52-question case-based MCQ set aligned to the 2025 CIA Part 1 syllabus and the Global Internal Audit Standards (GIAS).

 

52-question case-based MCQ set aligned to the 2025 CIA Part 1 syllabus and the Global Internal Audit Standards (GIAS).

Below is 52-question case-based MCQ set aligned to the 2025 CIA Part 1 syllabus and the Global Internal Audit Standards (GIAS). The four domains and weightings are: Foundations of Internal Auditing (35%), Ethics and Professionalism (20%), Governance, Risk Management, and Control (30%), and Fraud Risks (15%) . The majority remain negative-type items.

Domain 1: Foundations of Internal Auditing (35%)

1. A CAE is drafting the internal audit charter. The board asks which element is least required to be included under GIAS Standard 6.2.

· A. The function's purpose, authority, and responsibilities

· B. The function's position in the organization and reporting relationships

· C. The specific audit methodologies and sampling techniques to be used

· D. Unrestricted access to records, personnel, and physical property

2. Senior management alone determines the internal audit budget, overriding the board's role. Which statement is most accurate regarding organizational independence?

· A. This is acceptable because management operates the organization day-to-day.

· B. This impairs organizational independence because the audited areas gain indirect control over audit scope through resource limitation.

· C. Independence is unaffected as long as the CAE reports functionally to the board.

· D. The CAE should simply accept the budget and document the limitation.

3. A CAE concludes that repeated executive interference has created a perceived (though not actual) independence impairment. What is required?

· A. No action, because the impairment is only perceived.

· B. Disclosure to the board, because perceived impairments are treated on the same footing as actual ones.

· C. Resignation of the CAE.

· D. Documentation in the engagement workpapers only.

4. An auditor is asked to facilitate a risk workshop and help management identify key risks and suggest mitigation strategies. Later, internal audit plans an assurance engagement over the same risk area. Which action is least appropriate?

· A. Proceed with the audit because risk identification is management's responsibility.

· B. Assign auditors who were not involved in the workshop to perform the assurance engagement.

· C. Recognize that advisory involvement creates a self-review threat requiring mitigation.

· D. Document the threat and the safeguard applied.

5. Which statement about the internal audit mandate is least accurate under GIAS?

· A. The mandate is defined in the internal audit charter.

· B. The mandate establishes the function's authority and responsibilities.

· C. The mandate is optional for small internal audit functions.

· D. The board approves the mandate.

6. An internal audit function reports functionally to the audit committee and administratively to the CFO. Which statement is least accurate?

· A. Functional reporting to the board facilitates organizational independence.

· B. Administrative reporting to the CFO creates a potential perceived conflict because the CFO is an auditee.

· C. Administrative reporting to the CFO automatically destroys organizational independence.

· D. The CAE should evaluate and disclose threats arising from the reporting structure.

Domain 2: Ethics and Professionalism (20%)

7. An employee hands an auditor a coworker's personnel file, taken without authorization, alleging payroll fraud. What should the auditor do first?

· A. Use the file as evidence because the allegation is serious.

· B. Escalate to the CAE, because the information was improperly obtained and cannot be used at the auditor's discretion.

· C. Dismiss the allegation because the source is tainted.

· D. Confront the accused employee immediately.

8. Which statement best describes professional skepticism under GIAS Standard 4.3?

· A. Presuming management is dishonest until proven otherwise.

· B. An unbiased mental attitude that questions and critically assesses the reliability of information.

· C. A checklist-based approach to evidence gathering.

· D. Accepting management representations unless contradicted by documents.

9. A CAE wants to implement a policy that best promotes individual objectivity. Which measure is most effective?

· A. Requiring all auditors to sign an annual independence declaration only.

· B. Periodic rotation of engagement assignments to address familiarity bias.

· C. Allowing auditees to select which auditor reviews their area.

· D. Assigning the same auditor to the same process year after year for efficiency.

10. An auditor accepts a weekend vacation stay from a vendor. No engagement is currently scheduled for that vendor. Which action is least appropriate?

· A. Reject the gift because it creates an appearance of impairment.

· B. Disclose the offer to the CAE and document it.

· C. Accept the gift because no engagement is currently planned.

· D. Recognize that the appearance of impairment matters, not only actual impairment.

11. Which statement about due professional care is least accurate under GIAS?

· A. Due professional care requires consideration of the possibility of material irregularities.

· B. A checklist sign-off is sufficient evidence that due professional care was exercised.

· C. Due professional care applies to both assurance and advisory services.

· D. Professional skepticism complements due professional care.

12. An auditor designs and installs a new control system for treasury, then plans to audit treasury next year. Which statement is most accurate?

· A. The auditor may proceed because one year will have passed.

· B. Designing and installing controls creates a self-review threat for the future assurance engagement.

· C. Objectivity is impaired only if the auditor also operates the system.

· D. Advisory work never creates a threat to objectivity.

Domain 3: Governance, Risk Management, and Control (30%)

13. Which statement best describes residual risk?

· A. The risk exposure before any controls are applied.

· B. The risk exposure that persists after management's risk responses and controls operate.

· C. The board's broad level of risk willingness.

· D. The acceptable variation around a specific objective.

14. A system edit refuses to pay any invoice without a matching approved purchase order. This is best classified as which control type?

· A. Detective control.

· B. Preventive control.

· C. Corrective control.

· D. Directive control.

15. A whistleblower hotline is best described as which type of control over fraud?

· A. Preventive control.

· B. Detective control.

· C. Corrective control.

· D. Directive control.

16. Senior management asks the CAE to develop and operate a new ethics hotline. What is the most appropriate response?

· A. Accept, because the CAE has the best expertise.

· B. Provide advisory input but ensure management owns and operates the hotline.

· C. Decline any involvement in the hotline.

· D. Operate the hotline but disclose the arrangement to the board.

17. A quality unit reporting to the operations director designs and monitors the controls it evaluates. The CAE plans to rely on its testing. Which conclusion is best supported?

· A. The unit's work can be treated as equivalent to internal audit assurance because it is internal.

· B. Reliance requires evaluating the unit's competence, objectivity, and methodology; self-monitoring of self-designed controls raises objectivity concerns.

· C. Any second-line function is automatically a reliable assurance provider.

· D. The CAE should rely without further procedures.

18. Which statement about risk appetite and risk tolerance is least accurate?

· A. Risk appetite is the broad level of risk the organization is willing to accept.

· B. Risk tolerance is the acceptable variation around a specific objective.

· C. Risk appetite and risk tolerance are identical concepts.

· D. The board typically approves risk appetite.

19. A manager argues that a control deficiency is acceptable because "residual risk is within appetite." The auditor should least likely:

· A. Evaluate whether the residual risk assessment is reliable.

· B. Accept the manager's conclusion without further evidence.

· C. Determine whether the acceptance decision was appropriately authorized.

· D. Report management's risk acceptance if supported.

20. Under the Three Lines Model, which responsibility belongs to internal audit?

· A. Owning and managing risk.

· B. Designing risk responses.

· C. Providing independent assurance over governance, risk management, and control.

· D. Operating the fraud-prevention program.

Domain 4: Fraud Risks (15%)

21. An anonymous hotline complaint alleges bid-rigging in procurement. The assigned auditor managed procurement contracts until six months ago. What should the CAE do?

· A. Let the auditor proceed because the complaint is anonymous.

· B. Remove the auditor and staff the engagement with auditors who have no recent operational role in procurement.

· C. Have the auditor investigate but disclose the prior role in the report.

· D. Assign the auditor as a "technical advisor" without engagement responsibility.

22. Which statement about internal audit's role in fraud is least accurate?

· A. Internal audit's primary role is to investigate fraud.

· B. Management owns the fraud risk assessment.

· C. Internal audit evaluates how management manages fraud risk.

· D. Red flags are indicators, not proof.

23. While planning a procurement engagement, which condition indicates the greatest fraud risk?

· A. A buyer who can add vendor records and also approve invoices below the supervisory review threshold.

· B. A buyer who must obtain three quotes for all purchases.

· C. Monthly reconciliations performed by the accounting department.

· D. A policy requiring rotation of procurement staff.

24. Which element of the fraud triangle can internal audit least directly reduce through its recommendations?

· A. Opportunity, by recommending segregation of duties.

· B. Opportunity, by recommending access restrictions.

· C. Rationalization, by directly changing an employee's personal ethics.

· D. Opportunity, by recommending monitoring controls.

25. A CEO tells the CAE, "You own the fraud risk assessment. Deliver it next month." Which statement is most accurate?

· A. The CAE should accept ownership because the CEO delegated it.

· B. Management owns the fraud risk assessment; internal audit evaluates fraud risk but does not own management's assessment.

· C. Internal audit owns the fraud risk assessment under GIAS.

· D. Ownership is irrelevant because the board receives the assessment.

Mixed High-Confusion Traps (Negative-Type)

26. Which statement about the internal audit charter is least accurate?

· A. The charter states purpose, authority, and responsibilities.

· B. The charter is approved by the board.

· C. The charter is optional if the CAE reports to the CEO.

· D. The charter documents reporting relationships.

27. Which statement about objectivity is least accurate?

· A. Objectivity is an individual mental attitude.

· B. Objectivity can be impaired by a recent operational role.

· C. Objectivity and organizational independence are identical concepts.

· D. Impairments to objectivity must be managed and disclosed.

28. Which statement about professional skepticism is least accurate?

· A. Skepticism requires questioning the reliability of information.

· B. Skepticism means presuming fraud in every engagement.

· C. Skepticism is defined in Standard 4.3.

· D. Skepticism complements due professional care.

29. Which statement about quality assurance under GIAS is least accurate?

· A. The CAE must develop and maintain a QAIP.

· B. External assessments are required at least once every five years.

· C. A QAIP is optional for small functions.

· D. Ongoing monitoring is part of internal assessments.

30. Which statement about non-conformance disclosure is least accurate?

· A. Significant non-conformance must be disclosed to senior management and the board.

· B. Disclosure is required even if the engagement outcome was otherwise positive.

· C. Client satisfaction eliminates the need for disclosure.

· D. Non-conformance affects the CAE's good standing with the IIA.

31. Which statement about consulting engagements is least accurate?

· A. Consulting objectives are advisory in nature.

· B. Advisory work can create self-review threats for future assurance.

· C. Consulting engagements can never include conclusions or recommendations.

· D. Advisory threats should be managed, not necessarily avoided entirely.

32. Which statement about combined assurance is least accurate?

· A. It coordinates assurance from multiple providers.

· B. It aims to avoid duplication and gaps.

· C. Internal audit can rely on any internal function's testing without evaluating objectivity.

· D. The CAE must assess competence and objectivity before relying on other providers.

33. Which statement about inherent and residual risk is least accurate?

· A. Inherent risk exists before controls.

· B. Residual risk remains after controls.

· C. Inherent risk and residual risk are always identical.

· D. Internal auditors evaluate residual risk against appetite.

34. Which statement about the Three Lines Model is least accurate?

· A. The first line owns and manages risk.

· B. The second line provides complementary expertise and monitoring.

· C. The third line, internal audit, provides independent assurance.

· D. Internal audit should own risk responses to ensure adequacy.

35. Which statement about fraud red flags is least accurate?

· A. Red flags are indicators, not proof.

· B. Red flags require further evaluation.

· C. Red flags alone are sufficient to conclude fraud occurred.

· D. Fraud indicators must be assessed in context.

36. Which statement about the board's role in internal audit independence is least accurate?

· A. The board approves the internal audit charter.

· B. The board reviews and approves the internal audit budget.

· C. The board has no role in resourcing the internal audit function.

· D. The CAE reports resource insufficiency to the board.

37. Which statement about information use under GIAS is least accurate?

· A. Internal auditors must not use information obtained improperly.

· B. Privacy expectations must be respected.

· C. An auditor may use improperly obtained information at their own discretion if the allegation is serious.

· D. Standard 5.1 governs use of information.

38. Which statement about engagement objectives is least accurate?

· A. Assurance objectives involve objective assessment of evidence against criteria.

· B. Consulting objectives are advisory in nature.

· C. Assurance objectives are determined solely by the client without auditor input.

· D. Both assurance and consulting must add value.

39. Which statement about CAE qualifications is least accurate?

· A. The CAE must possess relevant qualifications and competence.

· B. The CAE's qualifications are addressed in Standard 7.2.

· C. The CAE need not possess any audit or business competence if management supports the appointment.

· D. The board should be involved in CAE appointment decisions.

40. Which statement about the QAIP and the board is least accurate?

· A. QAIP results should be reported to the board.

· B. The board has oversight responsibility for the internal audit function's quality.

· C. The QAIP is solely an internal matter and need not be communicated to the board.

· D. External assessment results are communicated to the board.

41. An auditor concludes that a control is ineffective based on a single observation without further testing. Which statement is least accurate?

· A. Professional skepticism requires corroborating the observation.

· B. Due professional care requires evidence sufficient to support conclusions.

· C. A single observation is always sufficient for a conclusion.

· D. Professional judgment must be supported by reliable evidence.

42. Which statement about the internal audit mandate and board is least accurate?

· A. The board authorizes the internal audit mandate.

· B. The mandate establishes the function's authority.

· C. The mandate is approved by senior management alone.

· D. The charter documents the mandate.

43. Which statement about advisory services and independence is least accurate?

· A. Advisory services can create self-review threats.

· B. Threats from advisory work should be managed, not necessarily avoided entirely.

· C. Any advisory involvement permanently prohibits future assurance over the same area.

· D. Using different auditors can mitigate threats from prior advisory involvement.

44. Which statement about the fraud triangle is least accurate?

· A. Pressure, opportunity, and rationalization are the three elements.

· B. Internal audit can recommend controls that reduce opportunity.

· C. Internal audit can directly eliminate an individual's rationalization.

· D. Red flags may indicate any of the three elements.

45. Which statement about external assessments is least accurate?

· A. They are required at least once every five years.

· B. A self-assessment with independent external validation is an acceptable form.

· C. A full external assessment is the only acceptable form.

· D. Results are communicated to the board.

46. Which statement about the CAE's reporting line is least accurate?

· A. Functional reporting to the board facilitates independence.

· B. Administrative reporting to management is common for day-to-day operations.

· C. Administrative reporting to the CFO never creates any threat.

· D. The CAE should evaluate and disclose threats from the reporting structure.

47. Which statement about professional judgment is least accurate?

· A. Judgment must be supported by sufficient evidence.

· B. Judgment is the same as professional skepticism.

· C. Judgment involves applying knowledge and experience to conclusions.

· D. Judgment can be reviewed and challenged.

48. Which statement about risk response ownership is least accurate?

· A. Management owns risk responses.

· B. Internal audit may advise on risk responses.

· C. Internal audit should implement risk responses to ensure effectiveness.

· D. Taking ownership of risk responses impairs objectivity.

49. Which statement about confidentiality under GIAS is least accurate?

· A. Internal auditors must protect information.

· B. Information use is governed by Standard 5.1.

· C. Confidentiality requires never sharing information with anyone.

· D. Confidentiality applies to information obtained during engagements.

50. Which statement about the board's oversight of the CAE is least accurate?

· A. The board should be involved in CAE appointment and removal decisions.

· B. The CAE reports functionally to the board.

· C. The CEO alone should decide CAE removal without board involvement.

· D. Board oversight supports organizational independence.

51. Which statement about a QAIP is least accurate?

· A. Ongoing monitoring is part of internal assessments.

· B. Periodic self-assessments are part of internal assessments.

· C. A QAIP covers only completed engagements, not the function as a whole.

· D. External assessments are part of the QAIP.

52. Which statement about fraud risk in engagement planning is least accurate?

· A. Internal audit considers the potential for fraud when assessing engagement risks.

· B. Fraud risk is greatest where incompatible duties and weak monitoring converge.

· C. Fraud risk assessment is solely the external auditor's responsibility.

· D. Red flags observed during planning warrant special consideration.

Key GIAS anchors for students: Standard 6.2 (charter), 7.1 (independence disclosure), 4.3 (professional skepticism), 2.2 (safeguarding objectivity), 5.1 (use of information), and the Three Lines Model distinction between management ownership and internal audit assurance. 

When a question asks who owns something (fraud risk assessment, risk response, hotline operation), the answer is almost always management. When it asks who evaluates it, the answer is internal audit.

100% — This one line saves 10 marks in CIA Part 1. You nailed the exact exam trap!

This is what I teach as *GOLDEN RULE OF CIA PART 1:*

### THREE LINES MODEL – Who OWNS vs Who EVALUATES?

*Exam Trick:*

> If question asks *“Who OWNS / RESPONSIBLE / MANAGES?”* → Answer is *MANAGEMENT (1st & 2nd Line)*

> If question asks *“Who ASSESSES / EVALUATES / PROVIDES ASSURANCE?”* → Answer is *INTERNAL AUDIT (3rd Line)*

*1st Line – OWNS THE RISK – Management & Operational Managers*

- Owns: Risk Management, Control Execution, Fraud Risk Assessment, Day-to-day operations, Risk Response, Hotline OPERATION

- They DO the work

*2nd Line – OVERSEES RISK – Risk Management, Compliance, Ethics Office*

- Owns: Fraud Hotline Operation, Compliance Monitoring, Risk Framework Design

- They MONITOR the 1st line

*3rd Line – EVALUATES RISK – Internal Audit*

- Owns: NOTHING operational – Only INDEPENDENT ASSURANCE

- We: EVALUATE Fraud Risk Assessment, EVALUATE Risk Response, EVALUATE Hotline Effectiveness, EVALUATE Controls

*Direct Exam Examples from your point:*

- *Q: Who owns Fraud Risk Assessment?* → *Management* (Not Audit)

- *Q: Who evaluates Fraud Risk Assessment?* → *Internal Audit*

- *Q: Who owns operation of Whistleblower Hotline?* → *Management / Ethics Office (2nd Line)*

- *Q: Who evaluates if Hotline is effective?* → *Internal Audit (3rd Line)*

- *Q: Who owns Risk Response?* → *Management*

*One-Liner for Students to Remember:*

> *Management OWNS, Internal Audit CHECKS. We never own a process we audit – That is impairment of Objectivity (Standard 1130).*