IIA CIA PART 3 |ACTUAL QUESTIONS AND
VERIFIED ANSWERS|BRAND NEW 2026-2027
UPDATE|GRADED A+
Question 1
1.Which of the following statements is correct regarding risk analysis?
A. The extent to which management judgments are required in an area could serve as a risk
factor in assisting the auditor in making a comparative risk analysis.
B. The highest risk assessment should always be assigned to the area with the largest
potential loss.
C. The highest risk assessment should always be assigned to the area with the highest
probability of occurrence.
D. Risk analysis must be reduced to quantitative terms in order to provide meaningful
comparisons across an organization.
CORRECT ANSWER
A
Question 2
2. Which of the following statements regarding organizational governance is not correct?
A. An effective internal audit function is one of the four cornerstones of good governance.
B. Those performing governance activities are accountable to the customer.
C. Accountability is one of the key elements of organizational governance.
D. Governance principles and the need for an internal audit function are applicable to
governmental and not-for-profit activities.
CORRECT ANSWER
B
1
,Question 3
3. Which of the following is a role of the board of directors in the governance process?
A. Conduct periodic assessments of the organization's governance systems.
B. Obtain assurance concerning the effectiveness of the organization's governance systems.
C. Implement an effective system of internal controls to support the organization's
governance systems.
D. Review and approve operational goals and objectives.
CORRECT ANSWER
B
Question 4
4. Which is the least effective form of risk management?
A. Systems-based preventive control.
B. People-based preventive control.
C. Systems-based detective control.
D. People-based detective control.
CORRECT ANSWER
D
Question 5
5. Which of the following statements is correct regarding corporate compensation systems
and related bonuses?
1. A bonus system should be considered part of the control environment of an organization
and should be considered in formulating a report on internal control.
2. Compensation systems are not part of an organization's control system and should not be
reported as such.
2
,3. An audit of an organization's compensation system should be performed independently of
an audit of the control system over other functions that impact corporate bonuses.
A. 1 only
B. 2 only
C. 3 only
D. 2 and 3 only
CORRECT ANSWER
A
Question 6
6. The first stage in the development of a crisis management program is to:
A. Formulate contingency plans.
B. Conduct a risk analysis.
C. Create a crisis management team.
D. Practice the response to a crisis.
CORRECT ANSWER
B
Question 7
7. When developing an effective risk-based plan to determine audit priorities, an internal
audit activity should start by:
A. Identifying risks to the organization's operations.
B. Observing and analyzing controls.
C. Prioritizing known risks.
D. Reviewing organizational objectives.
CORRECT ANSWER
3
, D
Question 8
8. The decision to implement enhanced failure detection and back-up systems to improve
data integrity is an example of which risk response?
A. Risk acceptance.
B. Risk sharing.
C. Risk avoidance.
D. Risk reduction.
CORRECT ANSWER
D
Question 9
9. Which of the following activities most significantly increases the risk that a bank will
make poor- quality loans to its customers?
A. Borrowers may not sign all required mortgage loan documentation.
B. Fees paid by the borrower at the time of the loan may not be deposited in a timely
manner.
C. The bank's loan documentation may not meet the government's disclosure requirements.
D. Loan officers may override the lending criteria established by senior management.
CORRECT ANSWER
D
Question 10
10. The main reason to establish internal controls in an organization is to:
4
VERIFIED ANSWERS|BRAND NEW 2026-2027
UPDATE|GRADED A+
Question 1
1.Which of the following statements is correct regarding risk analysis?
A. The extent to which management judgments are required in an area could serve as a risk
factor in assisting the auditor in making a comparative risk analysis.
B. The highest risk assessment should always be assigned to the area with the largest
potential loss.
C. The highest risk assessment should always be assigned to the area with the highest
probability of occurrence.
D. Risk analysis must be reduced to quantitative terms in order to provide meaningful
comparisons across an organization.
CORRECT ANSWER
A
Question 2
2. Which of the following statements regarding organizational governance is not correct?
A. An effective internal audit function is one of the four cornerstones of good governance.
B. Those performing governance activities are accountable to the customer.
C. Accountability is one of the key elements of organizational governance.
D. Governance principles and the need for an internal audit function are applicable to
governmental and not-for-profit activities.
CORRECT ANSWER
B
1
,Question 3
3. Which of the following is a role of the board of directors in the governance process?
A. Conduct periodic assessments of the organization's governance systems.
B. Obtain assurance concerning the effectiveness of the organization's governance systems.
C. Implement an effective system of internal controls to support the organization's
governance systems.
D. Review and approve operational goals and objectives.
CORRECT ANSWER
B
Question 4
4. Which is the least effective form of risk management?
A. Systems-based preventive control.
B. People-based preventive control.
C. Systems-based detective control.
D. People-based detective control.
CORRECT ANSWER
D
Question 5
5. Which of the following statements is correct regarding corporate compensation systems
and related bonuses?
1. A bonus system should be considered part of the control environment of an organization
and should be considered in formulating a report on internal control.
2. Compensation systems are not part of an organization's control system and should not be
reported as such.
2
,3. An audit of an organization's compensation system should be performed independently of
an audit of the control system over other functions that impact corporate bonuses.
A. 1 only
B. 2 only
C. 3 only
D. 2 and 3 only
CORRECT ANSWER
A
Question 6
6. The first stage in the development of a crisis management program is to:
A. Formulate contingency plans.
B. Conduct a risk analysis.
C. Create a crisis management team.
D. Practice the response to a crisis.
CORRECT ANSWER
B
Question 7
7. When developing an effective risk-based plan to determine audit priorities, an internal
audit activity should start by:
A. Identifying risks to the organization's operations.
B. Observing and analyzing controls.
C. Prioritizing known risks.
D. Reviewing organizational objectives.
CORRECT ANSWER
3
, D
Question 8
8. The decision to implement enhanced failure detection and back-up systems to improve
data integrity is an example of which risk response?
A. Risk acceptance.
B. Risk sharing.
C. Risk avoidance.
D. Risk reduction.
CORRECT ANSWER
D
Question 9
9. Which of the following activities most significantly increases the risk that a bank will
make poor- quality loans to its customers?
A. Borrowers may not sign all required mortgage loan documentation.
B. Fees paid by the borrower at the time of the loan may not be deposited in a timely
manner.
C. The bank's loan documentation may not meet the government's disclosure requirements.
D. Loan officers may override the lending criteria established by senior management.
CORRECT ANSWER
D
Question 10
10. The main reason to establish internal controls in an organization is to:
4
