Free IIA-CIA-Part1: Certified Internal Auditor - Part 1 The Internal Audit Activity's Role in Governance Risk and Control Exam Questions and Answers

Last updated: September 12, 2026

Provider

IIA

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   Which of the following statements accurately describes the responsibility of the internal audit activity regarding IT governance? * 1. The internal audit activity does not have any responsibility because IT governance is the responsibility of the board and senior management of the organization. * 2. The internal audit activity must assess whether the IT governance of the organization supports the organization's strategies and objectives. * 3. The internal audit activity may assess whether the IT governance of the organization supports the organization's strategies and objectives. * 4. The internal audit activity may accept requests from management to perform advisory services regarding how the IT governance of the organization supports the organization's strategies and objectives.

   • A. 3 and 4.
   • B. 4 only.
   • C. 1 only.
   • D. 2 and 4.
   Reveal Answer

2. Question #2

   An internal audit team is performing an audit of workplace accident claims. Which of the following actions by the audit team best demonstrates due professional care?

   • A. Determining that the claims have been classified properly.
   • B. Placing reliance on medical reports from the injured worker's doctor.
   • C. Having an occupational health officer on the engagement team.
   • D. Reviewing claims to ensure all accidents actually occurred in the workplace.
   Reveal Answer

3. Question #3

   Which of the following combinations of conditions is most likely a red flag for fraud?

   • A. The practice of surprise audits and the implementation of an employee support program.
   • B. Occasional accounting department overrides and discontinuation of the anonymous fraud hotline due to infrequent use.
   • C. A veteran employee in upper management experiencing financial difficulties and recently implemented enhanced controls.
   • D. Hiring an employee with a prior fraud conviction and yearly management review.
   Reveal Answer

4. Question #4

   Which of the following is an example of a detective control?

   • A. Confirmation with suppliers and vendors.
   • B. Safety instructions.
   • C. Automatic shut-off valve.
   • D. Auto-correct software functionality.
   Reveal Answer

5. Question #5

   An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which of the following statements about a common risk language is true?

   • A. Decision makers will understand that the likelihood of missing or ineffective controls will be reduced.
   • B. Management will be able to reduce inherent risk because they will have a better understanding of risk.
   • C. Internal auditors will be able to reduce their sample sizes because controls will be more consistent.
   • D. Stakeholders will have more assurance that the risks are assessed consistently.
   Reveal Answer

6. Question #6

   An internal auditor in a small broadcasting organization was assigned to review the revenue collection process. The auditor discovered that some checks from three customers were never recorded in the organization's financial records. Which of the following documents would be the least useful for the auditor to verify the finding?

   • A. Copies of deposit slips.
   • B. Customer confirmation letters.
   • C. Copies of sales invoices.
   • D. Bank statements.
   Reveal Answer

7. Question #7

   In the area of business acumen, which of the following competencies would be the sole responsibility of an internal audit staff member?

   • A. Maintaining technical aspects of accounting standards and reporting processes.
   • B. Maintaining industry-specific knowledge appropriate to the organization.
   • C. Assessing how IT contributes to organization objectives, risks, and relevance to audit.
   • D. Understanding regulatory and legal framework and assessing its relevance.
   Reveal Answer

8. Question #8

   According to IIA guidance, which of the following are macro-level audit activities performed for an assurance engagement of the purchasing department? * 1. Obtain and review all purchasing-related audit reports issued within the past year. * 2. Meet with the quality assurance group to discuss its previous reports of any purchasing-related findings. * 3. Review a memo written by the purchasing manager that outlines ongoing problems with the purchasing software. * 4. Request a copy of the report from a purchasing audit conducted last year by an external service provider.

   • A. 2 and 4.
   • B. 3 and 4.
   • C. 1 and 3.
   • D. 1 and 2.
   Reveal Answer

9. Question #9

   According to IIA guidance, which of the following statements is true regarding periodic internal assessments of the internal audit activity?

   • A. Internal assessments must be performed at least once every five years by a qualified assessor.
   • B. Internal assessments are conducted to benchmark the internal audit activity's performance againstindustry best practices.
   • C. Follow-up to ensure appropriate improvements are implemented is a recommended, but not mandatory, element of internal assessments.
   • D. An internal auditor may perform a peer review of a colleague's workpapers, as long as the auditor wasn't involved in the audit under review.
   Reveal Answer

10. Question #10

    According to The IIA's Code of Ethics, which of the following statements is true?

    • A. When an internal auditor releases required information to a regulator, resulting in a significant loss through fines and penalties for the organization, he fails to
    • B. When an internal auditor disagrees with the treatment received by workers in the organization's foreign subsidiary and alters the audit program to highlight the
    • C. When an internal auditor continues with an audit engagement, despite the audit client's claims that the work performed is unnecessary and redundant he fails to
    • D. When an internal auditor limits the scope of the audit engagement after learning that management is hiding relevant information, he demonstrates integrity.
    Reveal Answer