CIA-1 domain - 35% of the exam

Foundations of Internal Auditing

Foundations of Internal Auditing is 35% of the IIA Certified Internal Auditor - Part 1: Essentials of Internal Auditing (CIA-1) exam. These are the objectives it covers, each with practice questions, with every answer explained.

Objectives in this domain

Describe the purpose of internal auditing according to the Global Internal Audit Standards, including the overall objectives and benefits of the internal audit function.
Section A.1easy
Explain the internal audit mandate and the responsibilities of the board and the chief audit executive in establishing the authority, role, and responsibilities of the internal audit function.
Section A.2medium
Recognize the requirements of an internal audit charter, including the components required by the Global Internal Audit Standards and the importance of board approval.
Section A.3easy
Interpret the differences between assurance services and advisory services, including limited versus reasonable assurance, and determine which type of service is appropriate in a given context.
Section A.4medium
Describe the types of assurance services performed by the internal audit function, including risk and control, compliance, IT security and privacy, performance, financial, and operational audits.
Section A.5medium
Describe the types of advisory services performed by the internal audit function, and the internal auditor's role in each while preserving objectivity.
Section A.6medium
Identify situations where the independence of the internal audit function may be impaired, including inappropriate reporting lines, scope limitations, restricted access, and budget constraints.
Section A.7medium
Recognize the internal audit function's role in the organization's risk management process, including The IIA's Three Lines Model and the safeguards needed when auditors take on first or second line responsibilities.
Section A.8medium

Sample question from this domain

Free sampleFoundations of Internal Auditingmedium

Aster Retail's audit committee wants internal audit to provide a high level of confidence that the year-end revenue controls are operating effectively, and it has allocated ample time for extensive testing. Which type of engagement matches this request?

AA reasonable assurance engagement, which performs more extensive procedures to support a positively expressed conclusion at a high though not absolute level of confidence. Correct
BA limited assurance engagement, which performs reduced procedures and conveys a lower level of confidence through a negatively expressed conclusion.
CAn advisory engagement, because testing controls at the audit committee's request is simply advice provided to the client on demand.
DA reasonable assurance engagement, which guarantees the revenue controls are free from any deficiency because the testing was so extensive.

Reasonable assurance applies more extensive procedures and a positively worded conclusion to convey a high, though not absolute, level of confidence. Reasonable and limited assurance differ by the depth of work performed and the confidence conveyed. A request for high confidence, backed by time for extensive testing, points to a reasonable assurance engagement with a positively expressed conclusion rather than a reduced-scope limited engagement.

Why A is correct: Reasonable assurance uses deeper procedures to underpin a positively worded conclusion at a high but not absolute level of confidence, which is exactly what the committee has asked for and resourced.

Why B is wrong: Limited assurance is tempting shorthand for any controls review, but its reduced procedures and negative wording give lower confidence than the high assurance requested, so it does not fit.

Why C is wrong: Concluding on whether controls operate effectively for stakeholders is assurance, not advice; labelling it advisory misclassifies the service and is therefore wrong.

Why D is wrong: Reasonable assurance is high but not absolute, so promising a guarantee of no deficiency overstates what the engagement can deliver and makes this option incorrect.

Other domains in this exam

Ethics and Professionalism20% of the exam
Governance, Risk Management, and Control30% of the exam
Fraud Risks15% of the exam

See also the CIA-1 cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors. Original, blueprint-aligned practice material only.