I85PREP
⌘ K
CIA Aptitude Test study materials
CIA Aptitude Test study resources

CIA Aptitude Test practice questions

One question at a time. Build your CIA Aptitude Test understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of Internal Auditing

According to the IPPF, which two components together form the mandatory elements that internal auditors must conform with?

  1. The Mission Statement and the Glossary
  2. The Implementation Guidance and the Supplemental Guidance
  3. The Code of Ethics and the Standards Correct answer.
  4. The Core Principles and the Definition of Internal Auditing

Explanation

The International Professional Practices Framework (IPPF) distinguishes mandatory from recommended guidance. The mandatory elements are the Core Principles, the Definition of Internal Auditing, the Code of Ethics, and the Standards; among the answer choices, only the pairing of the Code of Ethics with the Standards is fully mandatory.

Question 2Foundations of Internal Auditing

The chief audit executive reports functionally to the audit committee and administratively to the chief financial officer. Which arrangement best preserves organizational independence?

  1. The audit committee delegates all audit supervision to the CFO
  2. The CFO sets the scope of individual audit engagements
  3. The audit committee approves the audit plan and the CAE's performance evaluation Correct answer.
  4. The CFO approves the internal audit budget and performance evaluation

Explanation

Organizational independence is safeguarded when the governing body approves the audit charter, risk-based plan, budget, and the CAE's appointment and evaluation. Functional reporting to the audit committee must carry these substantive powers, not merely a reporting line.

Question 3Foundations of Internal Auditing

An internal auditor is assigned to review the accounts payable process after having managed that same process two years earlier. What is the most appropriate action?

  1. Accept the engagement because the auditor knows the process best
  2. Disclose the prior role and decline or be reassigned to preserve objectivity Correct answer.
  3. Accept the engagement but exclude the period the auditor managed
  4. Accept the engagement because two years have passed since the prior role

Explanation

Objectivity is an individual attribute that can be impaired by a recent operational role, regardless of elapsed time or expertise. The auditor should disclose the conflict, and reassignment is the appropriate safeguard rather than selective scoping.

Question 4Foundations of Internal Auditing

Which statement best describes the difference between independence and objectivity in the Standards?

  1. Independence and objectivity are interchangeable terms in the Standards
  2. Independence applies only to the CAE; objectivity applies only to staff auditors
  3. Independence is an organizational attribute; objectivity is an individual attribute Correct answer.
  4. Independence concerns ethics; objectivity concerns competence

Explanation

The Standards treat independence as the freedom from conditions that threaten the ability of the internal audit activity to carry out its work, an attribute of the function. Objectivity is an unbiased mental attitude of individual internal auditors.

Question 5Foundations of Internal Auditing

An internal auditor discovers that a senior manager is diverting funds. The auditor reports the matter to the CAE, who decides to delay reporting to the audit committee until the annual report is issued. Which principle is most directly violated?

  1. Integrity in reporting and disclosure Correct answer.
  2. Confidentiality of engagement records
  3. Due professional care in engagement planning
  4. Continuing professional development

Explanation

The Code of Ethics requires internal auditors to disclose all material facts known to them that, if not disclosed, could distort reporting of activities under review. Delaying a material fraud report to protect timing violates that integrity obligation.

Question 6Foundations of Internal Auditing

Which of the following is the primary purpose of the internal audit activity as defined in the IPPF?

  1. To replace the external audit function during interim periods
  2. To enhance and protect organizational value by providing risk-based assurance, advice, and insight Correct answer.
  3. To prepare financial statements for external reporting
  4. To enforce compliance by disciplining employees

Explanation

The Definition of Internal Auditing describes an independent, objective assurance and consulting activity designed to add value and improve operations. The mission statement frames this as enhancing and protecting organizational value through risk-based assurance, advice, and insight.

Question 7Foundations of Internal Auditing

A CAE is asked by the CEO to add a consulting engagement to improve a new inventory system. Which condition must be satisfied before accepting?

  1. The engagement must replace the next scheduled assurance engagement
  2. The engagement must be approved by the external auditor
  3. The engagement must not impair objectivity and must be consistent with the audit charter Correct answer.
  4. The engagement must be performed without documenting scope

Explanation

Consulting services are permissible when they align with the internal audit charter and do not impair objectivity. The CAE must evaluate whether the consulting role creates self-review or other threats before accepting.

Question 8Foundations of Internal Auditing

Which document formally defines the internal audit activity's purpose, authority, and responsibility and must be approved by the governing body?

  1. The risk register
  2. The internal audit charter Correct answer.
  3. The engagement work program
  4. The quality assurance manual

Explanation

The internal audit charter is the formal document approved by the board or governing body that establishes the activity's position, authority, and scope. It authorizes access to records and personnel needed to perform engagements.

Question 9Foundations of Internal Auditing

The CAE is reviewing whether the internal audit activity conforms with the Standards. Which activity provides ongoing and periodic assessments of the quality of the audit function?

  1. The follow-up process for management actions
  2. The engagement-level supervision review
  3. The quality assurance and improvement program Correct answer.
  4. The risk-based annual audit plan

Explanation

The quality assurance and improvement program covers all aspects of the internal audit activity and includes both ongoing and periodic internal assessments plus external assessments. Its purpose is to evaluate conformance with the Standards and the Code of Ethics.

Question 10Foundations of Internal Auditing

An internal audit activity undergoes an external quality assessment. Within what maximum interval must such an external assessment generally occur?

  1. Every five years Correct answer.
  2. Every seven years
  3. Every three years
  4. Every year

Explanation

The Standards require an external assessment at least once every five years performed by a qualified, independent assessor or assessment team. A self-assessment with independent validation may satisfy the requirement.

Question 11Foundations of Internal Auditing

Which of the following best illustrates a self-review threat to an internal auditor's objectivity?

  1. Auditing a function whose manager the auditor has never met
  2. Auditing a process governed by unfamiliar regulations
  3. Auditing a process the auditor previously designed and implemented Correct answer.
  4. Auditing a department located in another country

Explanation

A self-review threat arises when an auditor evaluates work they previously performed, because the auditor may be reluctant to identify their own deficiencies. Prior design or implementation responsibility is a classic source of this threat.

Question 12Foundations of Internal Auditing

The internal audit activity's risk-based plan should be based primarily on which input?

  1. The organization's risk management framework and input from senior management and the board Correct answer.
  2. The prior year's audit plan without modification
  3. The availability of audit staff during peak vacation periods
  4. The preferences of the largest department heads

Explanation

A risk-based plan prioritizes engagements by aligning with the organization's objectives and risk profile, drawing on the risk management framework and input from senior management and the board. Staffing availability and prior plans are secondary considerations.

Question 13Foundations of Internal Auditing

An auditor is assigned to an engagement involving complex derivative instruments and lacks the necessary expertise. According to the Standards, the auditor should:

  1. Proceed and rely on management's representations
  2. Decline all future engagements involving derivatives
  3. Obtain the needed competence or disclose the limitation to the CAE Correct answer.
  4. Perform the work without documenting the knowledge gap

Explanation

Internal auditors must possess or obtain the knowledge, skills, and competencies needed to perform their responsibilities. When expertise is lacking, the auditor should seek appropriate assistance or disclose the limitation so the CAE can address it.

Question 14Foundations of Internal Auditing

Which statement correctly describes the relationship between the internal audit activity and the audit committee?

  1. The CAE reports functionally to the audit committee to support independence Correct answer.
  2. The audit committee directs daily audit fieldwork
  3. The audit committee reports to the CAE on audit findings
  4. The audit committee is chaired by the CAE

Explanation

Functional reporting to the audit committee supports the independence of the internal audit activity by placing oversight with the governing body. The committee does not manage fieldwork or report to the CAE.

Question 15Foundations of Internal Auditing

Which of the following best describes the role of the internal audit activity in enterprise risk management?

  1. Approving risk responses proposed by management
  2. Setting the organization's risk appetite on behalf of the board
  3. Providing assurance on the effectiveness of risk management and offering advice Correct answer.
  4. Owning and operating the risk management process

Explanation

Internal audit provides assurance that risk management processes are effective and may offer consulting advice, but it does not own or operate the risk management process. Setting risk appetite and approving responses are management and board responsibilities.

Question 16Foundations of Internal Auditing

An internal auditor is preparing to communicate a significant control deficiency to management. Which approach best reflects the Standards on communicating results?

  1. Limit the report to a list of findings without context
  2. Report only verbally to avoid creating a permanent record
  3. Include the engagement's objectives, scope, conclusions, and recommendations Correct answer.
  4. Delay the report until the next annual audit cycle

Explanation

Communications should include the engagement's objectives, scope, and results, along with conclusions and recommendations where appropriate. Reports must be accurate, objective, clear, concise, constructive, complete, and timely.

Question 17Foundations of Internal Auditing

The CAE determines that the internal audit activity lacks sufficient resources to complete the approved risk-based plan. What is the most appropriate action?

  1. Communicate the resource limitation and its impact to senior management and the board Correct answer.
  2. Silently reduce the audit scope to fit available resources
  3. Cancel the plan and perform no engagements
  4. Borrow staff from the audited department to fill the gap

Explanation

When resource limitations affect the ability to achieve the audit plan, the CAE must communicate the impact to senior management and the board. The governing body can then decide on resource allocation or accept the resulting risk.

Question 18Foundations of Internal Auditing

Which of the following situations most clearly impairs the organizational independence of the internal audit activity?

  1. The internal audit activity has unrestricted access to records
  2. The CAE reports administratively to the controller and has no direct access to the board Correct answer.
  3. The audit committee reviews the audit charter annually
  4. The CAE attends audit committee meetings

Explanation

Organizational independence requires that the CAE have direct access to the governing body and report to a level that allows unbiased work. Reporting administratively to the controller, a management role within the financial function, creates a conflict.

Question 19Foundations of Internal Auditing

An auditor's spouse is the manager of the department scheduled for the next engagement. What should the auditor do first?

  1. Perform the engagement but omit findings related to the spouse
  2. Proceed because the relationship is personal, not professional
  3. Ask the spouse to approve the engagement work program
  4. Disclose the relationship to the CAE for evaluation and possible reassignment Correct answer.

Explanation

A close personal relationship with a manager in the audited area creates a familiarity or conflict-of-interest threat to objectivity. The auditor must disclose the situation so the CAE can evaluate it and apply safeguards such as reassignment.

Question 20Foundations of Internal Auditing

Which of the following best reflects the Core Principles for the Professional Practice of Internal Auditing?

  1. They replace the Standards as the primary mandatory guidance
  2. They are optional marketing statements with no link to the Standards
  3. They describe characteristics of an effective internal audit activity, such as integrity and objectivity Correct answer.
  4. They apply only to external quality assessments

Explanation

The Core Principles articulate the characteristics that an internal audit activity must demonstrate to be considered effective, including integrity, objectivity, competence, and alignment with strategy. They are mandatory elements that the Standards operationalize.

Question 21Independence and Objectivity

An internal auditor is assigned to review the accounts payable process. She previously worked as the accounts payable supervisor for eight months, ending two years ago. According to the IIA Code of Ethics and the Standards, what is the most appropriate action?

  1. Accept the engagement but have a colleague sign the final report
  2. Decline the engagement and refuse to disclose the reason to avoid embarrassment
  3. Disclose the prior role and let the engagement supervisor decide whether to reassign Correct answer.
  4. Proceed with the engagement because two years have passed since she left the role

Explanation

Objectivity is impaired when an auditor audits activity for which she had responsibility within the prior year; beyond one year, the impairment is not automatic, but potential conflicts must be disclosed so the supervisor can evaluate and document the decision. Concealing the prior role is itself a violation of integrity. Signing by a colleague does not cure the underlying objectivity concern.

Question 22Independence and Objectivity

Which statement best describes the relationship between organizational independence and individual objectivity for an internal audit activity?

  1. Both terms are interchangeable and describe the auditor's freedom from political pressure
  2. Organizational independence is a prerequisite that supports each auditor's ability to remain objective Correct answer.
  3. Independence refers to freedom from bias in judgment, and objectivity refers to reporting line placement
  4. Objectivity applies only to the chief audit executive, while independence applies to staff auditors

Explanation

Independence is an organizational attribute of the internal audit activity, while objectivity is an individual attribute of each auditor. A sound reporting line and unrestricted access create the structural conditions that allow auditors to exercise unbiased judgment. The two concepts are complementary, not interchangeable.

Question 23Independence and Objectivity

The chief audit executive reports functionally to the audit committee and administratively to the chief financial officer. Which situation most clearly threatens the internal audit activity's independence?

  1. The audit committee approves the internal audit charter and the annual risk-based plan
  2. The chief audit executive meets privately with the audit committee each quarter
  3. The chief financial officer sets the internal audit budget and controls performance evaluations Correct answer.
  4. The audit committee reviews and concurs with the chief audit executive's appointment

Explanation

Administrative reporting to an executive whose area is audited creates a self-interest and undue-influence threat, particularly when that executive controls resources and evaluations. Functional reporting to the audit committee preserves independence over audit scope, plan, and reporting. The other options reflect practices that strengthen independence.

Question 24Independence and Objectivity

An auditor is asked by the engagement supervisor to omit a documented control weakness from the draft report because it may upset the auditee's executive director. What should the auditor do first?

  1. Report the request to the chief audit executive as a potential objectivity threat Correct answer.
  2. Include the finding but soften the language so the risk sounds minor
  3. Delay the report indefinitely until the executive director leaves the position
  4. Remove the finding to preserve the working relationship with the auditee

Explanation

Pressure to suppress a legitimate finding is an undue-influence threat to objectivity and must be escalated rather than accommodated. The chief audit executive is responsible for resolving such conflicts and safeguarding the audit's integrity. Altering or withholding the finding would compromise the accuracy and honesty of reporting.

Question 25Independence and Objectivity

Which of the following assignments would most likely be considered an impairment of the internal audit activity's independence if accepted?

  1. Performing a post-implementation review of a system the internal audit activity did not design
  2. Taking operational responsibility for implementing the procurement system's controls Correct answer.
  3. Reviewing the design of a new procurement system before it goes live
  4. Advising management on control risks associated with the procurement system

Explanation

Assuming operational responsibility for controls places the internal audit activity in a management role, creating a self-review threat when it later audits that area. Consulting and advisory work that leaves decision-making with management does not necessarily impair independence. The key distinction is who owns and implements the control.

Question 26Independence and Objectivity

An internal auditor has been asked to join a cross-functional committee that will select a vendor and negotiate the contract. The auditor's role would be to provide control advice. What is the most appropriate response?

  1. Join the committee and vote on the vendor selection to ensure controls are considered
  2. Join the committee and later lead the audit of the vendor selection process
  3. Join the committee in an advisory capacity without decision-making authority Correct answer.
  4. Decline any role because auditors may never participate in cross-functional teams

Explanation

Auditors may serve as advisers on committees provided they do not assume management responsibilities or make operating decisions. Advisory participation preserves objectivity as long as decision authority remains with management. Voting or later auditing the same decision would create a self-review threat.

Question 27Independence and Objectivity

After auditing the treasury function, an auditor is offered a significant discount on a personal mortgage by the bank whose treasury operations she reviewed. The offer comes from a relationship manager she dealt with during the audit. What is the most appropriate action?

  1. Accept the discount only if other employees received the same terms
  2. Accept the discount because it is a standard product offered to many customers
  3. Decline the offer and disclose it to the chief audit executive Correct answer.
  4. Accept the discount but disclose it in the next audit report

Explanation

Accepting a benefit from an auditee during or shortly after an engagement creates a self-interest threat to objectivity and the appearance of impropriety. The auditor should decline and disclose the offer so the organization can document and manage the conflict. Availability to other customers does not remove the threat created by the timing and source.

Question 28Independence and Objectivity

Which arrangement best preserves the independence of the internal audit activity when the organization has no audit committee?

  1. The chief audit executive reports to the controller and coordinates work with external auditors
  2. A board-level oversight body or equivalent approves the charter and receives reports Correct answer.
  3. The chief executive officer approves the audit plan and receives all engagement reports
  4. The internal audit activity reports to the external audit firm's engagement partner

Explanation

The Standards require functional reporting to the board, and where a formal audit committee is absent, a board-level oversight group or equivalent should fulfill that role. This structure gives the function independent oversight and a channel to escalate issues. Reporting to management executives weakens the ability to audit their areas objectively.

Question 29Independence and Objectivity

An auditor is evaluating a control that she designed while temporarily assigned to the operations department six months ago. What is the primary reason she should not perform this assessment?

  1. She may be reluctant to conclude that her own design is deficient Correct answer.
  2. She has not been formally reassigned to the internal audit activity
  3. She lacks current knowledge of the control's operating environment
  4. She has not completed the required hours of continuing education

Explanation

Reviewing controls the auditor designed creates a self-review threat, because she has an incentive to conclude that her own work is adequate. Objectivity requires that auditors not evaluate work for which they were responsible. The concern is bias, not technical competence or administrative status.

Question 30Independence and Objectivity

An audit team member's spouse is the divisional controller of a business unit scheduled for an operational audit next quarter. What is the most appropriate action for the chief audit executive?

  1. Allow the team member to participate if she signs a confidentiality agreement
  2. Reassign the team member so she has no role in auditing the spouse's area Correct answer.
  3. Assign the team member to the engagement to demonstrate confidence in her objectivity
  4. Assign the team member to the engagement but exclude the controller from interviews

Explanation

A close family relationship with a manager in the audited area creates a significant familiarity threat to objectivity. The most effective safeguard is to remove the auditor from that engagement entirely. Partial exclusions or signed declarations do not adequately mitigate the closeness of the relationship.

Question 31Independence and Objectivity

Which of the following best illustrates a safeguard that supports auditor objectivity at the individual level?

  1. Locating the internal audit activity in the same building as the auditee
  2. Rotating auditors among engagements so no one reviews the same area indefinitely Correct answer.
  3. Having the auditee approve the auditor's performance evaluation
  4. Requiring all auditors to hold the same professional certification

Explanation

Rotation limits familiarity and self-interest threats by preventing long-term relationships with the same auditee and area. It is a recognized individual-level safeguard that supports objectivity. Certification, physical proximity, and auditee-controlled evaluations do not address bias or influence.

Question 32Independence and Objectivity

The chief audit executive is asked to serve as the organization's interim chief financial officer during a leadership vacancy. Which response best aligns with the Standards?

  1. Accept the role because interim assignments are excluded from independence rules
  2. Accept the role only if the audit committee approves and outside assurance covers the finance function Correct answer.
  3. Accept the role and continue to lead internal audit to maintain continuity
  4. Accept the role and audit the finance function after returning to internal audit

Explanation

Accepting a management role creates a significant impairment, and the Standards require that if such a role is unavoidable, it be approved by the board and that independent assurance be obtained over the area managed. The chief audit executive should not simultaneously lead internal audit while holding the operational position. Interim status does not exempt the assignment from independence requirements.

Question 33Independence and Objectivity

An auditor's objectivity is best described as which of the following?

  1. An attitude of impartiality that allows the auditor to make balanced judgments Correct answer.
  2. A structural reporting line that bypasses operating management
  3. The authority to access records without management approval
  4. The absence of any personal or professional relationship with auditees

Explanation

Objectivity is a state of mind characterized by impartiality and freedom from bias, allowing auditors to reach balanced conclusions. It is not equivalent to having no relationships, which is unrealistic, nor to access rights or reporting lines. Those structural elements support independence, but they do not define objectivity.

Question 34Independence and Objectivity

An internal auditor is asked to perform an assurance engagement on a process owned by a close personal friend. The auditor believes she can remain fair. What is the most appropriate course of action?

  1. Proceed because the auditor's self-assessment of impartiality is sufficient
  2. Proceed but have a supervisor review the draft report for tone
  3. Disclose the relationship and request reassignment to another engagement Correct answer.
  4. Proceed and disclose the friendship only if a finding is challenged

Explanation

A close personal relationship with the process owner creates a familiarity threat that the auditor may underestimate. The appropriate response is to disclose the relationship and remove herself from the engagement. Self-assessment, supervisory review of tone, or delayed disclosure do not adequately address the threat.

Question 35Independence and Objectivity

Which of the following would most likely be viewed as an inappropriate restriction on the internal audit activity's independence?

  1. Management reviews draft reports for factual accuracy before issuance
  2. The chief audit executive reports audit results directly to the board
  3. Management requires auditors to notify the area before routine fieldwork begins Correct answer.
  4. The audit committee approves the annual audit plan without management sign-off

Explanation

Advance notification requirements imposed by management can allow the auditee to alter or conceal evidence, restricting the auditor's freedom to obtain information. Independence includes unrestricted access to records, personnel, and property. Factual-accuracy review, board reporting, and audit committee plan approval are normal and appropriate.

Question 36Independence and Objectivity

The internal audit activity is asked to take over the reconciliation of a key account temporarily because the accounting team is short-staffed. What is the most appropriate response?

  1. Decline the task and explain that performing it would impair future audit objectivity Correct answer.
  2. Accept the task and assign it to the auditor with the least seniority
  3. Accept the task and disclose the impairment in the following year's audit plan
  4. Accept the task because it will give auditors deeper insight into the process

Explanation

Performing an operating task places the internal audit activity in a management role and creates a self-review threat when the area is later audited. The function should decline operational work and explain the independence implications to management. Insight gained does not offset the loss of objectivity.

Question 37Independence and Objectivity

Which statement about disclosing impairments of independence is most consistent with the Standards?

  1. Impairments should be disclosed to the auditee so it can evaluate the auditor's work
  2. Impairments should be disclosed only when they affect the final audit opinion
  3. Impairments should be disclosed to the board, with the nature of the impairment and related details Correct answer.
  4. Impairments should be disclosed only if the auditor personally benefited from them

Explanation

The Standards require the chief audit executive to disclose impairments of independence or objectivity to the board, including the nature of the impairment and its effect on the engagement. Disclosure supports transparency and allows the board to take corrective action. Limiting disclosure to opinion-changing cases or to personal benefit is too narrow.

Question 38Independence and Objectivity

An auditor has a material investment in a supplier that the organization is considering for a major contract. The auditor is assigned to the team evaluating the procurement process. What is the most significant threat to objectivity?

  1. Self-review threat arising from prior work on procurement controls
  2. Intimidation threat arising from the supplier's negotiating power
  3. Self-interest threat arising from the auditor's financial stake Correct answer.
  4. Familiarity threat arising from repeated contact with the supplier

Explanation

A direct financial interest in a party affected by the audit creates a self-interest threat, because the auditor's judgment could be influenced by personal financial gain. The other threat categories describe different circumstances, such as pressure, close relationships, or reviewing one's own work. The dominant concern here is the auditor's own financial stake.

Question 39Independence and Objectivity

An auditor is assigned to review the performance of a department whose manager previously supervised the auditor and wrote her performance evaluations. Which safeguard is most appropriate?

  1. Assign the engagement to an auditor without the prior supervisory relationship Correct answer.
  2. Allow the auditor to proceed because the supervisory relationship has ended
  3. Shorten the engagement to reduce the time spent with the manager
  4. Have the department manager review the draft findings before release

Explanation

A recent supervisory relationship with the auditee creates familiarity and self-interest threats, because the auditor may be reluctant to criticize a former supervisor. The most effective safeguard is to assign the engagement to someone without that relationship. Shortening the engagement or involving the auditee in report review does not address the bias.

Question 40Independence and Objectivity

Which of the following best describes the chief audit executive's responsibility regarding the internal audit charter?

  1. The charter should be revised annually by the auditees to reflect their preferences
  2. The charter should be approved by the board and periodically reviewed to confirm its adequacy Correct answer.
  3. The charter should be drafted by the external auditor and adopted without modification
  4. The charter should be approved by the chief executive officer and kept confidential from the board

Explanation

The charter defines the internal audit activity's purpose, authority, and responsibility, and it must be approved by the board. Periodic review confirms that it remains adequate for the function's mission. Board approval is what establishes the function's independent mandate and access.

Question 41Proficiency and Due Professional Care

According to the International Standards for the Professional Practice of Internal Auditing, which statement best describes the concept of due professional care as it applies to an internal auditor's engagement work?

  1. Due professional care requires the auditor to apply the care and skill expected of a reasonably prudent and competent internal auditor, but it does not imply infallibility. Correct answer.
  2. Due professional care requires the auditor to perform detailed testing of every transaction in the audit universe each year.
  3. Due professional care means the auditor must guarantee that no material error or fraud exists in the audited area.
  4. Due professional care means the auditor must follow a single prescribed audit program without deviation.

Explanation

The Standards frame due professional care as the care and skill expected of a reasonably prudent and competent internal auditor in similar circumstances. It is a standard of reasonable competence, not a guarantee of complete assurance or infallibility, and it does not require exhaustive testing of every item.

Question 42Proficiency and Due Professional Care

An internal auditor is assigned to an engagement involving a complex derivative valuation model. The auditor lacks specialized expertise in quantitative finance. What action is most consistent with the proficiency standard?

  1. Proceed with the engagement using general audit knowledge and disclose the limitation only if a problem arises.
  2. Rely entirely on management's representations about the model and document them as sufficient evidence.
  3. Decline the engagement permanently because auditors should never audit areas outside their competence.
  4. Obtain the necessary knowledge or engage a competent specialist, such as an external expert, to assist. Correct answer.

Explanation

The proficiency standard requires internal auditors to possess or obtain the knowledge, skills, and competencies needed to perform their responsibilities. When an engagement requires expertise the auditor lacks, the appropriate response is to acquire the knowledge or bring in a qualified specialist.

Question 43Proficiency and Due Professional Care

Which of the following best characterizes the relationship between proficiency and due professional care under the Standards?

  1. Proficiency and due professional care are identical concepts and are used interchangeably in the Standards.
  2. Proficiency concerns the knowledge and skills the auditor brings, while due professional care concerns the diligence and judgment applied in performing the work. Correct answer.
  3. Due professional care is a substitute for proficiency when an auditor has many years of experience.
  4. Proficiency applies only to chief audit executives, while due professional care applies only to staff auditors.

Explanation

Proficiency addresses the knowledge, skills, and other competencies required to perform engagements. Due professional care addresses the diligence, judgment, and reasonable care with which those competencies are applied. They are complementary but distinct requirements.

Question 44Proficiency and Due Professional Care

During an engagement, an internal auditor discovers that the audit client has a policy of recording revenue in the period cash is received rather than when earned. The auditor should recognize this as a matter that most directly bears on which consideration?

  1. The potential for material misstatement arising from inappropriate accounting treatment. Correct answer.
  2. The engagement's budgeted time versus actual time.
  3. The auditor's own continuing professional education hours.
  4. The adequacy of the audit committee's meeting schedule.

Explanation

Due professional care includes alertness to the risk of significant errors, fraud, and noncompliance. A policy that records revenue on a cash basis rather than an accrual basis is a potential accounting misstatement that the auditor must evaluate and pursue.

Question 45Proficiency and Due Professional Care

An internal auditor is preparing working papers for an engagement. Which practice best reflects the exercise of due professional care in documentation?

  1. Documenting sufficient information so that another competent auditor could re-perform the work and reach the same conclusions. Correct answer.
  2. Recording only conclusions and omitting the evidence and reasoning that support them.
  3. Keeping documentation confidential by storing it only in the auditor's personal notes.
  4. Relying on memory and reconstructing the file only when a supervisor requests it.

Explanation

Due professional care requires that engagement records contain sufficient information to support conclusions and allow re-performance by another auditor. Documentation should capture evidence, analysis, and conclusions, not merely outcomes.

Question 46Proficiency and Due Professional Care

Which of the following is the most appropriate way for an internal auditor to maintain the proficiency required by the Standards?

  1. Avoid unfamiliar areas so that existing skills are never tested.
  2. Pursue continuing professional development, such as ongoing education and training relevant to internal auditing. Correct answer.
  3. Rely solely on the knowledge gained during initial professional certification.
  4. Delegate all technical judgments to junior staff to save time.

Explanation

The Standards expect internal auditors to maintain and enhance their proficiency through continuing professional development. Initial certification is a starting point, not a permanent substitute for ongoing learning.

Question 47Proficiency and Due Professional Care

An internal auditor is assigned to review a process in which the auditor previously served as the operating manager. What is the most appropriate action under the Standards regarding objectivity and due professional care?

  1. Proceed but omit any findings that reflect poorly on the auditor's prior decisions.
  2. Rely on the prior manager's subordinates to perform the review to avoid a conflict.
  3. Disclose the potential impairment to the chief audit executive so that the assignment can be reassessed or reassigned. Correct answer.
  4. Proceed with the engagement because the auditor's prior experience guarantees deep understanding.

Explanation

An auditor who recently managed an area has an objectivity impairment that should be disclosed to the chief audit executive. Due professional care includes recognizing and communicating circumstances that could compromise objectivity so the assignment can be reassessed.

Question 48Proficiency and Due Professional Care

An internal auditor performs an engagement and concludes that internal controls over payroll are operating effectively. Later, a material payroll fraud is discovered. Which statement best reflects the Standards' position on the auditor's responsibility?

  1. The auditor must resign from the profession because a fraud occurred on their watch.
  2. The auditor bears no responsibility in any circumstance once a report is issued.
  3. Due professional care does not imply infallibility, but the auditor's work should be evaluated against whether reasonable procedures and judgment were applied. Correct answer.
  4. The auditor automatically violated the Standards because an effective audit would have found the fraud.

Explanation

The Standards state that due professional care does not imply infallibility, so the discovery of a fraud after an engagement does not by itself prove a violation. The relevant question is whether the auditor exercised the care and skill expected of a reasonably prudent and competent auditor.

Question 49Proficiency and Due Professional Care

An internal auditor is planning an engagement and must decide how much evidence to gather. Which consideration is most relevant to exercising due professional care in that decision?

  1. The number of prior engagements the auditor has completed in any area.
  2. The significance, materiality, and risk of the activity being reviewed, along with the cost and benefit of obtaining evidence. Correct answer.
  3. The length of the engagement report that management would like to receive.
  4. The preference of the audit client regarding how much evidence should be collected.

Explanation

Due professional care requires the auditor to consider the relative materiality and significance of the matter and to balance the cost of obtaining evidence against its benefit. Risk and materiality drive the sufficiency of evidence.

Question 50Proficiency and Due Professional Care

Which action by an internal auditor would most clearly demonstrate a lack of due professional care during fieldwork?

  1. Extending testing after an unexpected anomaly is identified.
  2. Accepting a management explanation for a control exception without obtaining any corroborating evidence. Correct answer.
  3. Consulting a specialist when the engagement involves complex tax rules.
  4. Documenting the rationale for selecting a particular sampling approach.

Explanation

Due professional care requires the auditor to obtain sufficient appropriate evidence and to exercise professional skepticism. Accepting an unverified management explanation without corroboration falls short of that expectation.