I85PREP
⌘ K
CIA Part 2 study materials
CIA Part 2 study resources

CIA Part 2 practice questions

One question at a time. Build your CIA Part 2 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Engagement Planning

What is the primary purpose of planning an individual internal audit engagement?

  1. To provide a basis for the external auditor to rely on the internal audit function's work
  2. To focus attention on significant risks so that work is performed efficiently Correct answer.
  3. To reduce the total number of audit hours charged below the prior year's actual level
  4. To guarantee that no material misstatement or irregularity remains undetected by the audit

Explanation

Engagement planning directs attention to the significant areas and risks so that the engagement is performed effectively and efficiently. It is a means of organizing the work, not a guarantee of complete detection or a tool for cost-cutting or external reliance.

Question 2Engagement Planning

Which statement best distinguishes engagement objectives from engagement scope?

  1. Objectives are written after fieldwork, while scope is written before fieldwork begins
  2. Objectives state the boundaries of the area to be examined, while scope describes the results expected to be achieved
  3. Objectives state what the engagement is to accomplish, while scope defines the boundaries of the work Correct answer.
  4. Objectives are established by the audit committee, while scope is established by the engagement client's management

Explanation

Objectives are broad statements of what the engagement is intended to accomplish, whereas scope identifies the subject matter, period, and boundaries of the work. Both are established during planning and both are approved within the audit function.

Question 3Engagement Planning

What is the principal function of an engagement work program?

  1. To authorize the engagement client to begin implementing corrective action on reported findings
  2. To list the procedures to be performed to achieve the engagement objectives Correct answer.
  3. To summarize the results of the engagement for the audit committee
  4. To record the audit evidence obtained and the conclusions reached

Explanation

A work program is the documented set of procedures, prepared during planning, that will be performed to accomplish the engagement objectives. It is approved before work begins and serves as the basis for directing and supervising the engagement.

Question 4Engagement Planning

A time budget prepared during engagement planning is used primarily to:

  1. Establish the billable rates to be charged to the engagement client
  2. Replace the need for periodic progress reports submitted to engagement management
  3. Allocate staff hours and monitor progress against the engagement plan Correct answer.
  4. Determine the number of findings that the engagement will produce

Explanation

A time budget translates the planned work program into estimated hours by activity and staff level, supporting resource allocation and allowing actual progress to be monitored. Significant variances are investigated and may prompt revision of the plan.

Question 5Engagement Planning

When assigning staff to an engagement, the chief audit executive should ensure that the team collectively possesses:

  1. A rotation of members who have never worked in the audited area
  2. At least one member holding a professional certification in accounting
  3. The knowledge, skills, and other competencies needed to perform the work Correct answer.
  4. More years of service in the organization than the client's management team possesses

Explanation

Staffing decisions are based on the competencies the engagement requires, considering the nature and complexity of the subject matter as well as the experience of team members. Certifications, tenure, and rotation are only some of the factors that may support competence.

Question 6Engagement Planning

Before beginning fieldwork on a recurring engagement, the team should review prior engagement working papers primarily to:

  1. Identify previously identified issues and changes that affect current risk Correct answer.
  2. Verify that last year's time budget was fully consumed before closing
  3. Reuse the previous year's conclusions without retesting the underlying conditions
  4. Confirm that the same staff will be assigned to the engagement again this year

Explanation

Reviewing prior work papers and reports provides background on the process, previously identified issues, and the status of corrective action, which informs the assessment of current risk. It does not permit carrying forward old conclusions as current evidence.

Question 7Engagement Planning

Engagement work programs and planning decisions should be documented and approved:

  1. After the engagement report has been issued and management responds
  2. Only if the audit committee specifically requests a copy of the program
  3. Before the work is performed, by the appropriate engagement supervisor Correct answer.
  4. Verbally, during the opening conference held with the engagement client

Explanation

The approved work program provides the authorization to proceed and the basis for supervision, so it must be documented and approved before the work is performed. Planning decisions should also be recorded in the engagement planning documentation.

Question 8Engagement Planning

Which statement about engagement planning is most accurate?

  1. Planning is completed once the work program is approved and should not be revisited afterward
  2. Planning is performed by the engagement client's management rather than the audit team
  3. Planning is required only for assurance engagements and not for consulting engagements
  4. Planning is a continuous process that may be revised as new information emerges Correct answer.

Explanation

Planning is continuous: knowledge gained during the engagement may require reassessment of objectives, scope, and procedures, with revisions documented and approved. Planning also applies to consulting engagements, though its formality varies.

Question 9Engagement Planning

In planning an assurance engagement, the auditor considers materiality primarily to:

  1. Determine the nature, timing, and extent of procedures and evaluate findings Correct answer.
  2. Establish the number of staff to be assigned to the engagement team
  3. Decide whether the engagement should be performed at all this year
  4. Set the fee that will be charged to the engagement client for the work

Explanation

Materiality is considered throughout the engagement: it influences how much and what kind of evidence is gathered and provides the threshold against which findings are evaluated and reported.

Question 10Engagement Planning

A risk-based approach to engagement planning means that the auditor should:

  1. Test all controls in the audited process with the same depth of coverage
  2. Focus effort where the likelihood and impact of adverse events are greatest Correct answer.
  3. Select samples randomly so that every transaction has an equal chance of selection
  4. Rely on management's risk register without independent verification of the entries

Explanation

Risk-based planning concentrates resources on the areas with the greatest likelihood and impact of adverse events, subject to the auditor's own assessment rather than management's alone. This drives the nature, timing, and extent of procedures.

Question 11Engagement Planning

The purpose of a preliminary survey (walk-through) in engagement planning is to:

  1. Document the client's agreement to the engagement's scope and timing
  2. Gather conclusive evidence supporting the engagement's final overall opinion
  3. Test the operating effectiveness of the key controls in the process
  4. Obtain background understanding of the area and refine risks and objectives Correct answer.

Explanation

A preliminary survey builds the auditor's understanding of the activity, its processes, and its risks, allowing objectives and the work program to be refined. Evidence gathered at this stage is generally insufficient to support final conclusions.

Question 12Engagement Planning

Which item is most likely to be included in an engagement planning memorandum?

  1. Detailed listings of every transaction examined during fieldwork
  2. The final engagement report together with management's written responses
  3. The prior year's financial statements with the external audit opinion attached
  4. Engagement objectives, scope, timing, and resource requirements Correct answer.

Explanation

The planning memorandum records the decisions made during planning, including objectives, scope, significant risks, timing, staffing, and budgets. It provides evidence that planning was performed and approved before fieldwork.

Question 13Engagement Planning

During planning, engagement supervision should include:

  1. Delegate approval of the engagement plan to the client's management
  2. Wait until the draft report stage to review the team's work in detail
  3. Perform all of the fieldwork personally to guarantee the quality of the evidence
  4. Approve the engagement work program and ensure staff understand the objectives Correct answer.

Explanation

Supervision begins at planning: the supervisor approves the work program, clarifies objectives and responsibilities, and remains involved throughout the engagement. Supervision is a continuing process, not a single review at the end.

Question 14Engagement Planning

When assessing fraud risk during engagement planning, the auditor should consider:

  1. The absence of prior fraud findings as evidence that fraud risk is low
  2. Only the matters raised by the external auditor in prior years' reports
  3. Incentives, opportunities, and attitudes that could permit fraud Correct answer.
  4. Only the risk of misappropriation of physical assets such as inventory

Explanation

Fraud risk assessment considers incentives or pressure, opportunity, and rationalization or attitude, in line with the fraud triangle, and covers both misappropriation and fraudulent reporting. The auditor's own assessment is required regardless of prior findings.

Question 15Engagement Planning

To coordinate with the external auditor during planning, the chief audit executive should:

  1. Allow the external auditor to set the internal audit engagement objectives
  2. Suspend internal audit work in areas that the external auditor plans to test
  3. Provide unrestricted access to all engagement working papers without documentation
  4. Discuss planned coverage, timing, and areas of overlap to avoid duplication Correct answer.

Explanation

Coordination involves sharing planned coverage and timing so that the two groups complement each other and duplication is minimized, while each retains responsibility for its own conclusions.

Question 16Engagement Planning

When planning an engagement in a highly automated environment, the auditor should consider:

  1. The reliance on systems, data integrity, and general IT controls Correct answer.
  2. That testing IT general controls is unnecessary when application controls work
  3. That automated controls cannot be relied upon without manual evidence
  4. That IT risks are the responsibility of the IT function and fall outside scope

Explanation

Planning in automated environments requires consideration of the systems that process transactions, the integrity of the data used, and the general IT controls on which automated application controls depend.

Question 17Engagement Planning

Decisions about the nature, timing, and extent of evidence gathering are made during planning because they:

  1. Link the planned procedures to the engagement objectives and identified risks Correct answer.
  2. Can be left to staff discretion once fieldwork begins in earnest
  3. Are determined solely by the size and complexity of the audited entity
  4. Must be finalized before the engagement client is contacted by the team

Explanation

Planning ties the choice of procedures, their timing, and their extent directly to the engagement objectives and the risks assessed, which is what makes the resulting evidence sufficient and appropriate.

Question 18Engagement Planning

When an engagement's scope includes compliance with laws and regulations, planning should include:

  1. Obtain a legal opinion on every applicable statute and regulation
  2. Identify the significant requirements and the risk of noncompliance Correct answer.
  3. Defer all compliance testing to the organization's legal department
  4. Assume compliance unless a whistleblower reports otherwise

Explanation

The auditor identifies the laws and regulations significant to the engagement objectives and assesses the risk of noncompliance, then designs procedures proportionate to that risk. Legal expertise may be consulted but a legal opinion on every statute is not required.

Question 19Engagement Planning

Communicating the engagement plan to the engagement client during planning helps to:

  1. Confirm understanding of the scope, timing, and information needs Correct answer.
  2. Obtain the client's approval of the final audit report wording
  3. Transfer responsibility for the engagement's conclusions to the client's management
  4. Guarantee that no disagreements will arise during fieldwork

Explanation

Early communication aligns expectations about what will be examined, when, and what information or access the team needs, which reduces disruption and misunderstandings. Responsibility for conclusions remains with the auditor.

Question 20Engagement Planning

When planning a consulting engagement, the internal auditor should first:

  1. Issue an assurance opinion on the area under review at the conclusion
  2. Obtain audit committee approval for each procedure performed
  3. Reach written agreement with the client on objectives, scope, and responsibilities Correct answer.
  4. Design detailed tests of controls over the process before any discussion

Explanation

Consulting engagements rest on an agreed understanding with the client about objectives, scope, respective responsibilities, and expected deliverables, documented before work begins. Testing and opinions are features of assurance work.

Question 21Engagement Planning

Which engagement objective is stated most appropriately?

  1. Review the procurement department's activities thoroughly and report all findings
  2. Ensure that procurement fraud does not exist anywhere in the organization
  3. Assess the general efficiency of the company's overall operations
  4. Evaluate whether procurement transactions complied with the policy in effect during the year Correct answer.

Explanation

A well-stated objective identifies a specific subject matter, a criterion (the policy in effect), and a measurable form of evaluation. Vague or absolute formulations cannot be satisfied by any realistic amount of audit work.

Question 22Engagement Planning

An engagement scope statement should exclude an area when:

  1. Management has asked that the area be reviewed in a later period instead
  2. Testing the area would require more staff hours than the engagement budget allows
  3. Prior engagements found no significant issues in that area of the organization
  4. The area falls outside the approved objectives and the exclusion is documented Correct answer.

Explanation

Scope is defined by the approved objectives; anything outside them is excluded, and exclusions should be documented and communicated so that readers do not mistakenly believe the area was covered. Budget pressure, prior results, or a client request alone are not valid basis for exclusion.

Question 23Engagement Planning

Engagement risk is best described as:

  1. The risk that the auditor's sample will not be representative of the population being tested
  2. The risk of an unsound conclusion or harm to the function's credibility Correct answer.
  3. The risk that the entity's financial statements are materially misstated by management
  4. The risk that the engagement will exceed the approved time budget and require extension

Explanation

Engagement risk is the possibility that the auditor issues an inappropriate conclusion, or that the engagement itself damages the credibility and standing of the internal audit activity. It is managed through planning, supervision, and quality review rather than by sampling design alone.

Question 24Engagement Planning

During fieldwork the auditor discovers a significant control weakness in an area outside the planned scope. The most appropriate action is to:

  1. Assess the significance, then revise the plan and obtain approval for the change Correct answer.
  2. Immediately expand testing in the area without informing the engagement supervisor
  3. Ignore the matter because it was not included in the engagement objectives
  4. Complete only the approved work program to preserve comparability with the plan

Explanation

Planning is continuous, so new information is evaluated against the objectives and risk assessment, and material changes to scope or procedures are documented and approved by the appropriate level of audit management. Unapproved unilateral expansion or rigid adherence to the original plan are both inappropriate.

Question 25Engagement Planning

Which statement about planning differences between assurance and consulting engagements is most accurate?

  1. Both engagement types require identical testing procedures and identical reporting formats
  2. Assurance engagements never require any communication with the client during the planning phase
  3. Consulting scope is agreed with the client; assurance objectives are set independently Correct answer.
  4. Consulting engagements do not require documented planning or retention of working papers

Explanation

In consulting engagements, the internal auditor works with the client to agree on objectives, scope, and responsibilities, whereas in assurance engagements the auditor determines objectives independently and reports an impartial conclusion. Both still require planning and documentation proportionate to the engagement.

Question 26Engagement Planning

Engagement planning is best characterized as which of the following?

  1. A task performed only by the engagement supervisor.
  2. A one-time activity completed before fieldwork begins.
  3. A formal step required only for assurance engagements.
  4. A continuous process that is updated as new information is obtained. Correct answer.

Explanation

Planning is iterative and continues throughout the engagement as the auditor learns more about the area under review. It is not confined to a single pre-fieldwork event, and it applies to both assurance and consulting engagements.

Question 27Engagement Planning

Engagement objectives should primarily be aligned with which of the following?

  1. The prior year's engagement work program.
  2. The preferences of the engagement client.
  3. The organization's strategic objectives and related risks. Correct answer.
  4. The personal development goals of the audit staff.

Explanation

Engagement objectives are derived from the organization's goals and the risks that threaten them, so the engagement adds value to the organization. Prior work programs and client preferences are inputs, not the primary basis for objectives.

Question 28Engagement Planning

Which of the following is an essential element of an engagement scope statement?

  1. The names of all employees to be interviewed.
  2. The specific time period, locations, and activities to be covered. Correct answer.
  3. The audit fees to be charged to the client.
  4. The exact sample size for each test.

Explanation

Scope defines the boundaries of the engagement, including the period, locations, and processes or activities included. Detailed procedures and sample sizes belong in the work program, not the scope statement.

Question 29Engagement Planning

Who typically authorizes the engagement plan before fieldwork begins?

  1. The audit committee chair personally.
  2. The engagement client's chief executive.
  3. The chief audit executive or a designee. Correct answer.
  4. The external auditor.

Explanation

The chief audit executive is responsible for approving engagement plans, though this authority may be delegated to an appropriate designee. Client executives and external auditors may be informed, but they do not authorize the internal audit plan.

Question 30Engagement Planning

When assigning staff to an engagement, the auditor should primarily consider which of the following?

  1. The staff's availability for overtime.
  2. The skills and experience required by the engagement's objectives. Correct answer.
  3. The seniority of staff in the audit department.
  4. The preferences of the engagement client.

Explanation

Staffing should match the competencies needed to achieve the engagement objectives, including any specialized knowledge. Seniority alone, overtime availability, and client preferences are secondary considerations.

Question 31Engagement Planning

The primary purpose of a time budget for an engagement is to:

  1. Replace the need for supervision during fieldwork.
  2. Satisfy regulatory reporting requirements.
  3. Determine the audit fee to be charged to the client.
  4. Measure and control the efficient use of engagement resources. Correct answer.

Explanation

A time budget estimates the hours needed and provides a basis for monitoring progress and controlling resources. It does not eliminate supervision, set client fees, or exist merely to satisfy regulators.

Question 32Engagement Planning

During planning, analytical procedures are most useful for:

  1. Confirming the accuracy of the financial statements.
  2. Identifying unusual trends and potential risk areas. Correct answer.
  3. Documenting the auditor's understanding of controls.
  4. Testing the operating effectiveness of internal controls.

Explanation

Planning analytics compare current information with expectations to highlight anomalies that warrant attention. They are not tests of controls and do not by themselves confirm financial statement accuracy.

Question 33Engagement Planning

A planning meeting with the engagement client is most likely held to:

  1. Confirm logistics, expectations, and access to information. Correct answer.
  2. Determine the auditor's staffing assignments.
  3. Obtain the client's approval of the audit work program.
  4. Negotiate the audit findings before fieldwork begins.

Explanation

A planning meeting coordinates practical arrangements and clarifies expectations so fieldwork can proceed smoothly. Findings cannot be negotiated before evidence is gathered, and the client does not approve the work program.

Question 34Engagement Planning

If significant new information emerges during fieldwork, the auditor should:

  1. Immediately terminate the engagement.
  2. Continue with the original plan to preserve consistency.
  3. Reassess and revise the engagement plan as appropriate. Correct answer.
  4. Delegate the decision to the engagement client.

Explanation

Because planning is continuous, the auditor must evaluate new information and adjust the plan when it affects objectives, risks, or procedures. Terminating the engagement or ignoring the information would be inappropriate.

Question 35Engagement Planning

When a client requests a change to the agreed engagement scope, the auditor should first:

  1. Accept the change to maintain a positive client relationship.
  2. Evaluate the impact of the change and document it. Correct answer.
  3. Complete the original scope and ignore the request.
  4. Refer the request to the external auditor.

Explanation

The auditor must assess how a scope change affects objectives, risk, resources, and reporting, then document the decision and obtain appropriate approval. Automatic acceptance or outright refusal is not appropriate.

Question 36Engagement Planning

When planning to use data from the client's information system, the auditor should primarily assess:

  1. The cost of extracting the data.
  2. The number of users with access to the system.
  3. The physical location of the servers.
  4. The reliability and completeness of the data. Correct answer.

Explanation

Data reliability and completeness directly affect the quality of audit evidence and the conclusions drawn from it. Cost and physical location are secondary considerations, and user counts do not establish data integrity.

Question 37Engagement Planning

When planning an engagement, coordination with other internal assurance functions primarily helps to:

  1. Shift responsibility for findings to those functions.
  2. Increase the audit budget.
  3. Avoid duplication of effort and leverage complementary work. Correct answer.
  4. Reduce the need for engagement supervision.

Explanation

Coordinating with other assurance providers allows the auditor to understand coverage, avoid redundant work, and use relevant results. It does not transfer responsibility or eliminate supervision.

Question 38Engagement Planning

The auditor's review of key performance indicators during planning is most useful for:

  1. Identifying areas of potential risk or poor performance. Correct answer.
  2. Determining the audit fee.
  3. Establishing the engagement's time budget.
  4. Selecting the audit team members.

Explanation

Performance indicators can reveal trends, outliers, and areas where actual results diverge from expectations, pointing to higher-risk areas. They do not directly set fees, staffing, or budgets.

Question 39Engagement Planning

Why should the auditor consider the organization's ethical climate during engagement planning?

  1. Because it determines the engagement's budget.
  2. Because it is required only for consulting engagements.
  3. Because ethical climate is irrelevant to operational audits.
  4. Because a weak ethical climate can increase the risk of fraud and noncompliance. Correct answer.

Explanation

The ethical climate, often called the tone at the top, affects the likelihood of fraudulent or noncompliant behavior. It is relevant to all engagement types and does not by itself determine budgets.

Question 40Engagement Planning

When planning a follow-up engagement, the auditor should focus primarily on:

  1. Expanding the scope to all organizational processes.
  2. Verifying whether prior recommendations have been implemented. Correct answer.
  3. Assessing the performance of the audit team.
  4. Repeating all procedures from the original engagement.

Explanation

A follow-up engagement determines whether management has implemented agreed corrective actions and whether those actions are effective. It does not require repeating the original engagement in full or expanding to unrelated areas.

Question 41Engagement Planning

During planning, the auditor's decision on whether to use sampling should be based primarily on:

  1. The preferences of the engagement client.
  2. The nature of the population and the engagement objectives. Correct answer.
  3. The availability of audit software.
  4. The number of prior year findings.

Explanation

Sampling is appropriate when examining the entire population is impractical and when the population and objectives allow for a representative sample. Client preferences and prior findings are not the primary drivers.

Question 42Engagement Planning

When an engagement requires specialized expertise, the auditor should:

  1. Ask the client to provide the specialist's conclusions.
  2. Proceed without the expertise to stay within budget.
  3. Include a qualified specialist in the engagement team. Correct answer.
  4. Defer the engagement until the next year.

Explanation

If the engagement objectives require specialized knowledge, the auditor should obtain that expertise, either by assigning a qualified specialist or engaging one. Proceeding without it or relying solely on the client undermines the engagement's quality.

Question 43Engagement Planning

When planning an engagement in a remote or virtual environment, the auditor should pay particular attention to:

  1. The auditor's physical fitness.
  2. The number of in-person meetings.
  3. The security and reliability of remote access to client data. Correct answer.
  4. The client's office location.

Explanation

Remote engagements depend on secure, reliable access to client systems and data. The auditor must plan for confidentiality, data integrity, and connectivity to obtain sufficient evidence.

Question 44Engagement Planning

If actual time exceeds the budgeted time for an engagement, the auditor should:

  1. Reduce the scope without documentation.
  2. Bill the client for the overrun.
  3. Stop work immediately.
  4. Investigate the reason and consider plan revisions. Correct answer.

Explanation

A budget overrun is a signal to examine why the estimate was inaccurate or why the work expanded, and to determine whether the plan needs revision. Stopping work or undocumented scope reduction could compromise the engagement.

Question 45Engagement Planning

Reviewing the organization's strategic plan during engagement planning helps the auditor to:

  1. Determine the audit fee.
  2. Assign administrative staff.
  3. Understand priorities and risks that affect the engagement. Correct answer.
  4. Avoid communicating with management.

Explanation

The strategic plan identifies the organization's direction, priorities, and related risks, which helps the auditor focus the engagement on what matters most. It does not set fees or staffing.

Question 46Engagement Planning

During planning, the auditor's assessment of the control environment is primarily used to:

  1. Determine the nature and extent of testing. Correct answer.
  2. Prepare the financial statements.
  3. Set the audit committee agenda.
  4. Conclude on the effectiveness of controls.

Explanation

A preliminary understanding of the control environment helps the auditor decide how much and what kind of testing is needed. Conclusions about effectiveness come after testing, and preparing financial statements is management's responsibility.

Question 47Engagement Planning

When engagement objectives cannot be achieved because of a scope limitation, the auditor should:

  1. Issue an unqualified report.
  2. Ignore the limitation and proceed.
  3. Modify the engagement scope or report the limitation. Correct answer.
  4. Extend the deadline indefinitely.

Explanation

A scope limitation prevents the auditor from obtaining sufficient evidence, so the scope must be revised or the limitation must be communicated in the engagement report. Ignoring it would mislead report users.

Question 48Engagement Planning

The auditor's determination of the appropriate mix of engagement procedures during planning is most influenced by:

  1. The prior year's budget.
  2. The engagement's objectives and assessed risks. Correct answer.
  3. The availability of clerical staff.
  4. The client's preferences.

Explanation

Procedures are selected to achieve the engagement objectives and address the risks identified during planning. Client preferences and administrative resources may affect logistics but not the fundamental procedure mix.

Question 49Engagement Planning

When planning an engagement, the auditor should consider the organization's risk appetite because:

  1. It eliminates the need for risk assessment.
  2. It is only relevant to financial audits.
  3. It influences the acceptable level of residual risk and the testing focus. Correct answer.
  4. It determines the audit fee.

Explanation

Risk appetite indicates how much risk the organization is willing to accept, which helps the auditor judge whether residual risk is acceptable and where to focus testing. It does not replace risk assessment or set fees.

Question 50Engagement Planning

If the client has performed a self-assessment of controls, the auditor should:

  1. Evaluate the self-assessment's reliability and consider using it. Correct answer.
  2. Disregard it entirely.
  3. Include it as audit evidence without further work.
  4. Accept the results without verification.

Explanation

A client self-assessment can be useful, but the auditor must evaluate the process behind it and decide whether it is reliable enough to rely on. Uncritical acceptance or blanket rejection are both inappropriate.