Here are 20 case-based multiple-choice questions covering all domains of the CIA Part 1 Exam Syllabus (Internal Audit Fundamentals: Foundations, Ethics/Professionalism, Governance/Risk/Control, and Fraud Risks).
Question 1: Foundations – Internal Audit Purpose
Case: An internal audit activity (IAA) is asked by the production vice president to design a new assembly-line routing slip to fix bottlenecks. The Chief Audit Executive (CAE) accepts this operational workflow design assignment.
- Question: Which of the following actions fails to align with the core mandate of internal auditing under global standards?
- A. Performing consulting services that compromise subsequent objective assurance evaluations on that specific line.
- B. Reviewing operational efficiency metrics during routine scheduled audits.
- C. Providing objective evaluations of organizational risk management frameworks.
- D. Assessing the reliability and integrity of operational reporting systems.
- Answer:
Question 2: Foundations – Internal Audit Charter
Case: A newly drafted charter for an internal audit activity states that the internal auditors may review any record or physical property, but must obtain prior clearance from the head of human resources before interviewing any plant supervisor.
- Question: Which of the following provisions in the charter represents an improper constraint on internal audit authority?
- A. Permitting access to operational records and plant properties.
- B. Requiring human resources clearance prior to interviewing operational supervisors.
- C. Granting the CAE direct access to the board of directors.
- D. Outlining the scope of both assurance and advisory services.
- Answer:
Correction for Q2 option mapping:
- A. Permitting physical access to all enterprise assets.
- B. Allowing the chief executive officer to set the internal audit budget.
- C. Requiring human resources clearance prior to interviewing operational supervisors.
- D. Granting the CAE direct communication access to the governing board.
- Answer:
Question 3: Foundations – Assurance vs. Advisory Services
Case: An internal auditor performs a review of IT disaster recovery procedures and issues a formal rating along with recommendations. In the next quarter, the same auditor writes and implements a data backup schedule for a newly acquired subsidiary.
- Question: Which of the following activities constitutes a departure from pure assurance engagements?
- A. Evaluating the design adequacy of backup systems.
- B. Testing recovery time objectives against established benchmarks.
- C. Directly executing operational data backup schedules for the subsidiary.
- D. Reporting control deficiencies to senior operational management.
- Answer:
Question 4: Ethics – Integrity Principle
Case: An internal auditor discovers a minor misclassification in travel expense reports submitted by a close personal friend in marketing. The auditor skips reporting this discrepancy because it falls below the monetary materiality threshold set for field audits.
- Question: Which of the following ethical obligations under the IIA Code of Ethics is compromised by the auditor's omission?
- A. Performing work with honesty, diligence, and responsibility.
- B. Avoiding participation in activities that impair professional judgment.
- C. Exhibiting high competency and continuing professional education.
- D. Maintaining absolute discretion when handling sensitive corporate files.
- Answer:
Question 5: Ethics – Objectivity Impairment
Case: An internal auditor was transferred from the corporate accounting department six months ago, where she personally managed the reconciliations for the main operating cash account. She is now assigned to lead the quarterly cash controls audit.
- Question: Which of the following conditions correctly characterizes this assignment regarding professional objectivity?
- A. It represents an unmitigated impairment because she previously performed operational work on that specific account.
- B. It is fully acceptable provided she signs an independence declaration form.
- C. It breaches confidentiality standards by exposing prior accounting entries.
- D. It constitutes a violation of institutional competency requirements.
- Answer:
Question 6: Ethics – Confidentiality Principle
Case: An internal auditor discusses unannounced upcoming plant downsizing data with a neighbor at a social gathering to impress them with insider knowledge, though no financial gain or competitive harm occurs.
- Question: Which of the following rules of professional conduct is violated by this casual disclosure?
- A. Performing internal audit services with professional proficiency.
- B. Refraining from using information for personal or inappropriate interpretation.
- C. Disclosing confidential information without legal or professional obligation.
- D. Obeying the governing laws of the host country jurisdiction.
- Answer:
Question 7: Ethics – Competency Requirement
Case: An internal auditor is assigned to evaluate a complex blockchain-based smart contract settlement system. The auditor has no training, practical experience, or understanding of distributed ledger technology and submits an assurance report claiming complete control efficacy based on verbal assurances from the IT developer.
- Question: Which of the following professional standards is breached through this audit approach?
- A. The requirement to engage only in services for which the auditor possesses the necessary knowledge and skills.
- B. The mandate to report all findings directly to external regulatory bodies.
- C. The duty to rotate audit assignments every three years.
- D. The obligation to perform joint audits with external technical specialists.
- Answer:
Question 8: Governance – Board and Management Roles
Case: The board of directors delegates complete authority over corporate risk governance policies, executive compensation metrics, and internal control monitoring design directly to the Chief Executive Officer without establishing an independent audit committee or oversight mechanism.
- Question: Which of the following governance deficiencies is most directly demonstrated by this structural arrangement?
- A. Absence of effective independent oversight of management actions by the governing board.
- B. Failure of the internal audit activity to maintain a dual reporting line.
- C. Inadequate allocation of operational resources for line management.
- D. Excessive reliance on external auditors for routine financial reconciliations.
- Answer:
Question 9: Governance – Organizational Culture
Case: An enterprise exhibits a dominant "shoot the messenger" organizational culture where middle managers systematically hide production failure metrics from executive leadership to avoid punitive measures.
- Question: Which of the following impacts on the internal control environment is expected under this specific culture?
- A. Management reports will accurately reflect residual risk profiles.
- B. Employees will aggressively utilize anonymous whistleblowing channels.
- C. Fraud detection and risk identification will be significantly obstructed or delayed.
- D. Operational efficiency metrics will display absolute integrity.
- Answer:
Question 10: Risk Management – Risk Appetite vs. Tolerance
Case: A retail bank establishes an explicit operational error rate limit of 0.05% for customer fund transfers, representing the maximum boundary of variation the board is willing to accept for transactional accuracy.
- Question: Which of the following governance components does this specific 0.05% boundary represent?
- A. The entity's overarching high-level risk appetite statement.
- B. An unquantifiable inherent operational hazard.
- C. The precise operational risk tolerance threshold for transaction processing.
- D. A residual risk exposure level post-mitigation.
- Answer:
Question 11: Risk Management – Inherent vs. Residual Risk
Case: An IT warehouse implements state-of-the-art multi-factor authentication, biometric door locks, and real-time network intrusion prevention software to protect sensitive customer records.
- Question: Which of the following terms describes the remaining threat level to customer data after these robust security measures are fully functioning?
- A. Total inherent risk magnitude.
- B. Ignored systemic vulnerability.
- C. Residual risk exposure.
- D. Unmanaged compliance hazard.
- Answer:
Question 12: Control Concepts – Preventive Controls
Case: Management lists several internal mechanisms intended to safeguard cash receipts: security cameras in the lobby, daily exception reports on cash drawers, supervisor sign-offs on large refunds, and pre-numbered cash register slips requiring manager approval before drawer opening.
- Question: Which of the following listed procedures functions as a detective control rather than a preventive control?
- A. Pre-numbered cash register slips requiring manager entry.
- B. Biometric identification pads installed at the vault entrance.
- C. Daily exception reports identifying cash drawer discrepancies after closing.
- D. Physical security guard patrols during business hours.
- Answer:
Question 13: Control Concepts – Control Environment
Case: A manufacturing plant manager routinely bypasses corporate purchasing authorizations for urgent equipment repairs by splitting large invoices into multiple small purchase orders to stay under individual approval ceilings. Upper management is aware but ignores this practice due to high production targets.
- Question: Which of the following foundational components of internal control is most undermined by this management behavior?
- A. The overall control environment and tone at the top.
- B. Physical safeguarding of inventory records.
- C. Independent reconciliation of bank balances.
- D. Segregation of operational custody from accounting.
- Answer:
Question 14: Control Concepts – Evaluating Control Design
Case: An internal auditor reviews a manual inventory ordering process. The warehouse clerk creates purchase orders, approves the purchase orders, receives the inventory dock delivery, and enters the receiving log into the accounting system without any secondary review or system restriction.
- Question: Which of the following control deficiencies is explicitly exposed in this process design?
- A. Inadequate segregation of incompatible duties.
- B. Absence of timely batch numbering protocols.
- C. Failure to perform monthly physical inventory counts.
- D. Ineffective physical security of the inventory warehouse floor.
- Answer:
Question 15: Fraud Risks – Fraud Triangle Elements
Case: A long-term trusted payroll supervisor with mounting personal gambling debts uses administrative rights in the software to create a fictitious employee, routing extra direct deposits to an alternative personal account. No mandatory vacation policies or password access restrictions exist.
- Question: Which of the following elements of the fraud triangle is represented by the supervisor's mounting gambling debts?
- A. Rationalization of dishonest actions.
- B. Systemic lack of physical controls.
- C. Financial pressure or incentive.
- D. Perceived organizational opportunity.
- Answer:
Question 16: Fraud Risks – Management vs. Employee Fraud
Case: The Chief Financial Officer adjusts journal entries at year-end to artificially inflate reported revenue numbers to meet aggressive earnings targets tied to executive stock option bonuses.
- Question: Which of the following primary characteristics differentiates this fraudulent activity from typical asset misappropriation by low-level clerks?
- A. It is typically characterized by financial statement distortion aimed at external stakeholders rather than direct personal cash theft.
- B. It is easily detected through basic cash count reconciliations.
- C. It lacks any rationalization component for the perpetrator.
- D. It originates from weak physical locks on inventory doors.
- Answer:
Question 17: Fraud Risks – Auditor Responsibility
Case: An internal auditor is conducting an operational efficiency review of the procurement department. During routine document inspection, the auditor notes duplicate vendor invoice numbers with altered invoice dates paid to the same address.
- Question: Which of the following responses is required of the internal auditor upon identifying these red flags?
- A. Disregard the anomaly because the engagement scope is strictly operational efficiency, not fraud investigation.
- B. Immediately confront the procurement clerk without notifying the CAE.
- C. Expand audit procedures to determine if fraud indicators warrant a formal investigation referral.
- D. Issue an immediate public press release regarding suspected malfeasance.
- Answer:
Question 18: Fraud Risks – Warning Signs (Red Flags)
Case: An accountant responsible for accounts payable processing exhibits an affluent lifestyle far exceeding known salary levels, refuses to take annual paid vacations for five consecutive years, and reacts defensively when colleagues look at vendor master files.
- Question: Which of the following conclusions should the internal auditor draw regarding these behavioral indicators?
- A. They indicate optimal operational performance and high employee dedication.
- B. They represent classic behavioral red flags associated with potential occupational fraud.
- C. They signify conformance with corporate governance standards.
- D. They confirm the total absence of inherent risk in accounting.
- Answer:
Question 19: Foundations – Mandate and Authority
Case: The CAE receives a complaint from an anonymous whistleblower alleging kickbacks in the shipping department. When the internal audit team arrives, the shipping manager refuses to hand over shipping manifests, stating that internal audit has no jurisdiction over third-party logistics records.
- Question: Which of the following assertions regarding internal audit authority is accurate in this context?
- A. Internal auditors must restrict their work to financial ledgers and avoid operational shipping docks.
- B. The manager's refusal violates the unrestricted access rights granted to internal audit in the approved charter.
- C. Internal audit must obtain explicit permission from external legal counsel before examining shipping records.
- D. The CAE must cancel the audit due to lack of administrative supervision over logistics.
- Answer:
Question 20: Governance & Control – Three Lines Model
Case: In a large manufacturing enterprise, operational management owns risk identification, a separate risk management and compliance department oversees risk frameworks, and the internal audit team provides independent assurance to the board.
- Question: Which of the following structural arrangements would violate the core principles of the Three Lines Model ?
- A. Assigning internal audit the responsibility for designing and operating operational risk mitigation controls.
- B. Having operational managers assess their own first-line operational risks.
- C. Requiring internal audit to report functionally to the audit committee.
- D. Maintaining a separate compliance oversight unit in the second line.
- Answer:
