Free IIA-CIA-PART1 Practice Test

The IIA's Standard 1210: Proficiency states that the internal audit activity must collectively possess the knowledge, skills, and other competencies needed to perform its responsibilities. The Chief Audit Executive (CAE) is responsible for ensuring this collective proficiency. When hiring a new internal auditor, the CAE's primary consideration is to assess the current team's competencies, identify any gaps relative to the audit plan's requirements, and select a candidate whose skills fill those gaps. This approach ensures the team as a whole is equipped to meet its objectives, directly aligning with the core principle of collective proficiency mandated by the Standards.

A. The length and consistency of the auditor's work experience is a factor, but its relevance to the team's specific needs is more critical than its duration.
B. The auditor's demonstrated problem-solving skills is a single competency; the primary need is to address the overall competency gaps of the entire team, which may lie in other areas.
D. The auditor's ability to be self-motivated and a good team player are important soft skills, but they are secondary to the specific technical and professional competencies required by the proficiency standard.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1210 – Proficiency: "The internal audit activity must collectively possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities."

Interpretation of Standard 1210: This section emphasizes that the CAE must consider the skills needed to perform the audit plan and that proficiency is a collective attribute of the team. Hiring is a key method for the CAE to build this collective capability.

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 1210: Proficiency.

Getting Started Section: "The CAE may start by identifying the knowledge, skills, and other competencies the internal audit activity needs to perform its work... The CAE may then assess the competencies of the current internal audit staff to identify areas for development or to determine the competencies needed when hiring new internal audit staff." This directly supports hiring based on a comparison to the existing team's skills.

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation.

Chapter 3, "The International Professional Practices Framework: Authoritative Guidance for the Internal Audit Profession," page 68: Discusses Standard 1210, explaining that the CAE must assemble a staff with the necessary collective skills. "For example, if the audit plan includes several information system audits, the CAE must ensure that the internal audit staff collectively has sufficient information system audit skills to perform the work." This illustrates hiring to fill specific, identified team needs.

The board of directors' primary governance role is oversight, not direct management. Succession planning for the CEO and key executives is a critical oversight function that directly establishes the "tone at the top." By selecting, evaluating, and planning for the replacement of senior leadership, the board ensures that competent and ethical individuals are in place to design, implement, and maintain the organization's system of internal control. This action is a fundamental component of the control environment, which is the foundation for all other components of internal control, making it the best demonstration of governance.

A. This is incorrect because senior management, not the board, is directly responsible for developing and implementing the internal control system. The board's role is to oversee this process.
B. This describes a poor governance structure. Best practices require a majority of independent, non-executive directors to ensure objective oversight and mitigate conflicts of interest.
C. The audit committee chair must be an independent, non-executive board member. The chief audit executive (CAE) reports functionally to the audit committee but cannot chair it, as this would impair independence.

1. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary.

Principle 2, Page 6: "The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control." The supporting text clarifies that the board's oversight responsibilities include selecting and overseeing key members of senior management, including the CEO.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing.

Standard 2110: Governance, Page 13: "The internal audit activity must assess and make appropriate recommendations to improve the organization’s governance processes for... Ensuring effective organizational performance management and accountability." This standard encompasses the board's oversight of senior management's performance and accountability, which includes their selection and succession.

3. Larcker, D. F., & Tayan, B. (2015). Corporate Governance Matters: A Closer Look at Organizational Choices and Their Consequences. Stanford Graduate School of Business.

Chapter 4: The Board of Directors, Section on "CEO Succession Planning," Pages 101-104: This academic text explicitly identifies CEO succession planning as one of the most important responsibilities of the board of directors, highlighting it as a cornerstone of effective governance and long-term organizational stability.

Workpapers (also known as engagement records) are the primary documentation of the audit process. They contain the detailed records of planning, risk assessments, procedures performed, evidence gathered, and conclusions reached. This comprehensive documentation serves as the principal evidence that the internal auditor exercised due professional care by demonstrating a diligent, competent, and systematic approach in conformance with the International Standards for the Professional Practice of Internal Auditing (specifically Standard 1220: Due Professional Care and Standard 2330: Documenting Information).

A. Internal audit charter: The charter is a high-level document that defines the internal audit activity's purpose, authority, and responsibility; it does not provide evidence of care exercised during a specific engagement.
C. Audit report: The audit report is a summary of the engagement's results and conclusions. It is the product of the audit work, not the detailed evidence of the process followed to achieve it.
D. Code of ethics: The code of ethics provides guiding principles and rules of conduct for auditors. It is a framework for behavior, not evidence of the actual performance or diligence in an audit. ---

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing.

Standard 1220: Due Professional Care: "Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor." This standard sets the requirement.

Standard 2330: Documenting Information: "Internal auditors must document relevant information to support the conclusions and engagement results." The Interpretation section clarifies that engagement workpapers "provide the principal support for the internal auditors’ communications" and "facilitate quality assurance reviews," which would assess due professional care.

2. Pickett, K. H. S. (2011). The Internal Auditing Handbook (3rd ed.). John Wiley & Sons.

Chapter 18, "Working papers," explains that workpapers are essential to demonstrate that the audit was performed with due professional care and in accordance with professional standards. They provide the evidence linking the audit objectives to the conclusions. (Specific reference: pp. 485-487).

3. Moeller, R. R. (2016). Brink's Modern Internal Auditing (8th ed.). John Wiley & Sons.

Chapter 13, "Performing the Internal Audit Engagement," states, "Audit working papers are the records kept by the internal auditor of the procedures followed, the tests performed, the information obtained, and the conclusions reached... They provide the evidence that the internal auditor has exercised due professional care." (Specific reference: Section on "Documenting Internal Audit Work").

The primary role of the internal audit activity is to provide independent and objective assurance and consulting services. According to the Institute of Internal Auditors (IIA) Standards, the internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement. This "assisting" role is fulfilled through evaluation, advice, and recommendations, which helps management fulfill its responsibility for controls without the internal audit activity assuming management's duties. This maintains the crucial elements of independence and objectivity required for the internal audit function.

A. "Ensuring" that risks are managed is a direct responsibility of management, not internal audit. Internal audit provides assurance on the effectiveness of management's risk management processes.
C. "Implementing" new controls is a management function. If internal audit implements controls, it cannot objectively audit them later, which would be a severe impairment of its independence.
D. Internal audit coordinates with external auditors but does not "validate" their work. Each has distinct responsibilities and reports to different stakeholders, although they may rely on each other's work to improve efficiency.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 2130 – Control.

The standard explicitly states: "The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement." This directly supports option B.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Definition of Internal Auditing.

The definition states internal auditing is an "independent, objective assurance and consulting activity... It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes." This supports the "assisting" and "improving" role, while the "independent, objective" nature precludes management functions like "ensuring" (A) and "implementing" (C).

3. Pickett, K. H. S. (2019). The Internal Auditing Handbook (4th ed.). Wiley. Chapter 2, The Internal Audit Role.

This academic text clarifies that "Internal audit is not responsible for implementing its recommendations... Management is responsible for deciding what action to take in response to reported audit findings." (paraphrased from discussion on audit roles). This directly refutes option C.

4. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 1100 – Independence and Objectivity.

This standard emphasizes that the internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results. Taking on management responsibilities such as implementing or ensuring controls would directly violate this standard.

According to the IIA's International Standards for the Professional Practice of Internal Auditing, the chief audit executive (CAE) is responsible for ensuring the internal audit activity is competent. Competence refers to the knowledge, skills, and other abilities required. This collective competence directly determines if the internal audit staff has the necessary proficiency—the ability to apply those competencies—to perform specific engagements. The CAE must assess the staff's competence to determine if they possess the required proficiency for the planned audit work. If a gap exists, the CAE must provide training or obtain competent external resources.

A. The cost-benefit relationship of planned audits is influenced by many factors, including risk and potential impact. While a competent team may be more efficient, proficiency for the engagement is the more direct and primary consideration derived from competence.
C. Management, not the internal audit activity, is responsible for the achievement of the objectives of internal control. Internal audit provides assurance and advice regarding these controls.
D. The quantity of audits performed is primarily determined by the risk-based audit plan and available resources, not solely by the competence level of the staff. Quality and proficiency are prioritized over quantity.

1. The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), 2017.

Standard 1210 – Proficiency: "Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity must collectively possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities."

Interpretation of Standard 1210: "Proficiency is the ability to apply knowledge, skills, and other competencies to perform an engagement or service." This directly links the possession of competencies to the ability (proficiency) to carry out engagements.

2. The Institute of Internal Auditors (IIA), Implementation Guide 1210: Proficiency, 2017.

Section: "Assessing Competency": "The CAE assesses the knowledge, skills, and other competencies of the internal audit staff, at least annually... This assessment helps the CAE in determining the right mix of staff for specific engagements..." This shows that assessing competence is done to ensure the staff has the proficiency for engagements.

3. Pickett, K. H. Spencer. The Internal Auditing Handbook. 3rd ed., John Wiley & Sons, 2010.

Chapter 4, Section 4.4.2 "Competence": "The CAE must ensure that the internal audit team collectively has the right skills and experience to deliver the audit plan... This involves assessing the skills of the team against the requirements of the audit plan to identify any skills gaps." This academic text confirms that competence is assessed against the requirements of engagements (i.e., to ensure proficiency).

The scenario describes the risk of incorrect acceptance, also known as Type II or beta risk. This is a type of sampling risk where the sample results lead an internal auditor to conclude that a recorded balance is not materially misstated when, in fact, it is. This risk is critical because it impairs the effectiveness of the audit, potentially causing the audit team to fail to identify a significant issue. The auditor incorrectly accepts the population (the inventory account balance) as being fairly stated.

A. incorrect rejection risk: This is the opposite risk (Type I or alpha risk), where a sample leads the auditor to conclude an account is materially misstated when it is not.
C. Tolerable misstatement risk: Tolerable misstatement is the maximum error an auditor is willing to accept in a population. It is a planning concept for materiality, not a type of sampling risk.
D. Anticipated misstatement risk: Also known as expected misstatement, this is the auditor's estimate of error in the population before sampling begins. It is an input for determining sample size, not a sampling risk.

1. The Institute of Internal Auditors (IIA). (2017). Practice Guide: Audit Sampling.

Page 11, Section: "Sampling Risk": "The risk of incorrect acceptance (beta or Type II risk) is the risk that the sample supports the conclusion that the recorded account balance is not materially misstated when it is materially misstated." This directly defines the situation described in the question.

2. Arens, A. A., Elder, R. J., & Beasley, M. S. (2020). Auditing and Assurance Services: An Integrated Approach (17th ed.). Pearson.

Chapter 15, Page 503, "Risks of Incorrect Acceptance and Incorrect Rejection": The text defines the risk of incorrect acceptance (RIA) as "the risk that the sample supports the conclusion that the recorded account balance is not materially misstated when it is materially misstated." It further explains that RIA is a serious concern because it results in audit failure.

3. DeFond, M. (n.d.). Audit Sampling. Courseware from the Leventhal School of Accounting, University of Southern California.

Lecture Notes, Module on Audit Sampling: In discussions of sampling for substantive tests, the risk of incorrect acceptance is defined as the risk of concluding the book value is acceptable when it is materially misstated. This risk is contrasted with the risk of incorrect rejection, which affects audit efficiency rather than effectiveness.

Organizational independence is achieved when the chief audit executive (CAE) reports functionally to the board. According to the IIA's International Standards for the Professional Practice of Internal Auditing, this functional reporting relationship includes the board's approval of the internal audit budget and resource plan. By providing the budget directly to the board for approval, the CAE ensures that the internal audit activity has sufficient resources to execute its responsibilities without undue influence or interference from management. This action is a key safeguard for independence, as it prevents management from limiting the scope or effectiveness of internal audit work by controlling its funding.

A. The CAE seeks senior management approval of the internal audit charter This is incorrect. The charter must be approved by both senior management and the board. Relying solely on management approval would undermine, not demonstrate, independence.
B. The CAE obtains senior management's approval to hire staff This is an administrative, not a functional, reporting matter. While the CAE manages staffing, this day-to-day operational task does not best demonstrate the high-level organizational independence from management.
C. The CAE reports significant issues to the organization's CEO This is insufficient. To maintain independence, the CAE must have direct and unrestricted communication with the board, especially regarding significant issues and risks. Reporting only to the CEO is incomplete.

1. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF). International Standards for the Professional Practice of Internal Auditing (Standards), 2017.

Standard 1110 – Organizational Independence: "The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities."

Implementation Guide 1110: States that functional reporting to the board "typically involves the board: ... Approving the internal audit budget and resource plan." This directly supports option D as a key demonstration of independence. The guide also clarifies that administrative reporting to senior management includes "budgeting and human resources management," which shows why option B is a weaker example of independence.

2. The Institute of Internal Auditors (IIA), Practice Guide. Developing the Internal Audit Strategic Plan, July 2020.

Section: "Obtaining Approval of the Plan and Resources" (Page 11): "The CAE should present the internal audit strategic plan and related resource requirements to senior management and the board for review and approval... The board’s approval of the plan and the resources needed to execute it is a key element of the board’s oversight responsibilities and a safeguard of internal audit’s independence." This reinforces that board approval of resources (budget) is a critical aspect of independence.

3. Soh, D. S., & Martinov-Bennie, N. (2011). The internal audit function: Perceptions of internal audit roles, effectiveness and evaluation. Managerial Auditing Journal, 26(7), 605-622. https://doi.org/10.1108/02686901111153303

This academic article discusses the factors contributing to internal audit effectiveness, highlighting that a direct reporting line to the audit committee (a committee of the board) for matters including budget approval is crucial for ensuring independence from management. This aligns with the IIA guidance and supports the choice of option D.

The situation described involves an auditor being assigned to audit a department where they were recently employed. This creates an impairment of individual objectivity. According to The Institute of Internal Auditors (IIA) Standards, objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which they had responsibility within the previous year. When such an impairment impacts a specific engagement, the Standards mandate that the nonconformance, the reasons for it, and its impact on the engagement must be disclosed in the final communication of results (the audit report).

A. An external quality assessment performed once every five years is in full conformance with IIA Standard 1312, which requires such assessments "at least once every five years."
B. While positive assurance is generally preferred, the use of negative assurance is not an explicit nonconformance with the Standards that would require disclosure in the report.
C. The internal audit plan can and should include consulting engagements based on opportunities to add value, not just risks, as permitted by IIA Standard 2010.C1.

1. The Institute of Internal Auditors. (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1130.A1: "Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year."

Standard 2431 – Disclosure of Nonconformance: "When nonconformance with the Code of Ethics or the Standards impacts a specific engagement, communication of the results must disclose the: Principle or rule of conduct of the Code of Ethics or Standard(s) with which full conformance was not achieved; Reason(s) for nonconformance; and Impact of nonconformance on the engagement and the communicated engagement results."

2. The Institute of Internal Auditors. (2017). Implementation Guidance: Standard 1130: Impairment to Independence or Objectivity. This guide clarifies that if an auditor is assigned to an area of previous responsibility, "the impairment must be disclosed to the engagement client and in the engagement report."

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., Salamasick, M., & Sobel, P. J. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. Chapter 3, "Standard 1130: Impairment to Independence or Objectivity," discusses that assigning auditors to areas where they recently worked is a common example of an objectivity impairment that must be disclosed.