Free IIA IIA-CIA-Part2 Practice Questions 2026 - Page 10

Explanation:

This question tests the auditor's understanding of communication practices during an internal audit engagement. It requires identifying the value of ongoing, transparent communication with management throughout the fieldwork phase.

✅ Correct Option:

A. The auditor should accommodate the request for information and brief management on significant preliminary observations as they develop.
Continuous and open communication with management during an engagement is a best practice in internal auditing. Discussing preliminary observations as they arise ensures there are "no surprises" at the closing conference, allows the auditor to verify the factual accuracy of their findings immediately, and gives management an early opportunity to clarify misunderstandings or gather missing documentation before the final report is drafted.

❌ Incorrect options:

B. The auditor should advise management that the requested information cannot be communicated until the engagement is complete and the results undergo a quality check by the engagement supervisor.
Withholding all information until the entire audit and supervisory review are complete creates an adversarial environment and increases the risk of publishing inaccurate information. While the supervisor must review final conclusions, sharing preliminary observations with operational management is entirely permissible and encouraged.

C. The auditor should share the requested information but clearly communicate that it is not appropriate for him to correct any observations based on further information that may be provided by management.
This statement contradicts the purpose of sharing preliminary findings. If management provides valid, verifiable documentation or context that refutes or alters a preliminary observation, the auditor is professionally obligated to evaluate that evidence and adjust or drop the finding accordingly.

D. The auditor should partially accommodate the request, explaining that he can provide status updates regarding the engagement procedures and timeline but he is unable to provide information regarding preliminary observations.
Limiting updates strictly to timelines and administrative progress is unnecessary and counterproductive. Providing early insights into identified risks or control exceptions helps build a collaborative partnership and allows management to begin researching or implementing immediate corrective actions.

🔧 Reference:
→ The IIA Guidance on Communicating Audit Results emphasizes that routine status updates and the discussion of preliminary observations with engagement clients during fieldwork are essential for ensuring factual accuracy, building trust, and facilitating timely remediation.

Explanation:

This question tests the use of data analytics in evaluating the completeness of an invoicing process. To assess completeness, the auditor should verify whether all electricity consumption that occurred was properly captured and billed. The most effective procedure directly compares actual usage data with invoiced amounts.

🟢 Correct Option:

D. Conduct a comparison to identify deviations between electricity amounts billed to customers and information regarding actual consumption.
Comparing billed electricity amounts with actual consumption data directly addresses invoice completeness. Differences between recorded consumption and invoiced usage may indicate missing charges, billing errors, or processing failures. This approach provides relevant audit evidence because it tests whether all customer consumption has been accurately transferred into the invoicing system and recorded completely.

🔴 Incorrect options:

A. Conduct a trend analysis of customers' payment history and flag those with the most inconsistent payments and debts.
Payment trends focus on customer payment behavior and collection risk. This analysis does not determine whether all electricity consumption was completely invoiced.

B. Conduct a ratio analysis by calculating the relationship between sums paid in local currency and volume of electricity billed in megawatt hours.
Ratio analysis may reveal unusual relationships but does not directly verify whether all consumption amounts were included in the billing process.

C. Conduct an analysis of clients’ electricity consumption patterns within a specified period and identify consumption spikes.
Consumption spike analysis can identify unusual usage patterns but does not directly test whether the invoicing process completely captured and billed the recorded consumption.

🔧 Reference:
⇒ Global Internal Audit Standards – Engagement Evidence and Analysis
Confirms that auditors should obtain relevant and reliable evidence supporting engagement objectives.

⇒ IIA Practice Guide – Data Analytics in Internal Auditing
Confirms that data analysis techniques should directly support the audit objective and testing requirements.

Explanation:

This question is testing when a chief audit executive should escalate a follow-up issue to the board. The key issue is not whether management created an alternate control or whether compliance is good, but whether the remaining risk after the new process is still too high for management to accept.

✔️ Correct Option:

1. In the opinion of the CAE the level of residual risk assumed by senior management is too high
This is the condition that justifies reporting to the board. If the CAE believes the risk left after management’s response is still above an acceptable level, escalation is appropriate. The CAE’s role is to inform the board when management appears to be accepting more risk than the organization should tolerate.

❌ Incorrect options:

2. Testing of compliance with the new process finds that all new contracts in excess of $1 million have been approved by the vice president of sales
This shows the process is being followed, but it does not prove the risk is unacceptable or requires board reporting. Compliance alone does not trigger escalation unless the residual risk remains too high.

3. The cost of modifying the sales system to include a preventive control is less than $100,000
The cost of modifying the system may be useful in deciding among control options, but cost alone does not justify reporting to the board. Board reporting depends on risk significance, not just implementation cost.

🔧 Reference:
→ The IIA — Standard 2600: Communicating the Acceptance of Risks — confirms that internal audit escalates when management accepts a level of risk that may be unacceptable.

→ The IIA — Global Internal Audit Standards — supports communication of significant risk matters to appropriate governance bodies.

Explanation:

This question tests understanding of the AIC's preliminary communication responsibilities before and at the start of a recurring assurance engagement. It focuses on when and how the HR department should be informed about upcoming audit activity to support proper planning and cooperation.

✅ Correct Options:

2. The AIC should notify HR management before the planning stage begins
Early notification allows HR management to prepare, gather relevant information, and designate contacts before fieldwork planning starts. This proactive communication supports a collaborative engagement approach and helps the AIC gather preliminary insights that inform scope and risk considerations before formal planning is finalized.

3. The AIC should schedule formal status meetings with HR management at the start of the engagement
Establishing status meetings early ensures ongoing, structured communication throughout the engagement. This allows HR management to stay informed of progress, raise concerns promptly, and maintain a transparent working relationship, which supports smoother fieldwork execution and reduces surprises at the reporting stage.

❌ Incorrect Options:

1. The AIC should notify HR management when the draft audit plan is being developed, as a courtesy
The internal audit plan is developed at the organizational level, typically well before individual engagements begin. Notifying HR at this early, high-level planning stage is not standard practice; direct communication with HR occurs closer to the specific engagement's planning phase, not during overall plan drafting.

4. The AIC should finalize the scope of the engagement before communicating with HR management
Communicating with HR management should occur before scope finalization, not after. Early dialogue helps the AIC incorporate HR's operational context and concerns into the scope, rather than presenting a fixed scope without input from the area being reviewed.

🔧 Reference:
→ IIA Implementation Guide 2201 – Planning Considerations — supports that internal auditors should establish understanding and communicate with engagement clients early in the planning process to gather relevant information and set expectations.

Explanation:

This question tests your knowledge of the chief audit executive's (CAE) specific responsibilities concerning the final audit report, as defined by IIA Standards. The CAE holds ultimate accountability for the quality and distribution of the final engagement communication.

✔️ Correct Options:

3. Review and approve the final audit report.
The CAE is responsible for reviewing and approving the final engagement communication before it is issued. This is a direct requirement of IIA Standard 2440, confirming the CAE's role in ensuring the quality and accuracy of the final report.

4. Determine who will receive the final audit report.
Determining the appropriate recipients for the final audit report is another core responsibility of the CAE under Standard 2440. The CAE decides to whom and how the results will be disseminated to ensure they reach parties who can give them due consideration.

❌ Incorrect options:

1. Coordinate post-engagement conferences to discuss the final audit report with management.
This is typically a responsibility of the engagement supervisor or the auditor-in-charge, not the CAE. While the CAE has ultimate oversight, the coordination of these operational meetings is usually delegated.

2. Include management's responses in the final audit report.
While management's responses are an important part of the final report, it is the internal auditor's responsibility to ensure they are included appropriately. This is a function of the audit team, not a specific duty reserved for the CAE.

🔧 Reference:
→ IIA Standard 2440: Disseminating Results – Confirms the CAE is responsible for reviewing and approving the final engagement communication before issuance and deciding to whom and how it will be disseminated.

Explanation:

This question tests your understanding of the attributes of an audit observation (Criteria, Condition, Cause, and Effect). It requires you to identify the relationship between a process deficiency (the lack of a requirement for justification) and the observed problem (the accumulation of large travel advances).

✅ Correct Option:

D. A cause of the organization's accumulation of large travel advances
The "Cause" explains the underlying reason why the deficiency or problem exists. In this scenario, the organization is accumulating excessively large travel advances because its current procedures do not require employees to provide any justification for advances over a specific dollar threshold. The lack of a preventative control rule is what allows the accumulation to happen.

❌ Incorrect options:

A. A criterion of the organization's accumulation of large travel advances
"Criteria" represent the standards, measures, or expectations used to evaluate the process (i.e., what should be happening, such as an official policy or industry benchmark). The statement describes a gap in current procedures, not an established standard of performance.

B. A condition of the organization's accumulation of large travel advances
The "Condition" is the factual evidence found during the audit (i.e., what is happening). Here, the condition is the actual "accumulation of large travel advances" by the organization. The procedural gap itself is the reason behind this condition.

C. A consequence of the organization's accumulation of large travel advances
The "Consequence" (or Effect) represents the risk, financial exposure, or impact resulting from the condition (e.g., lost interest income, increased risk of fraud, or unrecovered cash). The lack of a policy requirement is the origin of the issue, not its outcome.

🔧 Reference:
→ The IIA Guidance on Communicating Audit Results establishes that the "Cause" attribute of an audit finding must identify the root control gap or procedural failure that allowed the problematic condition to occur.

Explanation:

This question tests the purpose of an exit conference in an internal audit engagement. Exit conferences are conducted to discuss observations, validate facts, obtain management responses, and communicate important matters before issuing the final report. They help improve report accuracy and ensure management understands significant issues requiring attention.

🟢 Correct Option:

A. A primary purpose of the exit conference is to provide for the timely communication of observations that call for immediate management action.
Exit conferences allow auditors and management to discuss significant findings before the final report is issued. Communicating observations that require prompt action helps reduce risk exposure and allows management to begin corrective measures early. This process also provides an opportunity to clarify facts, resolve misunderstandings, and improve the quality of final engagement communication.

🔴 Incorrect options:

B. Both the chief audit executive and the chief executive over the activity or function reviewed must attend the exit conference to validate the findings.
IIA guidance does not require mandatory attendance by specific executives. Attendance depends on the engagement circumstances and organizational practices.

C. The exit conference provides only anticipated results for inclusion in the final audit communication.
Exit conferences involve discussion of findings, observations, and management responses rather than only presenting expected final report content.

D. During the exit conference, the performance of the internal auditors who executed the engagement is reviewed.
The purpose of an exit conference is to discuss engagement results and related issues, not to evaluate the auditors' performance.

🔧 Reference:
⇒ IIA Standards – Communicating Results
Confirms the purpose of communicating significant observations and engagement results.

⇒ IIA Practice Guide – Audit Reporting and Communication
Confirms that discussions with management support timely communication and validation of findings.

Explanation:

This question tests what an internal auditor should consider first when setting engagement objectives for a newly acquired subsidiary. The most important input is the business context: what the organization is trying to achieve, what risks exist, how controls are designed, and what stakeholders expect from the assurance work. Those factors directly shape relevant, risk-based audit objectives.

✔️ Correct Option:

C. Organizational strategy, objectives, risks, control framework, and the expectations of stakeholders regarding the audit
These are the core items that should drive engagement objectives. In a newly acquired subsidiary, the auditor must understand how the subsidiary fits into the parent organization’s strategy, what risks are most significant, what control environment exists, and what the board or management expects from the engagement. This ensures the audit objectives are aligned with business needs and risk priorities.

❌ Incorrect options:

A. Previous performance of the subsidiary specifically its financial results over the last three years and the outcome of external audit reviews
Historical financial results and external audit outcomes may be useful background, but they do not define the engagement objectives. They are narrower than the broader strategic, risk, and control considerations that should drive planning.

B. The results of previous internal audits of the subsidiary the recommendations provided and whether the recommended actions have been implemented
Prior internal audit work can help the auditor understand recurring issues, but it is still only one part of planning. Engagement objectives should be based on current risks, strategy, controls, and stakeholder expectations, not only past audit results.

D. The qualifications and competencies of the subsidiary's management team and their understanding of risk and control
Management capability matters, but it is not the most important basis for defining engagement objectives. The audit should be planned around the organization’s risks and control environment, while management competence is only one factor within that assessment.

🔧 Reference:
→ The IIA — Engagement Planning: Establishing Objectives and Scope — confirms that engagement planning should consider strategy, objectives, risks, and stakeholder expectations.

→ The IIA — Establishing Objectives and Scope — supports using contextual and risk-based factors to form engagement objectives.

Explanation:

This question tests your ability to distinguish between types of audit evidence and select an appropriate procedure that satisfies specific constraints. The question explicitly asks for sufficient, indirect evidence to confirm the existence of the asset.

✅ Correct Option:

A. Review logs of the vehicles assigned to employees for the delivery of goods during the engagement period.
Reviewing third-party or operationally independent documentation—such as vehicle assignment logs, trip sheets, fuel cards, or maintenance records—provides excellent indirect evidence of existence. If a vehicle is consistently racking up mileage, consuming fuel, and being checked out by employees to deliver goods during the audit period, it proves the vehicle exists and is operational, without requiring the auditor to physically see it.

❌ Incorrect options:

B. Visit the home address of the specific employee to see the selected vehicle.
Physically inspecting the vehicle at an employee's home provides direct evidence of existence, not indirect evidence. Additionally, this approach is operationally inefficient, costly, and raises potential privacy or safety concerns, making it an inappropriate response under the question's constraints.

C. Compare the registered details of the vehicle in the fixed asset register to a datestamped photograph of the vehicle.
A photograph can be easily manipulated, misdated, or taken from a different asset altogether. It does not provide reliable or sufficient evidence to verify current existence, as the photo does not independently prove the vehicle is still in the company's possession or exists at the time of the audit.

D. Seek independent confirmation of the vehicle's details from one of the delivery employees.
Inquiring with a delivery employee provides oral evidence, which is considered weak when used in isolation for existence testing. Furthermore, an employee within the same operational line is not considered a truly "independent" third party, making their verbal confirmation insufficient to prove the physical existence of the asset.

🔧 Reference:
→ The IIA Performance Standard 2310 (Identifying Information) requires auditors to identify sufficient, reliable, relevant, and useful information. Analytical and documentary trails (like usage logs) serve as valid indirect evidence when direct physical inspection is unfeasible.

Explanation:

This question tests the reliability and strength of audit evidence used to verify the existence of inventory. Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly from others. Physical observation provides stronger support for confirming that inventory recorded in accounting records actually exists.

🟢 Correct Option:

A. The auditor performs an observation.
Direct observation by the auditor provides strong evidence of inventory existence because the auditor personally verifies that the product is physically present. Evidence obtained directly by the auditor is generally considered more reliable than representations from employees or external parties. Physical observation supports the conclusion that the inventory recorded in accounting records actually exists at the time of testing.

🔴 Incorrect options:

B. The vendor provides third-party confirmation.
Third-party confirmation can provide reliable information but usually confirms transactions, ownership, or balances rather than directly proving that inventory currently exists within the organization.

C. The auditor documents interviews with multiple warehouse personnel.
Employee interviews provide testimonial evidence, which is generally less reliable than physical evidence because it depends on individual statements and recollections.

D. Warehouse management submits photographs of the product on the inventory shelf.
Photographs provide supporting information but are less reliable than direct observation because images may be outdated, incomplete, or manipulated.

🔧 Reference:
⇒ Global Internal Audit Standards – Engagement Evidence
Confirms that auditors should obtain sufficient, reliable, and relevant evidence.

⇒ IIA Practice Guide – Audit Evidence
Confirms that evidence obtained directly by auditors is generally more reliable than indirect evidence.