I85PREP
⌘ K
CIA Part 1 study materials
CIA Part 1 study resources

CIA Part 1 practice questions

One question at a time. Build your CIA Part 1 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of Internal Auditing

According to the IIA's Definition of Internal Auditing, internal auditing is designed primarily to:

  1. Add value and improve operations Correct answer.
  2. Ensure compliance with government regulations
  3. Replace the work of the external auditor
  4. Certify the reliability of financial reporting

Explanation

The Definition describes internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving risk management, control, and governance processes.

Question 2Foundations of Internal Auditing

The mission of internal audit, as stated in the IPPF, is to enhance and protect organizational value by providing stakeholders with:

  1. guaranteed detection of all material fraud
  2. objective assurance, advice, and insight Correct answer.
  3. regulatory approval of the control environment
  4. a certified opinion on internal controls

Explanation

The mission statement states that internal audit enhances and protects organizational value by providing stakeholders with objective assurance, advice, and insight. These three elements reflect the assurance and consulting nature of the activity.

Question 3Foundations of Internal Auditing

Which of the following is one of the four principles of The IIA's Code of Ethics?

  1. Transparency
  2. Accountability
  3. Confidentiality Correct answer.
  4. Independence

Explanation

The Code of Ethics contains four principles: integrity, objectivity, confidentiality, and competency, each supported by rules of conduct. Confidentiality obligates internal auditors to be prudent in the use and protection of information acquired in the course of their duties.

Question 4Foundations of Internal Auditing

Which of the following best describes the internal audit charter?

  1. It defines the activity's purpose, authority, and responsibility Correct answer.
  2. It describes the staffing levels and budget needed to deliver the annual plan
  3. It summarizes the audit findings reported to the board during the year
  4. It lists the detailed audit procedures to be performed during each engagement

Explanation

The Standards require the purpose, authority, and responsibility of the internal audit activity to be formally defined in an internal audit charter. The charter establishes the activity's position in the organization and authorizes access to records, personnel, and property needed to perform engagements.

Question 5Foundations of Internal Auditing

Final approval of the internal audit charter rests with:

  1. the chief audit executive
  2. the board Correct answer.
  3. senior management alone
  4. the external auditor

Explanation

The Standards require the chief audit executive to review the charter periodically and present it to senior management and the board for approval. Board approval is what gives the charter its authority and reinforces the independence of the activity.

Question 6Foundations of Internal Auditing

According to the Definition of Internal Auditing, the internal audit activity provides two categories of services, which are:

  1. assurance and inspection
  2. attestation and compliance
  3. advisory and investigative
  4. assurance and consulting Correct answer.

Explanation

The Definition identifies internal auditing as an independent, objective assurance and consulting activity. Assurance services involve objective assessment of evidence to provide opinions or conclusions, while consulting services are advisory in nature and generally performed at the request of the client.

Question 7Foundations of Internal Auditing

The Standards require that the chief audit executive have:

  1. a permanent voting seat on the audit committee
  2. authority to approve the organization's financial statements
  3. direct access to the board Correct answer.
  4. control over the external audit budget

Explanation

The Standards require the CAE to communicate and interact directly with the board, including in private sessions without management present. Direct access supports the free flow of information and protects the independence of the internal audit activity.

Question 8Foundations of Internal Auditing

Due professional care requires internal auditors to:

  1. apply the care expected of a reasonably prudent auditor Correct answer.
  2. obtain an unqualified opinion from external audit
  3. achieve complete assurance that no material error exists
  4. review every transaction in the area under audit

Explanation

The Standards state that internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor. Due professional care does not imply infallibility, nor does it require exhaustive testing of every item.

Question 9Foundations of Internal Auditing

Which of the following is one of the Core Principles for the Professional Practice of Internal Auditing?

  1. Reports to the external auditor on control matters
  2. Provides risk-based assurance Correct answer.
  3. Rotates the chief audit executive every three years
  4. Guarantees absolute assurance to the board

Explanation

The Core Principles describe what makes an internal audit activity effective, including demonstrating integrity, objectivity, confidentiality, and competency; aligning with the organization's strategies and risks; being appropriately positioned and resourced; providing risk-based assurance; being insightful, proactive, and future-focused; and promoting organizational improvement.

Question 10Foundations of Internal Auditing

Which statement correctly distinguishes independence from objectivity?

  1. Both terms describe the auditor's technical proficiency
  2. Both terms are achieved once the board approves the charter
  3. Independence relates to organizational conditions; objectivity is an unbiased mental attitude Correct answer.
  4. Independence is a state of mind, while objectivity refers to reporting lines

Explanation

Independence is freedom from conditions that threaten the ability of the internal audit activity to carry out its responsibilities without bias, and it is supported mainly through reporting lines and board interaction. Objectivity is an unbiased mental attitude that allows auditors to perform engagements and report results honestly.

Question 11Foundations of Internal Auditing

If the independence or objectivity of an internal auditor is impaired in fact or appearance, the auditor must:

  1. complete the engagement and note the issue in the final report
  2. obtain board approval before continuing the work
  3. disclose the details of the impairment to appropriate parties Correct answer.
  4. resign from the internal audit activity

Explanation

The Standards require that impairments to independence or objectivity, in fact or appearance, be disclosed to appropriate parties. The nature of the disclosure depends on the impairment, and further action is decided based on the circumstances.

Question 12Foundations of Internal Auditing

Under the Standards addressing continuing professional development, internal auditors are required to:

  1. pursue continuing professional development Correct answer.
  2. attend at least 40 hours of formal training each year
  3. complete a graduate degree in accounting
  4. hold a professional auditing certification

Explanation

The Standards require internal auditors to enhance their knowledge, skills, and other competencies through continuing professional development. The proficiency of the internal audit activity depends on the collective competence of its staff and their ongoing development.

Question 13Foundations of Internal Auditing

An external quality assessment of the internal audit activity must be performed at least every:

  1. two years
  2. three years
  3. ten years
  4. five years Correct answer.

Explanation

The Standards require an external assessment by a qualified, independent assessor or assessment team at least once every five years. The chief audit executive discusses with the board the form and timing of the external assessment.

Question 14Foundations of Internal Auditing

An internal audit activity may state that it conforms with the International Standards for the Professional Practice of Internal Auditing only when:

  1. its quality assurance and improvement program supports it Correct answer.
  2. the external auditor agrees with the statement
  3. it has completed the approved annual audit plan
  4. the board has given the CAE permission to make the statement

Explanation

The Standards permit the conformance statement only if the results of the quality assurance and improvement program support it. If nonconformance affects the activity's ability to fulfill its responsibilities, the chief audit executive must disclose the nonconformance to senior management and the board.

Question 15Foundations of Internal Auditing

Which statement best describes a consulting engagement performed by internal auditors?

  1. Its nature and scope are generally agreed with the engagement client Correct answer.
  2. It guarantees that the client's process is free of risk
  3. It must be performed by the external auditor
  4. It always results in a formal assurance opinion for the board

Explanation

Consulting services are advisory in nature and are generally performed at the specific request of the engagement client, with the objectives and scope agreed with that client. Internal auditors must still maintain objectivity and must not assume management responsibilities.

Question 16Foundations of Internal Auditing

In the Three Lines Model, the internal audit function is best described as:

  1. an external party providing assurance to regulators
  2. part of the second line, monitoring compliance
  3. the third line, reporting to the governing body Correct answer.
  4. part of the first line, performing day-to-day controls

Explanation

The Three Lines Model assigns operational management responsibility for controls to the first line and risk and compliance oversight to the second line. Internal audit is the independent third line, providing assurance and advice to the governing body on the effectiveness of governance, risk management, and control.

Question 17Foundations of Internal Auditing

With respect to fraud, internal auditors are expected to:

  1. assist in deterrence and detection Correct answer.
  2. guarantee that all fraud will be detected
  3. prosecute suspected fraudsters
  4. accept sole responsibility for preventing fraud

Explanation

Management is responsible for establishing controls that deter and detect fraud, while internal audit assists by evaluating those controls and assessing fraud risk. Internal auditors need sufficient knowledge to identify indicators of fraud but are not expected to be experts in detecting it.

Question 18Foundations of Internal Auditing

When evaluating the organization's governance processes, the internal audit activity would include which of the following in its scope?

  1. promoting appropriate ethics and values Correct answer.
  2. negotiating contracts with major suppliers
  3. designing the organization's marketing campaigns
  4. preparing the organization's financial statements

Explanation

The Standards list governance processes for internal audit to evaluate, including making strategic and operational decisions, overseeing risk management and control, promoting appropriate ethics and values, ensuring effective performance management and accountability, communicating risk and control information, and coordinating the activities of the board, auditors, and management.

Question 19Foundations of Internal Auditing

A sound internal audit plan should be:

  1. fixed for five years to support long-term coverage
  2. developed and finalized solely by senior management
  3. a roll-forward of the prior year's plan to ensure comparability
  4. risk-based and approved by the board Correct answer.

Explanation

The chief audit executive must establish a risk-based plan, consistent with the organization's goals, that identifies the priorities of the internal audit activity. The plan is communicated to and approved by senior management and the board and is reviewed and adjusted as risks change.

Question 20Foundations of Internal Auditing

The chief audit executive is required to share information and coordinate activities with:

  1. the organization's customers
  2. the regulator's inspection team
  3. the board only
  4. other internal and external assurance providers Correct answer.

Explanation

The Standards require the CAE to share information and coordinate activities with other internal and external assurance and consulting service providers. This coordination helps ensure adequate coverage and minimizes duplication of effort.

Question 21Foundations of Internal Auditing

Which combination best describes the standard reporting relationships of the chief audit executive?

  1. Functional to the board; administrative to management Correct answer.
  2. Administrative to the board, functional to management
  3. Functional and administrative to the audit committee
  4. Administrative to the external auditor, functional to the CFO

Explanation

Functional reporting to the board typically covers approving the charter and audit plan, receiving reports, and evaluating the CAE's performance, while administrative reporting to management covers day-to-day matters such as budgeting and human resources. This structure protects independence while allowing the activity to operate effectively.

Question 22Foundations of Internal Auditing

An internal auditor transferred out of the accounts payable department ten months ago is now assigned to audit accounts payable. Under the Standards, the auditor's objectivity is:

  1. acceptable if the workpapers are reviewed by another auditor
  2. presumed to be impaired, so the assignment should be reassigned Correct answer.
  3. not affected, because the auditor now works in internal audit
  4. impaired only if the prior role involved supervising staff

Explanation

The Standards state that objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the auditor had responsibility within the previous year. Because the transfer occurred ten months ago, the auditor should not be assigned to that engagement.

Question 23Foundations of Internal Auditing

The chief audit executive concludes that senior management has accepted a level of residual risk that may be unacceptable to the organization. Under the Standards, if the matter is not resolved with senior management, the CAE must:

  1. report the matter to the board for resolution Correct answer.
  2. report the matter to the external auditor for action
  3. refer the matter to the industry regulator
  4. accept the decision because risk is management's responsibility

Explanation

The CAE must first discuss the matter with senior management; if the residual risk decision is not resolved, the CAE must report it to the board for resolution. Risk acceptance remains a management decision, but internal audit must escalate unresolved concerns.

Question 24Foundations of Internal Auditing

Before accepting a consulting engagement that may impair the internal auditor's objectivity, the auditor must:

  1. decline the engagement in all circumstances
  2. disclose the potential impairment to the engagement client Correct answer.
  3. obtain written approval from the external auditor
  4. complete the work and disclose the impairment in the final report

Explanation

The Standards require that potential impairments to independence or objectivity relating to proposed consulting services be disclosed to the engagement client before the engagement is accepted. Disclosure allows the client to decide whether to proceed with full knowledge of the situation.

Question 25Foundations of Internal Auditing

Within the International Standards, attribute standards differ from performance standards in that attribute standards address:

  1. the required content of the internal audit charter only
  2. the requirements for external quality assessments only
  3. the nature of engagements and the steps of the audit process
  4. the attributes of organizations and parties performing internal audits Correct answer.

Explanation

Attribute standards address the characteristics of organizations and parties performing internal audit activities, covering purpose and authority, independence and objectivity, proficiency and due professional care, and the quality assurance and improvement program. Performance standards describe the nature of internal audit activities and provide quality criteria for measuring performance.

Question 26Foundations of Internal Auditing

According to the IIA's definition, the internal audit activity exists primarily to:

  1. replace the work performed by the external auditor
  2. eliminate the organization's exposure to risk
  3. certify the reliability of the organization's financial statements
  4. add value and improve an organization's operations Correct answer.

Explanation

The definition describes internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluating governance, risk management, and control.

Question 27Foundations of Internal Auditing

The internal audit charter most appropriately establishes the internal audit activity's:

  1. annual budget, staffing levels, and salary bands
  2. detailed audit procedures for individual engagements
  3. purpose, authority, and responsibility Correct answer.
  4. the organization's risk appetite and tolerance levels

Explanation

The charter is a formal document approved by the board that defines the activity's purpose, authority, and responsibility. It is the source of the internal audit activity's mandate and its right of access to records, personnel, and property.

Question 28Foundations of Internal Auditing

Which of the following is one of the four principles of the IIA Code of Ethics?

  1. Integrity Correct answer.
  2. Transparency
  3. Independence
  4. Accountability

Explanation

The Code of Ethics is built on four principles: integrity, objectivity, confidentiality, and competency. These principles are expected of everyone who performs internal audit services.

Question 29Foundations of Internal Auditing

An engagement that examines whether a department is achieving its objectives efficiently and effectively is best described as:

  1. a compliance audit
  2. a financial audit
  3. an operational audit Correct answer.
  4. an information technology audit

Explanation

An operational (performance) audit evaluates the efficiency and effectiveness of operations and whether objectives are being met. Financial audits address financial information, compliance audits address adherence to rules, and IT audits focus on systems and technology controls.

Question 30Foundations of Internal Auditing

Internal assessments, one component of a quality assurance and improvement program, consist of:

  1. a satisfaction survey of senior management and the board
  2. a review of prior-year working papers by the external auditor
  3. an external review by a qualified independent assessor
  4. ongoing monitoring and periodic self-assessments Correct answer.

Explanation

The quality assurance and improvement program has two components: internal assessments and external assessments. Internal assessments consist of ongoing monitoring of the activity's work plus periodic self-assessments of conformance with the Standards and the Code of Ethics.

Question 31Foundations of Internal Auditing

Under the Code of Ethics, an internal auditor may disclose confidential information obtained during an engagement when:

  1. required by law or a legal or regulatory obligation Correct answer.
  2. the auditor's supervisor gives informal permission
  3. the information concerns a competitor of the organization
  4. the disclosure would help a colleague in another department

Explanation

The confidentiality principle permits disclosure when the auditor is required by law or a professional obligation to do so. Otherwise, information is disclosed only with proper authority and only on a need-to-know basis.

Question 32Foundations of Internal Auditing

The scope of internal auditing, as defined in the Standards, includes evaluating the adequacy and effectiveness of the organization's:

  1. employee compensation and benefits administration
  2. governance, risk management, and control processes Correct answer.
  3. marketing strategy and sales performance
  4. external financial reporting and tax filings

Explanation

The Standards state that internal auditing evaluates and contributes to the improvement of governance, risk management, and control processes. These three areas define the activity's broad scope of work.

Question 33Foundations of Internal Auditing

The internal audit staff lacks expertise in a highly specialized area that is central to an approved engagement. The most appropriate action for the chief audit executive is to:

  1. complete the engagement using only the staff's generalist knowledge
  2. delegate the detailed testing to management of the audited function
  3. remove the engagement from the risk-based audit plan permanently
  4. engage a competent outside specialist to assist Correct answer.

Explanation

The Standards require the chief audit executive to obtain competent advice and assistance when the internal audit activity lacks the knowledge, skills, or competencies needed for an engagement. The engagement proceeds with qualified support rather than being dropped or handed to the auditee.

Question 34Foundations of Internal Auditing

The IIA Code of Ethics applies to:

  1. only the chief audit executive and senior audit managers
  2. only members of the organization's audit committee and board
  3. only certified internal auditors employed by the organization
  4. individuals and entities that perform internal audit services Correct answer.

Explanation

The Code of Ethics applies to individuals and entities that provide internal audit services, including external service providers and others performing work for the internal audit activity. Applicability depends on the service performed, not on job title or certification.

Question 35Foundations of Internal Auditing

Which statement about the Implementation Guidance in the IPPF is correct?

  1. It describes how to apply the Standards but is not mandatory Correct answer.
  2. It is mandatory for all internal audit activities and must be cited in the charter
  3. It consists of the Code of Ethics and the definition of internal auditing
  4. It replaces the Standards when the organization is small

Explanation

Within the IPPF, the Standards are the mandatory requirements, while implementation guidance explains approaches for applying them in practice. Implementation guidance is helpful and authoritative in nature but is not itself mandatory.

Question 36Foundations of Internal Auditing

Under the Standards on monitoring progress, the chief audit executive is responsible for:

  1. deciding which reported findings management is permitted to ignore
  2. personally implementing the corrective actions agreed to by management
  3. referring all unresolved findings to the external auditor for follow-up
  4. monitoring and following up on management's remediation of findings Correct answer.

Explanation

The chief audit executive must establish and maintain a process to monitor the disposition of results communicated to management. This means tracking whether agreed corrective actions have been implemented and escalating matters that remain unresolved.

Question 37Foundations of Internal Auditing

Significant engagement results should be communicated to:

  1. the external auditor, who decides whether to inform the board
  2. all employees, through a general announcement
  3. management and, where relevant, the board Correct answer.
  4. the engagement client only

Explanation

Results are communicated to the parties who can act on them and, for significant matters, to the board. The chief audit executive determines the appropriate recipients so that significant risks and control weaknesses reach the right level of authority.

Question 38Foundations of Internal Auditing

An organization asks internal audit to take over the operation of its enterprise risk management process, including setting the risk appetite and owning risk responses. The chief audit executive should:

  1. decline, because internal auditors may not work on risk management at all
  2. accept, provided the arrangement is disclosed to the board annually
  3. decline, because owning risk decisions impairs objectivity Correct answer.
  4. accept, because internal auditors are the most knowledgeable about risk

Explanation

Internal audit may provide assurance and consulting services related to risk management, but taking on management's responsibility for risk creates a self-review threat and undermines objectivity. Setting risk appetite and owning responses are management decisions that internal audit must not make.

Question 39Foundations of Internal Auditing

An internal auditor has led engagements at the same subsidiary for six consecutive years and has developed close personal ties with its management. Which threat to objectivity does this situation most directly illustrate?

  1. advocacy threat
  2. self-review threat
  3. intimidation threat
  4. familiarity threat Correct answer.

Explanation

Long-standing relationships and repeated assignments with the same people create a familiarity threat, in which trust and personal ties can dull an auditor's skepticism. Objectivity threats are managed by rotating assignments, independent reviews, and disclosure of impairments.

Question 40Foundations of Internal Auditing

In reporting to the board on the system of internal control, the chief audit executive should recognize that internal control provides:

  1. assurance only over the reliability of financial reporting
  2. no assurance but rather a record of management's intentions
  3. absolute assurance that objectives will be achieved
  4. reasonable, not absolute, assurance about objectives Correct answer.

Explanation

Internal control is a process designed to provide reasonable assurance regarding the achievement of objectives. Limitations such as human error, collusion, and management override mean absolute assurance is never attainable.

Question 41Independence and Objectivity

According to the IIA definition, independence is best described as:

  1. the authority to approve management's operating decisions
  2. freedom from conditions that threaten an unbiased audit outcome Correct answer.
  3. the complete absence of personal relationships with auditees
  4. a mental attitude of impartiality toward the auditee

Explanation

Independence is an organizational attribute concerned with conditions that could pressure the internal audit activity and compromise unbiased work. Objectivity, by contrast, is the individual auditor's mental attitude. Complete separation from auditees is not required, and operating authority belongs to management.

Question 42Independence and Objectivity

Under the IIA framework, objectivity is defined as:

  1. an unbiased mental attitude that permits engagements to be performed without compromising quality Correct answer.
  2. the organizational right to report findings to the board
  3. freedom from conditions that threaten the audit activity's work
  4. the elimination of every possible conflict of interest

Explanation

Objectivity is the mental attitude of internal auditors and requires them not to subordinate their judgment on audit matters to others. It is a personal attribute rather than an organizational reporting structure. Conflicts must be managed, not eliminated absolutely.

Question 43Independence and Objectivity

To whom should the chief audit executive report functionally?

  1. The external auditor
  2. The controller
  3. The chief financial officer
  4. The audit committee of the board Correct answer.

Explanation

Functional reporting to the board or its audit committee supports the internal audit activity's independence and gives it authority to report findings without management filter. Administrative reporting may run to senior management, but functional oversight belongs with the board.

Question 44Independence and Objectivity

The administrative reporting line of the chief audit executive most commonly runs to the:

  1. chief executive officer Correct answer.
  2. head of the audited department
  3. external audit partner
  4. audit committee chair

Explanation

Administrative reporting typically covers day-to-day human resources, budgeting, and office administration and commonly runs to the CEO. Functional reporting to the board or audit committee is kept separate to preserve independence.

Question 45Independence and Objectivity

An internal auditor is offered a valuable personal gift by the manager of an area being audited. The appropriate response is to:

  1. decline the gift and disclose the offer to the CAE Correct answer.
  2. accept it only after the engagement is finished
  3. accept it as a normal business courtesy
  4. share it with the audit team

Explanation

Internal auditors must avoid accepting anything that could impair, or appear to impair, their professional judgment. Declining the gift and disclosing the offer allows the CAE to assess and document the situation. Accepting it, even later or collectively, still creates a familiarity or influence threat.

Question 46Independence and Objectivity

Which assignment most clearly impairs an internal auditor's independence?

  1. using data analytics tools on client records
  2. auditing a process in another country
  3. taking over the daily operation of the process being reviewed Correct answer.
  4. reviewing a department's compliance with a policy drafted by the legal department

Explanation

Independence is impaired when internal auditors assume management responsibilities, such as operating a process they later must assess. Auditing a policy drafted by another function or using analytics tools does not by itself transfer management responsibility.

Question 47Independence and Objectivity

An internal auditor was responsible for a specific operating activity within the previous year. The auditor should:

  1. audit it after a colleague reviews the work
  2. audit it after completing additional training
  3. not provide assurance on that activity Correct answer.
  4. audit it if management gives written approval

Explanation

Objectivity is presumed to be impaired when an internal auditor provides assurance on an activity for which the auditor had responsibility within the previous year. Approval, review, or training does not remove that self-review threat.

Question 48Independence and Objectivity

The internal audit plan should be approved by the:

  1. board or its audit committee Correct answer.
  2. external auditor
  3. chief financial officer
  4. operating managers covered by the plan

Explanation

Approval of the internal audit plan is a functional oversight responsibility of the board or audit committee. This approval protects the audit activity from management influence over what gets audited.

Question 49Independence and Objectivity

Which item falls within the functional reporting relationship between the CAE and the board?

  1. Approval of the CAE's annual leave schedule
  2. Processing of the department's expense reports
  3. Approval of the CAE's appointment and removal Correct answer.
  4. Assignment of the CAE's office space

Explanation

Functional reporting includes matters that affect the CAE's authority and independence, such as appointment, removal, and oversight of the audit plan. Leave schedules, office space, and expense processing are administrative matters.

Question 50Independence and Objectivity

A CAE's performance evaluation and compensation are most appropriately approved by the:

  1. controller
  2. managers of the audited areas
  3. audit committee, with input from the CEO Correct answer.
  4. external auditor

Explanation

Compensation and performance evaluation of the CAE should be controlled at the board or audit committee level to prevent management from influencing audit results. Input from the CEO can be useful, but final approval should rest with the committee.