CIA P3 Quality of the Internal Audit Function: practice questions with answers

Question 1

Which activity at Aldersgate Bank's internal audit function is an example of ONGOING MONITORING within its quality assurance and improvement program?

1. A Engagement supervisors reviewing workpapers and draft reports against the function's methodology on every engagement
2. B An independent assessor reviewing the function's conformance with the Standards as part of a five-yearly assessment
3. C The external auditor reviewing internal audit's work before relying on it for the financial statement audit
4. D A team from the function's quality unit reviewing a selection of completed engagement files once a year

Show the answer

Answer: A. The quality assurance and improvement program includes internal assessments, made up of (1) ongoing monitoring, which is part of the routine supervision, review and measurement of internal audit activity (for example, engagement supervision, standard checklists and performance metrics), and (2) periodic self-assessments, performed at intervals by members of the function or others in the organization with sufficient knowledge of internal audit practices. It also includes external quality assessments.

Question 2

Holloway Credit's four-person internal audit function has a limited budget. Its external quality assessment is due next year. Which approach would satisfy the external assessment requirement?

1. A An extended internal self-assessment performed every year, with the external assessment deferred to an eight-year cycle instead
2. B The external auditor's annual evaluation of internal audit work before relying on it for the financial statement audit
3. C A comprehensive self-assessment by the function, with its conclusions validated by a qualified, independent external validator
4. D A review by the organization's compliance department, which is independent of internal audit within the organization

Show the answer

Answer: C. Standard 8.4 allows the external quality assessment requirement to be met through a self-assessment with independent validation (SAIV): the function performs a rigorous self-assessment and a qualified, independent external assessor validates it. This is often more economical for smaller functions. The CAE should discuss with the board the rationale for choosing an SAIV rather than a full external assessment.

Question 3

The CAE of Galloway Telecom wants to formalize how the function's performance is measured. Which approach is MOST consistent with the Global Internal Audit Standards?

1. A Use the number of engagements completed as the sole measure, because it is objective and easy to verify
2. B Develop performance objectives and measures with input from the board and senior management, and report progress against them
3. C Let senior management set the function's performance targets, because management is the main day-to-day user of internal audit's work
4. D Avoid formal measures, because quantitative indicators may encourage auditors to prioritize speed over quality

Show the answer

Answer: B. Standard 12.2 (Performance Measurement) requires the CAE to develop objectives to evaluate the function's performance and a performance measurement methodology, including key performance indicators, with input from the board and senior management. Results are reported to the board and senior management, and the board approves the function's performance objectives. Measures typically balance efficiency, quality, stakeholder value and people indicators.

Question 4

An external quality assessment of Wexcombe Insurance's internal audit function identifies a nonconformance: the function has no documented methodology for rating the significance of engagement findings. The assessor has sent the complete results directly to the audit committee, and the CAE has prepared an action plan. Under Standard 8.4, what is the audit committee's role NOW?

1. A Write the findings-rating methodology itself, because the nonconformance was identified by an independent assessor
2. B Delegate approval of the action plan to the CFO, who is responsible for the organization's financial reporting
3. C Review and approve the CAE's action plan and its timeline, and then monitor the CAE's progress in implementing it
4. D Take no further action until the next external assessment, which will confirm whether the plan has been implemented

Show the answer

Answer: C. Standard 8.4 (External Quality Assessment) sets out the board's responsibilities, which include:

- discussing and approving the CAE's plan for the assessment;
- receiving the complete results directly from the assessor;
- reviewing and approving the CAE's action plans to address identified deficiencies and opportunities for improvement; and
- approving a timeline for completing the action plans and monitoring the CAE's progress.

At Wexcombe, the first steps are done, so the audit committee now approves the plan and timeline and follows up on progress, for example through quarterly QAIP updates from the CAE.

Question 5

Five regional water utilities in the same industry association, Aberlyn, Brockford, Calverly, Dunmere and Elstow, are looking for a low-cost way to meet the external quality assessment requirement for their internal audit functions. Which arrangement is MOST likely to be considered independent under Standard 8.4?

1. A Aberlyn and Brockford assess each other, and the other three utilities hire the same external consulting firm
2. B Each is assessed by the next in a five-way rotation, so no two assess each other, and all members confirm no conflicts
3. C Each assessment is performed by the association's quality committee, made up of the members' own CAEs, which sets and monitors members' quality standards
4. D Each assessment is performed by the utility's own risk department, which is organizationally separate from internal audit

Show the answer

Answer: B. Standard 8.4 requires the external quality assessment to be performed by a qualified, independent assessor or team. The IIA's considerations on independence include:

- Reciprocal peer assessments between two organizations are not independent.
- Assessments rotated among three or more peer organizations (for example, members of the same industry association) may be considered independent, if independence and objectivity are protected and every team member can fully carry out the role.
- People from a related organization or from an entity with oversight or quality assurance responsibilities for the subject organization are not independent.
- Staff from another department of the same organization are not independent.

A five-way rotation (Brockford assesses Aberlyn, Calverly assesses Brockford, and so on, with Aberlyn assessing Elstow) avoids any two-way swap. Each team still needs at least one member with an active CIA designation and should attest that it has no conflicts of interest.

Question 6

The audit committee of Kestrel Foods asks why the CAE's performance report includes both quantitative and qualitative measures. Which explanation is MOST appropriate?

1. A The Standards require that at least half of the measures reported to the board be qualitative, so that numbers do not dominate
2. B Quantitative measures are easy to track but mostly capture outputs, while qualitative measures capture judgments of quality and value
3. C Qualitative measures are more reliable than quantitative measures, so they are used to check that the quantitative data are accurate
4. D Quantitative measures assess the function as a whole, while qualitative measures are used only to appraise individual auditors

Show the answer

Answer: B. Quantitative measures (for example, plan completion, days to report, cost per hour) are objective, easy to compare over time and easy to set targets for, but they mostly measure output and efficiency and can encourage speed over substance. Qualitative measures (for example, structured feedback from the board and senior management, interviews, assessments of report insight) capture perceptions of quality and value but are more subjective.

Using both gives the board a balanced picture of the function's performance, which supports the performance measurement methodology required by Standard 12.2.