Certified Internal Auditor MCQ Flashcards
7 cards from real Certified Internal Auditor practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Certified Internal Auditor MCQ flashcards as text
According to the IIA's Three Lines Model, which group is primarily responsible for managing risk on a day-to-day basis?
Answer: Operational management and staff (first line)
The first line consists of operational management and staff who own and manage risks as part of their daily responsibilities.
An auditor discovers that an organization consistently records revenue one day before shipment occurs to meet quarterly targets. Under GAAP, this is most likely a violation of which accounting principle?
Answer: Revenue recognition / matching principle
Under GAAP/ASC 606, revenue must be recognized when performance obligations are satisfied (delivery), not before shipment is complete.
Which of the following statements about the internal audit charter is correct?
Answer: The charter establishes the purpose, authority, and responsibility of the internal audit activity and must be approved by the board
The internal audit charter defines the purpose, authority, and responsibility of the function and must be approved by the board (or equivalent governing body).
When conducting a data analytics procedure, an internal auditor sorts all transactions by amount from highest to lowest and reviews the top 10%. This is an example of which technique?
Answer: Stratification
Stratification involves dividing a population into subgroups (e.g., by amount) to focus testing on higher-risk segments.
An organization has identified a risk but decided to take no action because the cost of the control exceeds the potential loss. This is an example of which risk response?
Answer: Risk acceptance
Risk acceptance is the deliberate decision to retain a risk because the cost of mitigation outweighs the potential impact.
During an engagement, an internal auditor finds that management's response to a reported finding is inadequate. According to IIA Standards, what should the auditor do?
Answer: Communicate the unresolved issue to senior management and the board if necessary
When management's corrective action plan is inadequate, the CAE must escalate the unresolved matter to senior management and ultimately the board.
Which of the following best describes 'professional skepticism' as it applies to internal auditors?
Answer: Maintaining a questioning mind and critically assessing evidence regardless of past relationships or prior audit results
Professional skepticism means maintaining a questioning mind and critically evaluating evidence rather than accepting representations at face value.