IIA-CRMA-ADV Practice Test 2026

Explanation;

Variance analysis is a diagnostic tool, not a conclusion in itself. When unexpected deviations appear, the auditor's primary duty is investigation. The deviation may stem from valid business fluctuations, data entry errors, unrealistic budgeting, or control failures. Until the root cause is identified, the auditor cannot assess materiality, risk, or the need for corrective action. Gathering additional information—through inquiry, corroboration, and expanded testing—is mandatory per professional standards.

Why others are incorrect:

A (Report to audit committee):
Premature and escalatory. Operational variances are discussed with management first; only material, unresolved, or fraud-related issues reach the audit committee. Reporting uninvestigated data undermines credibility.

C (Conclude budget was unreasonable):
Unsubstantiated assumption. An unrealistic budget is one of many possible causes. Accepting deviations without evidence violates due professional care and skips required analytical follow-up.

D (Perform alternative procedures with no deviations):
Evasive and unethical. This constitutes "shopping" for comfortable evidence and ignores red flags. Auditors must pursue anomalies, not avoid them.

References:

IIA Standard 2320 – Analysis and Evaluation: Auditors must base conclusions on appropriate analyses; unexpected differences require further evaluation.

IIA Standard 1220 – Due Professional Care: Auditors must exercise prudent judgment—neither overreacting (A) nor dismissing (C/D) without evidence.

Explanation:

Supervisory review of working papers is an internal quality assurance procedure mandated to ensure that engagement evidence is sufficient, reliable, relevant, and logically supports the audit conclusions. The Chief Audit Executive (CAE) bears direct accountability for this oversight. Standard techniques to evidence such review are practical, cost-effective, and retained within the audit function—they include physical sign-offs (initials/dates), structured checklists, and narrative memoranda. These methods provide a clear, contemporaneous audit trail that supervision actually occurred.

Why others are incorrect:

A (Initials and dates):
Correct standard technique. This provides immediate, verifiable evidence that a specific reviewer examined each workpaper at a specific time—simple yet effective.

B (Engagement working paper checklist):
Correct standard technique. This ensures all required review steps (e.g., cross-referencing, tick-mark explanations, conclusion support) have been systematically completed. It promotes consistency across engagements.

C (Memorandum discussing review results):
Correct standard technique. This is especially useful for complex or high-risk engagements, as it documents the reviewer's professional judgments, unresolved issues, and overall concurrence with the engagement conclusions.

References:

IIA Standard 2340 – Engagement Supervision: "Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff are developed." Supervision must be evidenced internally by the CAE or designee.

IIA Standard 1312 – External Assessments: "External assessments must be conducted at least once every five years by a qualified, independent assessor..." This clearly restricts external involvement to periodic functional reviews, not per-engagement workpaper sign-offs.

Explanation:

Due professional care (Standard 1220) represents the prudent judgment and competence expected of a reasonably skilled internal auditor. Critically, it does not imply infallibility or absolute assurance—auditors work within practical constraints. When exercising due care in an assurance engagement, the Standards explicitly require auditors to consider three factors: (1) the complexity, materiality, or significance of matters under review (A); (2) the cost-benefit trade-off of performing assurance procedures (C); and (3) the probability of significant errors, fraud, or noncompliance (D). These factors collectively define the reasonable scope of work.

Option B is the correct "not a consideration" because it demands that assurance services ensure "all risks are identified." This is an impossible and unrealistic benchmark. Risk identification is inherently subjective, limited by available information, management override, and evolving business conditions. Due professional care mandates a risk-based approach—focusing on significant risks that could materially impact objectives, not an exhaustive catalog of every conceivable risk. Expecting "all risks" would render engagements interminable, cost-prohibitive, and operationally paralysing. The Standards explicitly reject absolute assurance; auditors provide reasonable assurance within defined materiality and cost-benefit boundaries. Therefore, this option contradicts the very essence of due professional care.

Why others are incorrect

A (Complexity, materiality, significance): Correct per Standard 1220.A1. These determine the nature and extent of testing—highly compl

ex or material areas demand deeper scrutiny.

C (Cost vs. potential benefits): Correct per Standard 1220.A2. Due care acknowledges resource limitations; procedures must be proportionate to expected benefits, not exhaustive.

D (Probability of significant errors/fraud/noncompliance): Correct per Standard 1220.A1. This is the foundation of risk-based auditing—higher risk areas receive greater attention.

References:

IIA Standard 1220 – Due Professional Care: "Due professional care does not imply infallibility or absolute assurance." This directly invalidates the "all risks" standard.

IIA Standard 1220.A1 – Assurance Engagements: "Internal auditors must consider the relative complexity, materiality, or significance of matters... and the probability of significant errors, irregularities, or noncompliance." (Covers A and D).

Explanation:

The core of this question lies in understanding the distinction between organizational independence and individual objectivity, as defined by the IIA Standards. The CAE violated the principle of organizational independence, which is the freedom for the internal audit activity to carry out its responsibilities in an unbiased manner. This independence is fundamentally achieved through an appropriate organizational status and reporting lines, most critically, a functional reporting line to the board .

Here is why the other options are incorrect:

A. Due professional care:
This relates to the application of diligence and competence in performing the audit work itself . The scenario states the work was performed by a "qualified internal auditor," and it does not indicate that the investigation was improperly planned, supervised, or executed. It is the reporting of the results, not the conduct of the work, that is the issue .

B. Individual objectivity:
This requires an internal auditor to maintain an unbiased mental attitude and avoid conflicts of interest . There is no information in the scenario to suggest the auditor had a personal bias, a conflict of interest, or had their impartiality compromised during the investigation .

C. Proficiency:
This refers to the internal auditor possessing the knowledge and skills required to perform the engagement . The scenario explicitly states the work was performed by a "qualified internal auditor," ruling this option out.

Reference

IIA Standard 1100 – Independence and Objectivity: The internal audit activity must be independent, and internal auditors must be objective in performing their work.

IIA Standard 1110 – Organizational Independence:The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. The CAE must confirm to the board, at least annually, the organizational independence of the internal audit activity

Explanation:

The three areas for improvement identified by the quality assessment—achievement of engagement objectives, quality of work, and staff development—are the precise and explicit purposes of engagement supervision as defined by the IIA Standards. Standard 2340 states that engagements must be properly supervised to ensure that objectives are achieved, quality is assured, and staff is developed.

Here is why the other options are incorrect:

A. Demonstrated compliance with procedures:
While checklists and following procedures are part of a QAIP, they are tools, not the primary driver. Compliance with procedures helps ensure consistency but does not, by itself, guarantee that engagement objectives are achieved or that staff is developed. This is an outcome of good supervision, not the primary focus itself.

B. Due professional care:
This refers to the care and skill expected of a reasonably prudent and competent internal auditor in performing their work. It is an attribute of the audit work itself, not the primary management process used to cause improvements in quality and staff development across the entire activity.

D. Employment of tools and techniques:
Tools and techniques (such as software for workpapers or data analytics) can support the audit process and improve efficiency, but they are secondary. Without proper supervision, even the best tools do not ensure that engagement objectives are achieved, quality is assured, or staff are developed.

Reference

IIA Standard 2340 – Engagement Supervision: "Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed".

Standard 12.3 – Oversee and Improve Engagement Performance (New GIAS): This principle explicitly states that the CAE must establish methodologies for engagement supervision, quality assurance, and competency development. The extent of supervision depends on the auditor's proficiency and the engagement's complexity.

Explanation:

The question asks for a control failure that is not directly attributable to the customer billing application itself. This means we are looking for failures in the general IT controls (GITCs) or management processes that surround the application, rather than failures in the application's specific automated logic or data processing.

Statement 2 describes an untested program change being moved from test to production. This is a failure of change management controls—a general IT control that governs the software development lifecycle (SDLC). It is not a failure within the billing application's code; it is a failure in the process that manages how code is deployed into that application.

Statement 4 describes end-user security being inadvertently granted by management. This is a failure of access controls / user provisioning (another general IT control or an administrative control). It is a human/management error in granting permissions, not a flaw in the billing application's own logic or data tables.

Why the other options are incorrect:

Statement 1:End users raising concerns regarding data integrity is directly attributable to the billing application. Data integrity issues (e.g., duplicate records, incorrect totals, missing transactions) are typically the result of failures in the application's input validation, processing logic, or database update routines. This is a direct application control failure.

Statement 3: Purchase history not reconciling with accounts receivable is a failure of application processing controls (specifically, a reconciliation control within or output by the billing system). The failure lies in the application's ability to accurately post and track transactions, making it directly attributable to the application.

Since Statement 1 and Statement 3 are directly attributable to the application, any answer containing them (A, B, or C) is incorrect. Only Statements 2 and 4 are failures of the surrounding IT general and administrative controls, making option D the correct choice.

Reference:

IIA Standard 2110 – Governance: Internal audit must assess and make appropriate recommendations for improving the governance process. This includes evaluating the IT governance structure, which encompasses change management and access controls.

Explanation:

The IIA’s Three Lines Model provides a clear framework for delineating risk management roles. The Compliance department is the definitive example of the second line of defense, as it provides oversight, monitoring, and expert challenge to the first line’s risk-taking activities. Its primary function is to ensure that operational management adheres to laws, regulations, and internal policies—a role that inherently involves evaluating the design and effectiveness of controls without owning the operational risks themselves.

Why the other options are incorrect:

A. Purchasing department:
This is a purely operational function that executes day-to-day transactions (procuring goods/services). It directly owns and manages the risks associated with its activities, placing it firmly in the first line of defense, not the second.

C. Credit department:
Like purchasing, this department is embedded in daily operations (extending credit, setting limits, collecting payments). It is responsible for managing credit risk at the source, making it a first-line function.

D. Internal audit department:
This is the quintessential third line of defense. Internal audit provides independent, objective assurance to the board and audit committee on the effectiveness of governance, risk management, and internal controls. It does not participate in operational risk decisions or compliance monitoring, preserving its objectivity.

References

IIA Position Paper: "The Three Lines of Defense in Effective Risk Management and Control" (2013) – Explicitly structures the three lines, placing operational management (first line), risk and compliance functions (second line), and internal audit (third line) into distinct categories.

Explanation:

A walk-through is the only audit technique that simultaneously serves two critical purposes: (1) evaluating the design effectiveness of a control, and (2) embodying the analytical process of auditing.

During a walk-through, the auditor selects one or a few transactions and traces them from initiation through the entire process to final recording, while simultaneously asking questions, observing activities, and inspecting documents. This technique forces the auditor to actively analyze each step, question "what if" scenarios (e.g., what if this approval is missing?), and mentally verify whether the control, as designed, would actually prevent or detect errors or fraud. It is not a passive documentation exercise; it is a dynamic, analytical assessment that combines inquiry, observation, and inspection to form a professional judgment.

Why the other options are incorrect:

A. A risk and control matrix:
This is a documentation tool used to map risks to controls and record the results of testing. It does not, by itself, evaluate design or involve analytical reasoning—it merely organizes information already gathered.

B. A flowchart:
This is a visual depiction of a process or workflow. While useful for understanding the sequence of steps, a flowchart only shows what should happen on paper. It does not validate that the control actually operates as depicted, nor does it require analytical evaluation of the control's adequacy.

D. A process narrative:
This is a written description of a process, often used for documentation purposes. Like a flowchart, it is descriptive, not evaluative. It lacks the dynamic, questioning, and transactional tracing that characterizes the analytical process of auditing.

References

IIA Standard 2210 – Engagement Objectives: Requires internal auditors to consider the probability of significant errors, fraud, noncompliance, and other exposures when developing engagement objectives. Walk-throughs are the primary technique used during the planning phase to obtain this understanding and evaluate control design.

Explanation:

This scenario presents a clear conflict of interest that directly threatens the auditor's individual objectivity (Standard 1120). The senior auditor has a familial relationship (brother-in-law) with the head of a department they routinely audit. This creates an actual or perceived bias that could impair impartial judgment, regardless of whether any improper act has occurred.

The most appropriate action is twofold: (1) remove the auditor from the assignment to eliminate the conflict, and (2) take corrective action for the auditor's failure to disclose the relationship. Standard 1120 and the Code of Ethics (Rule of Conduct: Objectivity) require internal auditors to disclose any known conflicts of interest to the CAE before accepting or continuing an engagement. The auditor was hired six months prior, meaning this relationship existed and should have been disclosed at the time of hiring or before any subsequent procurement audit. The CAE cannot ignore this lapse; failure to address it sets a dangerous precedent and undermines the credibility of the internal audit activity.

Why the other options are incorrect:

A. The CAE should not interfere:
Incorrect. The CAE has a positive duty to manage objectivity threats. Ignoring a known conflict violates Standard 1130 (Impairments to Independence or Objectivity), which requires the CAE to address impairments and disclose them to the board.

B. The CAE should remind the auditor of his obligation:
Insufficient. A mere reminder does not remove the actual conflict. The auditor already has an obligation; reminding them without reassigning them fails to protect objectivity and allows the impairment to persist.

D. Require written disclosure before continuing:
Inadequate. Disclosure is required, but it does not eliminate the threat. The auditor should have disclosed before the hiring or before auditing procurement after the hiring. Continuing the assignment even with written disclosure violates the IIA's requirement that objectivity must be both maintained and perceived. The CAE must remove the individual from the engagement.

References

IIA Standard 1120 – Individual Objectivity: "Internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest."

IIA Standard 1130 – Impairments to Independence or Objectivity: "If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties... The CAE must address any impairments." This mandates action, not passive acknowledgment.

Explanation:

The ability to render impartial and unbiased assessments is the very definition of objectivity, which, when combined with the proper organizational status (independence), forms the foundational pillar of the internal audit activity's credibility.

Organizational status (independence) is achieved through a reporting line to the board/audit committee, giving the CAE the authority and freedom to determine the scope of work, perform audits without interference, and communicate results to the highest governance level.

Objectivity is the individual mental attitude that requires auditors to not subordinate their judgment on audit matters to others.

Together, these two elements—organizational independence and individual objectivity—are the only factors that collectively ensure both the fact and the appearance of impartiality. Without them, no amount of supervision, skill, or certification can guarantee unbiased assessments.

Why the other options are incorrect

B. Supervision of the CAE by senior management:
Incorrect. Reporting to senior management (operational line) actually undermines impartiality, as management may influence audit scope or findings. The CAE must report functionally to the board to preserve independence (Standard 1110).

C. Organizational knowledge and skills:
Incorrect. While competence (proficiency) is necessary to perform audits, it does not ensure impartiality. A highly skilled auditor can still be biased or influenced. Competence addresses ability, not independence.

D. CAE certification:
Incorrect. Certification demonstrates professional knowledge and commitment to the Code of Ethics, but it does not, by itself, ensure impartial assessments. It is the organizational structure and adherence to objectivity principles that guarantee unbiased work, not a credential.

References

IIA Standard 1100 – Independence and Objectivity: "The internal audit activity must be independent, and internal auditors must be objective in performing their work." This standard explicitly links the two concepts as the basis for impartial assessments.

IIA Standard 1110 – Organizational Independence: Requires the CAE to report to a level within the organization that allows the internal audit activity to fulfill its responsibilities, specifically a functional reporting line to the board.