IIA CIA 1 – MIXED.FINAL EXAM TEST 2026\2027.
When internal auditors possess the knowledge, skills, and other competencies needed to perform
their individual responsibilities.
What is "proficiency" as defined in The IIA's International Professional Practices Framework
Anonymity does not disclose the caller's identity, while confidentiality discloses it securely.
What is the distinction between hotline anonymity and confidentiality?
Turnbull guidance
Feedback process to learn from mistakes and to harness potential improvements and risk
reductions.
An organization creates an initiative involving all employees to develop a thorough enterprise risk
management (ERM) process that focuses on significant risks and promotes proactively managing risk
exposures. It builds early warning mechanisms into existing management information systems. Employees
are given specific responsibilities to monitor for the identified risks in their purview. A year later, the
system is continuing to function as it was built. According to the Turnbull guidance, what might be missing
from this ERM system?
Protecting organizational value
Which of the following is part of the Mission of Internal Audit?
Reliability of financial reporting
The Institute of Chartered Accountants in England and Wales (ICAEW) generated the Cadbury framework,
which was concerned with reporting on controls related to which of the following?
Cadbury framework
Risk and control information is communicated.
The internal audit activity should contribute to the organization's governance by evaluating the processes
through which:
Explain to the audit client how the area being reviewed relates to the original audit contained in
the announcement letter.
A chief audit executive (CAE) receives a call from an audit client complaining that the audit team is
deviating from the audit announcement letter by going into areas that are not within the scope of the
audit. What is the best way for CAE to resolve this issue if she believes the internal audit team was doing
the right thing?
Unfettered access to corporate employees, facilities, and records (including those of
contractors).
Which practice supports the mandate of an internal audit function?
Works with management in their areas of responsibility.
, IIA CIA 1 – MIXED.FINAL EXAM TEST 2026\2027.
The chief risk officer is most effective when he or she:
Gather evidence to establish either cause for fraud investigation or a lack of cause.
During a regularly scheduled audit of a billing area, an internal auditor is told by an employee that a new
manager frequently takes the place of workers who are absent or on break. The predecessor never did
this. What should the auditor do next?
Independence
A written charter that outlines the internal audit department's purpose, authority, and responsibility and
is approved by the audit committee or board of directors is primarily meant to enhance the department's:
Audit by element
What method of auditing corporate social responsibility (CSR) is the chief audit executive (CAE) for a
large transportation company pursuing if she has instructed the audit staff to consider reviewing the
relevant portions of CSR as part of every audit that they perform?
Audit committees may be composed of independent directors. However, those directors may have
close personal and professional friendships with management.
Audit committees have been identified as a major factor in promoting the independence of both internal
and external auditors. Which of the following is the most important limitation on the effectiveness of audit
committees?
Watch the behavior of others to determine what works and what does not.
The best way a new internal auditor can learn about the company's corporate culture would be to:
Implement an effective environmental compliance program, which includes systems for
monitoring, auditing, and reporting on activities and results in this compliance area. Operating
contracts typically do not require a separate project manager.
A company with older facilities is taking on asbestos abatement in their buildings to safeguard their
employees. The operating department and procurement work closely together to ensure it hires a
competent asbestos abatement firm. This is an operating contract. A project manager has not been
assigned to oversee the firm's activities. What would be the best step the company could do to improve
the controls over this area?
Audit committee
Who is responsible for overseeing the evaluation of information security (data protection) and control?
Review of all purchase requisitions by a supervisor in the user department prior to submitting
them to the purchasing department
Which control would prevent the ordering of quantities in excess of an organization's needs?
Numerical analysis
An internal auditor uses Benford's Law analysis to search for potential fraud. This probability principle is
the cornerstone of:
When internal auditors possess the knowledge, skills, and other competencies needed to perform
their individual responsibilities.
What is "proficiency" as defined in The IIA's International Professional Practices Framework
Anonymity does not disclose the caller's identity, while confidentiality discloses it securely.
What is the distinction between hotline anonymity and confidentiality?
Turnbull guidance
Feedback process to learn from mistakes and to harness potential improvements and risk
reductions.
An organization creates an initiative involving all employees to develop a thorough enterprise risk
management (ERM) process that focuses on significant risks and promotes proactively managing risk
exposures. It builds early warning mechanisms into existing management information systems. Employees
are given specific responsibilities to monitor for the identified risks in their purview. A year later, the
system is continuing to function as it was built. According to the Turnbull guidance, what might be missing
from this ERM system?
Protecting organizational value
Which of the following is part of the Mission of Internal Audit?
Reliability of financial reporting
The Institute of Chartered Accountants in England and Wales (ICAEW) generated the Cadbury framework,
which was concerned with reporting on controls related to which of the following?
Cadbury framework
Risk and control information is communicated.
The internal audit activity should contribute to the organization's governance by evaluating the processes
through which:
Explain to the audit client how the area being reviewed relates to the original audit contained in
the announcement letter.
A chief audit executive (CAE) receives a call from an audit client complaining that the audit team is
deviating from the audit announcement letter by going into areas that are not within the scope of the
audit. What is the best way for CAE to resolve this issue if she believes the internal audit team was doing
the right thing?
Unfettered access to corporate employees, facilities, and records (including those of
contractors).
Which practice supports the mandate of an internal audit function?
Works with management in their areas of responsibility.
, IIA CIA 1 – MIXED.FINAL EXAM TEST 2026\2027.
The chief risk officer is most effective when he or she:
Gather evidence to establish either cause for fraud investigation or a lack of cause.
During a regularly scheduled audit of a billing area, an internal auditor is told by an employee that a new
manager frequently takes the place of workers who are absent or on break. The predecessor never did
this. What should the auditor do next?
Independence
A written charter that outlines the internal audit department's purpose, authority, and responsibility and
is approved by the audit committee or board of directors is primarily meant to enhance the department's:
Audit by element
What method of auditing corporate social responsibility (CSR) is the chief audit executive (CAE) for a
large transportation company pursuing if she has instructed the audit staff to consider reviewing the
relevant portions of CSR as part of every audit that they perform?
Audit committees may be composed of independent directors. However, those directors may have
close personal and professional friendships with management.
Audit committees have been identified as a major factor in promoting the independence of both internal
and external auditors. Which of the following is the most important limitation on the effectiveness of audit
committees?
Watch the behavior of others to determine what works and what does not.
The best way a new internal auditor can learn about the company's corporate culture would be to:
Implement an effective environmental compliance program, which includes systems for
monitoring, auditing, and reporting on activities and results in this compliance area. Operating
contracts typically do not require a separate project manager.
A company with older facilities is taking on asbestos abatement in their buildings to safeguard their
employees. The operating department and procurement work closely together to ensure it hires a
competent asbestos abatement firm. This is an operating contract. A project manager has not been
assigned to oversee the firm's activities. What would be the best step the company could do to improve
the controls over this area?
Audit committee
Who is responsible for overseeing the evaluation of information security (data protection) and control?
Review of all purchase requisitions by a supervisor in the user department prior to submitting
them to the purchasing department
Which control would prevent the ordering of quantities in excess of an organization's needs?
Numerical analysis
An internal auditor uses Benford's Law analysis to search for potential fraud. This probability principle is
the cornerstone of:
