LATEST CIA WRITTEN EXAM
QUESTIONS WITH VERIFIED ANSWERS
2026/2027
The chief audit executive (CAE) most likely promotes a culture of competency by -
ANSWER-Providing evidence of an active quality assurance program. Explanation: The
CAE may demonstrate a culture supportive of competency and the continual
improvement of proficiency, effectiveness, and quality through evidence that a quality
assurance and improvement program is active (IG, Code of Ethics: Competency).
A new staff internal auditor was told to perform an engagement in an area with which
the internal auditor was not familiar. Because of time constraints, no supervision was
provided. In this situation, - ANSWER-The internal audit activity violated the Standards
by not providing adequate supervision.
The IIA's Competency Framework includes which core competency? - ANSWER-
Technology-based audit methods.
Internal auditors specifically demonstrate conformance with the confidentiality principle
by - ANSWER-Documenting distribution restrictions on engagement records. Internal
auditors conform with engagement record confidentiality by documenting distribution
restrictions in workpapers and reports and by retaining authorizations of all disclosures
and approved distribution lists (IG, Code of Ethics: Confidentiality).
Given that internal audit engagements must be performed with proficiency and due
professional care, which of the following is true? - ANSWER-The internal audit activity
need not decline an engagement because it currently lacks the needed competencies.
Which one of the following must be included in the internal audit charter? - ANSWER-
Internal audit responsibility. The purpose, authority, and responsibility of the internal
audit activity must be formally defined in an internal audit charter.
An organization has outsourced its internal audit activity to an external service provider
(ESP). The ESP must make the outsourcing organization aware that it - ANSWER-
Retained responsibility for the internal audit activity's effectiveness.
According to the competency principle and the related Rules of Conduct in The IIA's
Code of Ethics, internal auditors must - ANSWER-Continually improve their proficiency.
Freedom from conditions that threaten internal auditors' ability to do unbiased work is -
ANSWER-Independence. Independence is "the freedom from conditions that threaten
the ability of the internal audit activity to carry out internal audit responsibilities in an
unbiased manner" (The IIA Glossary).
, Which of the following is a component of The IIA's Code of Ethics? - ANSWER-
Principles.
When the internal audit activity outsources some of its functions to an external service
provider (ESP), - ANSWER-The IIA's Standards must be followed by the ESP.
The purpose of the internal audit activity can be best described as? (emphasis on best)
- ANSWER-Adding value to the organization. (Internal auditing is an independent,
objective assurance and consulting activity designed to add value and improve an
organization's operations (Definition of Internal Auditing).)
Which of the following actions by an internal auditor is most likely a violation of The IIA's
Code of Ethics? - ANSWER-Accepting a moderate gift from a customer of his or her
organization.
Principles included in The IIA's Code of Ethics are interpreted by Rules of Conduct.
Which principles as interpreted require disclosures by internal auditors? - ANSWER-
Rule of Conduct 1.1 (Integrity) states that internal auditors shall "observe the law and
make disclosures expected by the law and the profession." Rule of Conduct 2.3
(Objectivity) states that internal auditors shall "disclose all material facts known to them
that, if not disclosed, may distort the reporting of activities under review."
An internal auditor most directly violates the integrity principle under The IIA Code of
Ethics by - ANSWER-Engaging in a legal act discreditable to the organization. Under
Rule of Conduct 1.3 (Integrity), an internal auditor must not knowingly be a party to an
illegal activity or engage in acts discreditable to the profession of internal auditing or to
the organization.
An internal auditor who uses the CIA designation after it has expired most likely is
engaging in an act discreditable under which principle of The IIA's Code of Ethics? -
ANSWER-Integrity.
The ISO 31000 model describes three approaches to providing assurance on risk
management processes. Which of the following is not one of these approaches? -
ANSWER-Negative assurance. Negative assurance is not a concept applicable to
providing assurance on risk management processes described in the ISO 31000 model.
Which of the following are elements of a supporting aspect component of the COSO
ERM framework? - ANSWER-Information and communication. The COSO ERM
framework consists of five interrelated components. The supporting aspect components
are (1) governance and culture and (2) information, communication, and reporting. The
common process components are (1) strategy and objective setting, (2) performance,
and (3) review and revision.
Senior management has identified the following risk areas within the organization:
QUESTIONS WITH VERIFIED ANSWERS
2026/2027
The chief audit executive (CAE) most likely promotes a culture of competency by -
ANSWER-Providing evidence of an active quality assurance program. Explanation: The
CAE may demonstrate a culture supportive of competency and the continual
improvement of proficiency, effectiveness, and quality through evidence that a quality
assurance and improvement program is active (IG, Code of Ethics: Competency).
A new staff internal auditor was told to perform an engagement in an area with which
the internal auditor was not familiar. Because of time constraints, no supervision was
provided. In this situation, - ANSWER-The internal audit activity violated the Standards
by not providing adequate supervision.
The IIA's Competency Framework includes which core competency? - ANSWER-
Technology-based audit methods.
Internal auditors specifically demonstrate conformance with the confidentiality principle
by - ANSWER-Documenting distribution restrictions on engagement records. Internal
auditors conform with engagement record confidentiality by documenting distribution
restrictions in workpapers and reports and by retaining authorizations of all disclosures
and approved distribution lists (IG, Code of Ethics: Confidentiality).
Given that internal audit engagements must be performed with proficiency and due
professional care, which of the following is true? - ANSWER-The internal audit activity
need not decline an engagement because it currently lacks the needed competencies.
Which one of the following must be included in the internal audit charter? - ANSWER-
Internal audit responsibility. The purpose, authority, and responsibility of the internal
audit activity must be formally defined in an internal audit charter.
An organization has outsourced its internal audit activity to an external service provider
(ESP). The ESP must make the outsourcing organization aware that it - ANSWER-
Retained responsibility for the internal audit activity's effectiveness.
According to the competency principle and the related Rules of Conduct in The IIA's
Code of Ethics, internal auditors must - ANSWER-Continually improve their proficiency.
Freedom from conditions that threaten internal auditors' ability to do unbiased work is -
ANSWER-Independence. Independence is "the freedom from conditions that threaten
the ability of the internal audit activity to carry out internal audit responsibilities in an
unbiased manner" (The IIA Glossary).
, Which of the following is a component of The IIA's Code of Ethics? - ANSWER-
Principles.
When the internal audit activity outsources some of its functions to an external service
provider (ESP), - ANSWER-The IIA's Standards must be followed by the ESP.
The purpose of the internal audit activity can be best described as? (emphasis on best)
- ANSWER-Adding value to the organization. (Internal auditing is an independent,
objective assurance and consulting activity designed to add value and improve an
organization's operations (Definition of Internal Auditing).)
Which of the following actions by an internal auditor is most likely a violation of The IIA's
Code of Ethics? - ANSWER-Accepting a moderate gift from a customer of his or her
organization.
Principles included in The IIA's Code of Ethics are interpreted by Rules of Conduct.
Which principles as interpreted require disclosures by internal auditors? - ANSWER-
Rule of Conduct 1.1 (Integrity) states that internal auditors shall "observe the law and
make disclosures expected by the law and the profession." Rule of Conduct 2.3
(Objectivity) states that internal auditors shall "disclose all material facts known to them
that, if not disclosed, may distort the reporting of activities under review."
An internal auditor most directly violates the integrity principle under The IIA Code of
Ethics by - ANSWER-Engaging in a legal act discreditable to the organization. Under
Rule of Conduct 1.3 (Integrity), an internal auditor must not knowingly be a party to an
illegal activity or engage in acts discreditable to the profession of internal auditing or to
the organization.
An internal auditor who uses the CIA designation after it has expired most likely is
engaging in an act discreditable under which principle of The IIA's Code of Ethics? -
ANSWER-Integrity.
The ISO 31000 model describes three approaches to providing assurance on risk
management processes. Which of the following is not one of these approaches? -
ANSWER-Negative assurance. Negative assurance is not a concept applicable to
providing assurance on risk management processes described in the ISO 31000 model.
Which of the following are elements of a supporting aspect component of the COSO
ERM framework? - ANSWER-Information and communication. The COSO ERM
framework consists of five interrelated components. The supporting aspect components
are (1) governance and culture and (2) information, communication, and reporting. The
common process components are (1) strategy and objective setting, (2) performance,
and (3) review and revision.
Senior management has identified the following risk areas within the organization:
