العربية

CIA Part 2

Certified Internal Auditor (CIA) Part 2: Internal Audit Engagement: free practice test

Start with 10 free questions to see what needs more practice. Finish to see your score, weakest units and every option explained.

Back to Certified Internal Auditor (CIA) Part 2: Internal Audit Engagement

Practice test questions with answers and explanations

Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.

01An internal auditor is setting the scope of an assurance engagement over the company's remote-access arrangements, including authentication and monitoring of external connections. How should the auditor treat the Cybersecurity Topical Requirement?

Practice question Unit: Engagement Planning

  1. ATreat it as optional guidance that the auditor may follow where it seems useful

    Topical Requirements are mandatory, not optional guidance, when the topic is in scope.

  2. BConsider it only once the board specifically asks for a cybersecurity opinion in the engagement

    Applicability is triggered by the engagement scope, not by a specific board request.

  3. CFollow its pertinent requirements in planning and performing the engagement ✓ Correct answer

    Authentication and monitoring of external connections are cybersecurity matters, so the topic is in scope and the relevant requirements apply.

  4. DDefer it to a separate cybersecurity engagement and keep this engagement limited to access procedures

    Splitting off the topic would leave in-scope cybersecurity risks unaddressed and does not avoid the requirement.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section A, Topic 1, p.1; The IIA, Global Internal Audit Standards (2024), Standard 13.3 Engagement Objectives and Scope; The IIA, Global Internal Audit Standards (2024), IPPF introduction: Topical Requirements; IIA Topical Requirement & User Guide: Cybersecurity

02An internal auditor is evaluating whether a retailer collected all supplier rebates it was entitled to last year. Which criteria are most relevant?

Practice question Unit: Engagement Planning

  1. AThe purchasing manager's yearly rebate estimate

    An estimate is not an authoritative specification of entitlement.

  2. BThe rebate amounts recorded in the general ledger

    Recorded amounts are part of the condition being tested, not the criteria.

  3. CThe average rebate percentage reported by competing retailers

    Competitor averages do not define what this retailer was owed.

  4. DThe rebate terms in the signed supplier agreements ✓ Correct answer

    Entitlement is defined by the contracts, so the agreed rebate terms specify the desired state.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section A, Topic 2, p.1; The IIA, Global Internal Audit Standards (2024), Standard 13.4 Evaluation Criteria

03An internal auditor is preparing the work program for an assurance engagement on cybersecurity. How should the Cybersecurity Topical Requirement shape the program?

Practice question Unit: Engagement Planning

  1. AIt sets a baseline of requirements to evaluate; auditors add procedures based on the engagement risk assessment ✓ Correct answer

    Topical Requirements establish a minimum baseline for the topic; the Standards still require a risk assessment and a work program based on it.

  2. BIt replaces the work program, with the requirement itself serving as the audit procedures

    A work program must still identify criteria, tasks, methodologies, and assigned auditors.

  3. CIt is used only after fieldwork to grade management's cybersecurity maturity

    The requirement guides planning and performance, not only post-fieldwork grading.

  4. DIt provides the complete list of test steps; no engagement risk assessment is needed for cybersecurity work

    The engagement risk assessment is still required under the Standards.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section A, Topic 3, p.1; The IIA, Global Internal Audit Standards (2024), Standard 13.6 Work Program; The IIA, Global Internal Audit Standards (2024), IPPF introduction: Topical Requirements; IIA Topical Requirement & User Guide: Cybersecurity

04Management is launching a new digital service with requirements changing weekly and wants early insight on risks. Which engagement approach is most suitable?

Practice question Unit: Engagement Planning

  1. AA continuous auditing routine run on the service's transaction data

    A new service has little stable transaction data yet; short sprints with frequent results suit changing requirements.

  2. BAn integrated audit covering IT and operations once the service is stable

    Waiting for stability gives no early insight while requirements are still changing.

  3. CA traditional approach that fixes scope at the start and reports after testing is done

    A fixed scope with late reporting would deliver insights after key decisions are made.

  4. DAn agile approach using short sprints with frequent communication of results ✓ Correct answer

    Rapidly changing requirements and a need for early insight favor iterative work and frequent feedback.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section A, Topic 4, p.2; The IIA, Global Internal Audit Standards (2024), Standard 13.3 Engagement Objectives and Scope; Generally accepted agile auditing concepts

05While assessing risks for a cybersecurity engagement, the auditor reviews how management handles cyber risks. Under the risk management area of the Cybersecurity Topical Requirement, what should the auditor evaluate?

Practice question Unit: Engagement Planning

  1. AWhether the board has approved a cybersecurity strategy that is updated as threats change

    A board-approved, updated cybersecurity strategy belongs to the governance area; the question asks about the risk management area, which covers how cyber risks are assessed, owned, and escalated.

  2. BWhether cyber risks are assessed periodically and escalated when tolerance is exceeded ✓ Correct answer

    The risk management area concerns how cyber risks are identified, assessed, owned, and escalated.

  3. CWhether user access to critical systems is reviewed and revoked on a timely basis

    Reviewing and revoking user access is part of the control processes area, not the risk management area.

  4. DWhether systems are patched and configured to approved security baselines

    Patching and secure configuration are control processes; they do not show how cyber risks are assessed and escalated.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section A, Topic 5, p.2; The IIA, Global Internal Audit Standards (2024), Standard 13.2 Engagement Risk Assessment; The IIA, Global Internal Audit Standards (2024), IPPF introduction: Topical Requirements; IIA Topical Requirement & User Guide: Cybersecurity

06An auditor wants to know whether warehouse staff follow the procedure of checking ID badges before releasing goods. Which method gives the most direct information?

Practice question Unit: Information Gathering, Analysis, and Evaluation

  1. AAnalyzing monthly inventory values by location

    Inventory values do not show badge checks.

  2. BObserving the release process in real time ✓ Correct answer

    Observation gives the auditor direct information about how an activity is actually performed.

  3. CReviewing the procedures manual and training records

    Manuals and training records show what should happen, not what does.

  4. DInquiry of the warehouse manager about the procedure

    Inquiry is indirect.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section B, Topic 1, p.3; The IIA, Global Internal Audit Standards (2024), Standard 14.1 Gathering Information for Analyses and Evaluation

07An auditor testing payroll accuracy for the current year collects detailed data on the prior year's recruitment campaign costs. How should this information be evaluated?

Practice question Unit: Information Gathering, Analysis, and Evaluation

  1. AIt is sufficient, because a large volume of data was collected

    Volume does not create sufficiency when the information is irrelevant.

  2. BIt is reliable, so it should be used

    Reliable but irrelevant information does not support the objective.

  3. CIt is not relevant, since it lies outside the objective and period ✓ Correct answer

    Information must relate to the objectives and scope; prior-year recruitment costs do not address current payroll accuracy.

  4. DIt is relevant and useful, because recruitment affects payroll indirectly

    An indirect link does not make data relevant; it must relate to the objective and period.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section B, Topic 2, p.3; The IIA, Global Internal Audit Standards (2024), Standard 14.1 Gathering Information for Analyses and Evaluation

08What is the main difference between continuous monitoring and continuous auditing?

Practice question Unit: Information Gathering, Analysis, and Evaluation

  1. AMonitoring is management's process; auditing is internal audit's ongoing assurance ✓ Correct answer

    Continuous monitoring is a management responsibility for overseeing controls; continuous auditing is internal audit's frequent, automated assurance work.

  2. BMonitoring uses manual reviews and checklists; auditing relies on artificial intelligence

    The difference is ownership: monitoring is management's process; continuous auditing is internal audit's assurance.

  3. CMonitoring covers financial controls; auditing covers IT controls

    Both can cover any control area; the difference is who performs them and why.

  4. DMonitoring runs in real time; auditing reviews data after period-end

    Continuous auditing is also frequent or near real time; the difference is ownership and purpose.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section B, Topic 3, p.4; Generally accepted data analytics concepts; The IIA's Three Lines Model (2020)

09Why do internal auditors divide a process into segments such as initiation, authorization, recording, and reporting?

Practice question Unit: Information Gathering, Analysis, and Evaluation

  1. ATo assign each segment a separate risk and audit rating

    Segments may be rated, but the purpose is to tie risks and controls to where they occur.

  2. BTo link each risk and control to the stage where it occurs ✓ Correct answer

    Segmenting lets the auditor pinpoint where risks arise and which controls address them, which supports the engagement risk assessment.

  3. CTo estimate the hours needed for each part of fieldwork

    Budgeting is a side use; segmentation mainly links risks and controls to stages.

  4. DTo reduce the number of controls management needs to design

    Control design is management's responsibility; segmentation does not reduce it.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section B, Topic 4, p.4; The IIA, Global Internal Audit Standards (2024), Principle MAP, Standard 13.2 Engagement Risk Assessment; Generally accepted process mapping concepts

10A new engagement on fleet maintenance is starting. The supervisor has not yet seen the draft engagement objectives. What should the supervisor do first?

Practice question Unit: Engagement Supervision and Communication

  1. AApprove the work program first, then review the objectives

    The work program is built to achieve the objectives, so objectives are reviewed first.

  2. BTake the lead auditor's confirmation that the required objectives are complete

    The supervisor's own review is needed; a confirmation from the lead does not replace it.

  3. CInvite fleet management to approve the draft objectives

    Management is consulted on objectives, but internal audit approves them.

  4. DReview the draft objectives to confirm they address key risks ✓ Correct answer

    Standard 12.3 notes that the CAE or supervisor should review the engagement objectives during planning.

Reference: CIA Part 2 Expanded Test Specifications (2025 syllabus, V2.09.2024), Section C, Topic 1, p.5; The IIA, Global Internal Audit Standards (2024), Standard 12.3 Oversee and Improve Engagement Performance; Standard 13.3 Engagement Objectives and Scope

Keep preparing for Certified Internal Auditor (CIA) Part 2: Internal Audit Engagement

See also: Accounting & Tax Exams

All Accounting & Tax Exams (14)