CIA CHALLENGE EXAM.FINAL TEST 2026\2027.
IIA mandatory guidance
Code of Ethics and Standards
Core principles of IA (10)
1. Integrity
2. Competence and professional care
3. Objective and independent (free from undue influence)
4. Aligns with strategies, objectives and risks of org.
5. Appropriately positioned and adequately resourced
6. Quality and continuous improvement
7. Communicates effectively
8. Risk-based assurance
9. Insightful, proactive and future-focused
10. Promotes org. improvement
Mission of IA
To enhance and protect organizational value by providing risk-based and objective assurance, advice, and
insight.
IIA Code of Ethics
1. Integrity
2. Objectivity
3. Confidentiality
4. Competence
Mandatory elements of IA charter (must be defined)
1. Purpose, authority and responsibility
2. Nature of assurance and consulting services
3. Mandatory nature of Core Principles, Code of Ethics, Standards and Definition
Attribute standards address...
Characteristics of internal audit activity
Interpretation of independence (attribute standard)
freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit
responsibilities in an unbiased manner.
Interpretation of objectivity (attribute standard)
unbiased mental attitude that allows internal auditors to perform engagements in such a manner that
they believe in their work product and that no quality compromises are made
, CIA CHALLENGE EXAM.FINAL TEST 2026\2027.
Examples of impairment to independence or objectivity (4 examples)
Conflict of interest, scope limitation, restrictions to access to records, personnel and properties, and
resource limitations (i.e. funding)
Objectivity is presumed impaired if IA had responsibilities for activity within ___________
the previous year
Proficiency refers to
knowledge, skills and competencies
Proficiency in relation to fraud (IIA Standard 1210.A2)
Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it
is managed by the organization, but are not expected to have the expertise of a person whose primary
responsibility is detecting and investigating fraud.
Proficiency in relation to IT risks (IIA Standard 1210.A3)
Internal auditors must have sufficient knowledge of key information technology risks and controls and
available technology-based audit techniques to perform their assigned work. However, not all internal
auditors are expected to have the expertise of an internal auditor whose primary responsibility is
information technology auditing.
IIA Definition of Due professional care
Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal
auditor. Due professional care does not imply infallibility.
1220.A1- For assurance engagements, Internal auditors must exercise due professional care by
considering the:
- Extent of work needed to achieve engagement objectives
- Relative complexity, materiality, or significance of matters for assurance procedures
- Adequacy and effectiveness of governance, risk management and controls
- Probability of significant errors, fraud or noncompliance
- cost of assurance in relation to potential benefits
1220.C1- For consulting engagements, Internal auditors must exercise due professional care
during a consulting engagement by considering the:
- Needs and expectations of clients, including nature, timing and communication of results
- Relative complexity and extent of work needed to achieve objectives
- Cost of consulting engagement in relation to potential benefits
Purpose of a Quality Assurance and Improvement Program (QAIP)
An evaluation conformance with the Standards and an evaluation of whether internal auditors apply the
Code of Ethics. Also assesses the efficiency and effectiveness of the internal audit activity and identifies
opportunities for improvement.
IIA mandatory guidance
Code of Ethics and Standards
Core principles of IA (10)
1. Integrity
2. Competence and professional care
3. Objective and independent (free from undue influence)
4. Aligns with strategies, objectives and risks of org.
5. Appropriately positioned and adequately resourced
6. Quality and continuous improvement
7. Communicates effectively
8. Risk-based assurance
9. Insightful, proactive and future-focused
10. Promotes org. improvement
Mission of IA
To enhance and protect organizational value by providing risk-based and objective assurance, advice, and
insight.
IIA Code of Ethics
1. Integrity
2. Objectivity
3. Confidentiality
4. Competence
Mandatory elements of IA charter (must be defined)
1. Purpose, authority and responsibility
2. Nature of assurance and consulting services
3. Mandatory nature of Core Principles, Code of Ethics, Standards and Definition
Attribute standards address...
Characteristics of internal audit activity
Interpretation of independence (attribute standard)
freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit
responsibilities in an unbiased manner.
Interpretation of objectivity (attribute standard)
unbiased mental attitude that allows internal auditors to perform engagements in such a manner that
they believe in their work product and that no quality compromises are made
, CIA CHALLENGE EXAM.FINAL TEST 2026\2027.
Examples of impairment to independence or objectivity (4 examples)
Conflict of interest, scope limitation, restrictions to access to records, personnel and properties, and
resource limitations (i.e. funding)
Objectivity is presumed impaired if IA had responsibilities for activity within ___________
the previous year
Proficiency refers to
knowledge, skills and competencies
Proficiency in relation to fraud (IIA Standard 1210.A2)
Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it
is managed by the organization, but are not expected to have the expertise of a person whose primary
responsibility is detecting and investigating fraud.
Proficiency in relation to IT risks (IIA Standard 1210.A3)
Internal auditors must have sufficient knowledge of key information technology risks and controls and
available technology-based audit techniques to perform their assigned work. However, not all internal
auditors are expected to have the expertise of an internal auditor whose primary responsibility is
information technology auditing.
IIA Definition of Due professional care
Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal
auditor. Due professional care does not imply infallibility.
1220.A1- For assurance engagements, Internal auditors must exercise due professional care by
considering the:
- Extent of work needed to achieve engagement objectives
- Relative complexity, materiality, or significance of matters for assurance procedures
- Adequacy and effectiveness of governance, risk management and controls
- Probability of significant errors, fraud or noncompliance
- cost of assurance in relation to potential benefits
1220.C1- For consulting engagements, Internal auditors must exercise due professional care
during a consulting engagement by considering the:
- Needs and expectations of clients, including nature, timing and communication of results
- Relative complexity and extent of work needed to achieve objectives
- Cost of consulting engagement in relation to potential benefits
Purpose of a Quality Assurance and Improvement Program (QAIP)
An evaluation conformance with the Standards and an evaluation of whether internal auditors apply the
Code of Ethics. Also assesses the efficiency and effectiveness of the internal audit activity and identifies
opportunities for improvement.
