Examworthyexamworthy.comIIA Certified Internal Auditor - Part 3: Internal Audit Function cheat sheet
The Institute of Internal Auditors
Free to share. Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors; CIA-3 and related marks belong to their respective owners.
At a glance
Format: Multiple choice, closed book
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
Part 3 tests whether you can run and report on the internal audit function as a chief audit executive would, choosing the correct next action, not reciting a definition.
Spot the trap
Tempting wrong answers, and why they failTempting but wrong
Bundling a significant finding into the final report is fine because it can then be presented with full context and a documented management response.
Why it fails
Presenting with full context feels tidy, but timeliness means communicating significant findings soon enough for action. A six-week delay lets a known loss continue, so an interim communication is needed instead.
Engagement Results and Monitoring
Tempting but wrong
The audit universe is the risk-prioritised set of engagements approved for the year, and the audit plan is the broader catalogue of everything that could be audited.
Why it fails
This inverts the two terms. Both involve lists, which makes the swap tempting, but the universe is the full catalogue of what could be audited and the plan is the selected, scheduled subset.
Internal Audit Operations
Tempting but wrong
Reliance is justified once the audit committee has formally approved the external auditors' engagement letter for the year.
Why it fails
Engagement approval is a real governance step, but committee approval of the external audit engagement says nothing about whether that work is competent, objective, or relevant to internal audit's control objective.
Internal Audit Plan
Tempting but wrong
The external assessment must be a full assessment performed every year by a reviewer employed elsewhere within the same organisation.
Why it fails
An annual cadence is stricter than required, and a reviewer from inside the same organisation is not independent of it, so this fails the independence expectation. The rule is at least every five years by a qualified reviewer from outside the organisation.
Quality of the Internal Audit Function
Tempting but wrong
Issue the report on deadline with a note that some figures are provisional and may be revised after publication.
Why it fails
A provisional caveat looks pragmatic against a deadline, but publishing a figure known to be unsupported breaches the accuracy attribute rather than curing it.
Engagement Results and Monitoring
Tempting but wrong
Both plan completion and overdue high-risk remediation actions are KPIs because both are measurable numbers reported to the board each quarter.
Why it fails
Being numeric and board-reported does not make a measure a KPI. The overdue-actions figure signals emerging exposure rather than the function's performance, so it functions as a KRI, not a KPI.
Internal Audit Operations
Tempting but wrong
You can rely on external work because doing so will reduce internal audit's budgeted hours for the year.
Why it fails
Efficiency motivates coordination, but cost saving is a benefit of reliance, not a criterion for it. The decision to rely must rest on the quality and relevance of the other provider's work.
Internal Audit Plan
Tempting but wrong
A self-assessment signed off by the chief audit executive alone counts, provided it is repeated at least every three years.
Why it fails
A self-assessment without independent external validation is an internal activity; the chief audit executive's sign-off does not supply the external independence the obligation requires.
Quality of the Internal Audit Function
Key terms
Exam-day rules
- Read the last line of the question first. It tells you what is actually being asked, so you can read the scenario looking for the required next action rather than memorising detail.
- Choose the single best next action, not merely a defensible one. Several options are often reasonable; the exam wants the one that follows a sound process without skipping a required step.
- Protect the reporting line to the board. When a matter concerns independence, a significant risk, or an accepted risk judged unacceptable, the answer travels the functional line to the board, not just to management.
- Respect sequence. Follow up before escalating, discuss with senior management before communicating to the board, and confirm implementation before closing a finding.
- Watch for absolutes such as always and never. The correct Part 3 answer is usually the most proactive, evidence-based next step, not a blanket rule.
Revision schedule
- Day 1Map the syllabus and set a date
- Week 1Lock the function-management model (Internal Audit Operations)
- Weeks 1-2Build the plan and secure quality (Internal Audit Plan and Quality)
- Weeks 2-3Go deep on engagement results and monitoring
- Week 3Practise on scenarios with every answer explained