IIA-CIA-PART1 questions and answers

According to IIA guidance, which of the following is accurate regarding the chief audit executive's (CAE's) requirement to report the results of quality assessments?

1. The CAE must report the results of external assessments at least annually.
2. The CAE must report the results of ongoing monitoring at least annually.
3. The CAE must report the results of quality assessments to senior management.
4. The CAE must report the results of quality assessments to the board.

According to IIA guidance, a new internal auditor is expected to possess which of the following competencies?

Which of the following is an example of a transaction-level control?

According to IIA guidance, which of the following corporate social responsibility (CSR) evaluation activities may be performed by the internal audit activity?
1. Consult on CSR program design and implementation.
2. Serve as an advisor on CSR governance and risk management.
3. Review third parties for contractual compliance with CSR terms.
4. Identify and mitigate risks to help meet the CSR program objectives.

Which of the following engagements would be considered an appropriate consulting service?

Which of the following controls would most likely prevent the input of an unreasonable number of labor hours into a costing system?

An internal auditor pays to participate in the company's annual golf tournament, which is held outside of normal business hours. The auditor wins the putting contest and is awarded an all-expense-paid weekend vacation. According to the IIA Code of Ethics regarding objectivity, the auditor's best course of action would be to:

The results of an internal control questionnaire revealed that all investment activity exceeding $10,000

must be approved by the assistant treasurer. A sample of these transactions with a ve-percent acceptable error rate found that 98 of the 100 items tested included the assistant treasurer's approval. Based on this data, the auditor should:

When planning an audit engagement, what should an internal auditor first consider when assessing the risk of fraud in the area to be audited?

To identify those components of a telecommunications system that present the greatest risk, an internal auditor should first:

Which of the following must be included when reporting results of a quality assurance and improvement program?

Which data analytics competency is critical for new internal auditors to possess in order to plan and perform internal audit engagements in conformance with the Standards?

The chief audit executive (CAE) wants to ensure that there are suficient resources available to fulfill the responsibilities of the internal audit activity in the coming year.

Which statement describes the most logical sequence of events for the CAE to undertake in order to achieve this objective?

Which of the following best defines the role of internal auditing in risk management?

An internal auditor is researching the laws and regulations related to a city's grant program.

Which of the following procedures is least relevant to this task?

According to IIA guidance, which of the following must internal auditors consider to conform with the requirements for due professional care during a consulting engagement?

1. The cost of the engagement, as it pertains to audit time and expenses in relation to the potential benefits.
2. The needs and expectation of clients, including the nature, timing, and communication of engagement results.
3. The application of technology-based audit and other data analysis techniques, where appropriate.
4. The relative complexity and extent of work needed to achieve the engagement's objectives.

Senior management at a financial institution has received allegations of fraud at its derivatives trading desk and has asked the internal audit activity to investigate and issue a report concerning the allegations. The internal audit activity has not yet developed suficient proficiency regarding derivatives trading to conduct a thorough fraud investigation in this area.

Which of the following courses of action should the chief audit executive (CAE) take to comply with the Standards?

Which of the following is the primary concern of an internal auditor in a comprehensive audit of an organization?

Which of the following statements is true with regard to governance?

When can an internal audit activity use the statement, "Conforms with the International Standards for the Professional Practice of Internal Auditing"?

Performing a monthly analysis of potential duplicate invoices paid to suppliers is an example of which type of fraud control?

The results of an assessment of the adequacy of controls would be considered incomplete or misleading unless the internal auditor considers which of the following?

Which of the following topics would a chief audit executive most likely include with their report to the board?

Which of the following are appropriate ways to obtain continuous professional education?

1. Instructing at a local IIA training event.
2. Attending internal audit conferences and seminars.
3. Practicing specialized audit and consulting work.
4. Participating in research projects in internal auditing.

An internal auditor found that his organization did not make a disclosure that is required by law. However, the auditor decided not to raise an audit finding.

Which of the following Code of Ethics principles was violated?

An internal auditor conducted a surprise inventory count at a warehouse of a small subsidiary. By the end of the count, it became apparent that a few items from several categories were missing. The warehouse manager explained that he took those items for personal needs, and he said that he would provide information about other employees' wrongdoings to avoid being reported. The auditor agreed not to report the issue, which ultimately enabled her to uncover more significant losses.

Which of the following statements is true regarding this situation?

In its five years of existence, an internal audit activity conducted a single internal assessment of its quality assurance and improvement program (QAIP). The results of that assessment showed that the internal audit activity did not conform with the Standards. Prior to this, an external assessment of the internal audit activity's QAIP was conducted, which reported that the internal audit activity was in conformance with the Standards.
Considering the two assessments, what would be the internal audit activity's current state of conformance with the Standards?

A large trucking organization wants to reduce traffic accidents by improving its system of internal controls.

Which of the following controls is correctly classified?

1. Review of speeding violations to identify repetitive locations and drivers is an example of a preventive control.
2. Defensive driver training is an example of a directive control.
3. The installation of tracking devices in delivery vehicles is an example of a corrective control.
4. Providing a vehicle driver handbook is an example of a detective control.

The main reason to establish internal controls in an organization is to:

Which of the following methods is not valid for completing continuing professional education hours?

Which of the following statements pertaining to the relationship between independence and objectivity is accurate?

With regard to governance, which of the following is a board-level responsibility rather than a management responsibility?

Which of the following is a second line of defense in effective risk management and control?

Which of the following describes a control weakness?

During a monthly internal audit staff meeting, the chief audit executive (CAE) decided to reinforce the importance of internal audit staff being objective in their work.

Which of the following examples would be most appropriate for the CAE to include as part of the meeting presentation?

Which of the following would be a violation of the IIA Code of Ethics?

Which of the following is a limitation of internal controls?

An employee is more likely to commit fraud if which of the following red flags are present?

1. The employee believes that he is being underpaid and deserves a higher salary.
2. The employee is close to retirement and has expressed a desire to take an expensive trip around the world.
3. The employee has personal financial problems and seems very unhappy.
4. The employee is spending much more time at the office than usual and has been asking about opportunities for professional advancement.

The chief audit executive (CAE) is drafting the annual internal audit plan and seeks input from senior management and the external auditor prior to submitting it for approval to the board.
According to IIA guidance, which of the following statements is true regarding this scenario?

Which of the following is the primary advantage of using a computer assisted audit technique (CAAT) to provide a higher level of assurance?

According to IIA guidance, which of the following components must be included in the annual report to the board on the quality assurance and improvement program?

Which of the following is an appropriate role for the board in governance?

Which of the following organizations has an impairment to internal audit independence?

A senior executive at a government-owned organization received an invitation to attend a public exhibition where he can learn about new trucks relevant to the organization's business. As a special perk, the executive is offered an opportunity to drive a luxury vehicle manufactured by one of the exhibiting companies. Prior to the event, the executive asked for the chief audit executive's (CAE's) advice.

What should the CAE recommend as the most appropriate course of action for the executive?

Which of the following best supports the internal audit activity's role in evaluating governance?

In order to provide the most useful information for an organization's risk management decisions, which of the following should be assessed?

Which of the following should be incorporated in a risk management policy?

I- Boundaries and limit structures.
II-. Requirements for reporting risk.
III-. Risk authorities.

Which of the following most accurately describes corporate social responsibility at an organization?

An auditor identifies three errors in the sample of 25 entries selected for review (a 12 percent error rate).
Based on this result, the auditor assumes that approximately 59 of the total population of 492 entries are incorrect.
To reach this assumption, the auditor has used a technique known as which of the following?

If earnings on financial statements for internal use only have been manipulated in the past, an internal auditor is likely to focus on which of the following?

An organization's chief audit executive (CAE) has been asked to conduct an assurance engagement for an information technology system that was subject to a consulting engagement in the prior year.

How should the CAE respond?

An organization's project managers regularly travel to various destinations. Although plane tickets and accommodations are booked and paid for by the organization, project managers can still submit for reimbursement any travel-related receipts for transportation, dining, and other miscellaneous costs.

Which of the following fraud schemes should the auditor test for?

Which of the following is not an appropriate type of coordination between the internal audit activity and regulatory auditors?

Prior to commencing a financial compliance engagement, the engagement supervisor reads the business plan for the finance department and meets informally with the director to learn more about any key issues.

Which of the following competencies is the engagement supervisor demonstrating?

Which of the following best describes the expectation for internal auditors to demonstrate due professional care when performing their work?

Which of the following decisions made during the testing phase of a compliance audit requires the most judgment by an internal auditor?

According to IIA guidance, the chief audit executive, board, and senior management must mutually agree on which of the following?

Under which of the following circumstances should the final audit report include a disclosure of nonconformance with the Standards?

During an account receivables audit, an internal auditor found a significant number of input errors resulting in a $500,000 balance understatement.

Which of the following is the most important question the internal auditor should ask to develop an appropriate recommendation for this finding?

When performing an audit of the risk management process an auditor makes the observations listed below.

Which poses the greatest risk to the organization?

An organization is considering purchasing a new banking software system and has asked the internal audit activity to evaluate the system. An internal auditor assigned to perform the engagement worked at the software company two years ago and is familiar with the system's design strengths and weaknesses.

Which of the following is true regarding impairment to the auditor's objectivity?

A manufacturer uses a materials requirements planning (MRP) system to track inventory, orders, and raw materials requirements. What condition should an auditor search for in the MRP database if a preliminary assessment indicated that inventory is understated?

I- Item cost set at zero.
II-. Negative quantities on hand.
III-. Order quantity exceeding requirements.
IV-. Inventory lead times exceeding delivery schedule.

What is the primary purpose of a risk management program?

Which of the following best demonstrates organizational independence of the internal audit activity?

During a review of data center physical security and environmental controls, an auditor should ensure that:

I- Visitors are accompanied by authorized personnel at all times.
II-. Only developers and operators have access to the data center.
III-. Fire suppression equipment is tested periodically.
IV-. Fire and water detectors have been installed.

The internal auditor of a small manufacturer noted that the accounting department has insufficient staff to achieve proper segregation of duties.

What type of controls would the auditor likely recommend to management to specifically address this problem?

An internal auditor must determine which components of an organization's telecommunications may introduce the greatest risk.

Which of the following tasks should the internal auditor complete first?

A newly hired internal auditor is most likely to need further education in the area of business acumen in which of the following situations?

Which of the following circumstances would most likely be considered a potential red flag for fraud by the internal audit activity?

An organization purchases an insurance policy against re.

Which of the following risk management techniques does this exemplify?

Which of the following statements, if true, could justify an auditor's decision not to report governance-related control defficiencies to the audit committee?

In which of the following ways can a whistleblower hotline serve as a preventative control?

An internal audit charter should do which of the following?

According to IIA guidance, which of the following is not a responsibility of the chief audit executive pertaining to documenting information to support internal audit engagement results and conclusions?

A daily log of treasury dealers who exceeded their authorized limits serves as a:

In preparing for an audit of the footwear division of a major retail organization, an internal auditor gathered the following information about the organization's stores:

In addition to labor costs, the other costs associated with each store are leasing and maintenance expenses.

Which of the following is a valid conclusion?

A manufacturing organization receives all direct materials for nished goods production.

Which of the following is the strongest preventive control for lapses in quality assurance?

Which of the following is not a benefit of using information technology in solving audit problems?

Which of the following risk assessment tools would best facilitate the matching of controls to risks?

Once the cause of a problem has been identified, the next step is to:

An internal auditor assessed the controls within his organization's payroll process and suspects that erroneous payments may have been made to a fraudulent bank account.

What is the best course of action for the auditor to take?

During an audit of the purchasing department, an internal auditor identifies significant issues that could affect the organization's financial reporting. Management disagrees with the audit results.

Which of the following responses best demonstrates the internal auditor has the necessary competencies related to professional judgement and conflict management?

A high-volume retailer of consumer goods has used point-of-sale data to record sales and update inventory records for several years. When price changes are scheduled, corporate headquarters downloads a price change file to a computer server system at each store. Each store's assistant manager is responsible for checking the server for downloads and running the program that updates the store's price file at the authorized price update time. In comparison with having headquarters initiate the price update centrally, this approach to price updating will most likely:

A chief audit executive (CAE) identifies that the internal audit activity lacks a necessary skill to perform a management request for a consulting engagement.
According to IIA guidance, which of the following is the most appropriate action the CAE should take regarding the request?

The internal audit activity conducted an organizationwide risk assessment. One of the most significant risks identified is associated with the oil price market. The chief audit executive (CAE) is considering including in the annual audit plan an assessment of the effectiveness of oil price risk management. The manager responsible commented that the assessment was not needed, as market risks were regularly addressed by the financial risk committee.
If the CAE decides to include this activity in the annual audit plan anyway, how should it be recorded?

According to the IIA Code of Ethics, the deliberate omission of relevant information from an audit report would violate which principle?

Which of the following would constitute an effort of an organization's corporate social responsibility initiative?

The chief audit executive for an organization has just completed a risk assessment process, identified the areas with the highest risk, and assigned an audit priority to each. Which of the following statements is true and consistent with the International Professional Practices Framework?

I- Items should be ranked in the order of quanti able dollar exposure to the organization.
II-. The audit priorities should be in order of major control defficiencies.
III-. The risk assessment, though quanti ed, is the result of professional judgments about both exposures and probability of occurrences.

Which of the following factors is not likely to affect the level of inherent risk associated with an application system?

Which of the following is a valid statement about the use of visual observations during an audit engagement?

1. Visual observations can be used to detect ineffective controls, idle resources, and safety hazards.
2. Visual observations can be used during both preliminary survey and fieldwork stages of the audit engagement.
3. Visual observations can provide unsubstantiated facts to management if the internal auditor believes the information is useful.
4. Visual observations can assist an auditor in determining if a material observation should be communicated through informal means to the organizations senior management.

An internal audit of an organization's disbursement department revealed that multiple payments were made to legitimate vendors bearing fraudulent banking information belonging to employees in the department. These vendors were initially set up with accurate banking information but were subsequently modified by disbursement officers with access to the vendor management system.

Which of the following controls would have likely prevented the fraudulent modi cation of vendors' banking information?

The organization implements several controls to address the risk that employees might submit false claims for travelling expenses. The controls include requiring claims to be approved by a direct supervisor, providing clear guidance regarding which expenses can be included, automatic calculations of daily allowance, and notifying employees that the submission of false claims will be investigated.

Which of the described controls is irrelevant to the risk?

Once an organization's risks are identified, what would be the next step to ensure resources are properly allocated to manage those risks?

Which of the following would not be a factor for senior management to consider when determining the internal audit activity's role in an organization's risk management process?

A chief audit executive (CAE) has been asked by the board to evaluate the effectiveness of ethical programs created by management.

Which of the following would be the most appropriate action for the CAE to take?

According to IIA guidance, which of the following is an area in which the internal auditor should be proficient?

Internal auditors are preparing for an engagement to evaluate an organization's plan to accept cryptocurrency as a form of payment.

Which of the following would demonstrate the internal auditors' business acumen in this scenario?

A chief audit executive (CAE) was asked by senior management to establish and manage a risk management function. A new chief risk officer was hired a year later to assume these responsibilities. As this function was included in the current annual audit plan, the CAE engaged an external resource for a risk management engagement.

Which of the following potential threats to objectivity was the CAE likely addressing?

What type of risk management strategy is being employed when an organization installs two rewalls to provide protection from unauthorized access to the network?

Which of the following statements is true regarding globally recognized internal control frameworks?