IIA certification practice

Free IIA-ACCA Practice Test

10 free IIA-ACCA exam-style questions for Accounting CIA Challenge Exam, with answers, explanations and source references.

Last updated November 4, 2026

Full set: 604 questions

IIA-ACCA refers to the IIA's Accounting CIA Challenge Exam, the route ACCA members and other qualified accountants with an active CPA or CA from an approved body can take toward the Certified Internal Auditor credential. The exam has 150 multiple-choice questions in 180 minutes, is delivered by computer at Pearson VUE test centers, and is offered only in the February, June, September and November windows.

The syllabus effective 1 June 2026 has five sections. Engagement Performance carries the largest weight at 25%, and its questions describe audit situations rather than ask for definitions. Internal Audit Professionalism and Quality, Engagement Planning, and Engagement Results and Monitoring each carry 20%, while Internal Audit Operations and Audit Plan carries 15%. If your background is in external audit, review the internal audit view of risk, independence and reporting closely.

Work through these free practice questions one at a time and check each answer before moving on. Read every explanation, even when you were right, to confirm your reasoning matches the internal audit approach. Track your misses by section, and spend extra review time on the heavier sections where you score lowest.

Get Full Access

An organization with global headquarters in the United States has subsidiaries in eight other nations. If the organization operates with an ethnocentric attitude, which of the following statements is true?

Answer options

Open this question on its own page

A newly promoted chief audit executive (CAE) is faced with a backlog of assurance engagement reports to review for approval. In an attempt to attach a priority for this review, the CAE scans the opinion statement on each report. According to IIA guidance, which of the following opinions would receive the lowest review priority? 1. Graded positive opinion. 2. Negative assurance opinion. 3. Limited assurance opinion. 4. Third-party opinion.

Answer options

Correct Answer:

Question breakdown

Tests: Distinguish types of engagement opinions and their reliance levels
Difficulty: Hard

Key idea: Opinions that give positive or graded assurance, or that third parties will rely on, carry the most reliance and risk, so they deserve CAE review before negative or limited assurance opinions.

How to reach the answer

Rank each opinion type by the level of assurance it gives and the reliance others will place on it.
A graded positive opinion states affirmatively how effective controls are, which is high reliance.
A third-party opinion may be relied on by external parties, which raises exposure.
Negative assurance opinions ('nothing came to our attention') and limited assurance opinions give lower assurance from narrower work, so they get the lowest priority.

Each option

AIncorrect. The graded positive opinion is high-assurance and should be reviewed early, so this pairing is wrong.
BIncorrect. Both graded positive and third-party opinions carry high reliance and warrant higher review priority.
CCorrect. Negative assurance and limited assurance opinions give the lowest level of assurance and therefore the lowest review priority.
DIncorrect. The third-party opinion may be relied on externally, so it should not be in the lowest-priority group.

Common trap: Candidates may read 'negative' as meaning bad findings that need urgent attention, when it actually describes a low level of assurance.

In practice: A CAE triaging report approvals focuses scrutiny on reports that make strong affirmative statements or will be relied on by boards, regulators or other external parties.

Remember: The more assurance an opinion gives and the more others rely on it, the higher its CAE review priority; negative and limited assurance rank lowest.

Open this question on its own page

Division A produces a product with a variable cost of $5 per unit and an allocated fixed cost of S3 per unit The market price of the product is S15 plus 20 percent selling cost. Division B currently purchases this product from an external supplier but is going to purchase it from division A for S18 Which of the following methods of transfer pricing is being used?

Answer options

Open this question on its own page

Which of the following statements about matrix organizations is false?

Answer options

Open this question on its own page

According to IIA guidance, which of the following are macro-level audit activities performed for an assurance engagement of the purchasing department? 1. Obtain and review all purchasing-related audit reports issued within the past year. 2. Meet with the quality assurance group to discuss its previous reports of any purchasing-related findings. 3. Review a memo written by the purchasing manager that outlines ongoing problems with the purchasing software. 4. Request a copy of the report from a purchasing audit conducted last year by an external service provider.

Answer options

Open this question on its own page

An internal audit team is performing an audit of workplace accident claims. Which of the following actions by the audit team best demonstrates due professional care?

Answer options

Correct Answer:

Question breakdown

Tests: Apply the due professional care standard to engagement staffing
Difficulty: Medium

Key idea: Due professional care means applying the care and skill a reasonably prudent auditor would use, including making sure the team has the expertise that a complex or specialized subject requires.

How to reach the answer

The question asks which action shows the care and skill applied to the engagement as a whole, not which test step is routine.
Workplace accident claims involve medical and occupational health judgments that general auditors usually lack.
A prudent auditor recognizes that gap and adds a specialist, which reflects due care for complexity and significance.
Options B and D are ordinary audit procedures, and option C is uncritical reliance, which works against due care.

Each option

ACorrect. Adding an occupational health specialist shows the team considered how complex the subject is and made sure it had the expertise to judge the claims competently.
BIncorrect. Checking claim classification is a standard test step and does not specifically show the prudent care and skill the standard asks for.
CIncorrect. Accepting reports from the claimant's own doctor without question shows a lack of professional skepticism, which is the opposite of due care.
DIncorrect. Confirming that accidents happened at work is a normal validity test, and the team cannot do it well without the right expertise anyway.

Common trap: Option D sounds rigorous and fraud-focused, so candidates may treat a thorough test step as due care, overlooking that due care starts with having the competence to judge the evidence.

In practice: When engagements cover health and safety, actuarial, IT security, or engineering areas, the CAE often brings in guest auditors or outside specialists so the team's conclusions hold up.

Remember: Due professional care includes recognizing when a subject needs specialist expertise and getting it, rather than relying on unqualified judgment.

Open this question on its own page

Which segregation of duties would best reduce the risk of payroll fraud?

Answer options

Correct Answer:

Question breakdown

Tests: Evaluate segregation of duties in the payroll cycle
Difficulty: Medium

Key idea: Payroll fraud risk is lowest when no single function can both create an employee and control where that employee's pay goes.

How to reach the answer

Identify the main payroll fraud schemes: ghost employees and diverted pay.
For a ghost employee scheme, a person must be able to add an employee and also direct the payment to an account they control.
In A, HR adds employees while payroll controls bank details, so neither function can complete the scheme alone, and direct deposit removes the risk of check handling.
In D, HR both adds employees and enters bank details, so one function can create a ghost employee and route the pay to itself.

Each option

ACorrect. Employee setup is kept apart from bank account maintenance, and direct deposit removes the risk of physical check interception, which blocks a single-person ghost employee scheme.
BIncorrect. HR both adds employees and hands out paychecks, so HR could create a fictitious employee and keep the check.
CIncorrect. HR adds employees, submits hours, and delivers checks, which concentrates almost the whole payroll cycle in one function.
DIncorrect. HR adds employees and also sets the bank account where pay is deposited, so it can create a ghost employee paid into its own account.

Common trap: A and D look almost the same because both use direct deposit, but in D the function that creates employees also controls where the money goes.

In practice: Auditors reviewing payroll check HRIS and payroll system access rights to confirm that the people who create employee records cannot also change bank account details.

Remember: In payroll, keep the authority to create an employee separate from control over that employee's payment destination.

Open this question on its own page

When an organization is choosing a new external auditor, which of the following is the most appropriate role for the chief audit executive to undertake?

Answer options

Correct Answer:

Question breakdown

Tests: Identify the CAE's appropriate role in external auditor selection
Difficulty: Medium

Key idea: The board or audit committee selects the external auditor, and the CAE can support the process with advice without taking over the decision or management responsibilities.

How to reach the answer

Selecting and appointing the external auditor is the responsibility of the board or audit committee, not internal audit.
The CAE should avoid management decisions that could impair internal audit's independence or that belong to governance bodies.
Advising on regulatory requirements for auditor selection, such as rotation and independence rules, is a supporting role that fits the CAE's knowledge of risk and compliance.
Acquiring the service or setting the selection criteria would make the CAE a decision maker in the process.

Each option

AIncorrect. Reviewing and acquiring the external audit service is a procurement decision that belongs to the audit committee or board, not the CAE.
BIncorrect. Appraisal and actuarial services have nothing to do with choosing the external auditor.
CIncorrect. Setting the selection criteria is a decision for the audit committee, and having the CAE do it would overstep the CAE's role.
DCorrect. Pointing out the regulatory requirements to consider is an advisory input that helps the audit committee without the CAE taking ownership of the selection.

Common trap: Option C appeals because the CAE knows audit quality well, but setting the criteria effectively steers the selection, which is the audit committee's governance responsibility.

In practice: During an external auditor tender, the CAE may brief the audit committee on rotation rules, independence restrictions, and coordination needs, while the committee sets the criteria and makes the appointment.

Remember: In external auditor selection, the CAE advises, for example on regulatory requirements, and the audit committee decides.

Open this question on its own page

Which of the following best describes the misdirection of payments on accounts receivable to an employee's bank account?

Answer options

Correct Answer:

Question breakdown

Tests: Classify fraud schemes by how they relate to accounting records
Difficulty: Medium

Key idea: Off-book fraud diverts assets before they are recorded or outside the recorded flow, so the stolen funds never show up in the organization's books.

How to reach the answer

Fraud is often classed as on the books (open or hidden) or off the books.
When a customer payment goes straight to an employee's bank account, the cash never enters the organization's records.
Because the theft happens outside the accounting system, it is off the books, much like skimming.
Detection depends on external evidence such as customer confirmations or complaints, not on reviewing the ledger.

Each option

AIncorrect. Open on-book fraud leaves recorded but unconcealed transactions in the records, which is not the case when cash is diverted before it is recorded.
BIncorrect. Hidden on-book fraud hides fraudulent entries inside the records, but here the receipt is never recorded at all.
CCorrect. Diverted receivable payments go around the organization's records completely, which makes this off-book fraud.
DIncorrect. 'Fraud on the balance sheet' is not a standard category of fraud scheme.

Common trap: Because receivables are recorded, candidates may think the scheme is hidden on the books, but the stolen cash itself never enters the accounting records.

In practice: Auditors detect diverted receipts through positive customer confirmations, aging analysis of growing receivables, and reconciliation of bank lockbox deposits.

Remember: If stolen funds never enter the organization's records, the scheme is off-book fraud and is best found through external evidence.

Open this question on its own page

An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which of the following statements about a common risk language is true?

Answer options

Correct Answer:

Question breakdown

Tests: Understand the purpose of a common risk language in ERM
Difficulty: Easy

Key idea: A common risk language makes sure risks are defined, described, and rated the same way across the organization, so assessments are consistent and comparable.

How to reach the answer

Ask what a shared vocabulary and taxonomy actually change.
A common risk language standardizes how risks are described and rated, so assessments from different units can be compared and combined.
It does not change inherent risk, the effectiveness of controls, or audit sample sizes.
The clue is consistency, which points to stakeholders getting more assurance that risks are assessed uniformly.

Each option

AIncorrect. Inherent risk exists before any response, so understanding risk better through common terms does not lower it.
BIncorrect. Shared terminology does not make controls more consistent or effective, so it gives no basis for smaller samples.
CCorrect. Shared definitions and rating scales lead to consistent risk assessments across the organization, which gives stakeholders more assurance.
DIncorrect. A common vocabulary improves communication but does not itself reduce the likelihood of missing or ineffective controls.

Common trap: Option A sounds reasonable because better understanding seems to lead to lower risk, but inherent risk is measured before responses and does not change with terminology.

In practice: When organizations build an ERM framework, they publish a risk taxonomy and standard likelihood and impact scales so business-unit risk registers can be combined into one enterprise view.

Remember: A common risk language delivers consistency and comparability in risk assessment, not a direct reduction in risk.

Open this question on its own page

Question 1 of 10

Browse IIA exams

About the exam

IIA-ACCA exam at a glance

Key facts for the Accounting CIA Challenge Exam exam, taken from the official exam page.

Exam code	CIA Challenge Exam syllabus effective 1 June 2026 (V2.10.2025)
Number of questions	150
Time allowed	180 minutes
Question types	Multiple choice
Exam price	Application $150 USD (IIA member) / $380 USD (non-member); exam $845 USD (member) / $1,245 USD (non-member). Member pricing in certain countries changes from 4 January 2027.
Delivery	Computer-based testing at Pearson VUE test centers
Languages	English, French, Spanish
Prerequisites	Active CPA or CA from an approved qualified accounting body (ACCA is listed); letter of good standing and government-issued photo ID required; students ineligible
Validity and renewal	Registration authorizes a 180-day exam window (or until program expiration, whichever is sooner); certified individuals self-attest annually that renewal requirements are met
Version status	New CIA Challenge Exam syllabus effective 1 June 2026.

Source: official IIA-ACCA exam page. Verified November 4, 2026. Prices and policies can change, so confirm with the provider before booking.

Exam objectives

What the IIA-ACCA exam covers

The IIA-ACCA exam is organized into 5 official domains. Weight shows the share of the exam each domain represents, so spend your study time in proportion.

Section A: Internal Audit Professionalism and Quality 20%
Section B: Internal Audit Operations and Audit Plan 15%
Section C: Engagement Planning 20%
Section D: Engagement Performance 25%
Section E: Engagement Results and Monitoring 20%

Domains and weights from the official IIA-ACCA exam outline.

Quick answers

IIA-ACCA exam FAQ

How many questions are on the IIA-ACCA exam?

The IIA-ACCA exam has 150 questions and gives you 180 minutes to finish. Question types include multiple choice.

How much does the IIA-ACCA exam cost?

The IIA-ACCA exam costs Application $150 USD (IIA member) / $380 USD (non-member); exam $845 USD (member) / $1,245 USD (non-member). Member pricing in certain countries changes from 4 January 2027.. Check the official exam page for the price in your country.

How long is the IIA-ACCA certification valid?

Registration authorizes a 180-day exam window (or until program expiration, whichever is sooner); certified individuals self-attest annually that renewal requirements are met.

Source context

How this practice set is maintained

Maintained by the CertMage content team, this page loads questions from the exam dataset connected to its preparation resource. When an answer includes a supporting reference, it is shown with that answer so you can review the underlying vendor documentation.

Certification objectives, interfaces, and vendor services can change. Verify important details against the provider's current exam guide and documentation before your exam.

Reviewed by Alexandra Stone CISSP, CISM, CISA, Security+, CEH

How many questions are on the IIA-ACCA exam?

How much does the IIA-ACCA exam cost?

How long is the IIA-ACCA certification valid?

How this practice set is maintained

IIA IIA-CIA-PART3 certification exam

Practice of Internal Auditing

IIA Certification

IIA Iia Crma certification exam

Control Self-Assessment®

Certified Financial Services Auditor