CIA — Practice Questions, Part 2 flashcards

6 of 60 questions free to study here · 5 topics · the whole deck is built into Willys

Multiple-choice practice questions, one best answer each, on risk-based audit planning, engagement objectives and scope, evidence, sampling, analytics, workpapers, findings, reporting and follow-up.

Get the app All IIA Certified Internal Auditor (CIA), Parts 1–3 decks

Practice deck · part of IIA Certified Internal Auditor (CIA), Parts 1–3 · written against: IIA CIA exam syllabus effective 2025, aligned with the Global Internal Audit Standards (2024). Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list

An internal audit function starts running continuous monitoring scripts and replaces long annual engagements with short, iterative reviews. What should the CAE do about the function's methodology?

A) Ask senior management to issue a formal policy that describes the new approach
B) Wait for the next external quality assessment to design the methodology
C) Let each audit team document its own approach as the reviews proceed
D) Update the written methodology, train staff and confirm it still conforms

D) Update the written methodology, train staff and confirm it still conforms

The CAE establishes the function's methodologies, keeps them current and makes sure staff are trained in them, while checking that matters such as documentation and supervision still conform with the Standards. Leaving each team to improvise would undermine consistency and quality.
Managing the Internal Audit Function › Strategy and Methodologies
A CAE is building next year's internal audit plan. The organization has a mature ERM process, and its risk register was refreshed last quarter. How should the CAE use the register?

A) Set it aside so that the audit risk assessment stays fully independent
B) Adopt management's rankings unchanged to avoid duplicating the ERM work
C) Limit the plan to the risks that the register itself rates as high
D) Use it as an input, applying independent judgment to its rankings

D) Use it as an input, applying independent judgment to its rankings

Where ERM is mature, management's risk assessment is a valuable input, but the CAE still applies independent judgment. Adopting the rankings unchanged gives up that judgment, and ignoring a sound register wastes good information.
Managing the Internal Audit Function › Risk-Based Internal Audit Plan
An auditor is planning an assurance engagement on the procurement process. Before setting the engagement objectives, what should the auditor understand first?

A) The number of findings raised in other departments during the prior year
B) The external auditor's materiality level for the annual financial statements
C) The procurement department's budget for the coming year and its variances
D) Procurement's objectives, the significant risks and the related controls

D) Procurement's objectives, the significant risks and the related controls

Engagement planning starts with the activity's objectives and strategies, the significant risks to them and the controls that address those risks. Objectives set without that understanding may miss the risks that matter.
Engagement Planning › Engagement Risk Assessment
An auditor wants evidence on whether year-end inventory counts are performed properly. Which evidence is generally the most reliable?

A) Notes from the auditor's interview with the warehouse manager
B) An email from the count team confirming the procedure was followed
C) The auditor's own observation of a count while it is in progress
D) The warehouse supervisor's written description of the count procedure

C) The auditor's own observation of a count while it is in progress

Evidence the auditor obtains firsthand, such as direct observation, is generally more reliable than descriptions or confirmations provided by the auditee.
Performing the Engagement › Evidence
A draft finding reads: Eight of 30 sampled journal entries above the threshold had no second approver, as the month-end close policy requires. Which elements of a complete finding are missing?

A) Condition and cause
B) Criteria and effect
C) Criteria and condition
D) Cause and effect

D) Cause and effect

The draft states the condition (8 of 30 lacked approval) and the criteria (the close policy). It does not explain why the approvals were missing or what risk results.
Communicating Engagement Results › Findings
Management reports that the action plan for a high-risk finding on segregation of duties is complete. What should internal audit do before closing the finding?

A) Leave it open until the area's next full scheduled audit takes place
B) Close it based on management's written confirmation of completion
C) Ask the external auditor to confirm that the action plan is complete
D) Verify implementation with evidence, such as retesting the control

D) Verify implementation with evidence, such as retesting the control

For significant findings, internal audit should verify with evidence or retest; management's own confirmation may suffice only for lower-risk items where the methodology allows.
Monitoring Progress › Follow-Up

Unlock the whole deck

You are studying a free 6-question sample. All 60 questions of CIA — Practice Questions, Part 2, the other 8 IIA Certified Internal Auditor (CIA), Parts 1–3 decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More IIA Certified Internal Auditor (CIA), Parts 1–3 decks

Foundations, Ethics and Governance Governance, Risk, Control and Quality Practice Questions, Part 1 Engagement Planning and Performance Communicating Results and Monitoring Business Acumen and Risk Information Security, IT and Financial Management Practice Questions, Part 3

← All IIA Certified Internal Auditor (CIA), Parts 1–3 decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

IIA CIA Exam Expanded Test Specifications, 2025 syllabus (V2.09.2024): engagement planning, evidence, sampling, analytics, workpapers, findings and supervision follow Part 2, Internal Audit Engagement, Sections A-C; the audit plan, resources, coordination and reliance, board reporting and performance cards follow Part 3, Sections A-C, and the final communication, error, risk acceptance and follow-up cards follow Part 3, Section D, Engagement Results and Monitoring. IIA Global Internal Audit Standards (issued January 2024, effective 9 January 2025) — topic outline only; no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Not financial, tax or legal advice. These cards prepare you for an exam; rules and figures change, so check current standards before relying on any of it.

CIA® and Certified Internal Auditor® are registered trademarks of The Institute of Internal Auditors, Inc. (The IIA), which is not affiliated with and does not endorse this product.

Use of these pages is covered by our Terms of Use.