Free IIA-CRMA Practice Test

This approach is the most comprehensive and compliant with professional standards. It addresses the immediate competency gap for the high-risk financial derivatives audit by engaging an external expert, thereby ensuring the engagement is conducted with the required proficiency as mandated by IIA Standard 1210.A1. Simultaneously, it addresses the long-term development of the internal audit staff through supplementary training. This dual strategy represents effective resource management by solving the current problem while building internal capabilities for the future, ensuring the internal audit activity can fulfill its responsibilities effectively.

A. Outsourcing without informing the audit committee is inappropriate. The CAE has a responsibility to communicate significant issues, including resource limitations and sourcing decisions, to senior management and the board/audit committee.
B. Delaying a critical audit significantly is not a prudent course of action, as it leaves a potentially high-risk area unexamined. The immediate need for assurance is not met by a long-term training plan alone.
C. Assigning auditors who are known to lack the requisite skills violates the fundamental IIA Standard 1210 on Proficiency. The "most competent" among an unqualified team is still not competent for the specific engagement.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1210: Proficiency: "The internal audit activity must collectively possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities."

Standard 1210.A1: "The chief audit executive must obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement." This standard directly supports the action of employing an expert consultant.

Standard 2060: Reporting to Senior Management and the Board: This standard requires the CAE to report on resource limitations, which contradicts the approach in option A.

2. The Institute of Internal Auditors (IIA). (2017). Practice Guide: Sourcing the Internal Audit Function.

Section: Co-sourcing, Page 10: The guide explains that co-sourcing is a common strategy to "fill gaps in skill sets" for specialized areas. It states, "Co-sourcing is often used to address skill gaps in specialized or technical areas (e.g., derivatives, treasury, and certain IT areas)." This directly validates using an expert for a financial derivatives audit.

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation.

Chapter 17, "Managing the Internal Audit Activity," Page 17-11: The text discusses staffing and resource management, stating, "When the internal audit function lacks specific expertise for a particular engagement, it may be necessary to use external resources... This is a common practice for audits of highly technical areas such as derivatives..." This academic source confirms that engaging experts for specialized audits is a best practice.

The primary purpose of reporting initial test results to the auditor-in-charge is to facilitate proper engagement supervision. The supervisor is responsible for ensuring that the audit work is performed correctly, the evidence gathered is sufficient and appropriate, and the conclusions drawn are logical and well-supported. This internal review process is a critical quality control step that validates the staff auditor's work and ensures that any judgments and conclusions communicated to management are professionally sound and accurate.

A. Gaining client agreement is a desired outcome, but the primary reason for supervisory review is to first ensure the internal quality and validity of the findings.
B. The chain of evidence is maintained through proper workpaper documentation practices, which is distinct from the supervisory review of conclusions.
D. While this review is evidence of supervision, the fundamental reason for the review is to ensure quality and appropriate judgment (Option C), not just to check a box.

1. The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), January 2017.

Standard 2340 – Engagement Supervision: "Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed." This standard directly links supervision to assuring quality, which encompasses the professional judgments and conclusions mentioned in option C.

2. The Institute of Internal Auditors (IIA), Implementation Guide for Standard 2340: Engagement Supervision, July 2020.

Paragraph on "Elements of Supervision": The guide states that supervision includes "reviewing the work performed to ensure it adequately supports the engagement observations, conclusions, and recommendations." This directly supports the idea that the supervisor's review is essential for validating the conclusions before they are finalized or shared.

3. Sawyer, L. B., Dittenhofer, M. A., & Scheiner, J. H. (2003). Sawyer's Internal Auditing: The Practice of Modern Internal Auditing (5th ed.). The Institute of Internal Auditors Research Foundation.

Chapter 19, "Supervising the Audit Assignment": This chapter details the supervisor's role in reviewing workpapers to "determine that the conclusions are sound and are supported by the audit evidence." This aligns with ensuring appropriate professional judgments and conclusions are made.

According to the Institute of Internal Auditors (IIA) guidance, ongoing internal assessments are integrated into the day-to-day management and supervision of the internal audit activity. These assessments involve continuous monitoring of performance. The analysis of performance metrics, such as audit engagement cycle times, audit plan completion rates, and adherence to budgets, is a primary tool for this ongoing monitoring. This allows the chief audit executive (CAE) to evaluate the efficiency and effectiveness of the internal audit activity in real-time and make timely adjustments.

A. Benchmarking is a comparative tool more commonly associated with periodic assessments, which are conducted less frequently to provide a broader evaluation against best practices.
B. A report of results and response plans is an output of the assessment process, not a process or tool used to conduct the ongoing assessment itself.
D. Formal self-assessments and stakeholder surveys are characteristic components of periodic assessments, which provide a more holistic, point-in-time review of conformance with the Standards.

1. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF), Standard 1311: Internal Assessments. This standard mandates that internal assessments must include both "Ongoing monitoring of the performance of the internal audit activity" and "Periodic self-assessments." This establishes the fundamental distinction between the two types of assessments.

2. The Institute of Internal Auditors (IIA), Implementation Guide 1311: Internal Assessments, January 2017. In the section "Ongoing Monitoring," the guide states, "Tools and practices that support ongoing monitoring may include... Key performance indicators to monitor the performance of the internal audit activity (e.g., audit plan completion, time budgets, recommendations accepted, and client satisfaction)." Analysis of cycle times is a key performance indicator.

3. The Institute of Internal Auditors (IIA), Practice Guide: Quality Assurance and Improvement Program, December 2020. Page 13 discusses ongoing monitoring, listing examples of metrics such as "cycle time from the start of planning to issuance of the final engagement communication" and "actual engagement hours versus budgeted hours." This directly supports option C as a tool for ongoing assessment. The guide explicitly associates benchmarking (Option A) and stakeholder surveys (Option D) with periodic assessments (Page 15).

The Institute of Internal Auditors (IIA) Global Internal Audit Competency Framework identifies 10 core competencies essential for internal auditors. These include "Governance, risk, and control," "Business acumen," and "Internal audit delivery." "Performance management," which typically refers to the human resources process of managing employee performance, is not one of the 10 specified core competencies for the internal audit profession as defined by the IIA. While the internal audit function must manage its own performance through a quality assurance and improvement program (QAIP), "performance management" as a general discipline is not a distinct competency within this framework.

A. Governance, risk, and control is a foundational competency, representing the core subject matter expertise of internal auditors.
C. Business acumen is a critical competency, enabling auditors to understand the organization's objectives, environment, and industry to provide relevant assurance and advice.
D. Internal audit delivery is a core competency that encompasses the entire audit process, from planning and fieldwork to communication of results.

1. The Institute of Internal Auditors. (2013). The IIA's Global Internal Audit Competency Framework. Page 6, "The 10 Competencies". The official document lists the 10 competencies, which include Governance, Risk, and Control; Business Acumen; and Internal Audit Delivery, but does not include Performance Management.

2. Coetzee, P., & Lubbe, D. (2014). The risk management competence of internal auditors. International Journal of Auditing, 18(2), 125-137. This academic article discusses the IIA Competency Framework, referencing its key components like governance, risk, control, and business acumen as essential for internal auditors (Section 2.1, Literature Review). https://doi.org/10.1111/ijau.12022

3. DePaul University. (2020). Course Syllabus ACC 642: Internal Auditing. This university courseware references the IIA Competency Framework as a foundational element for the profession, covering topics like GRC, business acumen, and audit delivery as key learning objectives aligned with professional standards.

The core issue is the internal auditor's objectivity regarding the specific audit engagement. According to the IIA's International Standards for the Professional Practice of Internal Auditing, objectivity is presumed to be impaired if an auditor provides assurance services for an activity for which they had responsibility within the previous year. In this scenario, the auditor's previous responsibility was in the Financial Services Department. The audit is of the payroll function, which is managed by the Human Resources Department. Since she had no prior responsibility for the area being audited, her objectivity is not presumed to be impaired, and she may participate in the audit.

A. The one-year restriction applies only when auditing specific operations for which the auditor was previously responsible. This restriction is not relevant here as she is auditing a different department.
C. While supervision by an auditor-in-charge is standard practice for any audit team member, especially a trainee, it is not the primary reason she is permitted to participate from an objectivity standpoint.
D. The fact that the assignment serves as a training opportunity is the purpose of her participation, not the justification for her independence and objectivity, which is the central issue of the question.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1130.A1: "Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year." This standard directly supports that the impairment rule is tied to previous responsibility, which does not exist in this scenario.

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 1130: Impairment to Independence or Objectivity.

Paragraph on "Assessing Operations for Which Internal Auditors Were Previously Responsible": This guide clarifies that the one-year cooling-off period is a critical safeguard against self-review. As the auditor is not reviewing her own prior work or the work of her former department (Financial Services), this safeguard is not triggered for an audit of the Human Resources Department.

3. Moeller, R. R. (2016). Brink's Modern Internal Auditing (8th ed.). John Wiley & Sons.

Chapter 4, Section on "Internal Auditor Objectivity": This academic text discusses that objectivity threats often arise from prior roles, economic interests, or personal relationships related to the audited entity. The scenario does not present such a threat, as the auditor's prior role was in a separate functional area from the one being audited.

A manager who regularly assumes the duties of their subordinates is a significant behavioral red flag for fraud. This action directly undermines the fundamental internal control principle of segregation of duties. By performing tasks that should be separated (e.g., authorization, custody of assets, and record-keeping), the manager creates an opportunity to both perpetrate and conceal fraudulent acts. This circumvention of controls is a classic method for management to override the established control system, making it the most likely indicator of fraud among the options provided.

A. Paying commissions on verified sales is a strong internal control designed to prevent fraud, not an indicator that it is occurring.
B. Consistently untimely reports are more commonly an indicator of operational inefficiency or inadequate resources rather than a direct sign of fraud.
D. A company's earnings falling in line with a broader industry downturn is a normal and expected economic event, not a fraud symptom.

1. COSO. (2013). Internal Control—Integrated Framework: Principles. Principle 10: "The organization selects and develops control activities that contribute to the mitigation of risks... Control activities include... Segregation of Duties." A manager assuming subordinate duties directly violates this principle, creating a significant control weakness and fraud opportunity.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2120.A2 requires internal audit to evaluate fraud potential and risk management. The associated Implementation Guide discusses fraud red flags, which include management override of controls and behavioral signs like a manager who insists on performing tasks that should be delegated.

3. Albrecht, W. S., Albrecht, C. O., Albrecht, C. C., & Zimbelman, M. F. (2019). Fraud Examination (6th ed.). In the chapter on "Recognizing the Symptoms of Fraud," the text identifies internal control weaknesses as a primary category of fraud symptoms. A key example provided is the lack of segregation of duties, which is precisely what occurs when a manager performs their subordinates' tasks. This behavior is listed as a classic red flag.

The "new paradigm" of the COSO Enterprise Risk Management (ERM) framework, as detailed in the 2017 "Integrating with Strategy and Performance" update, emphasizes the integration of risk management into the organization's most critical strategic decisions. Aligning risk appetite with strategy (B), enhancing risk response decisions (C), and reducing operational surprises to improve performance (D) are all core tenets of this modern, value-driven approach. In contrast, assessing risk factors (A) is a fundamental and timeless activity of any risk management process, including older, more compliance-focused models. While essential, the assessment of risks itself is not what defines the new paradigm; rather, the new paradigm is defined by how that assessment is integrated with strategy and performance.

B. Aligning risk appetite and strategy: This is a central theme of the COSO 2017 framework, which explicitly connects ERM to the strategy-setting process to create and preserve value.
C. Enhancing risk response decisions: A key goal of modern ERM is to use risk information to make better business decisions, thereby optimizing performance and the achievement of objectives.
D. Reducing operational surprises and losses: This is a primary benefit of effective ERM, contributing to performance stability and the preservation of value, which are key focuses of the new framework. ---

1. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance.

Page 1 (Executive Summary): The document states, "This publication addresses the evolution of enterprise risk management and the need for organizations to improve their approach to managing risk... It is the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value." This directly supports that options B, C, and D are key aspects of the new paradigm, while A is a foundational practice that the new paradigm builds upon.

2. Fraser, J. R., & Simkins, B. J. (2016). The challenges of and solutions for implementing enterprise risk management. Business Horizons, 59(6), 689-698. https://doi.org/10.1016/j.bushor.2016.06.007

Page 690, Section 2 ("The evolution of ERM"): The authors distinguish traditional risk management (TRM) from modern ERM, noting that ERM is "a strategic discipline that is forward-looking and integrated across the organization." This highlights the strategic nature of the "new paradigm" (Options B, C, D) compared to the more fundamental, process-oriented task of simply assessing risks (Option A), which was also part of TRM.

3. Beasley, M. S., Clune, R., & Hermanson, D. R. (2005). Enterprise risk management: An empirical analysis of factors associated with the extent of implementation. Journal of Accounting and Public Policy, 24(6), 521-531. https://doi.org/10.1016/j.jaccpubpol.2005.10.001

Page 522: This early paper on ERM adoption defines ERM as a process to "manage risks within its risk appetite." This concept of aligning risk appetite with strategy (Option B) is presented as a defining characteristic of the shift towards a more holistic ERM approach, distinguishing it from prior, less integrated risk management activities.

The internal audit charter is the formal document that defines the internal audit activity's (IAA) purpose, authority, and responsibility. It is approved by senior management and the board. The annual audit plan, which is derived from a risk assessment, is also approved by senior management and the board and specifies the engagements to be performed. When an engagement client disputes the scope, the most appropriate initial response is to refer them to these governing documents. This action clarifies that the scope is not arbitrary but is based on the IAA's formal mandate and an approved, risk-based plan, thereby reinforcing the IAA's authority and objectivity.

A. Terminating the engagement is an extreme reaction that abdicates the IAA's responsibility and fails to address the underlying dispute about its authority.
B. Allowing the client to dictate or negotiate the scope compromises the IAA's independence and the integrity of the risk-based audit plan.
D. Escalating to senior management or the board is a secondary step, to be taken only if the dispute cannot be resolved by referencing the charter and audit plan.

1. The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), 2017.

Standard 1000: Purpose, Authority, and Responsibility: "The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter... The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval." This standard establishes the charter as the foundational document defining the IAA's scope and authority.

Standard 2010: Planning: "The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals." The interpretation adds that this plan is submitted "to senior management and the board for review and approval." This confirms the audit plan is an approved document outlining specific engagement areas.

2. The Institute of Internal Auditors (IIA), Implementation Guide 1000: Purpose, Authority, and Responsibility, 2017.

Section: "Communicating the Charter": The guide states, "The charter also serves as a formal agreement or 'contract' with management and the board... The CAE should discuss the internal audit charter and the responsibilities of the internal audit activity with senior management and the board." This supports using the charter as the basis for discussion and clarification with stakeholders, including engagement clients.

The primary purpose of an account lockout mechanism is to prevent an undesirable event—specifically, unauthorized access—from occurring. After detecting a pattern of behavior that suggests a potential brute-force attack (three failed attempts), the system takes a proactive step to block any further attempts. This action of stopping a potential threat before it can succeed is the defining characteristic of a preventive control. While it is triggered by a detective element (counting failed logins), its ultimate function is to avert a security breach.

A. Corrective control. This is incorrect because a corrective control is enacted after an undesirable event has occurred to fix the damage. The account lockout happens before a breach to prevent it.
C. Detective control. This is incorrect because the control's main function is not simply to identify and report that failed attempts occurred. Its primary purpose is to act on that information to prevent access.
D. Compensating control. This is incorrect because the scenario does not describe this control as a backup or alternative for another weak or missing control; it is a primary security feature.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Framework and Appendices.

Reference: Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives.

Content: The framework discusses control activities that can be preventive or detective. Logical access controls, such as automated account lockouts, are classic examples of general controls over technology designed to prevent unauthorized access to information systems, thereby mitigating security risks before they are realized.

2. The Institute of Internal Auditors (IIA). (2017). Sawyer's Guide for Internal Auditors, 7th Edition.

Reference: Chapter 13, "Information Technology Auditing," Section on Application Controls.

Content: This guide explains that preventive controls are designed to stop errors or irregularities from happening. Controls over logical access, including password policies and system responses to failed login attempts like account lockouts, are categorized as preventive because they are intended to stop unauthorized individuals from gaining access to systems and data.

3. University of California, Office of Ethics, Compliance and Audit Services. Internal Controls - Basics.

Reference: Section on "Types of Internal Controls."

Content: University guidance on internal controls defines preventive controls as those that "keep errors and irregularities from happening in the first place." An account lockout is a direct application of this principle, designed to proactively secure a digital asset (the user account) from unauthorized use.

A risk and control matrix (RCM) is a tool that systematically documents and analyzes the relationship between business objectives, risks, and control activities. It embodies the analytical process by requiring the auditor to identify specific risks and then map the corresponding controls designed to mitigate them. This structured format facilitates a direct evaluation of control design adequacy against identified risks, making it a core analytical tool in auditing. The matrix itself represents the output of the analytical process of linking risks to controls.

B. A flowchart is a visual representation of a process; it documents the flow but does not inherently contain the structured analytical risk-to-control linkage of an RCM.
C. A walk-through is a test procedure used to confirm the auditor's understanding of a process and its controls, not a documentation tool that embodies the analytical process itself.
D. A process narrative is a written description of a process. Like a flowchart, it serves as documentation rather than a structured analytical tool for evaluating control design against risks.

1. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. In Chapter 7, "Performing the Engagement," the text describes the risk and control matrix as a tool that "provides a clear and concise way to document the linkage between risks and controls," which is fundamental to the analytical evaluation of control design.

2. The Institute of Internal Auditors (IIA). (2017). International Professional Practices Framework (IPPF). Standard 2210.A1 requires auditors to "identify and assess the risks relevant to the area under review." The RCM is a primary tool used to document this analytical assessment, linking identified risks to specific controls and evaluating their design.

3. Pickett, K. H. S. (2019). The Internal Auditing Handbook (4th ed.). Wiley. Chapter 15, "Documenting, Evaluating and Testing Internal Controls," explains that the RCM is used to "evaluate the design of the controls" by linking them to risks and control objectives, which is a fundamental analytical step in the audit process.