IIA IIA-CIA-Part1 Practice Exams
Last updated on Oct 22,2026- Exam Code: IIA-CIA-Part1
- Exam Name: CIA Exam Part One: Essentials of Internal Auditing
- Certification Provider: IIA
- Latest update: Oct 22,2026
The internal audit activity is asked to provide consulting services regarding the risks related to implementing a proposed new Inventory management system.
Which of the following would be a key consideration of the internal audit activity in accepting this engagement?
- A . Ask the inventory manager to determine whether the work planned would be sufficient to meet the consulting engagement objectives.
- B . Ensure that the method used to communicate the results of the consulting engagement is consistent with the board’s preferred method.
- C . Determine whether the benefits to be derived from the requested assessment would exceed the cost of providing the consulting service.
- D . Use email and telephone conversations to convey the results of the engagement, as these may prove to be the most efficient methods for communicating.
Which of the following activities would breach the principles of The IIA’s Code of Ethics?
- A . The internal auditor is keeping personal notes from an engagement conducted on the
organization’s information system security for future use. - B . The internal auditor is performing an engagement of the purchasing department where he used to work five years ago.
- C . The internal auditor is using information from a recent engagement to assist with a friend’s business.
- D . The internal auditor is discussing relevant information involving questionable vendors with a government regulatory agency.
An internal auditor performed a risk assessment and concluded that the controls over access privileges to a bank account were appropriate. Later, the auditor learned that a contractor was using a shared password provided by an authorized user of the account.
Which of the following statements best describes the auditor’s application of due professional care?
- A . Due professional care was exercised, despite the auditor’s failure to identify the significant risk.
- B . Due professional care was not exercised because the auditor failed to identify all the significant risks during the risk assessment.
- C . Due professional care was not exercised because the residual risk from the possibility of authorized users sharing their passwords was not considered.
- D . Due professional care was not exercised because the auditor failed to conduct interviews to obtain testimonial evidence of possible password sharing
According to IIA guidance, which of the following best describes the chief audit executive s responsibility for confirming to the board the organizational independence of the internal audit activity’?
- A . The CAE must do this at least annually
- B . The CAE must do this at least once every five years
- C . The CAE must do this upon completion of each external quality assessment
- D . The CAE should do this periodically in conjunction with a review of the internal audit charter
An internal auditor was assigned to work in the procurement department for six months to gam m-depth knowledge about the procurement process.
Which of the following personnel development practices was applied in this situation?
- A . Cosourcing
- B . Inbound rotation
- C . Guest auditor
- D . Outbound rotation
Which of the following would be considered a violation of The HAfs mandatory guidance on independence?
- A . The chief audit executive (CAE) reports functionally to the board and administratively to the chief financial officer.
- B . The board seeks senior management’s recommendation before approving the annual salary adjustment of the CAE.
- C . The CAE confirms to the board, at least once every five years, the organizational independence of the internal audit activity,
- D . The CAE updates the internal audit charter and presents it to the board for approval periodically, not on a specific timeline
During a payroll audit, the internal auditor discovered that several individuals who have the same position classification as he are earning a significantly higher salary. The auditor noted the names and amounts of each, and he planned to prepare a request to the chief audit executive for a salary increase based on this information.
Which of the following IIA Code of Ethics principles was violated in this scenario?
- A . Competency.
- B . Objectivity,
- C . Integrity.
- D . Confidentiality
Which of the following best describes a proactive role for the internal audit activity with regard to the organization’s ethics program?
- A . Becoming a voting member of the organization’s internal ethics council.
- B . Performing an annual organization wide employee survey.
- C . Reviewing all departmental ethics-related policies.
- D . Conducting annual ethics training for all employees.
Which of the following preventive controls would be most effective for organizations facing business disruptions and respective financial losses?
- A . Develop a business continuity plan for contingent situations.
- B . Insure the organization against financial losses.
- C . Rely on third-party cloud solution providers for the organization’s systems.
- D . Hedge company assets via purchasing derivatives.
What would be the proper sequence of steps for an internal auditor to take in order to draw a conclusion on internal control effectiveness and adequacy after ascertaining the key controls?
- A . Evaluate the adequacy of the controls and then test the controls for effectiveness.
- B . Test the controls for effectiveness and then evaluate the adequacy of the controls.
- C . Identify risks and then evaluate the controls for effectiveness.
- D . Evaluate the controls for effectiveness and then assess the risks in the area.