CIA Part 1 Practice Questions (2026) — Free Sample Questions with Answers

Answer: A

Inform the board of the cut and its effect on coverage of high-risk areas: Correct. A budget cut that prevents the function from covering significant risks is a resource limitation that can impair independence. The CAE must communicate its impact to the board, which approves the plan and decides how to respond.

Reduce testing on every engagement so the full plan still fits the budget: Incorrect. Inadequate: thinning all work hides the impact and risks insufficient work on high-risk areas without the board's knowledge.

Revise the internal audit plan and begin executing the revised plan immediately: Incorrect. Authority reversed: significant changes to the plan need board review and approval before they take effect.

Accept the reduction as a decision that belongs to senior management alone: Incorrect. Inadequate: the budget affects the function's ability to fulfill its mandate, so the board must be informed rather than the cut accepted silently.

When resources fall short of what the plan needs, the CAE communicates the impact to the board before significant plan changes are made.

Answer: B

Approving the final system configuration before it is released to users: Incorrect. Role confusion: approving the configuration is a management decision and would create a self-review threat when internal audit later audits the system.

Recommending control requirements for the project team to decide on: Correct. In system design work, internal audit can advise on control requirements early, when changes are cheapest, while management decides on and builds the controls. Because internal audit made no design decisions, it can later evaluate the system objectively.

Writing the system's user access matrix and approval workflows: Incorrect. Role confusion: designing the controls themselves makes internal audit the owner of what it would later audit.

Serving as a voting member of the project's steering committee: Incorrect. Role confusion: voting on project decisions is a management responsibility; a non-voting advisory role would be the appropriate alternative.

During system development, internal audit advises on controls but leaves design and approval decisions to management, so its later assurance stays objective.

Answer: C

Confirm that the code of conduct was approved and distributed to every employee: Incorrect. Scope too narrow: the existence and distribution of a code says nothing about whether behavior matches the stated values.

Review the financial statements for misstatements caused by unethical decisions: Incorrect. Scope too narrow: a financial-only lens misses most cultural risk, which shows up in behavior, incentives and decision-making.

Pair staff surveys with tests of incentives and misconduct handling: Correct. A culture audit looks at how people actually behave and at the systems that shape behavior (incentives, escalation, handling of misconduct). Combining perception evidence with tests of those mechanisms gives the board objective assurance consistent with the Purpose of Internal Auditing.

Draft a revised values statement for senior management to communicate to staff: Incorrect. Role confusion: setting and communicating values is a management and board responsibility, and drafting it is not assurance.

An audit of culture gathers evidence on actual behavior and on the mechanisms that shape it, not just on whether policies exist.

Answer: A

Assurance on vendor master data controls and advisory on the portal design: Correct. A conclusion on operating effectiveness for the audit committee calls for an assurance engagement. Helping design controls for a new system is an advisory service, provided management keeps the design decisions.

One advisory engagement covering both, since both involve vendor controls: Incorrect. Advisory services provide no assurance, so they cannot give the audit committee the conclusion it needs.

Assurance on the portal design and advisory on vendor master data controls: Incorrect. This reverses the services: the committee needs assurance on existing controls, and the new design calls for advice.

Assurance on vendor master data controls, declining the portal design request: Incorrect. The Standards allow advice on system design; declining is unnecessary if management keeps responsibility.

Match the service to the need: an independent conclusion against criteria calls for assurance, and help with design or implementation calls for advisory services.

Answer: D

Assign internal auditors who report to the CAE to audit the compliance function each year: Incorrect. Staff who report to the CAE would be assessing an area the CAE manages, so the impairment is not addressed.

Remove compliance from the audit universe, since the CAE will now manage it directly: Incorrect. Removing the area leaves an assurance gap; alternative assurance must be arranged instead.

Disclose the role to the board only after the first compliance review is complete: Incorrect. Too late: the board must acknowledge the impairment and agree safeguards when it approves the role, not after the work.

Record the role and its safeguards in the charter and arrange outside assurance: Correct. Standard 7.1 Organizational Independence requires the charter to document an ongoing role beyond internal auditing, its nature and its safeguards. Because compliance is subject to internal auditing, assurance over it must come from a party outside the internal audit function, such as an objective external provider reporting to the board.

For an ongoing role beyond internal auditing, document the role and safeguards in the charter and arrange independent assurance over that area.

Answer: A

Strengthening the organization's ability to create, protect, and sustain value: Correct. Domain I Purpose of Internal Auditing states that internal auditing strengthens the organization's ability to create, protect, and sustain value by giving the board and management independent, risk-based, and objective assurance, advice, insight, and foresight.

Expressing an opinion on the fairness of the annual financial statements: Incorrect. An opinion on the financial statements is the external auditor's role, not the Purpose of Internal Auditing.

Ensuring that the organization complies with all applicable laws and regulations: Incorrect. Compliance is only one part of internal audit coverage; this scope is too narrow, and ensuring compliance is management's responsibility.

Designing and maintaining the organization's system of internal control: Incorrect. Designing and maintaining controls is a management (first- and second-line) responsibility; internal audit evaluates controls.

Internal auditing exists to strengthen the organization's ability to create, protect, and sustain value through independent, risk-based, and objective assurance, advice, insight, and foresight.

Answer: B

Take no action because the report has already been issued: Incorrect. Issuing the report does not end the duty to disclose an impairment that affects reliability.

Discuss it with management, the board and affected parties to resolve it: Correct. Standard 2.3 requires the CAE, when an impairment affecting reliability is found after an engagement, to discuss the concern with the management of the activity, the board, senior management and/or other affected stakeholders and determine appropriate actions.

Withdraw the report at once without consulting any of the affected stakeholders: Incorrect. Acting alone skips the discussion the Standards require, and withdrawal may not be the right resolution.

Note the issue for consideration in next year's audit plan: Incorrect. Deferring the matter leaves stakeholders relying on possibly unreliable conclusions.

An impairment found after the engagement is discussed with the affected parties, including the board, so that the right action can be agreed.

Answer: C

Assign the same auditors because they know the workflow best: Incorrect. Using the advisors without considering their objectivity invites self-review bias.

Decline the engagement because the function advised on the workflow design: Incorrect. Prior advisory work does not automatically prohibit later assurance; the Standards require evaluating and managing objectivity.

Confirm the advice does not impair objectivity and staff accordingly: Correct. Standard 2.2 permits assurance after advisory work if the CAE confirms the nature of the advisory services does not impair objectivity and assigns resources so that individual objectivity is managed.

Ask procurement management to approve the engagement scope: Incorrect. Management approval of scope is undue influence and does not address the objectivity question.

Assurance after advisory work is allowed when the CAE confirms the advice did not impair objectivity and assigns staff to manage individual objectivity.

Answer: D

Remove the finding and raise the issue orally instead: Incorrect. Omitting a supported finding from the communication is concealment, which Standard 1.1 prohibits.

Defer the finding to next year's engagement report: Incorrect. Delaying a known safety issue withholds material facts the organization needs to make decisions now.

Lower the finding rating to preserve the working relationship: Incorrect. Minimizing a rating to satisfy management is a discreditable misrepresentation of the evidence.

Retain the finding and discuss the request with the CAE: Correct. Standard 1.1 requires honesty and professional courage: auditors must not conceal or omit findings and must communicate truthfully even under pressure. Discussing the situation with the CAE or a supervisor is the recommended course when integrity is challenged.

Professional courage means reporting evidence-based results truthfully despite pressure; seek the CAE's or a supervisor's guidance rather than giving in.

Answer: A

Funds are often unrecoverable once a transfer is released: Correct. When a loss cannot be reversed after it occurs, detecting it the next day does little to reduce impact, so a preventive control (such as independent approval before release) is needed.

Transfers are recorded in the general ledger each day: Incorrect. Prompt recording helps detection, but it does not address the need to stop unauthorized transfers before release.

Treasury staff are experienced and well trained: Incorrect. Plausible but irrelevant: competent staff do not remove the risk of unauthorized or erroneous transfers, nor the irreversibility of a loss.

The bank sends an electronic confirmation of each wire released: Incorrect. A confirmation arrives after release, so it is another detective measure rather than a reason to prevent.

Where losses are high-value and irreversible, detective controls alone are not enough; preventive controls must stop the event before it occurs.

Answer: C

Communicate the matter immediately to the board: Incorrect. Escalation to the board follows if the discussion with senior management does not resolve the matter; going straight to the board skips that step.

Require the manager to implement new controls: Incorrect. Role confusion: deciding the risk response belongs to management, and internal audit has no authority to impose controls.

Discuss the matter with senior management: Correct. When the CAE concludes that management has accepted a risk beyond the organization's appetite or tolerance, the GIAS expects the CAE to discuss it with senior management first; if it is not resolved, the CAE communicates it to the board.

Note the acceptance in the report and close it: Incorrect. Inadequate: a risk accepted beyond tolerance cannot simply be recorded and closed; it must be raised with senior management and, if unresolved, the board.

If management has accepted risk beyond appetite or tolerance, the CAE discusses it with senior management and escalates to the board if it remains unresolved.

Answer: D

Both processes deserve equal attention because their residual risk ratings are the same: Incorrect. Equal residual ratings hide the different exposures if controls fail; inherent risk and reliance on controls also matter.

Process B should receive more attention because it has no significant controls to test: Incorrect. Without controls, B's exposure is still only moderate, so the lack of controls alone does not make it the higher priority.

Process A can be excluded from the plan because its controls already reduce the risk: Incorrect. This is reversed: reliance on key controls to reduce a high inherent risk is exactly why those controls need assurance.

Process A may need more assurance, since a key control failure exposes high risk: Correct. With high inherent risk, A's moderate residual rating holds only if its key controls work, so assurance over those controls is valuable; B's exposure cannot rise above moderate even with no controls; Standard 9.4 Internal Audit Plan.

When residual ratings are equal, the process with high inherent risk that relies on key controls usually deserves more assurance, because a control failure would expose it to high risk.

Answer: A

Raise the assessed risk of revenue misstatement and override: Correct. A high-pressure, revenue-only incentive culture increases the risk of premature or fictitious revenue and override of controls, so engagement risks should be rated higher and procedures focused on them.

Reduce testing because the culture drives strong performance: Incorrect. This has the effect backwards: incentive pressure increases engagement risk, not assurance.

Exclude cultural factors because they are outside the engagement scope: Incorrect. Culture directly affects the control environment and engagement risks, so it must be considered in planning.

Require management to change the bonus plan before planning continues: Incorrect. Changing compensation is management's decision; internal audit may recommend it later but cannot make it a condition of planning.

Organizational culture, especially incentives and pressure, shapes engagement-level risk and should be reflected in the engagement risk assessment.

Answer: D

The suspect first, before evidence is destroyed: Incorrect. Approaching the suspect before the facts are developed gives away what investigators know and weakens the interview.

Possible co-conspirators first, neutral witnesses last: Incorrect. This reverses the logic: possible co-conspirators should be approached only once the evidence is developed, because they may alert the suspect.

All parties together to compare their accounts: Incorrect. Joint interviews let witnesses influence one another and inhibit candid disclosure. Interviews should be held separately.

Neutral witnesses first and the suspect last: Correct. Starting with neutral parties and then corroborating witnesses builds the facts and evidence before the suspect is approached. The interview of the suspect is then informed, and tipping off is less likely.

Fraud interviews generally move from the least to the most involved: neutral witnesses, then corroborating witnesses and possible co-conspirators, and finally the suspect.

Answer: A

A billing scheme using a shell company: Correct. A vendor at an employee's address, billing vague services in amounts set to avoid higher approval, is a classic sign of a fictitious (shell) vendor that the employee created to divert payments.

A ghost employee scheme in payroll: Incorrect. Ghost employee schemes run fictitious people through payroll. The facts describe a vendor paid through accounts payable.

A kickback scheme with a real supplier: Incorrect. A kickback usually involves a legitimate outside vendor that colludes with an insider. A vendor at the clerk's own home address points to a vendor the clerk controls.

A lapping scheme on customer receipts: Incorrect. Lapping happens in the receivables and cash-receipts cycle, where later customer payments cover earlier stolen ones. It does not involve vendor disbursements.

Red flags for a shell company include a vendor address matching an employee, vague service descriptions, and invoices kept just under approval thresholds.