A checklist is a highly effective, practical tool that breaks down complex processes into discrete, actionable steps. For a new auditor managing a heavy workload during engagement planning, a checklist provides immediate structure, helps prioritize activities (such as scheduling interviews, gathering policies, and executing walk-throughs), and ensures all mandatory standards are consistently met.

❌ Incorrect options:

A. Review the auditor's job description
A job description outlines broad professional roles, general responsibilities, performance expectations, and organizational reporting hierarchies. While it defines the auditor's long-term function within the company, it does not provide the specific, tactical, or step-by-step task tracking required to execute and organize a localized audit planning phase.

C. Develop a control questionnaire
An internal control questionnaire is a specialized diagnostic tool used by auditors to gather information directly from the auditee regarding the design of business unit controls. While it is an important planning document for evaluating the risk environment under review, it does not organize or track the auditor's personal task list.

D. Prepare a fishbone diagram
A fishbone (or Ishikawa) diagram is a structured cause-and-effect visualization tool used during problem-solving to brainstorm and categorize the root causes of a specific operational failure. It is an analytical tool used during the fieldwork or reporting phases, not an organization tool for an auditor's daily planning tasks.

🔧 Reference:
→ The IIA Standards Guidance on Engagement Planning Tools confirms that standardized templates and task checklists are essential for ensuring the completeness, consistency, and proper organization of preliminary audit activities.

Explanation:

This question tests communication practices during the reporting stage of an internal audit engagement. Draft reports are typically reviewed with appropriate parties before issuing the final report to verify accuracy, obtain management responses, and resolve disagreements. This process helps ensure findings are complete, fair, and supported by sufficient evidence.

🟢 Correct Option:

C. 1, 2, and 3
Draft reports should generally be reviewed with the client manager and management representatives responsible for the area being audited. Individuals who may challenge the report can provide clarification and supporting information, while persons responsible for corrective actions should participate because they will implement recommendations. This review process improves report accuracy and increases agreement on findings before final issuance.

🔴 Incorrect options:

A. 1 only
Reviewing only with the client manager and superior is too limited. Other relevant parties, especially those who may provide clarification or take corrective action, may need involvement.

B. 1 and 2 only
This option excludes individuals responsible for corrective actions. Their involvement is important because they help develop realistic responses and implementation plans.

D. 1, 2, and 4
The same individuals who receive the final report do not necessarily need to participate in draft review discussions. Final report recipients can include broader audiences not directly involved in issue resolution.

🔧 Reference:
⇒ IIA Standards – Communicating Results
Confirms that engagement communications should be accurate, complete, and discussed with appropriate parties.

⇒ IIA Practice Guide – Audit Reporting
Confirms the importance of discussing draft findings with relevant management before final report issuance.

Explanation:

This question tests the difference between inherent risk, residual risk, and risk tolerance. A risk becomes unacceptable when the amount of risk left after controls are applied is still above the organization’s tolerance level. That means the organization cannot reasonably accept it without further treatment.

✔️ Correct Option:

D. A risk where residual risk exceeds the tolerance level
Residual risk is what remains after controls are in place. If that remaining risk is still above the organization’s tolerance level, then the organization considers it unacceptable because the exposure is still too high. In practice, this means management must take additional action such as strengthening controls, transferring the risk, or avoiding the activity.

❌ Incorrect options:

A. A risk where likelihood and impact are high
High likelihood and high impact may indicate a serious risk, but that alone does not define it as unacceptable. The key test is whether the risk exceeds the organization’s tolerance after controls are applied.

B. A risk where inherent risk exceeds its residual risk
This is normal and expected because controls should reduce risk. It does not mean the risk is unacceptable; it only shows that the controls are having some effect.

C. A risk where inherent risk exceeds the tolerance level
Inherent risk is the starting risk before controls. Organizations usually judge acceptability based on residual risk, not inherent risk alone, because controls are part of the real operating environment.

🔧 Reference:
→ The IIA — Standard 2600: Communicating the Acceptance of Risks — confirms that internal audit considers whether management accepts risks within tolerance.

→ The IIA — Global Internal Audit Standards — supports evaluating risks in relation to organizational objectives and risk tolerance.

Explanation:

This question tests understanding of when a CAE's prior operational role creates an objectivity impairment under IIA guidance. It focuses on identifying which past involvement in the payroll function directly conflicts with the standard that auditors should not review activities for which they previously held responsibility.

✅ Correct Option:

C. Prior to becoming the CAE, the CAE was the payroll manager
Objectivity is presumed impaired when an internal auditor provides assurance over an area they previously managed, particularly in a direct operational capacity. As former payroll manager, the CAE held ownership of the processes and controls now under review, creating a self-review threat and a real risk of biased judgment regarding past decisions and practices within that function.

❌ Incorrect Options:

A. The CAE previously undertook a consulting assignment in that area to improve processes
IIA guidance permits assurance services following prior consulting work, provided the consulting did not impair objectivity and individual objectivity is properly managed. This scenario does not automatically create an impairment, since consulting roles are distinct from direct operational responsibility.

B. A couple of years ago, the CAE performed accounting functions for the payroll department
Objectivity impairment is generally presumed only for responsibilities held within the previous year. Since this involvement occurred a couple of years earlier, sufficient time has passed for the concern to be less significant compared to a direct managerial role held immediately before becoming CAE.

D. The assurance review was initiated following issues identified during a consulting assignment requested by management
This describes a normal, appropriate sequence where consulting work leads to a follow-up assurance review. It does not represent a conflict of interest, since the CAE is responding to management's request rather than reviewing an area of prior personal responsibility.

🔧 Reference:
→ IIA Attribute Standards – Standard 1130 — confirms objectivity is presumed impaired when providing assurance over an activity for which the auditor had prior direct responsibility.

Explanation:

This question tests your understanding of the reporting requirements for the Quality Assurance and Improvement Program (QAIP) under IIA guidance. The Standards establish clear timelines for communicating different types of quality assessment results to the board and senior management.

✔️ Correct Option:

D. Results of ongoing monitoring of the internal audit activity's performance must be reported to senior management and the board at least annually.
This is correct per IIA Standard 1320. The interpretation of this standard specifies that "the results of ongoing monitoring are communicated at least annually" to demonstrate conformance with the Standards . Ongoing monitoring is a key component of internal assessments and requires regular reporting .

❌ Incorrect options:

A. Results of internal assessments need to be reported to the board at least once every five years.
This is incorrect. The five-year requirement applies to external assessments, not internal assessments. Internal assessment results must be reported at least annually .

B. The external assessor must present the findings from the external assessment to senior management and the board upon completion.
This is not a mandatory requirement. While the CAE must communicate external assessment results, the Standards do not mandate that the external assessor personally present the findings .

C. Deficiencies within the internal audit activity must be reported to the board as soon as they are noted.
This is incorrect. Only nonconformance that impacts the overall scope or operation of the internal audit activity requires disclosure to the board (Standard 1322). Not all deficiencies trigger immediate reporting .

🔧 Reference:
→ IIA Standard 1320: Reporting on the Quality Assurance and Improvement Program – Confirms the CAE must communicate QAIP results, with ongoing monitoring results reported at least annually.

Explanation:

This question tests the auditor's understanding of communication practices during an internal audit engagement. It requires identifying the value of ongoing, transparent communication with management throughout the fieldwork phase.

✅ Correct Option:

A. The auditor should accommodate the request for information and brief management on significant preliminary observations as they develop.
Continuous and open communication with management during an engagement is a best practice in internal auditing. Discussing preliminary observations as they arise ensures there are "no surprises" at the closing conference, allows the auditor to verify the factual accuracy of their findings immediately, and gives management an early opportunity to clarify misunderstandings or gather missing documentation before the final report is drafted.

❌ Incorrect options:

B. The auditor should advise management that the requested information cannot be communicated until the engagement is complete and the results undergo a quality check by the engagement supervisor.
Withholding all information until the entire audit and supervisory review are complete creates an adversarial environment and increases the risk of publishing inaccurate information. While the supervisor must review final conclusions, sharing preliminary observations with operational management is entirely permissible and encouraged.

C. The auditor should share the requested information but clearly communicate that it is not appropriate for him to correct any observations based on further information that may be provided by management.
This statement contradicts the purpose of sharing preliminary findings. If management provides valid, verifiable documentation or context that refutes or alters a preliminary observation, the auditor is professionally obligated to evaluate that evidence and adjust or drop the finding accordingly.

D. The auditor should partially accommodate the request, explaining that he can provide status updates regarding the engagement procedures and timeline but he is unable to provide information regarding preliminary observations.
Limiting updates strictly to timelines and administrative progress is unnecessary and counterproductive. Providing early insights into identified risks or control exceptions helps build a collaborative partnership and allows management to begin researching or implementing immediate corrective actions.

🔧 Reference:
→ The IIA Guidance on Communicating Audit Results emphasizes that routine status updates and the discussion of preliminary observations with engagement clients during fieldwork are essential for ensuring factual accuracy, building trust, and facilitating timely remediation.

Explanation:

This question tests the use of data analytics in evaluating the completeness of an invoicing process. To assess completeness, the auditor should verify whether all electricity consumption that occurred was properly captured and billed. The most effective procedure directly compares actual usage data with invoiced amounts.

🟢 Correct Option:

D. Conduct a comparison to identify deviations between electricity amounts billed to customers and information regarding actual consumption.
Comparing billed electricity amounts with actual consumption data directly addresses invoice completeness. Differences between recorded consumption and invoiced usage may indicate missing charges, billing errors, or processing failures. This approach provides relevant audit evidence because it tests whether all customer consumption has been accurately transferred into the invoicing system and recorded completely.

🔴 Incorrect options:

A. Conduct a trend analysis of customers' payment history and flag those with the most inconsistent payments and debts.
Payment trends focus on customer payment behavior and collection risk. This analysis does not determine whether all electricity consumption was completely invoiced.

B. Conduct a ratio analysis by calculating the relationship between sums paid in local currency and volume of electricity billed in megawatt hours.
Ratio analysis may reveal unusual relationships but does not directly verify whether all consumption amounts were included in the billing process.

C. Conduct an analysis of clients’ electricity consumption patterns within a specified period and identify consumption spikes.
Consumption spike analysis can identify unusual usage patterns but does not directly test whether the invoicing process completely captured and billed the recorded consumption.

🔧 Reference:
⇒ Global Internal Audit Standards – Engagement Evidence and Analysis
Confirms that auditors should obtain relevant and reliable evidence supporting engagement objectives.

⇒ IIA Practice Guide – Data Analytics in Internal Auditing
Confirms that data analysis techniques should directly support the audit objective and testing requirements.

Explanation:

This question is testing when a chief audit executive should escalate a follow-up issue to the board. The key issue is not whether management created an alternate control or whether compliance is good, but whether the remaining risk after the new process is still too high for management to accept.

✔️ Correct Option:

1. In the opinion of the CAE the level of residual risk assumed by senior management is too high
This is the condition that justifies reporting to the board. If the CAE believes the risk left after management’s response is still above an acceptable level, escalation is appropriate. The CAE’s role is to inform the board when management appears to be accepting more risk than the organization should tolerate.

❌ Incorrect options:

2. Testing of compliance with the new process finds that all new contracts in excess of $1 million have been approved by the vice president of sales
This shows the process is being followed, but it does not prove the risk is unacceptable or requires board reporting. Compliance alone does not trigger escalation unless the residual risk remains too high.

3. The cost of modifying the sales system to include a preventive control is less than $100,000
The cost of modifying the system may be useful in deciding among control options, but cost alone does not justify reporting to the board. Board reporting depends on risk significance, not just implementation cost.

🔧 Reference:
→ The IIA — Standard 2600: Communicating the Acceptance of Risks — confirms that internal audit escalates when management accepts a level of risk that may be unacceptable.

→ The IIA — Global Internal Audit Standards — supports communication of significant risk matters to appropriate governance bodies.

Explanation:

This question tests understanding of the AIC's preliminary communication responsibilities before and at the start of a recurring assurance engagement. It focuses on when and how the HR department should be informed about upcoming audit activity to support proper planning and cooperation.

✅ Correct Options:

2. The AIC should notify HR management before the planning stage begins
Early notification allows HR management to prepare, gather relevant information, and designate contacts before fieldwork planning starts. This proactive communication supports a collaborative engagement approach and helps the AIC gather preliminary insights that inform scope and risk considerations before formal planning is finalized.

3. The AIC should schedule formal status meetings with HR management at the start of the engagement
Establishing status meetings early ensures ongoing, structured communication throughout the engagement. This allows HR management to stay informed of progress, raise concerns promptly, and maintain a transparent working relationship, which supports smoother fieldwork execution and reduces surprises at the reporting stage.

❌ Incorrect Options:

1. The AIC should notify HR management when the draft audit plan is being developed, as a courtesy
The internal audit plan is developed at the organizational level, typically well before individual engagements begin. Notifying HR at this early, high-level planning stage is not standard practice; direct communication with HR occurs closer to the specific engagement's planning phase, not during overall plan drafting.

4. The AIC should finalize the scope of the engagement before communicating with HR management
Communicating with HR management should occur before scope finalization, not after. Early dialogue helps the AIC incorporate HR's operational context and concerns into the scope, rather than presenting a fixed scope without input from the area being reviewed.

🔧 Reference:
→ IIA Implementation Guide 2201 – Planning Considerations — supports that internal auditors should establish understanding and communicate with engagement clients early in the planning process to gather relevant information and set expectations.

Explanation:

This question tests your knowledge of the chief audit executive's (CAE) specific responsibilities concerning the final audit report, as defined by IIA Standards. The CAE holds ultimate accountability for the quality and distribution of the final engagement communication.

✔️ Correct Options:

3. Review and approve the final audit report.
The CAE is responsible for reviewing and approving the final engagement communication before it is issued. This is a direct requirement of IIA Standard 2440, confirming the CAE's role in ensuring the quality and accuracy of the final report.

4. Determine who will receive the final audit report.
Determining the appropriate recipients for the final audit report is another core responsibility of the CAE under Standard 2440. The CAE decides to whom and how the results will be disseminated to ensure they reach parties who can give them due consideration.

❌ Incorrect options:

1. Coordinate post-engagement conferences to discuss the final audit report with management.
This is typically a responsibility of the engagement supervisor or the auditor-in-charge, not the CAE. While the CAE has ultimate oversight, the coordination of these operational meetings is usually delegated.

2. Include management's responses in the final audit report.
While management's responses are an important part of the final report, it is the internal auditor's responsibility to ensure they are included appropriately. This is a function of the audit team, not a specific duty reserved for the CAE.

🔧 Reference:
→ IIA Standard 2440: Disseminating Results – Confirms the CAE is responsible for reviewing and approving the final engagement communication before issuance and deciding to whom and how it will be disseminated.

Explanation:

This question tests your understanding of the attributes of an audit observation (Criteria, Condition, Cause, and Effect). It requires you to identify the relationship between a process deficiency (the lack of a requirement for justification) and the observed problem (the accumulation of large travel advances).

✅ Correct Option:

D. A cause of the organization's accumulation of large travel advances
The "Cause" explains the underlying reason why the deficiency or problem exists. In this scenario, the organization is accumulating excessively large travel advances because its current procedures do not require employees to provide any justification for advances over a specific dollar threshold. The lack of a preventative control rule is what allows the accumulation to happen.

❌ Incorrect options:

A. A criterion of the organization's accumulation of large travel advances
"Criteria" represent the standards, measures, or expectations used to evaluate the process (i.e., what should be happening, such as an official policy or industry benchmark). The statement describes a gap in current procedures, not an established standard of performance.

B. A condition of the organization's accumulation of large travel advances
The "Condition" is the factual evidence found during the audit (i.e., what is happening). Here, the condition is the actual "accumulation of large travel advances" by the organization. The procedural gap itself is the reason behind this condition.

C. A consequence of the organization's accumulation of large travel advances
The "Consequence" (or Effect) represents the risk, financial exposure, or impact resulting from the condition (e.g., lost interest income, increased risk of fraud, or unrecovered cash). The lack of a policy requirement is the origin of the issue, not its outcome.

🔧 Reference:
→ The IIA Guidance on Communicating Audit Results establishes that the "Cause" attribute of an audit finding must identify the root control gap or procedural failure that allowed the problematic condition to occur.