CIA P1 Part 1 · Internal Audit Fundamentals: mock exams and practice questions

Sample question 1 · Foundations of Internal Auditing

The audit committee of Marlinspike Ports wants evidence that internal audit is achieving the Purpose of Internal Auditing in Domain I, rather than simply being busy. Which observation in the CAE's annual report provides the best evidence?

1. A Internal audit issued 38 reports this year, four more than last year, all within the budgeted audit days.
2. B Management has accepted every finding raised over the last three years without challenging any of them.
3. C Board and management decisions on risk and control have been better informed by internal audit's work.
4. D No fraud or control failure has occurred during the year in any of the areas that internal audit reviewed.

Show the answer

Answer: C. Domain I states that internal auditing strengthens the organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight. Among the benefits it lists is enhanced decision-making and oversight. The best evidence that the Purpose is being achieved is therefore that the board and management actually use internal audit's work to make better-informed decisions on governance, risk and control. Report counts, uncontested findings or the absence of incidents measure activity or luck, not the value the Purpose describes.

Sample question 2 · Ethics and Professionalism

Under the IIA's Global Internal Audit Standards (effective January 2025), where are the ethical requirements that apply to internal auditors set out?

1. A In a separate Code of Ethics that sits outside the Standards and is issued as recommended guidance only
2. B In the Topical Requirements, which set out ethics rules for each type of audit subject
3. C In Domain II, Ethics and Professionalism, which contains five principles and their supporting standards
4. D In each organization's internal audit charter, which the board drafts and approves every year

Show the answer

Answer: C. The Global Internal Audit Standards are organised into five domains. Domain II, Ethics and Professionalism, replaced the old stand-alone Code of Ethics and contains five principles: demonstrate integrity, maintain objectivity, demonstrate competency, exercise due professional care and maintain confidentiality. Each principle is supported by standards with requirements that are mandatory for internal auditors.

Sample question 3 · Governance, Risk Management and Control

A country's corporate governance code requires each listed company either to follow every provision of the code or to disclose in its annual report which provisions it has departed from and why. This approach is best described as:

1. A A rules-based regime in which any departure from a provision is a legal offence
2. B A principles-based "comply or explain" regime relying on disclosure and market scrutiny
3. C A stakeholder-based regime in which employees approve all departures from the code
4. D A self-regulatory regime in which companies choose provisions without any disclosure

Show the answer

Answer: B. Governance codes broadly follow one of two approaches. Rules-based regimes (for example, much of the US Sarbanes-Oxley Act) make requirements legally mandatory. Principles-based codes usually operate on a "comply or explain" basis: companies may depart from a provision provided they disclose the departure and the reasons, and shareholders and the market judge whether the explanation is acceptable.