CIA Part 3 practice questions

1. 01

   Risk-based audit planning

   Question 1. Two processes compete for audit resources. One has material emerging risk and little recent assurance; the other has low stable risk and extensive recent coverage. Which approach best supports the audit plan?

   Answer to question 1

   AA. Always repeat last year's scheduleBB. Prioritize the higher risk and assurance gap, considering organizational objectivesCC. Allocate identical hours to every processDD. Let process owners veto all coverage

   Check answerExplanation after you answer
2. 02

   Resource management

   Question 2. The approved plan includes a complex cybersecurity engagement, but the audit team lacks the necessary expertise. What should the chief audit executive do?

   Answer to question 2

   AA. Proceed without acknowledging the gapBB. Remove all technical testing from the report without explanationCC. Obtain appropriate expertise and communicate any resource implicationsDD. Assume general audit experience covers every specialty

   Check answerExplanation after you answer
3. 03

   Quality improvement

   Question 3. An internal audit function repeatedly finds that engagement reports require major factual corrections after issue. Which response best addresses quality?

   Answer to question 3

   AA. Strengthen review and fact-validation steps, then monitor whether corrections declineBB. Measure success only by the number of reports issuedCC. Stop tracking correctionsDD. Shorten all reports without changing review

   Check answerExplanation after you answer
4. 04

   Monitoring action plans

   Question 4. Management reports that a high-risk finding is resolved. What is the most appropriate basis for closing it?

   Answer to question 4

   AA. The original due date has passedBB. The responsible manager says the report is inconvenientCC. The audit file has become largeDD. Appropriate follow-up evidence that the agreed response was implemented

   Check answerExplanation after you answer
5. 05

   Risk acceptance

   Question 5. The chief audit executive concludes that management is accepting risk above the organization's tolerance. Discussion with senior management does not resolve the concern. What is the appropriate next step?

   Answer to question 5

   AA. Take over management's operating decisionBB. Escalate the unresolved concern to the boardCC. Remove the risk from the audit recordDD. Treat the disagreement as automatic evidence of fraud

   Check answerExplanation after you answer
6. 06

   Assurance coordination

   Question 6. Compliance, risk management, and internal audit all test the same low-risk control while a major risk is unreviewed. What is the most useful improvement?

   Answer to question 6

   AA. Map assurance coverage and coordinate work while preserving responsibilitiesBB. Combine every function under the process owner being reviewedCC. Stop all testing to avoid overlapDD. Assume duplication proves complete coverage

   Check answerExplanation after you answer
7. 07

   Audit committee reporting

   Question 7. Which report best helps the board oversee the internal audit function?

   Answer to question 7

   AA. Only the total pages of workpapersBB. Only positive comments from process ownersCC. Only individual staff leave balancesDD. Significant results, plan progress, resource constraints, and unresolved risks

   Check answerExplanation after you answer
8. 08

   Plan changes

   Question 8. A major acquisition introduces risks not contemplated in the annual audit plan. What is the best response?

   Answer to question 8

   AA. Keep the plan unchanged because it was approvedBB. Cancel all existing work automaticallyCC. Reassess priorities and obtain appropriate approval for material plan changesDD. Defer all consideration of the acquisition until the next annual cycle

   Check answerExplanation after you answer
9. 09

   Performance measures

   Question 9. An audit function meets every report deadline but its recommendations rarely address the reported root causes. Which measure would add the most useful perspective?

   Answer to question 9

   AA. Average time spent drafting each reportBB. Whether agreed actions address causes and reduce the identified risksCC. Percentage of workpapers completed on scheduleDD. Number of engagements started each quarter

   Check answerExplanation after you answer
10. 10

    Recurring issues

    Question 10. The same access-control issue appears in several business units after local fixes. What should audit leadership consider?

    Answer to question 10

    AA. Whether a shared enterprise cause requires a broader responseBB. Closing the issue because each unit wrote a planCC. Ignoring the pattern to keep reports separateDD. Assuming repeated findings are always duplicate errors

    Check answerExplanation after you answer

Original CIA teaching samples, separate from the printable PDFs. Independently authored practice, not official exam items. This short set is for learning and does not predict an exam score.