Free IIA-CRMA-ADV Practice Test Questions 2026

Explanation:

The scenario describes a supervisor reviewing a new auditor's workpapers and determining whether additional audit procedures are necessary. This is the essence of engagement supervision, which is defined in Standard 2340 as the process of overseeing an engagement to ensure objectives are achieved, quality is assured, and staff is developed. The decision to expand procedures based on workpaper review is a direct supervisory responsibility. The supervisor must evaluate the sufficiency and reliability of the evidence gathered and, if it is inadequate, direct the auditor to perform additional tests.

Why the other options are incorrect :

A. Resource management: This concerns allocating budget, staff, and time to the overall audit plan. It does not address the judgment on whether a specific engagement's testing is complete based on workpaper review.

B. Coordination: This relates to synchronizing efforts with other auditors or departments to avoid duplication. It does not apply to the supervisor's decision to expand testing within a single engagement.

C. Due professional care: This is the overarching standard requiring diligence and skill. However, the mechanism by which due care is ensured in this instance is engagement supervision. The supervisor exercises due care through supervision.

References:

IIA Standard 2340 – Engagement Supervision: "Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed."

IIA Implementation Guide 2340: Supervision includes reviewing workpapers, evaluating the auditor's performance, and deciding whether additional work is needed to support conclusions.

Explanation:

Queuing theory is the most appropriate technique for evaluating the efficiency of a repetitive operational process like order filling and packaging. It is specifically designed to analyze workflow congestion, waiting times, and resource utilization—the core factors that determine whether a process is efficient or bottlenecked . By modeling order arrival rates and service times at each packaging station, queuing theory helps the auditor identify where delays occur and whether staffing or equipment is adequate to meet demand without excessive idle time or backlog . This aligns with IIA guidance that internal auditors should base conclusions on appropriate analyses and evaluations of operational efficiency .

Why the other options are incorrect:

A. Bedford analysis: "Bedford analysis" is not a recognized audit technique. A commonly used digital analysis tool is Benford's Law, which tests the integrity of large data sets by detecting anomalies in number distributions, not process efficiency .

B. Decision trees: These are classification models used to predict outcomes or assess risk based on multiple variables, but they do not analyze process flow, capacity, or congestion .

D. PERT chart: This is a project management tool for scheduling complex, non-repetitive projects with uncertain task durations; it is not designed for evaluating the day-to-day efficiency of a routine warehousing process.

References:

IIA Standard 2320 – Analysis and Evaluation: Requires internal auditors to base conclusions and engagement results on appropriate analyses and evaluations .

IIA Implementation Guide 2320: Recommends analytical procedures such as ratio, trend, and regression analysis to evaluate business processes .

Explanation:

A preventive control is designed to stop an undesirable event from occurring before it happens. Placing physical access controls on inventory (e.g., locks, keycard entry, security gates) is a classic example—it actively blocks unauthorized individuals from entering the storage area, thereby preventing theft, misplacement, or unauthorized use of inventory. This control acts as a barrier at the point of entry, deterring and stopping the threat before any loss occurs. Preventive controls are generally preferred because they reduce the need for corrective action after the fact.

Why the other options are incorrect:

A. Creating an audit trail: This is a detective control. It records who accessed what and when, but it does not prevent unauthorized access—it only logs it after the fact for review.

C. Reconciling purchase orders with approvals: This is a detective control. Reconciliation identifies mismatches or unauthorized transactions after they have been processed, allowing management to investigate and correct them.

D. Reviewing expense accounts for irregularities: This is a detective control. Reviews of expense accounts identify anomalies or potential fraud after expenses have been incurred and recorded.

References:

IIA Standard 2130 – Control: Requires internal auditors to evaluate the effectiveness of controls, including their classification as preventive, detective, or corrective.

IIA Practice Guide – "Auditing Internal Controls": Defines preventive controls as those that stop problems before they occur, such as physical access restrictions and segregation of duties.

Explanation:

Visual observation is a fundamental audit technique that involves physically seeing and inspecting activities, processes, and conditions. It is a powerful tool for gathering direct, firsthand evidence during an audit.

Statement 1 is correct.
Visual observations are highly effective for detecting ineffective controls (e.g., unlocked doors, missing segregation of duties), idle resources (e.g., unused equipment, overstaffed areas), and safety hazards (e.g., blocked fire exits, improper storage of hazardous materials). These are all tangible conditions that can be confirmed through direct observation.

Statement 2 is correct.
Visual observations are used throughout the audit process. During the preliminary survey, they help the auditor gain an initial understanding of the process, identify potential risk areas, and plan the engagement. During fieldwork, they are used to verify that controls are actually operating as described (e.g., observing that inventory counts are performed properly).

Why the other options are incorrect:

Statement 3 is incorrect.
Visual observations provide factual, firsthand evidence—they are not "unsubstantiated facts." If the auditor believes the information is useful, it must be documented and, if material, included in the audit report. Observations are not "unsubstantiated"; they are direct evidence.

Statement 4 is incorrect.
Material observations (significant findings) must be communicated through formal channels—typically in the final audit report to senior management and the board (Standard 2400). They should not be communicated informally, as this undermines the audit process and may compromise objectivity and completeness of reporting.

References:

IIA Standard 2320 – Analysis and Evaluation: Requires internal auditors to base conclusions on appropriate analyses and evaluations. Observation is a recognized technique for gathering evidence.

IIA Practice Advisory 2320-1 – Analysis and Evaluation: Notes that observation is a valid procedure for collecting information during both the preliminary survey and fieldwork phases.

Explanation:

The internal auditor's actions are appropriate and align with the IIA's guidance. In this situation, the auditor identified a potential red flag that was outside the scope of the current engagement. The correct protocol is to note the concern, report it to the appropriate level of management, and allow the chief audit executive (CAE) to determine the necessary further actions .

This approach is supported by the IIA Code of Ethics, specifically the Objectivity rule, which does not require the auditor to investigate issues outside their audit's scope, but does require them to disclose all material facts known to them .

This action is also consistent with the Standards concerning proficiency and due professional care. Internal auditors are expected to have sufficient knowledge to identify indicators of fraud, but they are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud . The auditor's reporting to the CAE ensures the issue is escalated and can be properly managed.

Why other options are incorrect:

A & D. In violation of the Code of Ethics:
The Code does not mandate the auditor investigate a personally-identified red flag outside the engagement's scope. The auditor acted with integrity by identifying the issue and reporting it, rather than ignoring it or withholding the information. Therefore, this is not a violation.

B. In violation of the Standards:
The Standards do not require an auditor to follow up on a red flag that is unrelated to the current engagement. The auditor's responsibility is to report the concern to the appropriate authority, and they fulfilled this duty by informing the CAE.

References:

IIA Code of Ethics – Principle II: Objectivity: Internal auditors exhibit the highest level of professional objectivity and make a balanced assessment of all the relevant circumstances. Rule 2.3 requires them to "disclose all material facts known to them that, if not disclosed, may distort the reporting of activities under review" .

Explanation:

The internal audit charter is the foundational document that establishes the internal audit activity’s (IAA) purpose, authority, and responsibility. It defines the scope of its activities and authorizes access to records, personnel, and physical properties relevant to the performance of engagements. The approved annual audit plan, which is based on the charter, specifically identifies the areas designated for audit.

When a client disputes the scope, the most appropriate and effective response is to refer them to these formal, board-approved documents. This affirms the IAA's mandate and authority without escalating the dispute unnecessarily. It is a clear, professional, and objective response grounded in the organization's governance framework.

Why the other options are incorrect:

A. Terminate the audit engagement in full:
This is an overreaction and a failure to fulfill the IAA's mandate. Lack of cooperation does not justify abandoning the engagement.

B. Terminate only the specific action or process:
This is also inappropriate. The IAA has a defined scope based on risk assessment and board approval. Substituting functions would undermine the audit objectives and compromise the integrity of the plan.

D. Seek the approval of senior management or the board:
This is premature and escalates a matter that can be resolved by referring to the charter and audit plan. The board has already approved these documents, so seeking their approval again is unnecessary.

References

IIA Standard 1000 – Purpose, Authority, and Responsibility: The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards.

IIA Implementation Guide 1000: The charter establishes the IAA's scope and authorizes access to records, personnel, and physical properties.

Explanation:

This scenario presents a direct conflict between a regulatory deadline and the internal audit activity’s (IAA) proficiency requirements. Standard 1210 – Proficiency mandates that internal auditors must possess the knowledge, skills, and competencies needed to perform their responsibilities. When this expertise is lacking, Standard 1210.A1 requires the CAE to “obtain competent advice and assistance”. If this cannot be achieved, Implementation Standard 1210.C1 explicitly states that the CAE must decline the consulting engagement if the internal auditors lack the necessary competencies.

Why Other Options Are Incorrect:

A. Continue with the engagement but highlight areas needing revision:
Proceeding with an audit when the IAA lacks the required proficiency violates the Standards and risks producing unreliable results. The CAE has a duty to ensure proficiency, not to deliver work with known deficiencies.

B. Ask a senior member of the IT department to join the audit team:
While the Standards allow for using experts from within the organization to fill gaps, this option fails to address the core problem. The IT staff member is not an internal auditor and would not have the audit competencies required for the engagement, likely leading to an impaired assessment.

C. Delay the engagement and ask the board for alternatives:
While the CAE must communicate significant issues to the board, the immediate decision to remove the engagement due to a deficiency in expertise lies with the CAE. The CAE then informs senior management and the board of the impact of this resource limitation.

References:

IIA Standard 1210 – Proficiency:Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities.

IIA Standard 1210.A1: The CAE must obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement.

Explanation:

The primary reason for reporting initial audit test results to the auditor-in-charge before advising management is rooted in the principle of engagement supervision. This process is designed to ensure that the work performed is of high quality and that the conclusions drawn are sound.

Quality Assurance and Professional Judgment: The core purpose of supervision, as defined by IIA Standard 2340, is to ensure objectives are achieved, quality is assured, and staff is developed . The supervisor, typically the auditor-in-charge, evaluates whether the information, testing, and results are sufficient and reliable to support the engagement conclusions . This includes reviewing preliminary conclusions to confirm they are logical, supported by evidence, and free from bias . Reporting results to the supervisor first allows for an objective review, ensuring that the final advice given to management is based on appropriate professional judgment .

Why Other Options Are Incorrect:

A. Increases the likelihood of client agreement:
While a supervisor's review might strengthen the report, obtaining client agreement is not the primary objective of this standard. The goal is to ensure the results themselves are correct and properly supported.

B. Ensures an appropriate chain of evidence:
The chain of evidence is maintained through the proper documentation of workpapers (Standard 2330), not specifically by reporting results to a supervisor before talking to management .

D. Required to demonstrate effective supervision:
While the supervisor's review is a key part of demonstrating effective supervision (e.g., through initials on workpapers), the reason the review is required is to ensure the quality and accuracy of the auditor's judgments and conclusions, not just to check a box for compliance .

References:

IIA Standard 2340 – Engagement Supervision: Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed .

Implementation Guide 2340: The supervisor evaluates whether the information, testing, and results are sufficient, reliable, and relevant to support conclusions. The CAE is responsible for all significant professional judgments made during engagements .

Explanation:

The risk of employees receiving kickbacks from suppliers is a significant fraud risk in procurement. Kickbacks typically occur when a procurement officer develops a close, long-term relationship with a supplier and begins to favor them (e.g., awarding contracts, approving inflated prices, or accepting substandard goods) in exchange for personal benefits. By periodically rotating procurement officers' assignments to different supplier accounts, the organization reduces the opportunity for such relationships to develop and persist. Rotation disrupts the familiarity and collusive environment that enables kickbacks, making it harder for a procurement officer to establish and maintain an ongoing corrupt arrangement with a specific supplier. This is a key preventive control.

Why the other options are incorrect:

B. A pre-award financial capacity analysis of suppliers:
This is a control to assess a supplier's ability to perform under a contract, not to detect or prevent kickbacks. It addresses supplier reliability, not employee integrity.

C. An automated computer report, organized by supplier, of any invoices for the same amount:
While this can identify duplicate invoices or unusual patterns, it is not specifically designed to detect kickbacks. Kickbacks are typically not reflected in identical invoice amounts; they involve inflated prices, fictitious services, or preferential treatment. This is a detective control that may catch some anomalies but does not address the root collusion risk.

D. Periodic inventories of kiln-dried wood at the organization's warehouse:
This is a control over the existence and condition of inventory, not over procurement relationships. It detects theft or misappropriation of physical assets, not kickbacks or vendor collusion.

References:

IIA Standard 2130 – Control: Requires internal auditors to evaluate the effectiveness of controls, including those designed to prevent and detect fraud.

IIA Practice Guide – "Auditing Procurement and Vendor Management": Recommends rotation of procurement staff as a control to reduce the risk of collusion and kickbacks.

Explanation:

The internal audit charter is a formal, high-level document that defines the activity's purpose, authority, and responsibility . Its role is to establish the internal audit activity's position within the organization and define the broad scope of its work . The upcoming year's specific audit engagements are detailed in a separate, dynamic annual audit plan, not the foundational charter .

Why the other options are incorrect

The charter provides the foundational framework and establishes the "rules of engagement." Here is why the other options are essential elements of that framework:

B. The internal audit activity's position within the organization: The charter must establish the activity's standing, including its reporting lines and access to records and personnel .

C. The scope of internal audit activities: The charter defines the scope and nature of the audit work, including the types of assurance and consulting services to be provided .

D. Agreement regarding roles and responsibilities: The charter acts as a formal, board-approved agreement on the roles and responsibilities of the internal audit activity, management, and the board .

References:

IIA Standard 1000 – Purpose, Authority, and Responsibility: The charter defines the activity's purpose, authority, and responsibility .

IIA Implementation Guide 1000: The charter establishes the activity's position and defines the scope of its work .

Explanation:

A code of ethics is essential for the internal audit profession because it provides a framework of principles and rules that guide internal auditors in their professional conduct and decision-making. The IIA's Code of Ethics establishes the foundational principles of Integrity, Objectivity, Confidentiality, and Competency. These principles are designed to guide auditors in serving the interests of their organizations, stakeholders, and the public by ensuring their work is performed with honesty, impartiality, and professionalism. The code serves as a moral compass, helping auditors navigate complex situations and maintain trust in the profession.

Why the other options are incorrect:

A. It ensures that all members of the profession possess the same level of competence:
Incorrect. The Code of Ethics sets standards for professional conduct, not for technical competence. Competence is addressed through professional certifications, continuing education, and proficiency standards (Standard 1210).

B. It provides auditors with protection from lawsuits:
Incorrect. A code of ethics does not protect auditors from legal liability. It establishes standards of behavior, not legal immunity.

D. It requires auditors to exhibit loyalty to their organizations:
Incorrect. While internal auditors serve their organizations, the Code of Ethics emphasizes objectivity, integrity, and professional responsibility—not blind loyalty. Auditors must remain independent and report facts truthfully, even if it is unfavorable to management.

References

IIA Code of Ethics – Preamble:States that the Code is necessary for the internal audit profession because it "provides guidance and promotes ethical behavior" and "describes the expectations of stakeholders."

IIA Code of Ethics – Principles: Defines the four principles—Integrity, Objectivity, Confidentiality, and Competency—as the foundation for professional conduct.

Explanation:

The scenario describes a high volume of customer complaints specifically about payments not being applied to their accounts. When customers pay their bills, they expect their accounts to be credited. If payments are not being applied, customers will call to inquire or complain.

Why the other options are incorrect:

B. An employee is tampering with customer checks:
This would result in theft of cash, but it would typically lead to complaints about missing payments or checks being cashed incorrectly, not about "payments not being applied." The customer's check would be processed but stolen, leading to a different type of complaint.

C. Employees are submitting fraudulent expense reports:
This is a scheme involving internal employees, not customer accounts. It would not generate complaints from external customers about their payments not being applied.

D. The customer service department is not forwarding complaints:
This would mean complaints are not reaching accounts receivable, but it does not explain why payments are not being applied. If payments are not being applied but complaints are not forwarded, the number of complaints reaching AR would be low—the opposite of the "high volume" described.

References:

IIA Standard 2130 – Control: Requires internal auditors to evaluate the effectiveness of controls, including billing and accounts receivable processes.

IIA Practice Guide – "Auditing Accounts Receivable": Identifies failure to send invoices as a key control deficiency that can lead to unapplied cash, customer disputes, and revenue misstatement.