CIA P1 Ethics and Professionalism: practice questions with answers

Question 1

Under the IIA's Global Internal Audit Standards (effective January 2025), where are the ethical requirements that apply to internal auditors set out?

1. A In a separate Code of Ethics that sits outside the Standards and is issued as recommended guidance only
2. B In the Topical Requirements, which set out ethics rules for each type of audit subject
3. C In Domain II, Ethics and Professionalism, which contains five principles and their supporting standards
4. D In each organization's internal audit charter, which the board drafts and approves every year

Show the answer

Answer: C. The Global Internal Audit Standards are organised into five domains. Domain II, Ethics and Professionalism, replaced the old stand-alone Code of Ethics and contains five principles: demonstrate integrity, maintain objectivity, demonstrate competency, exercise due professional care and maintain confidentiality. Each principle is supported by standards with requirements that are mandatory for internal auditors.

Question 2

Hamza has been an internal auditor at Brightling Health for six years and holds the CIA. He has just been promoted to audit manager, where he will supervise engagement teams, review working papers and coach junior staff, none of which he has done before. Which development plan best meets Standards 3.1 and 3.2?

1. A Complete the CPE hours his CIA requires on any topics, since his audit skills were judged good enough to earn the promotion
2. B Build the supervision, review and coaching skills his new role needs, through training and mentoring, alongside his CIA's CPE
3. C Repeat the technical courses he took as a new auditor, so that he can check junior staff's work against the same methods
4. D Postpone any development for a year, so that he can first learn what the new role requires through experience on the job

Show the answer

Answer: B. Standard 3.1 requires competencies suitable for one's job position and responsibilities, and Standard 3.2 requires internal auditors to maintain and continually develop their competencies, including through education and training, and certified auditors to meet the CPE requirements of their certifications. Hamza's new role is mainly about supervising, reviewing and coaching, so his development should focus on those skills, for example through training and mentoring by an experienced manager, while he continues to meet his CIA's CPE requirements. Random CPE topics, repeated entry-level courses or a year's delay would leave him without the competencies his position requires.

Question 3

During an operational engagement, an internal auditor at Marrow Paper finds evidence that a plant is discharging wastewater above the limits in its environmental permit. Which response best meets Standard 1.3, Legal and Ethical Behavior?

1. A Report the violation to the individuals or bodies with authority to act, as permitted by laws, regulations and the organization's policies
2. B Ignore the matter, because environmental compliance falls outside the engagement's agreed scope
3. C Post details of the violation on social media to pressure the organization to stop
4. D Agree with the plant manager to keep the matter confidential if the discharges stop next month

Show the answer

Answer: A. Standard 1.3 requires internal auditors not to engage in or be party to illegal or discreditable activity, to understand and abide by relevant laws and regulations, and, if they identify legal or regulatory violations, to report them to individuals or entities that have the authority to take action, as permitted by laws, regulations, policies and procedures. Typically this means the CAE, legal counsel, senior management and/or the board.

Question 4

The chief audit executive of Ellery Pharma engages an external data analytics firm to help internal audit process employee payroll records. Which statement about confidentiality is consistent with the Global Internal Audit Standards?

1. A The CAE must ensure the firm follows the same requirements for protecting information as internal audit's own staff
2. B The firm has no confidentiality obligations to Ellery because it is not part of internal audit
3. C The firm may reuse Ellery's payroll data in its anonymized industry benchmarking products
4. D Only the firm's own internal policies apply to the payroll data once it has been transferred

Show the answer

Answer: A. Standard 5.2 requires internal auditors to protect confidential and private information, and requires the CAE to ensure that the internal audit function's policies on protecting information are followed by everyone who assists the function, including external service providers. Engagement terms should cover confidentiality, use, retention and return or destruction of data.

Question 5

The CAE of Ridgeway Pharmacy Group proposes that 60% of each internal auditor's annual bonus should depend on the satisfaction ratings given by the managers of the areas audited. What is the main objectivity concern with this proposal?

1. A Auditors will build close relationships with auditees over time, a familiarity threat that is best managed by rotating assignments
2. B Auditors would be reviewing their own previous work, a self-review threat that requires a cooling-off period
3. C There is no concern, because the Standards require auditee ratings to be the main measure of internal auditor performance
4. D Auditors may soften or omit unfavorable findings to protect their ratings, a self-interest threat to objectivity

Show the answer

Answer: D. Standard 2.2 requires internal auditors to avoid conflicts of interest and not to be unduly influenced by their own interests or those of others. A bonus scheme in which most of the reward depends on auditees' approval creates a self-interest threat: an auditor may be tempted to soften findings to protect their income. The CAE should design performance measures that reward quality, evidence-based work (for example, supervisory review results and stakeholder value) rather than auditee approval of findings.

Question 6

Ottilie, an internal auditor at Brayford Energy, has been assigned to lead an engagement on the company's commodity hedging program. She has never worked on derivatives or hedge accounting, and fieldwork starts in three days. Under Standard 3.1, Competency, what should she do?

1. A Start fieldwork as planned and rely on the treasury team's explanations, since they are the company's experts on derivatives and hedging
2. B Tell the CAE or her supervisor about the gap before fieldwork, so that training, support or reassignment can be arranged
3. C Narrow the engagement scope herself to the areas she understands, without telling anyone about the change
4. D Refuse the assignment in a letter to the audit committee, since only the board can reassign engagements

Show the answer

Answer: B. Standard 3.1 requires internal auditors to possess or obtain the competencies needed for their responsibilities and to engage only in services for which they have, or can attain, the necessary competencies. Leading an engagement on derivatives with no relevant knowledge would not meet this requirement. Ottilie should raise the gap with the CAE or her supervisor straight away, so that the function can provide training, add a specialist to the team or assign someone else, before fieldwork begins.