(IIA) Flashcards
7 cards from real Certified Internal Auditor practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 (IIA) flashcards as text
Under the IIA Standards, a quality assurance and improvement program (QAIP) must include:
Answer: Both internal and external assessments
A QAIP must include both ongoing internal assessments and periodic external assessments to evaluate the effectiveness of the internal audit activity.
Which of the following BEST describes 'inherent risk' in the context of internal auditing?
Answer: Risk existing before management takes action to reduce it
Inherent risk is the level of risk present in an activity or process before considering the effect of controls or other mitigating factors.
An internal auditor who previously worked as the controller of an audited department should:
Answer: Disclose the prior role and assess whether objectivity is impaired
The auditor must disclose the former position and the CAE should evaluate whether objectivity is impaired before assigning the auditor to that engagement.
Which audit sampling method gives each item in the population an equal chance of selection?
Answer: Random sampling
Random sampling ensures every item in the population has an equal and known probability of being selected, reducing selection bias.
The THREE lines of defense model assigns which role to internal audit?
Answer: Third line — independent assurance
Internal audit serves as the third line of defense by providing independent assurance on the effectiveness of governance, risk management, and controls.
A preliminary survey conducted before an audit engagement is PRIMARILY used to:
Answer: Gain familiarity with the audited activity and identify risk areas
A preliminary survey helps auditors understand the activity being audited, identify potential risks, and determine the focus of the engagement.
Which of the following is an example of a detective control?
Answer: Conducting monthly bank reconciliations
Bank reconciliations detect discrepancies after they occur, making them detective controls rather than preventive or corrective controls.