IIA Certified Internal Auditor - Part 2: Internal Audit Engagement (CIA-2) practice questions

An internal auditor gathers a signed contract from the client's legal department, a verbal assurance from the process owner, and a copy of an invoice provided by the vendor being examined. When judging the reliability of this evidence, which principle should the auditor apply first?

• AEvidence obtained from a source independent of the client is generally more reliable than evidence supplied by an interested party.check_circle Correct
• BVerbal assurances from a process owner are the most reliable because they come directly from the person accountable for the control.
• CDocumentary evidence is reliable purely because it is written, regardless of who produced or supplied it.
• DThe most recently dated item is the most reliable because it reflects the current state of the process.

Why A is correct: Independence of source is a core determinant of reliability; evidence from a party with no stake in the outcome is less likely to be biased or manipulated.

Why B is wrong: Tempting because the owner is accountable, but oral evidence from an interested internal party is among the least reliable forms and needs corroboration.

Why C is wrong: Form of evidence matters, but written form alone does not confer reliability when the document originates from an interested source such as the vendor.

Why D is wrong: Recency can aid relevance, yet it says nothing about source independence or authenticity, so it is the wrong first test of reliability.

In the context of an internal audit engagement, what does appropriate supervision primarily provide assurance about?

• AThat the engagement objectives are achieved and the work supports the conclusions reached.check_circle Correct
• BThat every individual finding is separately escalated to the audit committee before the report is issued.
• CThat the auditors in charge design the operating controls that management will later implement.
• DThat the fieldwork is completed within the originally budgeted hours regardless of scope changes.

Why A is correct: Supervision exists to give reasonable assurance that objectives are met, quality is attained, and evidence supports the conclusions; that is its defining purpose.

Why B is wrong: Escalation of individual findings is a reporting and communication judgement, not the aim of supervision; treating supervision this way confuses two distinct activities.

Why C is wrong: Designing operating controls would breach independence and objectivity; supervision never extends internal audit into owning management's controls.

Why D is wrong: Budget adherence is a management concern that can be part of supervision, but it is not its primary assurance purpose and is subordinate to quality.

During planning, an audit lead must decide whether an upcoming procurement engagement is assurance or advisory. Which statement correctly distinguishes the two engagement types?

• AIn an assurance engagement the auditor advises management and management remains free to reject the recommendations offered.
• BAn assurance engagement involves a three-party relationship and an objective assessment against criteria, while advisory work is directed by the client to add value.check_circle Correct
• CIn an advisory engagement the auditor issues an independent opinion to third parties on the adequacy of the control environment.
• DBoth engagement types require the auditor to design and then implement the controls that management will later operate.

Why A is wrong: This is tempting because advice is common in audit work, but it describes advisory work; assurance involves an independent assessment against criteria, not optional advice.

Why B is correct: Correct because assurance rests on a process owner, an assessor, and a user, tested against defined criteria, whereas advisory scope and nature are agreed with the client.

Why C is wrong: This sounds authoritative, but issuing an independent opinion to reliant parties is the hallmark of assurance, not advisory work, which is client-directed counsel.

Why D is wrong: This is plausible because auditors advise on control gaps, but designing and implementing controls destroys independence; management owns and builds its own controls.