Certified Internal Auditor (CIA) Part 2 Exam 2026: Professional
Certification Practice Test — Audit Planning, Engagement
Execution, Evidence Collection, Findings Evaluation & Audit
Communication — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
Section A: Engagement Planning (50% — Questions 1–95)
Question 1
An internal auditor is planning an engagement for a multinational corporation's supply chain
operations. The auditor should FIRST:
A. Develop the engagement work program.
B. Establish engagement objectives and scope.
C. Perform a detailed risk assessment.
D. Determine resource requirements.
Correct Answer: B
Explanation: Engagement planning begins with establishing objectives and scope, which
guide all subsequent planning activities. The Global Internal Audit Standards require
objectives to be defined before scope and risk assessment.
Question 2
Which of the following BEST describes the relationship between engagement objectives and
engagement scope?
A. Scope determines objectives.
B. Objectives and scope are independent.
C. Scope defines the boundaries for achieving objectives.
D. Objectives are derived from scope limitations.
,Correct Answer: C
Explanation: Engagement scope establishes the boundaries within which objectives will be
achieved. Scope must be sufficient to accomplish the stated objectives without being
unnecessarily broad.
Question 3
An internal auditor is conducting a risk assessment for an engagement involving a new IT
system implementation. Which factor would MOST likely increase the assessed risk?
A. The system was developed internally.
B. The system processes routine transactions only.
C. The system has automated controls.
D. The system was implemented six months ago.
Correct Answer: A
Explanation: Internally developed systems typically carry higher risk due to potential
development errors, inadequate testing, and lack of external validation compared to vendor-
supported systems.
Question 4
During engagement planning, the auditor identifies that management has implemented a
new control over a significant risk. The auditor should:
A. Accept the control as effective based on management's assertion.
B. Determine whether the control has been tested for operating effectiveness.
C. Recommend an immediate walkthrough to validate the control.
D. Document the control and proceed with the engagement.
Correct Answer: B
,Explanation: The auditor must assess whether controls have been tested before relying on
them. Management's assertion alone is insufficient evidence of operating effectiveness.
Question 5
Which of the following is the PRIMARY purpose of a preliminary survey during engagement
planning?
A. To gather sufficient evidence to form an opinion.
B. To test the operating effectiveness of controls.
C. To obtain background information and identify areas of risk.
D. To prepare the final audit report.
Correct Answer: C
Explanation: The preliminary survey helps auditors understand the activity under review,
identify risks, and determine where to focus engagement efforts. It is not evidence-gathering
for final conclusions.
Question 6
An auditor is developing an engagement work program. The work program should:
A. Be identical to prior year's program to ensure consistency.
B. Specify procedures to achieve engagement objectives.
C. Be approved by the auditee before implementation.
D. Remain flexible without documented procedures.
Correct Answer: B
Explanation: The work program documents the procedures necessary to accomplish
engagement objectives. It should be tailored to the specific risks and circumstances of the
engagement.
, Question 7
When determining the level of staff and resources needed for an engagement, the auditor
should consider:
A. Only the auditor's availability.
B. The complexity of the area and required expertise.
C. The auditee's preference for staffing.
D. The budget allocated by the board.
Correct Answer: B
Explanation: Resource allocation should match the skills and experience required for the
engagement's complexity and risks. This ensures competent execution of audit procedures.
Question 8
An internal auditor is planning a compliance engagement related to environmental
regulations. The MOST appropriate engagement objective would be:
A. To verify all environmental laws worldwide.
B. To assess whether the organization is complying with applicable environmental
regulations.
C. To evaluate the effectiveness of the environmental department.
D. To determine the cost of environmental compliance.
Correct Answer: B
Explanation: Compliance engagement objectives should focus on whether the organization
conforms with applicable laws and regulations. This is appropriately bounded and risk-
focused.
Question 9
Certification Practice Test — Audit Planning, Engagement
Execution, Evidence Collection, Findings Evaluation & Audit
Communication — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
Section A: Engagement Planning (50% — Questions 1–95)
Question 1
An internal auditor is planning an engagement for a multinational corporation's supply chain
operations. The auditor should FIRST:
A. Develop the engagement work program.
B. Establish engagement objectives and scope.
C. Perform a detailed risk assessment.
D. Determine resource requirements.
Correct Answer: B
Explanation: Engagement planning begins with establishing objectives and scope, which
guide all subsequent planning activities. The Global Internal Audit Standards require
objectives to be defined before scope and risk assessment.
Question 2
Which of the following BEST describes the relationship between engagement objectives and
engagement scope?
A. Scope determines objectives.
B. Objectives and scope are independent.
C. Scope defines the boundaries for achieving objectives.
D. Objectives are derived from scope limitations.
,Correct Answer: C
Explanation: Engagement scope establishes the boundaries within which objectives will be
achieved. Scope must be sufficient to accomplish the stated objectives without being
unnecessarily broad.
Question 3
An internal auditor is conducting a risk assessment for an engagement involving a new IT
system implementation. Which factor would MOST likely increase the assessed risk?
A. The system was developed internally.
B. The system processes routine transactions only.
C. The system has automated controls.
D. The system was implemented six months ago.
Correct Answer: A
Explanation: Internally developed systems typically carry higher risk due to potential
development errors, inadequate testing, and lack of external validation compared to vendor-
supported systems.
Question 4
During engagement planning, the auditor identifies that management has implemented a
new control over a significant risk. The auditor should:
A. Accept the control as effective based on management's assertion.
B. Determine whether the control has been tested for operating effectiveness.
C. Recommend an immediate walkthrough to validate the control.
D. Document the control and proceed with the engagement.
Correct Answer: B
,Explanation: The auditor must assess whether controls have been tested before relying on
them. Management's assertion alone is insufficient evidence of operating effectiveness.
Question 5
Which of the following is the PRIMARY purpose of a preliminary survey during engagement
planning?
A. To gather sufficient evidence to form an opinion.
B. To test the operating effectiveness of controls.
C. To obtain background information and identify areas of risk.
D. To prepare the final audit report.
Correct Answer: C
Explanation: The preliminary survey helps auditors understand the activity under review,
identify risks, and determine where to focus engagement efforts. It is not evidence-gathering
for final conclusions.
Question 6
An auditor is developing an engagement work program. The work program should:
A. Be identical to prior year's program to ensure consistency.
B. Specify procedures to achieve engagement objectives.
C. Be approved by the auditee before implementation.
D. Remain flexible without documented procedures.
Correct Answer: B
Explanation: The work program documents the procedures necessary to accomplish
engagement objectives. It should be tailored to the specific risks and circumstances of the
engagement.
, Question 7
When determining the level of staff and resources needed for an engagement, the auditor
should consider:
A. Only the auditor's availability.
B. The complexity of the area and required expertise.
C. The auditee's preference for staffing.
D. The budget allocated by the board.
Correct Answer: B
Explanation: Resource allocation should match the skills and experience required for the
engagement's complexity and risks. This ensures competent execution of audit procedures.
Question 8
An internal auditor is planning a compliance engagement related to environmental
regulations. The MOST appropriate engagement objective would be:
A. To verify all environmental laws worldwide.
B. To assess whether the organization is complying with applicable environmental
regulations.
C. To evaluate the effectiveness of the environmental department.
D. To determine the cost of environmental compliance.
Correct Answer: B
Explanation: Compliance engagement objectives should focus on whether the organization
conforms with applicable laws and regulations. This is appropriately bounded and risk-
focused.
Question 9
