Skip to main content
CIA Part 1 · Practice cases

CIA Part 1 mixed practice: authority, objectivity, and controls

Use these five original cases to separate authority, personal objectivity, and control timing. Commit to an answer, then read why the alternatives fail. This is a targeted learning drill, not a full mock exam, an official question set, or a prediction of your exam score.

Try the cases before reviewing the answers

Answer 5 original cases, then check the set and compare the reasoning for each choice. These short learning checks are not a full exam simulation. Answers are not saved or sent.

Question 1: Required audit records are withheld. Which response best preserves an honest assurance conclusion?
Compare all three choices
A. Conclude from accessible records without changing the stated scope
A conclusion still covering the inaccessible work would imply evidence the team did not obtain.
B. Address and document the restriction and its effect on the planned conclusionBest answer
The scope restriction needs resolution or transparent treatment in the work and communication; missing evidence cannot become favorable assurance.
C. Replace the missing records with management’s assurance that controls operated
Management representations may be relevant, but they do not automatically substitute for the evidence the objective requires.
Question 2: An auditor managed the activity six months ago. Who should perform assurance over that activity now?
Compare all three choices
A. A suitably qualified auditor without the prior operational responsibilityBest answer
Reassignment addresses the recent self-review impairment. Expertise is important, but it does not override the presumption for recent operational responsibility.
B. The former manager with a signed declaration of impartiality
A declaration does not remove the presumed impairment created by the recent responsibility.
C. The former manager with only an added final workpaper review
A final review alone is not a reason to disregard the assurance restriction on auditing a recently managed activity.
Question 3: A system blocks an unapproved vendor-bank change before it reaches the master file and records the block in an exception log. Relative to unauthorized activation, which function is primary?
Compare all three choices
A. Detective, because the system creates an exception log
The log also supports detection or monitoring, but the action preventing this defined event is the block.
B. Corrective, because the user has already attempted the change
An attempted action is not the unwanted activation. The control stops that event rather than repairing its consequence.
C. Preventive, because activation is stopped before it occursBest answer
Control classification depends on the defined risk and timing. Here, the block prevents the unauthorized master-file change from taking effect.
Question 4: A business unit asks internal audit to choose which supplier should receive a contract. Which response preserves the proper role?
Compare all three choices
A. Select the supplier because audit reviewed the bids
Reviewing information does not transfer the operational contract-award responsibility to internal audit.
B. Provide relevant independent advice while management makes and owns the award decisionBest answer
Audit can contribute insight without accepting management’s accountability for choosing and implementing the decision.
C. Refuse to discuss any procurement risk
Preserving independence does not prohibit all advice or discussion of procurement controls and risk.
Question 5: A payment exception report is produced before release but reviewed the following week. For the released payments, what is the best classification?
Compare all three choices
A. Preventive because the report was generated early
Generation alone does not prevent release when no one acts on the exceptions before the event.
B. A guarantee against unauthorized payment
A report cannot guarantee prevention, particularly when its review occurs after the payments are released.
C. Detective if the later review identifies and follows up exceptionsBest answer
The operative review occurs after the event and can support detection and response if performed effectively.

0 of 5 answered

Three decisions this drill separates

  • Authority

    Resolve a restriction on required audit access.

    Avoid: Substituting an unsupported conclusion for missing evidence.

  • Objectivity

    Address a recent operational responsibility before assurance work.

    Avoid: Assuming knowledge of a process removes self-review risk.

  • Control timing

    Classify against the event the control is meant to prevent or detect.

    Avoid: Assigning a category from the software name.

A decision path you can use

  1. 1Answer each case without the explanation
  2. 2Identify the fact that changes the answer
  3. 3Revisit the matching lesson

Understand the method

Work through the reasoning

Use a consistent case-reading method

Read the requested decision before interpreting every background detail. Identify the actor, the organizational objective, the immediate problem, and the authority available to respond. In foundations cases, the decisive distinction is often between the function’s mandate, an individual’s objectivity, and a particular control’s operation. Similar consequences can arise from different underlying failures.

Write a short causal statement mentally: the auditor cannot test because access was denied; the auditor may be biased because they owned the decision; or the approval occurs too late to prevent the event. This helps select a response that changes the cause. Avoid selecting an answer just because it contains familiar terms such as independence, governance, or due care.

For authority cases, resolve the right level of disagreement

A manager can explain operational constraints and challenge factual errors, but should not unilaterally redefine an authorized audit mandate. When access or scope is restricted, consider the charter, established reporting channels, and the effect on the work. The initial response should be proportionate and directed toward resolving the restriction, with escalation when appropriate.

Do not compensate for denied evidence by silently expanding what interviews can prove. If a restriction remains, the conclusion and communication must reflect it. Equally, not every routine scheduling disagreement is a governance crisis. Look for the actual effect on authority, necessary information, timing, or the reliability of the intended conclusion.

For objectivity cases, change the assignment or its safeguards

A conflict declaration begins an assessment; it does not conclude one. Consider the relationship between the auditor and the activity being reviewed. Prior operational responsibility, personal interests, and pressure can each call for different safeguards. An answer that tells the auditor to be careful while leaving the exposure unchanged may not resolve the problem.

Separate this from a function-level reporting problem. Moving the CAE’s line on a chart will not necessarily address one auditor’s financial interest, and reassigning one auditor will not obtain records withheld from the whole team. Mixed cases require more than one response. Explain which fact makes each safeguard relevant.

Use wrong answers to diagnose a reasoning error

After checking the set, classify each miss by the distinction you overlooked. Did you confuse management ownership with advisory input, a policy with evidence of operation, or detection with prevention? Re-read the changed fact that would make a rejected answer appropriate. This produces a more useful review note than copying the correct letter.

The five cases sample selected foundations decisions and do not estimate a CIA exam score. A correct result on familiar wording does not establish transfer to a different process. Retry after explaining the rule in your own words, then apply it to a new setting, such as access provisioning instead of purchasing. The learning objective is consistent reasoning across contexts.

Original teaching example

Apply the method to a decision

The scenario

An auditor says a transaction-monitoring dashboard is preventive. The dashboard actually reports yesterday’s payments, and a supervisor reviews the exceptions this morning.

The decision

For the risk of an incorrect payment already made, the control is detective.

The decisive fact is that payment preceded the review. Change the workflow so the system blocks payment until approval and the classification changes. This is the kind of fact change to practice, rather than memorizing a dashboard label.

Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.

A second application

Change one fact and reconsider the answer

The situation

An auditor advises on a new inventory count procedure but does not approve it. Later, change the facts: the auditor becomes the warehouse manager who signs off the count results before being assigned to audit them.

Reason through it

The first version calls for assessing prior advisory involvement and suitable safeguards. The second introduces direct operational ownership of the results being evaluated. Treating the two versions as identical misses the mechanism of self-review.

Take the decision

Base the response on actual responsibilities. Practise identifying the smallest factual change that makes an answer unsuitable, rather than memorizing that all prior involvement has the same consequence.

Original hypothetical teaching case.

Questions about this topic

Does getting all five Part 1 cases right show exam readiness?

No. Five focused cases cannot represent the full syllabus or predict a scaled exam score. Use the explanations to find a specific weak distinction, then practice more varied questions.

Should I use the score from this set as an exam-readiness measure?

No. These five original cases provide focused learning feedback on selected decisions. Use the explanations to identify reasoning gaps; the set is not a validated mock exam or a prediction of your official score.

Sources and syllabus scope

Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.

IIA expanded syllabus

Establishes the examined topics. Primary domain: Foundations of Internal Auditing (35% of Part 1). This is a domain allocation, not a separate weight for this lesson.

Global Internal Audit Standards reference
Locator: Standards 2.2, 7.1, and 13.3. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.

Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.