IIA-CIA-Part1 Practice Questions

A.  

Record that the internal audit activity’s completion of audit assignments has been met.

B.  

Hire qualified and skilled internal auditors for the organization's internal audit activity.

C.  

Postpone audits where the internal team does not have the necessary skills or knowledge.

D.  

Assess the knowledge and skills of the internal audit activity to identify any gaps.

A.  

The chief audit executive reports directly to the board

B.  

Internal auditors may not disclose personal data of the audit client

C.  

Internal auditors may not accept gifts from management of the area under review

D.  

Internal auditors must observe the law and make required disclosures

A.  

The use of judgment enhances management's ability to make better decisions about internal control, but cannot guarantee perfect outcomes.

B.  

Introducing judgment generally diminishes management's ability to make good decisions about internal control.

C.  

It is inappropriate for management to exercise judgement in areas such as specifying and using suitable accounting principles.

D.  

It is inappropriate for management to exercise judgement in assessing whether components are present, functioning, and operating together

A.  

The internal audit charter.

B.  

Examples of internal audit reports.

C.  

The internal audit policy and procedures manual.

D.  

The IIA’s International Professional Practices Framework.

A.  

Regulatory approval from an accrediting agency.

B.  

Self-assessments against a competency framework.

C.  

Approval and signoff from the board of directors.

D.  

A review by external auditors on an annual basis

A.  

Auditors must have an IT specialty in at least one of their organization's key information technology systems.

B.  

Auditors must be proficient in data analysis and computer assisted audit techniques for their organization.

C.  

Auditors must understand their organization's integrated test facilities and generalized audit software.

D.  

Auditors must understand their organization's IT governance, risk, and control processes.

A.  

Percentage of highly significant risks covered by internal audit plan.

B.  

Percentage of previously unknown risks identified per engagement.

C.  

Percentage of internal audit staff skilled in alignment with the organization's structure and key risks.

D.  

Percentage of observations made in assurance engagements compared to advisory engagements.

A.  

The ability to inspire trust

B.  

The ability to communicate effectively

C.  

The ability to display courage

D.  

The ability to understand the needs of stakeholders

A.  

An internal auditor failed to expand the engagement and include managements preferences when determining the scope of an upcoming assurance engagement.

B.  

An internal audit activity lacks the skills need to perform a high-risk security engagement included on the annual audit plan.

C.  

A chief audit executive fated to perform a risk assessment prior to preparing the audit plan

D.  

An internal audit activity has existed for two years and has not undergone external quality assessment

A.  

The nature of consulting services typically is not included in the charter.

B.  

The chief audit executive must formally review the charter at least once a year

C.  

The nature of assurances provided to parties outside of the organization typically is not included in the charter.

D.  

The charter typically defines the internal audit activity's position within the organization.

A.  

Risk avoidance

B.  

Risk reduction

C.  

Risk sharing

D.  

Risk acceptance

A.  

Directive

B.  

Preventive

C.  

Detective

D.  

Automatic

A.  

The organization ensured that the third-party vendor provided the best pricing for the requested services.

B.  

The organization conducted quality control reviews of provided services to ensure industry standards were met.

C.  

The organization performed a due diligence review of all vendors during the bid review process.

D.  

The organization planned to issue a resolution concerning the third-party provider's labor practices.

A.  

Assessing management's acceptance of risk.

B.  

Reviewing a cybersecurity risk report issued by management.

C.  

Developing a list of emerging risks for management.

D.  

Prioritizing risks for management.

A.  

Control activities are defined by management through risk mitigation strategies

B.  

Control activities should be defined for all business processes

C.  

If two organizations have identical objectives and structures their control activities would be the same

D.  

Organizations that are less regulated generally have more complex control activities than highly regulated organizations