CIA P3 Part 3 · Internal Audit Function: mock exams and practice questions

Sample question 1 · Internal Audit Operations

Priya Raman has just been appointed chief audit executive (CAE) of Halvorsen Logistics. The audit committee asks her to produce an internal audit strategy before the next planning cycle. Under the Global Internal Audit Standards, which content is MOST essential to that strategy?

1. A A vision for the function, strategic objectives and supporting initiatives aligned with the organization's strategy
2. B A schedule of the engagements to be performed in the next twelve months, with the budgeted hours for each engagement
3. C A statement of the function's purpose, authority, responsibilities and unrestricted access to records, personnel and property
4. D A detailed manual covering workpaper format, sampling procedures, finding ratings and review sign-offs for engagements

Show the answer

Answer: A. The Global Internal Audit Standards (Principle 9) distinguish several planning documents. The internal audit strategy sets the long-term direction: a vision of what the function aims to become, strategic objectives to get there and initiatives (for example, talent, technology, quality) that support them, aligned with the organization's strategy and stakeholder expectations. The charter records the mandate and authority, the methodologies guide how work is done, and the internal audit plan lists the engagements and resources for a period. The CAE reviews the strategy with the board and senior management periodically.

Sample question 2 · Internal Audit Plan

Merrow Brands completes the acquisition of a payments company in another country. The subsidiary has its own IT systems and has never been audited by Merrow's internal audit function. What should the CAE do with respect to the audit universe?

1. A Add the subsidiary's processes, systems and entities to the audit universe and include them in the next risk assessment
2. B Exclude the subsidiary from the audit universe until it has operated under Merrow's ownership for one full financial year
3. C Include the subsidiary only if the board specifically requests an engagement on the acquired business
4. D Treat the subsidiary as covered by the parent company's existing auditable units for planning purposes

Show the answer

Answer: A. The audit universe is the full set of auditable units (entities, processes, functions, systems, projects) in the organization. It must be kept current when the organization changes. A new subsidiary with its own systems and an unfamiliar regulatory environment is often higher risk, so it should be added to the universe and assessed in the next documented risk assessment that underpins the plan.

Sample question 3 · Quality of the Internal Audit Function

Which activity at Aldersgate Bank's internal audit function is an example of ONGOING MONITORING within its quality assurance and improvement program?

1. A Engagement supervisors reviewing workpapers and draft reports against the function's methodology on every engagement
2. B An independent assessor reviewing the function's conformance with the Standards as part of a five-yearly assessment
3. C The external auditor reviewing internal audit's work before relying on it for the financial statement audit
4. D A team from the function's quality unit reviewing a selection of completed engagement files once a year

Show the answer

Answer: A. The quality assurance and improvement program includes internal assessments, made up of (1) ongoing monitoring, which is part of the routine supervision, review and measurement of internal audit activity (for example, engagement supervision, standard checklists and performance metrics), and (2) periodic self-assessments, performed at intervals by members of the function or others in the organization with sufficient knowledge of internal audit practices. It also includes external quality assessments.