Free IIA IIA-CIA-Part2 Practice Questions 2026 - Page 16

An internal auditor determined that the organization's accounting system was designed to reject duplicate invoices if they were issued with identical invoice numbers. However, if an invoice number was changed by at least one digit, the system would accept the duplicate invoice as new. Which of the following would be the most appropriate criteria to refer to in the audit observation?

A. Each invoice for goods or services acquired by the organization must be recorded only once in the accounting system.

B. The accounting system lacks efficient controls for the identification of duplicate invoices.

C. Disbursements may be made inappropriately, and liabilities may be overstated.

D. The accounting system is at the end of its lifetime and is no longer developed by the provider.

When forming an opinion on the adequacy of management's systems of internal control, which of the following findings would provide the most reliable assurance to the chief audit executive?

• During an audit of the hiring process in a law firm, it was discovered that potential employees' credentials were not always confirmed sufficiently. This process remained unchanged at the following audit.

• During an audit of the accounts payable department, auditors calculated that two percent of accounts were paid past due. This condition persisted at a follow up audit.

• During an audit of the vehicle fleet of a rental agency, it was determined that at any given time, eight percent of the vehicles were not operational. During the next audit, this figure had increased.

• During an audit of the cash handling process in a casino, internal audit discovered control deficiencies in the transfer process between the slot machines and the cash counting area. It was corrected immediately.

A. 1 and 3 only

B. 1 and 4 only

C. 2 and 3 only

D. 2 and 4 only

An internal audit team leader is having difficulties completing the planning phase of an assurance engagement because the business unit lacks a system of internal controls. Which of the following is the most appropriate course of action for the internal audit team leader?

A. Defer the engagement until a system of internal control has been established

B. Change the scheduled engagement from assurance to consulting to help correct the shortcomings

C. Add a consulting component to the already scheduled assurance engagement

D. Seek the involvement of the external auditor to assist with improving the internal controls

In an assurance engagement focused on the adequacy of organizationwide risk management practices, which of the following best describes a primary area of interest for the engagement?

A. The effectiveness of process-level and transaction-level controls.

B. Conflicts of interest within the organizational structure of the senior management.

C. The alignment of management decisions with the level of risk the organization is willing to accept.

D. The actions of upper management in response to the internal audit acth/lty's reporting

Which of the following is the primary reason the chief audit executive should consider the organization's strategic plans when developing the annual audit plan?

A. Strategic plans reflect the organization's business objectives and overall attitude toward risk.

B. Strategic plans are helpful to identify major areas of activity, which may direct the allocation of internal audit activity resources.

C. Strategic plans are likely to show areas of weak financial controls.

D. The strategic plan is a relatively stable document on which to base audit planning.

During a review of data privacy an internal auditor is tasked with testing management's identification and prioritization of critical data collected by the organization. Which of the following steps would accomplish this objective?

A. interview management to determine what types of data are collected and maintained

B. Trace data from storage to the collection sources to determine how critical data is collected and organized

C. Review a sample of data to determine whether the risk classification is reasonable

D. Document and test a data inventory and classification program by determining the data classification levels and framework

An internal auditor is planning an audit engagement of a subsidiary organization. The auditor learns that a corporate investigator from the holding organization is investigating the subsidiary regarding a fraud case. Which of the following is true regarding the scope of the internal auditor’s engagement?

A. As the fraud is already being investigated by the corporate investigator, it should be excluded from the scope of the audit engagement

B. The engagement should be framed as an advisory engagement to support the corporate investigator's work

C. The area under investigation should be excluded from the engagement scope if the auditor does not have the technical skills required to support a fraud investigation

D. The scope should consider the nature of the fraud risk and control weaknesses identified from the fraud case

Which of the following is the primary purpose of implementing a program whereby employees are rotated from other parts of the organization into the internal audit activity?

A. It provides the internal audit activity with more resourcing options to meet the audit plan

B. It offers internal auditors the opportunity to learn more about other work areas.

C. It gives nonauditors a better understanding of the control environment.

D. It provides an opportunity for the recruitment of employees as permanent internal auditors

A chief audit executive (CAE) a developing a work program for an upcoming engagement that will review an organization’s small contracting services. When of the following would the CAT need to consider most when developing the work program?

A. The contracting department's staffing changes within the last year

B. The certifications held by the internal auditors assigned to the engagement

C. The internal audit activity's increase n budget and staffing for the year

D. The organization's recent changes to how it processes payments

An internal auditor completed a test of 30 randomly selected accounts. For five of the accounts selected, the auditor was unable to find supporting documentation in the normal place of storage. Which of the following next steps would be most appropriate for the internal auditor to take?

A. Conclude that the test failed because at least 17 percent of the sample items were not supported.

B. Select five new accounts to replace the ones that were missing supporting documentation.

C. Expand the sample size to 60 to determine whether the error rate remains the same.

D. Contact management to determine whether the supporting documentation can be located elsewhere.