CIA EXAM PART 1 SUB-UNIT 6.FINAL TEST 2026\2027.
The likelihood of achieving control objectives is affected by which limitation inherent to internal
control?
A. The internal auditor's primary responsibility is the detection of fraud.
B. Management monitors internal control.
C. The cost of internal control should not exceed its benefits.
D. Management assesses controls.
Answer (C) is correct.
The cost of an entity's internal control should not exceed the benefits that are expected to be derived.
Although the cost-benefit relationship is a primary criterion that should be considered in designing
internal control, the precise measurement of costs and benefits usually is not possible.
Which of the following statements is correct regarding corporate compensation systems and
related bonuses?
A bonus system should be considered part of the control environment of an organization and
should be considered in formulating a report on internal control.
Compensation systems are not part of an organization's control system and should not be
reported as such.
An audit of an organization's compensation system should be performed independently of an audit
of the control system over other functions that impact corporate bonuses.
A.2 and 3 only.
B.3 only.
C.1 only.
D.2 only.
Answer (C) is correct.The control environment includes, among other things, the element of human
resource policies and practices. Thus, hiring, orientation, training, evaluation, counseling, promotion,
compensation, and remedial actions must be considered by management.
When a copy of the sale invoice is not received by an organization's shipping department, an
employee requests the document from the proper authority. This process is a(n)
A. Detective, preventive control.
,CIA EXAM PART 1 SUB-UNIT 6.FINAL TEST 2026\2027.
B. Active, detective control.
C. Passive, mitigating control.
D. Directive, detective control.
Answer (B) is correct.
When shipping documents are not received in the shipping department (such as copies of the sales
invoice, customer order form, and bill of lading), the clerk should attempt to obtain the proper
documentation from the originating organization. This type of control is detective because it detects and
attempts to correct an undesirable event that has occurred. It is also active because it takes a conscious
intervention by the clerk to ensure the documentation is received.
According to COSO, the use of ongoing and separate evaluations to identify and address changes
in internal control effectiveness can best be accomplished in which of the following stages of the
monitoring-for-change continuum?
A. Change identification.
B. Control revalidation/update.
C. Control baseline.
D. Change management.
Answer (A) is correct.
Of the four steps in the monitoring-for-change continuum described in the 2009 COSO document
Guidance on Monitoring Internal Control Systems, change identification is the one in which separate and
ongoing evaluations can best be accomplished.
Which of the following represents an example of an inherent limitation of internal controls?
A. Bank reconciliations are not performed on a timely basis.
B. The CEO can override a control and request a check with no purchase order.
C. Customer credit checks are not performed.
D. Shipping documents are not matched to sales invoices.
Answer (B) is correct.
Inherent limitations may exist and should be considered by the auditor. Human judgment can be faulty,
controls can be circumvented by collusion, and management may inappropriately override controls. Thus,
the CEO's requesting a check with no purchase order is possible because of an inherent limitation. It is an
override of the internal control by management.
, CIA EXAM PART 1 SUB-UNIT 6.FINAL TEST 2026\2027.
Controls may be classified according to the function they are intended to perform, for example,
as detective, preventive, or directive. Which of the following is a directive control?
A. Monthly bank statement reconciliations.
B. Recording every transaction on the day it occurs.
C. Dual signatures on all disbursements over a specific amount.
D. Requiring all members of the internal audit activity to be CIAs.
Answer (D) is correct.
Requiring all members of the internal audit activity to be CIAs is a directive control. The control is
designed to cause or encourage a desirable event to occur. The requirement enhances the
professionalism and level of expertise of the internal audit activity.
Management has a role in the maintenance of control. In fact, management sometimes is a
control. Which of the following most likely involves managerial functions as a control?
A. Monitoring performance.
B. Establishment of an internal audit activity.
C. Board approval of the charter of the internal audit activity.
D. Maintenance of a quality assurance program.
Answer (A) is correct.
Monitoring is a component of the internal control. It is a process that assesses the quality of the system's
performance over time. It consists of ongoing activities built into normal operations to ensure that they
continue to be performed effectively. Supervision and other ordinary management functions,
consideration of communications with external parties, and the actions of internal and external auditors
are examples.
When ERM is effective regarding all of the objectives, the board and management have reasonable
assurance that
Reporting is reliable
Compliance is achieved
The extent of achievement of strategic and operations objectives is known
A. 1 and 3 only.
B. 1 and 2 only.
C. 2 and 3 only.
D. 1, 2, and 3.
Answer (D) is correct.
When ERM is effective regarding all of the objectives, the board and management have reasonable
The likelihood of achieving control objectives is affected by which limitation inherent to internal
control?
A. The internal auditor's primary responsibility is the detection of fraud.
B. Management monitors internal control.
C. The cost of internal control should not exceed its benefits.
D. Management assesses controls.
Answer (C) is correct.
The cost of an entity's internal control should not exceed the benefits that are expected to be derived.
Although the cost-benefit relationship is a primary criterion that should be considered in designing
internal control, the precise measurement of costs and benefits usually is not possible.
Which of the following statements is correct regarding corporate compensation systems and
related bonuses?
A bonus system should be considered part of the control environment of an organization and
should be considered in formulating a report on internal control.
Compensation systems are not part of an organization's control system and should not be
reported as such.
An audit of an organization's compensation system should be performed independently of an audit
of the control system over other functions that impact corporate bonuses.
A.2 and 3 only.
B.3 only.
C.1 only.
D.2 only.
Answer (C) is correct.The control environment includes, among other things, the element of human
resource policies and practices. Thus, hiring, orientation, training, evaluation, counseling, promotion,
compensation, and remedial actions must be considered by management.
When a copy of the sale invoice is not received by an organization's shipping department, an
employee requests the document from the proper authority. This process is a(n)
A. Detective, preventive control.
,CIA EXAM PART 1 SUB-UNIT 6.FINAL TEST 2026\2027.
B. Active, detective control.
C. Passive, mitigating control.
D. Directive, detective control.
Answer (B) is correct.
When shipping documents are not received in the shipping department (such as copies of the sales
invoice, customer order form, and bill of lading), the clerk should attempt to obtain the proper
documentation from the originating organization. This type of control is detective because it detects and
attempts to correct an undesirable event that has occurred. It is also active because it takes a conscious
intervention by the clerk to ensure the documentation is received.
According to COSO, the use of ongoing and separate evaluations to identify and address changes
in internal control effectiveness can best be accomplished in which of the following stages of the
monitoring-for-change continuum?
A. Change identification.
B. Control revalidation/update.
C. Control baseline.
D. Change management.
Answer (A) is correct.
Of the four steps in the monitoring-for-change continuum described in the 2009 COSO document
Guidance on Monitoring Internal Control Systems, change identification is the one in which separate and
ongoing evaluations can best be accomplished.
Which of the following represents an example of an inherent limitation of internal controls?
A. Bank reconciliations are not performed on a timely basis.
B. The CEO can override a control and request a check with no purchase order.
C. Customer credit checks are not performed.
D. Shipping documents are not matched to sales invoices.
Answer (B) is correct.
Inherent limitations may exist and should be considered by the auditor. Human judgment can be faulty,
controls can be circumvented by collusion, and management may inappropriately override controls. Thus,
the CEO's requesting a check with no purchase order is possible because of an inherent limitation. It is an
override of the internal control by management.
, CIA EXAM PART 1 SUB-UNIT 6.FINAL TEST 2026\2027.
Controls may be classified according to the function they are intended to perform, for example,
as detective, preventive, or directive. Which of the following is a directive control?
A. Monthly bank statement reconciliations.
B. Recording every transaction on the day it occurs.
C. Dual signatures on all disbursements over a specific amount.
D. Requiring all members of the internal audit activity to be CIAs.
Answer (D) is correct.
Requiring all members of the internal audit activity to be CIAs is a directive control. The control is
designed to cause or encourage a desirable event to occur. The requirement enhances the
professionalism and level of expertise of the internal audit activity.
Management has a role in the maintenance of control. In fact, management sometimes is a
control. Which of the following most likely involves managerial functions as a control?
A. Monitoring performance.
B. Establishment of an internal audit activity.
C. Board approval of the charter of the internal audit activity.
D. Maintenance of a quality assurance program.
Answer (A) is correct.
Monitoring is a component of the internal control. It is a process that assesses the quality of the system's
performance over time. It consists of ongoing activities built into normal operations to ensure that they
continue to be performed effectively. Supervision and other ordinary management functions,
consideration of communications with external parties, and the actions of internal and external auditors
are examples.
When ERM is effective regarding all of the objectives, the board and management have reasonable
assurance that
Reporting is reliable
Compliance is achieved
The extent of achievement of strategic and operations objectives is known
A. 1 and 3 only.
B. 1 and 2 only.
C. 2 and 3 only.
D. 1, 2, and 3.
Answer (D) is correct.
When ERM is effective regarding all of the objectives, the board and management have reasonable
