Skip to main content
CIA Part 2 · Practice cases

CIA Part 2 planning practice: five timed cases with explanations

Practise five CIA Part 2 decisions about scope, criteria, and resources. Choose your answers before checking the set; an optional elapsed timer lets you record your pace without a countdown. Review why each alternative works or fails. This targeted drill is not a full-length exam or a pass prediction.

Try the cases before reviewing the answers

Answer 5 original cases, then check the set and compare the reasoning for each choice. These short learning checks are not a full exam simulation. Answers are not saved or sent.

Optional elapsed timer0:00

No countdown or automatic submission. Use the time to reflect on your process, not to predict an exam score.

Question 1: An engagement on vendor-payment fraud excludes bank-detail changes despite recent losses from diverted payments. What should the team do first?
Compare all three choices
A. Reassess scope against the loss mechanism and document the coverage decisionBest answer
The scope must address the risk connected to the objective. Include necessary work or transparently resolve why that assurance cannot be provided.
B. Keep scope because payment processing and supplier maintenance have different owners
Organizational boundaries do not remove a relevant path through which the defined fraud risk occurs.
C. Rely on last year’s vendor review without checking its coverage of bank changes
Prior assurance may help, but its scope, period, and continuing relevance must be evaluated before reliance.
Question 2: The policy says leaver access must be removed promptly but supplies no measurable deadline. What should happen before assessing exceptions?
Compare all three choices
A. Adopt the average observed removal time as the compliance threshold
A threshold derived solely from current performance can normalize poor performance rather than evaluate it against a defensible expectation.
B. Establish a suitable criterion using requirements and risk, and discuss it with managementBest answer
A justified criterion provides a stable basis for comparison. Discuss its suitability rather than selecting a cutoff to fit the observed results.
C. Use the auditor’s preferred deadline without explaining its basis
Professional judgment needs a defensible basis. An unexplained preference does not establish a suitable evaluation criterion.
Question 3: A necessary security procedure requires expertise the team lacks, and the deadline is fixed. Which plan is most defensible?
Compare all three choices
A. Retain the original assurance objective and substitute an interview without evaluating equivalence
An easier procedure is acceptable only if it supplies suitable evidence for the objective. The deadline alone does not establish equivalence.
B. Remove the procedure from the work program without changing the conclusion’s intended scope
Removing essential work silently leaves the intended conclusion broader than the supporting evidence.
C. Arrange suitable expertise or explicitly resolve the resulting objective and scope constraintBest answer
Resolve the capability gap or its impact openly. The work, resources, objective, and eventual conclusion must remain consistent.
Question 4: A case asks what skill is required to interpret privileged-access logs. Which planning decision is central?
Compare all three choices
A. Resource competenceBest answer
The question concerns whether the engagement has the capability needed to evaluate the required evidence.
B. The adequacy of the approval deadline
The approval deadline is a criterion; it does not establish whether the team can interpret the technical records.
C. The definition of the sampling unit
The sampling unit defines what is selected, not the competence needed to interpret the selected evidence.
Question 5: Why can selecting only completed removal tickets weaken a leaver-access plan?
Compare all three choices
A. Completed tickets are always fabricated
The concern is selection coverage, not an assumption that all completed records are false.
B. The selection may omit departures for which no ticket was createdBest answer
A population conditioned on successful processing can exclude the control failures the objective seeks.
C. A ticket can never contain useful evidence
Tickets can contribute evidence, but they should not automatically define the complete departure population.

0 of 5 answered

What to decide before fieldwork

  • Scope

    Include the exposure necessary to answer the objective.

    Avoid: Choosing only accessible or low-risk transactions.

  • Criteria

    Set a suitable benchmark before evaluating the condition.

    Avoid: Letting the observed result dictate what counts as acceptable.

  • Resources

    Match procedures with suitable expertise and availability.

    Avoid: Removing difficult tests without adjusting the conclusion.

A decision path you can use

  1. 1Make the planning decision
  2. 2Explain the decisive fact
  3. 3Check why the alternative fails

Understand the method

Work through the reasoning

Identify which planning decision the case asks you to make

The five cases combine decisions about objectives, scope, criteria, resources, and the work program. Start by locating the decision level. A question about which system to include concerns scope; a question about the expected approval deadline concerns criteria; a question about what evidence to inspect concerns procedures.

Many distractors offer a useful activity at the wrong level. Reconciling payment totals may be sensible but does not answer whether bank changes were authorized. Choose the action that addresses the stated objective and the immediate gap, not the action with the most technical language.

Follow the dependencies between planning choices

Understand the activity and its risks before selecting procedures. Define what the engagement should determine, establish the relevant boundaries and criteria, then design work that can produce the necessary evidence. Assess whether the team has suitable resources to perform that work.

The process can iterate as new information appears. A missing source may require an alternative procedure or a revised scope; a newly discovered risk may change the objective. The key is to explain and approve the change rather than treating the original plan as either untouchable or disposable.

Look for mismatches between the claim and the evidence

A common planning error starts from successful outcomes: completed approvals, resolved tickets, or registered suppliers. If the objective concerns missing approvals or unprocessed departures, such populations may omit the failure. Ask what records would contain an event even when the expected control never occurred.

Also compare the breadth of the intended conclusion with the proposed coverage. One site, one month, or one control may be enough for a narrow objective but inadequate for a broad one. A defensible answer either improves the work or makes the intended conclusion appropriately specific.

Review reasoning before trying to improve speed

Use the optional timer as a way to observe your pace, not as a validated exam simulation. After an attempt, review every alternative and explain the missing link. Separate a knowledge gap from a reading mistake, such as overlooking the word “before” in an approval criterion.

Retry after writing a short planning chain for each case: risk, objective, scope, criterion, evidence, resources. The exercise contains five original questions and is deliberately small. Use its feedback to select the linked lessons for further study rather than treating its score as a readiness assessment.

Original teaching example

Apply the method to a decision

The scenario

The team plans to assess whether employee access is removed on time. It selects only terminated accounts and uses a deadline invented after seeing the data.

The decision

Repair both the population and the criterion before relying on the planned test.

Start from departures, including people whose accounts remain active. Identify the applicable timing expectation before classification. Otherwise the procedure can miss the most important exceptions and judge the rest inconsistently.

Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.

A second application

A complete-looking plan tests the wrong question

The situation

The objective concerns unauthorized supplier-bank changes. The proposed procedures reconcile total payments, confirm supplier balances, and inspect the current policy.

Reason through it

These steps may support other objectives, but they do not directly establish whether actual bank changes were independently approved before activation. The plan needs a suitable change population and linked approval evidence.

Take the decision

Judge a plan by its risk-to-evidence connection, not by how many procedures it lists.

Original hypothetical teaching case.

Questions about this topic

Why does this drill contain more planning than reporting?

Its purpose is targeted planning practice, reflected in its title. The official Part 2 syllabus assigns 50% to the whole planning domain, but this five-case teaching set is not a miniature blueprint-balanced exam.

What should I do if I get the mixed set right but cannot explain the alternatives?

Review the rationales and reconstruct the planning chain. Correct selection by recognition or guessing is weaker evidence of understanding than explaining why each alternative does or does not answer the objective.

Sources and syllabus scope

Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.

IIA expanded syllabus

Establishes the examined topics. Primary domain: Engagement Planning (50% of Part 2). This is a domain allocation, not a separate weight for this lesson.

Global Internal Audit Standards reference
Locator: Standards 13.2-13.6. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.

Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.