Free IIA-CIA-Part3-3P Practice Test Questions 2026

Which of the following are included in ISO 31000 risk principles and guidelines?

A. Standards, framework, and process.

B. Standards, assessments, and process.

C. Principles, framework, and process.

D. Principles, practices, and process.

Which of the following application-based controls is an example of a programmed edit check?

A. Reasonableness check.

B. Transaction log.

C. Input error correction.

D. Authorization for access.

Which of the following is an example of a risk avoidance response?

A. Buying an insurance policy to protect against loss events.

B. Hedging against natural gas price fluctuations.

C. Selling a non-strategic business unit.

D. Outsourcing a high risk process to a third party.

A supervisor receives a complaint from an employee who is frustrated about having to learn a new software program. The supervisor responds that the new software will enable the employee to work more efficiently and with greater accuracy. This response is an example of:

A. Empathetic listening.

B. Reframing.

C. Reflective listening.

D. Dialogue.

Which of the following professional organizations sets standards for quality and environmental audits?

A. The Committee of Sponsoring Organizations of the Treadway Commission.

B. The Board of Environmental, Health, and Safety Auditor Certifications.

C. The International Organization of Supreme Audit Institutions.

D. The International Standards Organization.

Which of the following are the most appropriate measures for evaluating the change in an organization's liquidity position?

A. Times interest earned, return on assets, and inventory turnover.

B. Accounts receivable turnover, inventory turnover in days, and the current ratio.

C. Accounts receivable turnover, return on assets, and the current ratio.

D. Inventory turnover in days, the current ratio, and return on equity.

A key advantage of developing a computer application by using the prototyping approach is that it:

A. Does not require testing for user acceptance.

B. Allows applications to be portable across multiple system platforms.

C. Is less expensive since it is self-documenting.

D. Better involves users in the design process.

According to the COSO enterprise risk management (ERM) framework, which of the following is not a typical responsibility of the chief risk officer?

A. Establishing risk category definitions and a common risk language for likelihood and impact measures.

B. Defining ERM roles and responsibilities.

C. Providing the board with an independent, objective risk perspective on financial reporting.

D. Guiding integration of ERM with other management activities.

According to the International Professional Practices Framework, internal auditors who are assessing the adequacy of organizational risk management processes should not:

A. Recognize that organizations use different techniques for managing risk.

B. Seek assurance that the key objectives of the risk management processes are being met.

C. Determine and accept the level of risk for the organization.

D. Treat the evaluation of risk management processes differently from the risk analysis used to plan audit engagements.

According to the Standards, the internal audit activity must evaluate risk exposures relating to which of the following when examining an organization's risk management process?

1) Organizational governance.

2) Organizational operations.

3) Organizational information systems.

4) Organizational structure.

A. 1 and 3 only

B. 2 and 4 only

C. 1, 2, and 3 only

D. 1, 2, and 4 only

Which of the following types of analytics focuses less on analysis and more on condensing data into mote meaningful pieces of information?

A. Diagnostic analytics

B. Descriptive analytics

C. Prescriptive analytics

D. Predictive analytics

The chief audit executive (CAE) has embraced a total quality management approach to improving the internal audit activity's (IAA's) processes. He would like to reduce the time to complete audits and improve client ratings of the IAA.

Which of the following staffing approaches is the CAE most likely to select?

A. Assign a team with a trained audit manager to plan each audit and distribute field work tasks to various staff auditors.

B. Assign a team of personnel who have different specialties to each audit and empower team members to participate fully in key decisions.

C. Assign a team to each audit, designate a single person to be responsible for each phase of the audit, and limit decision making outside of their area of responsibility.

D. Assign a team of personnel who have similar specialties to specific engagements that would benefit from those specialties and limit key decisions to the senior person.