Page 1 of 136
NYC Internal Auditor EXAM QUESTIONS AND CORRECT
VERIFIED SOLUTIONS LATEST UPDATE THIS YEAR – JUST
RELEASED
NYC Internal Auditor Exam
10-LINE EXAM COVERAGE IN POINTS FORM
1. Primary Audit Purpose – Evaluating and improving the effectiveness of risk
management, control, and governance processes; NOT preparing financial statements or
managing operations.
2. Core Audit Domains – Financial, operational, compliance, and performance audits; IT
systems evaluation; management and efficiency assessments.
3. Government Auditing Standards (GAGAS/Yellow Book) – Mandatory for NYC municipal
audits; requires professional skepticism, reasonable care, and independence; mandates
3-year external peer review cycle.
4. COSO Internal Control Framework – Five components: Control Environment, Risk
Assessment, Control Activities, Information & Communication, Monitoring Activities.
5. Risk-Based Auditing – Prioritizes audit resources on higher-risk areas; inherent risk (no
controls) vs. residual risk (after controls) is a critical distinction.
6. Audit Evidence & Procedures – Most reliable evidence: external third-party
confirmations; analytical procedures identify unusual patterns; walkthroughs trace
transactions from start to finish; substantive testing verifies account accuracy.
7. Professional Standards & Independence – IIA International Professional Practices
Framework (IPPF); auditor independence requires freedom from conflicts; self-review
threat occurs when evaluating own work.
8. Fraud & Internal Controls – Segregation of duties prevents fraud by dividing
authorization, custody, and record-keeping; preventive controls stop errors before
occurrence; detective controls identify issues after occurrence.
9. NYC Municipal Audit Context – Compliance with procurement rules (PPB Rules); audits
safeguard taxpayer funds; material weaknesses reported to management and board; exit
conferences discuss draft findings with management.
10. Audit Risk Model – AR = IR × CR × DR (Inherent Risk × Control Risk × Detection Risk);
controls reduce but do not eliminate risk; management override is a significant
limitation.
, Page 2 of 136
100 NGN-STYLE NYS/NYC AUDITOR PRACTICE QUESTIONS WITH RATIONALES
SECTION 1: GOVERNMENT AUDITING STANDARDS (GAGAS / YELLOW BOOK)
QUESTION 1
Under Generally Accepted Government Auditing Standards (GAGAS), what is a key
distinguishing feature of government auditing compared to private sector auditing?
A) Government audits focus solely on financial statements
B) Government audits must consider compliance with laws and regulations in addition to
financial accuracy
C) Government audits do not require independence
D) Government audits are only performed by the Comptroller's Office
Correct Answer: B
Rationale: GAGAS requires government audits to evaluate compliance with applicable laws,
regulations, and grant agreements, in addition to financial statement accuracy. This broader
scope addresses public accountability beyond private sector audit objectives.
QUESTION 2
According to GAGAS, the primary objective of a performance audit is to:
A) Express an opinion on whether financial statements are fairly presented
B) Identify criminal activity and file immediate indictments
, Page 3 of 136
C) Provide objective analysis of program performance, efficiency, and internal controls
D) Replace management in daily operational decision-making
Correct Answer: C
Rationale: Performance audits evaluate program effectiveness, operational economy, efficiency,
internal controls, and compliance against objective benchmarks. They provide objective analysis
to assist management and governance bodies in improving performance.
QUESTION 3
An advocacy threat to auditor independence occurs when:
A) An auditor creates a situation that places them in advocacy of the audited entity's interests
B) An auditor has a close personal relationship with auditee staff
C) An auditor evaluates financial statements they previously prepared
D) An auditor accepts a nominal promotional gift
Correct Answer: A
Rationale: An advocacy threat compromises objectivity when the auditor supports positions too
closely aligned with the auditee's goals. Familiarity threats involve close relationships; self-
review threats involve evaluating one's own work.
QUESTION 4
According to GAGAS, external peer reviews must be conducted how frequently?
, Page 4 of 136
A) Every 1 year
B) Every 2 years
C) Every 3 years
D) Every 5 years
Correct Answer: C
Rationale: GAGAS mandates a three-year cycle for external peer reviews to ensure an
organization's internal quality control system is suitably designed and operating effectively.
QUESTION 5
An auditor discovers significant noncompliance with laws or regulations. GAGAS requires
reporting this information directly to:
A) Local media outlets
B) The public via personal web postings
C) Those charged with governance and entity officials
D) Federal tax collection authorities exclusively
Correct Answer: C
Rationale: GAGAS requires alerting the audited entity's management and oversight bodies first
so corrective action can be taken, unless external reporting is legally mandated.
NYC Internal Auditor EXAM QUESTIONS AND CORRECT
VERIFIED SOLUTIONS LATEST UPDATE THIS YEAR – JUST
RELEASED
NYC Internal Auditor Exam
10-LINE EXAM COVERAGE IN POINTS FORM
1. Primary Audit Purpose – Evaluating and improving the effectiveness of risk
management, control, and governance processes; NOT preparing financial statements or
managing operations.
2. Core Audit Domains – Financial, operational, compliance, and performance audits; IT
systems evaluation; management and efficiency assessments.
3. Government Auditing Standards (GAGAS/Yellow Book) – Mandatory for NYC municipal
audits; requires professional skepticism, reasonable care, and independence; mandates
3-year external peer review cycle.
4. COSO Internal Control Framework – Five components: Control Environment, Risk
Assessment, Control Activities, Information & Communication, Monitoring Activities.
5. Risk-Based Auditing – Prioritizes audit resources on higher-risk areas; inherent risk (no
controls) vs. residual risk (after controls) is a critical distinction.
6. Audit Evidence & Procedures – Most reliable evidence: external third-party
confirmations; analytical procedures identify unusual patterns; walkthroughs trace
transactions from start to finish; substantive testing verifies account accuracy.
7. Professional Standards & Independence – IIA International Professional Practices
Framework (IPPF); auditor independence requires freedom from conflicts; self-review
threat occurs when evaluating own work.
8. Fraud & Internal Controls – Segregation of duties prevents fraud by dividing
authorization, custody, and record-keeping; preventive controls stop errors before
occurrence; detective controls identify issues after occurrence.
9. NYC Municipal Audit Context – Compliance with procurement rules (PPB Rules); audits
safeguard taxpayer funds; material weaknesses reported to management and board; exit
conferences discuss draft findings with management.
10. Audit Risk Model – AR = IR × CR × DR (Inherent Risk × Control Risk × Detection Risk);
controls reduce but do not eliminate risk; management override is a significant
limitation.
, Page 2 of 136
100 NGN-STYLE NYS/NYC AUDITOR PRACTICE QUESTIONS WITH RATIONALES
SECTION 1: GOVERNMENT AUDITING STANDARDS (GAGAS / YELLOW BOOK)
QUESTION 1
Under Generally Accepted Government Auditing Standards (GAGAS), what is a key
distinguishing feature of government auditing compared to private sector auditing?
A) Government audits focus solely on financial statements
B) Government audits must consider compliance with laws and regulations in addition to
financial accuracy
C) Government audits do not require independence
D) Government audits are only performed by the Comptroller's Office
Correct Answer: B
Rationale: GAGAS requires government audits to evaluate compliance with applicable laws,
regulations, and grant agreements, in addition to financial statement accuracy. This broader
scope addresses public accountability beyond private sector audit objectives.
QUESTION 2
According to GAGAS, the primary objective of a performance audit is to:
A) Express an opinion on whether financial statements are fairly presented
B) Identify criminal activity and file immediate indictments
, Page 3 of 136
C) Provide objective analysis of program performance, efficiency, and internal controls
D) Replace management in daily operational decision-making
Correct Answer: C
Rationale: Performance audits evaluate program effectiveness, operational economy, efficiency,
internal controls, and compliance against objective benchmarks. They provide objective analysis
to assist management and governance bodies in improving performance.
QUESTION 3
An advocacy threat to auditor independence occurs when:
A) An auditor creates a situation that places them in advocacy of the audited entity's interests
B) An auditor has a close personal relationship with auditee staff
C) An auditor evaluates financial statements they previously prepared
D) An auditor accepts a nominal promotional gift
Correct Answer: A
Rationale: An advocacy threat compromises objectivity when the auditor supports positions too
closely aligned with the auditee's goals. Familiarity threats involve close relationships; self-
review threats involve evaluating one's own work.
QUESTION 4
According to GAGAS, external peer reviews must be conducted how frequently?
, Page 4 of 136
A) Every 1 year
B) Every 2 years
C) Every 3 years
D) Every 5 years
Correct Answer: C
Rationale: GAGAS mandates a three-year cycle for external peer reviews to ensure an
organization's internal quality control system is suitably designed and operating effectively.
QUESTION 5
An auditor discovers significant noncompliance with laws or regulations. GAGAS requires
reporting this information directly to:
A) Local media outlets
B) The public via personal web postings
C) Those charged with governance and entity officials
D) Federal tax collection authorities exclusively
Correct Answer: C
Rationale: GAGAS requires alerting the audited entity's management and oversight bodies first
so corrective action can be taken, unless external reporting is legally mandated.
