Free IIA IIA-CIA-Part1 Practice Questions 2026 - Page 15

Which of the following preventative controls would be most effective for organizations facing business disruptions and respective financial losses?

A. Develop a business continuity plan for contingent situations,

B. Insure the organization against financial losses.

C. Rely on third-party cloud solution providers for the organization's systems.

D. Hedge company assets via purchasing derivatives.

In an internal audit charter, which of the following statements regarding the chief audit executive (CAE) would be most directly related to describing the responsibilities of the internal audit activity*?

A. The CAE shall report functionally to the board and administratively to the chief financial officer

B. The CAE and the Internal audit activity shall have full access to any and all records and personnel of the organization that are relevant to audit engagements

C. The CAE and the internal audit activity shall be independent and objective in performing their work.

D. The CAE shall report periodically on the performance of the internal audit activity relative to its plan

According to the IIA Code of Ethics, which of the following best describes the conduct of an internal auditor who demonstrates the principle of competency?

A. The auditor is prudent in the use and protection of information acquired in the course of his work.

B. The auditor does not accept anything that may impair or be presumed to impair his professional judgment.

C. The auditor does not perform services in a particular area when he lacks skills in that area.

D. The auditor performs work with honesty, diligence, and responsibility.

The board of a newly established organization was discussing the contents of the draft internal audit charter One board member suggested adding to the charter an obligation for the internal audit activity to develop controls in business procedures. The board member explained that the new organization needs professional-level developers, internal auditors have the necessary skills and competencies, and the internal audit activity is well positioned to assume this responsibility. Which of the following would be a potential concern if the board member’s suggestion is adopted?

A. Due professional care.

B. Internal audit objectivity.

C. Risk management assurance.

D. Professional development.

According to ISO 31000, which of the following statements is correct?

A. The board is responsible for setting the organizational attitude through tone at the top,

B. The internal audit activity will provide assurance over operating effectiveness but not over the design of risk management activities,

C. The internal audit activity can give objective assurance on any part of the risk management framework for which it is responsible.

D. The framework is designed to be effective for organizations no matter how small.

What is the best course of action when the internal audit activity does not have the knowledge necessary to perform a planned audit of the organization's new IT data backup process?

A. Postpone the audit engagement to a later date.

B. Recruit and hire a full-time staff auditor who is proficient in data backup processes.

C. Change the plan from an assurance engagement to a consulting engagement.

D. Provide data backup training to the engagement supervisor.

A whistle blower notified internal audit of a conflict of interest between an organization's employee and a major supplier. Which of the following steps should be undertaken first?

A. Interview the employee identified by the whistleblower.

B. Attain an understanding of the employee's role, responsibilities, and relationship with the supplier.

C. Notify senior management, the board, and the external auditor about the alleged fraud

D. Review all the orders issued to the supplier to investigate potential fraud.

According to IIA guidance, which of the following actions by the chief audit executive (CAE) best demonstrates the organizational independence of the internal audit activity?

A. The CAE seeks senior management approval of the internal audit charter

B. The CAE obtains senior management's approval to hire staff

C. The CAE reports significant issues to the organization's CEO

D. The CAE provides the board with an annual budget for approval

According to IIA guidance, which of the following most appropriately justifies the CEO’s decision that the internal audit activity shall be responsible for risk management and investigation at a multinational organization?

A. The recommendation of the parent office external auditors.

B. The provisions of the internal audit charter

C. The authority of the CEO.

D. The level of proficiency of the chief audit executive

An internal auditor has suspicions that some fictitious vendors have been created in the organization's computer system. Which of the following would be the best technique to detect this fraud?

A. Review for duplicate invoice numbers, duplicate dates, and duplicate amounts

B. Run checks to find matches between vendor and employee addresses

C. Check for recurring requests for refunds where invoices are paid twice

D. Review for unexplained increases in inventory