Skip to main content
CIA Part 3 · Practice cases

CIA Part 3 mixed practice: plan, quality, and follow-up

These five original cases test decisions the audit function makes about changing risk, quality improvement, and unresolved actions. Choose the response that preserves evidence and accountability. The set is a learning exercise, not an official exam simulation or a readiness score.

Try the cases before reviewing the answers

Answer 5 original cases, then check the set and compare the reasoning for each choice. These short learning checks are not a full exam simulation. Answers are not saved or sent.

Question 1: A major acquisition creates a new platform risk after annual plan approval. What should the CAE do?
Compare all three choices
A. Keep the approved plan unchanged until the next annual risk assessment
Approval does not make the plan immune to significant changes in the risk environment.
B. Reassess risk and propose justified changes with coverage and resource consequencesBest answer
A dynamic plan responds to material risk changes through documented assessment and the appropriate communication and approval process.
C. Replace every scheduled engagement with acquisition work immediately
The new risk needs evaluation against existing commitments, mandatory work, and capacity; it does not automatically outrank every engagement.
Question 2: Internal checks find repeated unsupported conclusions. An external assessment is scheduled next year. What should the CAE do now?
Compare all three choices
A. Address the weakness and test whether subsequent work improvesBest answer
Internal quality assessment exists to identify and correct weaknesses continuously. Evaluate the cause and verify whether the chosen response changes the work.
B. Record it for the external assessor and postpone improvement decisions
The external assessment timetable is not a reason to leave a known quality weakness untreated.
C. Limit the response to distributing a reminder about documentation
A reminder might form part of a response, but is insufficient without evaluating causes and obtaining evidence of improvement.
Question 3: The CAE concludes that accepted risk exceeds organizational tolerance. Discussion with senior management leaves the issue unresolved. What is the next escalation?
Compare all three choices
A. The CAE approves temporary risk acceptance on management’s behalf
The CAE identifies and communicates the concern; resolving or accepting the business risk is not the CAE’s responsibility.
B. The CAE waits for the next routine follow-up date without further communication
A routine timetable does not justify withholding an unresolved acceptance concern that requires board communication.
C. The CAE communicates the unresolved concern to the boardBest answer
Standard 11.5 requires communication to the board when the unacceptable-risk concern remains unresolved after senior-management discussion.
Question 4: A new policy is issued to fix a recurring quality weakness. What is the strongest next evaluation?
Compare all three choices
A. Confirm only that the policy was emailed
Communication shows that staff received an instruction, not that performance changed.
B. Inspect subsequent work to see whether the weakness was actually addressedBest answer
Later operating evidence tests whether the improvement action achieved its intended purpose.
C. Declare success because the document is approved
Approval establishes authorization of the design, not effective implementation in practice.
Question 5: A provider’s old report remains marked as current coverage after a system replacement. Which response fits the function-level issue?
Compare all three choices
A. Keep the green cell because the provider is reputable
Reputation does not make evidence about a retired system current for its replacement.
B. Reassess coverage and update the map and planning implicationsBest answer
The changed system may create an assurance gap that should be visible in the map and considered in planning.
C. Treat the migration team’s acceptance sign-off as equivalent independent assurance
Management’s acceptance serves a different purpose and does not automatically replace suitable independent evaluation.

0 of 5 answered

Which level of decision does the case need?

  • Plan

    Reassess portfolio priorities when significant risks change.

    Avoid: Treating an approved annual schedule as permanently fixed.

  • Quality

    Respond to current weaknesses and verify improvement.

    Avoid: Waiting for the next external assessment to fix known problems.

  • Follow-up

    Assess evidence of implementation and remaining risk.

    Avoid: Closing an action because management clicked a status button.

A decision path you can use

  1. 1Identify the function-level decision
  2. 2Keep responsibility with the right actor
  3. 3Check the evidence supporting the response

Understand the method

Work through the reasoning

Keep the function-level decision in view

These five original cases ask about managing and overseeing internal audit across engagements. Identify whether the issue concerns strategy, portfolio coverage, resources, quality, or monitoring. A technically useful test procedure may still be the wrong answer when the question asks for a board-level coverage decision.

State the decision owner and the information they need. The CAE may need to propose a plan change; management may need to implement a response; the board may need to consider a significant unresolved concern. Avoid transferring operational responsibility to audit simply because audit identified the problem.

Challenge what a favorable dashboard leaves out

Completion, timeliness, satisfaction, and closure rates each describe a limited aspect of performance. Ask what changed in the denominator, which high-risk items remain, and what evidence supports the status. A technically correct percentage can still create an incomplete impression.

Choose responses that restore the missing context. Reporting a deferred specialist engagement, unverified management completion, or a stale assurance-map entry makes the decision more informed. Adding another activity count usually does not repair the underlying coverage or evidence gap.

Separate oversight, implementation, and verification

Management owns operations and corrective actions. Internal audit evaluates, communicates, and confirms implementation appropriately. The board provides oversight within its governance role. These distinctions remain relevant when a case involves urgent risk or delayed action.

When a proposed answer has audit run the control, accept risk for management, or declare conformance from satisfaction alone, identify the precise accountability or evidence problem. The strongest response addresses the issue while preserving the proper role and escalation route.

Use mistakes to choose the next lesson

After completing the set, compare the correct explanation with every alternative. A mistake about missing specialist capacity points to resource management; a mistake about stale coverage points to assurance-map maintenance; a mistake about training completion points to quality improvement verification.

Write one transferable rule from each case and apply it to a different example. The small set is a study exercise, not a psychometrically validated mock exam or readiness predictor. Use the feedback to guide deeper study across the linked topics rather than interpreting the score as an exam forecast.

Original teaching example

Apply the method to a decision

The scenario

Management reports a critical action as complete. The submitted evidence is a draft procedure that has not been approved or implemented.

The decision

Keep implementation unverified and assess the current exposure rather than closing the issue.

A planned response and an operating response are different states. Ask for suitable evidence, explain the status accurately, and escalate continued unacceptable risk through the appropriate channels. Audit should not take over operating the control to make the issue disappear.

Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.

A second application

Several green indicators share the same weak assumption

The situation

The function reports full plan completion, full action closure, and full assurance coverage. Deferred engagements were removed, owners closed their own actions, and the map has not been updated after a migration.

Reason through it

Each indicator depends on a different unsupported assumption. Reconcile commitments, distinguish reported from verified implementation, and reassess the map’s current coverage.

Take the decision

Evaluate the definition and evidence behind each signal. Several favorable metrics do not validate one another when each omits material context.

Original hypothetical teaching case.

Questions about this topic

Does this five-question drill mirror Part 3 domain weights?

No. It deliberately samples several function-level decisions for learning. The official domain allocations describe the examination, not this small original teaching set.

Why do these cases emphasize the meaning behind dashboard numbers?

Function-level decisions often depend on summaries. Understanding their definitions, coverage, and evidence prevents a correct calculation from supporting an incorrect conclusion about assurance, quality, or remediation.

Sources and syllabus scope

Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.

IIA expanded syllabus

Establishes the examined topics. Primary domain: Engagement Results and Monitoring (45% of Part 3). This is a domain allocation, not a separate weight for this lesson.

Global Internal Audit Standards reference
Locator: Standards 9.4, 12.1, 11.5, and 15.2. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.

Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.