Q: An internal auditor was asked to review an equal equity partnership. In one sampled transaction, Partner A transferred equipment into the partnership with a self-declared value of $10,000, and Partner B contributed equipment with a self-declared value of $15,000. The capital accounts of each partner were subsequently credited with $12,500. Which of the following statements is true regarding this transaction?

D Explanation: Comprehensive and Detailed In-Depth Partnership contributions should be recorded at their fair market value (FMV) at the time of contribution, ensuring equitable financial representation. Option A (Original cost of the equipment) – Not appropriate since the asset’s current fair value is relevant, not its historical cost. Option B (Weighted average approach) – Not applicable; capital accounts should reflect actual contributed value. Option C (No action necessary) – Incorrect because partners contributed assets of different values, making an equal capital credit unfair. Since partnership accounting requires fair market value for capital accounts, Option D is correct. Reference: IIA Financial Accounting – Partnership Equity Contributions

Q: A small chain of grocery stores made a reporting error and understated its ending inventory. What effect would this have on the income statement for the following year?

C Explanation: Comprehensive and Detailed Step-by-Step Explanation with all IIA Reference: = Understanding the Impact of an Understated Ending Inventory: Ending inventory is a key component of the cost of goods sold (COGS) calculation: COGS=BeginningInventory+Purchases−EndingInventoryCOGS = Beginning Inventory + Purchases - Ending InventoryCOGS=BeginningInventory+Purchases−EndingInventory If the ending inventory is understated, it means the reported inventory is lower than its actual value. This results in an overstated COGS because a smaller amount is subtracted in the formula above. An overstated COGS leads to an understated net income in the current year. Effect on the Following Year’s Income Statement: The beginning inventory for the next year is based on the ending inventory of the previous year. Since the prior year's ending inventory was understated, the new year's beginning inventory is also understated. A lower beginning inventory leads to a lower COGS in the new year. Since COGS is lower, net income in the following year will be overstated. IIA’s Perspective on Financial Reporting Errors: The IIA’s International Standards for the Professional Practice of Internal Auditing (IPPF) emphasize the importance of accurate financial reporting. IIA Standard 1220 – Due Professional Care requires internal auditors to consider the probability of errors, fraud, or misstatements in financial reporting. COSO’s Internal Control – Integrated Framework highlights that inventory valuation errors can impact financial integrity and decision-making. GAAP & IFRS Accounting Standards also require proper inventory reporting to ensure accurate financial statements. IIA Reference: IPPF Standard 1220 – Due Professional Care COSO Internal Control – Integrated Framework GAAP & IFRS Accounting Principles on Inventory Valuation Thus, the correct and verified answer is C. Net income would be overstated.

Q: An internal audit engagement team found that the risk register of the project under review did not include significant risks identified by the internal audit function. The project manager explained that risk register preparations are facilitated by risk managers and that each project’s risk review follows the same set of questions. Which of the following recommendations will likely add the greatest value to the project management process of the organization?

C Explanation: The root cause of the missing significant risks lies in the methodology used for risk identification. If the process relies too rigidly on a standard set of questions, it may overlook critical risks. By revising the risk identification methodology, the organization ensures that future projects capture relevant risks comprehensively and consistently, adding long-term value. Option A addresses only the current project, not the underlying issue. Option B may improve knowledge but does not fix the flawed process. Option D merely shifts responsibility but does not address the methodology weakness. Reference: IIA Standards – Standard 2120: Risk Management.

Q: The chief audit executive (CAE) and management of the area under review disagree over managing a significant risk item. According to IIA guidance, which of the following actions should the CAE take first?

D Explanation: When disagreements occur regarding risk management or audit findings, the CAE should first escalate the matter within management levels to attempt resolution. Only if the disagreement remains unresolved after discussion with senior management should the CAE report the matter to the board or audit committee. Options B and C are premature: the charter does not grant internal audit supremacy over management’s decisions, and documenting disagreement in the audit report should occur only after reasonable attempts at resolution. Option A (escalating immediately to the board) should occur only if discussion with management does not resolve the issue. Reference: IIA Standards – Standard 2600: Communicating the Acceptance of Risks.

Q: Which of the following data privacy concerns can be attributed specifically to blockchain technologies?

D Explanation: A core feature of blockchain technology is immutability—once data is recorded, it cannot be altered or deleted. While this supports integrity and transparency, it also creates a conflict with data privacy regulations such as the General Data Protection Regulation (GDPR), which grants individuals the “right to be forgotten.” The inability to erase personal data stored on blockchain creates a compliance challenge. Options A and B are incorrect: phishing is not inherent to blockchain, and transactions are not easily tampered with (immutability actually prevents that). Option C is misleading because regulations address data use but do not “overregulate” blockchain specifically. Reference: IIA Global Technology Audit Guide (GTAG): Understanding Blockchain and Related Risks.

Q: Which of the following types of accounts must be closed at the end of the period?

A Explanation: At the end of an accounting period, certain accounts must be closed to prepare financial statements and reset balances for the next period. The accounts that must be closed are temporary accounts, which include all income statement accounts (revenues, expenses, and gains/losses). Why Option A (Income statement accounts) is Correct: Income statement accounts (revenues, expenses, gains, and losses) are temporary accounts that track financial performance for a specific period. At the end of the period, these accounts are closed to the retained earnings account to reset them to zero for the next period. Why Other Options Are Incorrect: Option B (Balance sheet accounts): Incorrect because balance sheet accounts (assets, liabilities, and equity) are permanent accounts that carry their balances forward to the next period. Option C (Permanent accounts): Incorrect because permanent accounts include all balance sheet accounts, which are never closed. Option D (Real accounts): Incorrect because real accounts refer to balance sheet accounts (assets, liabilities, and equity), which remain open. IIA Reference: IIA GTAG – "Auditing Financial Close Processes": Discusses the closing of temporary accounts at the period end. COSO Internal Control – Integrated Framework: Recommends proper financial reporting controls, including account closures. IFRS & GAAP Accounting Standards: Define temporary and permanent accounts in financial reporting. Thus, the correct answer is A. Income statement accounts.

Q: An internal auditor identified a database administrator with an incompatible dual role. Which of the following duties should not be performed by the identified administrator?

D Explanation: A database administrator (DBA) should not perform duties that compromise segregation of duties (SoD). A conflict arises when a DBA has both design and security responsibilities, as this creates a risk of unauthorized changes, fraud, or data breaches. Analysis of Each Option: (A) Designing and maintaining the database. Incorrect: These tasks are related but do not create a major conflict, as maintenance follows the design phase. (B) Preparing input data and maintaining the database. Incorrect: While data preparation is typically a business function, maintaining the database does not create a direct security risk. (C) Maintaining the database and providing its security. Incorrect: Maintenance involves technical upkeep, and while security controls are crucial, they do not inherently conflict. (D) Designing the database and providing its security. (Correct Answer) A DBA responsible for both design and security could create backdoors or override security settings, leading to potential data manipulation or fraud. IIA Standard 2120 – Risk Management requires proper control segregation to prevent fraud and security risks. IIA GTAG 4 – Management of IT Auditing recommends separation of design, security, and administration functions to minimize risks. IIA Reference Supporting the Answer: IIA Standard 2120 – Risk Management: Encourages proper separation of duties to mitigate risks. IIA GTAG 4 – Management of IT Auditing: Recommends strict control over database access and security roles. Thus, the correct answer is (D) because combining database design and security responsibilities creates a significant conflict of interest, increasing security risks.

Question 1

A company records income from an investment in common stock when it does which of the following?

Accepted Answer

C

Explanation: When a company invests in common stock, it can earn income in two primary ways: Dividend income: When the company receives dividends, it recognizes the income. Capital gains: When the stock is sold for a higher price than its purchase price, it results in a gain. Why Option C (Receives dividends) is Correct: Dividends represent income from an investment in common stock when declared and paid by the issuing company. Under GAAP and IFRS, dividend income is recognized when received, not when declared. Companies record dividends as investment income in their income statement. Why Other Options Are Incorrect: Option A (Purchases bonds): Incorrect because purchasing bonds is an investment transaction, not income recognition. Option B (Receives interest): Incorrect because interest income applies to bond investments, loans, or deposits, not common stock investments. Option D (Sells bonds): Incorrect because selling bonds results in capital gains or losses, not regular investment income from common stock. IIA Reference: IIA Practice Guide – "Auditing Investment & Treasury Activities": Discusses the recognition of investment income. IFRS 9 (Financial Instruments) & GAAP Standards: Provide guidance on recording dividends as investment income. COSO Internal Control – Integrated Framework: Emphasizes proper financial reporting and income recognition.

Question 2

Which of the following statements is true regarding an organization's chief audit executive (CAE) when prioritizing the audit universe?

Accepted Answer

A

Explanation: When prioritizing the audit universe, the CAE typically uses a risk-factor approach. This includes a combination of likelihood, impact, control effectiveness, and other relevant criteria. Solely relying on impact (Option C) or likelihood (Option B) is insufficient. Heat maps (Option D) may be tools used within the process, but they are not the actual method of prioritization. Thus, the correct description is the risk-factor approach (Option A). Reference: IIA Practice Guide – Developing a Risk-based Internal Audit Plan.

Question 3

A new manager received computations of the internal fate of return regarding the project proposal.
What should the manager compare the computation results to in order to determine whether the
project is potentially acceptable?

Accepted Answer

C

Explanation: The internal rate of return (IRR) is a measure used to evaluate the profitability of an investment. The project is considered acceptable if its IRR is greater than or equal to the required rate of return (RRR), which is the minimum return an organization expects from an investment. Step-by-Step Correct Answer (C - Compare to the Required Rate of Return) The required rate of return (RRR) represents the minimum acceptable return for the project. If IRR ≥ RRR, the project is acceptable. If IRR < RRR, the project is rejected. The IIA Practice Guide: Auditing Capital Investments suggests comparing IRR to the RRR to ensure financial feasibility. Why Other Options Are Incorrect: Option A (Compare to the annual cost of capital): The cost of capital (WACC - Weighted Average Cost of Capital) is an important factor, but RRR is the direct benchmark for IRR comparison. Option B (Compare to the annual interest rate): Interest rates do not determine project feasibility—they only affect financing costs. Option D (Compare to the net present value - NPV): NPV and IRR are related, but they serve different purposes. IRR is compared against RRR, while NPV measures absolute profitability in dollar terms. IIA Reference for Validation: IIA Practice Guide: Auditing Capital Investments – Discusses IRR, RRR, and investment decision- making. IIA GTAG 3: Business Case Development – Explains how financial metrics like IRR and RRR are used in decision-making. Thus, C is the correct answer because IRR should be compared to the required rate of return to determine project acceptability.

Question 4

An internal auditor was asked to review an equal equity partnership. In one sampled transaction,
Partner A transferred equipment into the partnership with a self-declared value of $10,000, and
Partner B contributed equipment with a self-declared value of $15,000. The capital accounts of each
partner were subsequently credited with $12,500. Which of the following statements is true
regarding this transaction?

Accepted Answer

D

Explanation: Comprehensive and Detailed In-Depth Partnership contributions should be recorded at their fair market value (FMV) at the time of contribution, ensuring equitable financial representation. Option A (Original cost of the equipment) – Not appropriate since the asset’s current fair value is relevant, not its historical cost. Option B (Weighted average approach) – Not applicable; capital accounts should reflect actual contributed value. Option C (No action necessary) – Incorrect because partners contributed assets of different values, making an equal capital credit unfair. Since partnership accounting requires fair market value for capital accounts, Option D is correct. Reference: IIA Financial Accounting – Partnership Equity Contributions

Question 5

A small chain of grocery stores made a reporting error and understated its ending inventory. What effect would this have on the income statement for the following year?

Accepted Answer

C

Explanation: Comprehensive and Detailed Step-by-Step Explanation with all IIA Reference: = Understanding the Impact of an Understated Ending Inventory: Ending inventory is a key component of the cost of goods sold (COGS) calculation: COGS=BeginningInventory+Purchases−EndingInventoryCOGS = Beginning Inventory + Purchases - Ending InventoryCOGS=BeginningInventory+Purchases−EndingInventory If the ending inventory is understated, it means the reported inventory is lower than its actual value. This results in an overstated COGS because a smaller amount is subtracted in the formula above. An overstated COGS leads to an understated net income in the current year. Effect on the Following Year’s Income Statement: The beginning inventory for the next year is based on the ending inventory of the previous year. Since the prior year's ending inventory was understated, the new year's beginning inventory is also understated. A lower beginning inventory leads to a lower COGS in the new year. Since COGS is lower, net income in the following year will be overstated. IIA’s Perspective on Financial Reporting Errors: The IIA’s International Standards for the Professional Practice of Internal Auditing (IPPF) emphasize the importance of accurate financial reporting. IIA Standard 1220 – Due Professional Care requires internal auditors to consider the probability of errors, fraud, or misstatements in financial reporting. COSO’s Internal Control – Integrated Framework highlights that inventory valuation errors can impact financial integrity and decision-making. GAAP & IFRS Accounting Standards also require proper inventory reporting to ensure accurate financial statements. IIA Reference: IPPF Standard 1220 – Due Professional Care COSO Internal Control – Integrated Framework GAAP & IFRS Accounting Principles on Inventory Valuation Thus, the correct and verified answer is C. Net income would be overstated.

Question 6

An internal audit engagement team found that the risk register of the project under review did not
include significant risks identified by the internal audit function. The project manager explained that
risk register preparations are facilitated by risk managers and that each project’s risk review follows
the same set of questions. Which of the following recommendations will likely add the greatest value
to the project management process of the organization?

Accepted Answer

C

Explanation: The root cause of the missing significant risks lies in the methodology used for risk identification. If the process relies too rigidly on a standard set of questions, it may overlook critical risks. By revising the risk identification methodology, the organization ensures that future projects capture relevant risks comprehensively and consistently, adding long-term value. Option A addresses only the current project, not the underlying issue. Option B may improve knowledge but does not fix the flawed process. Option D merely shifts responsibility but does not address the methodology weakness. Reference: IIA Standards – Standard 2120: Risk Management.

Question 7

The chief audit executive (CAE) and management of the area under review disagree over managing a
significant risk item. According to IIA guidance, which of the following actions should the CAE take
first?

Accepted Answer

D

Explanation: When disagreements occur regarding risk management or audit findings, the CAE should first escalate the matter within management levels to attempt resolution. Only if the disagreement remains unresolved after discussion with senior management should the CAE report the matter to the board or audit committee. Options B and C are premature: the charter does not grant internal audit supremacy over management’s decisions, and documenting disagreement in the audit report should occur only after reasonable attempts at resolution. Option A (escalating immediately to the board) should occur only if discussion with management does not resolve the issue. Reference: IIA Standards – Standard 2600: Communicating the Acceptance of Risks.

Question 8

Which of the following data privacy concerns can be attributed specifically to blockchain technologies?

Accepted Answer

D

Explanation: A core feature of blockchain technology is immutability—once data is recorded, it cannot be altered or deleted. While this supports integrity and transparency, it also creates a conflict with data privacy regulations such as the General Data Protection Regulation (GDPR), which grants individuals the “right to be forgotten.” The inability to erase personal data stored on blockchain creates a compliance challenge. Options A and B are incorrect: phishing is not inherent to blockchain, and transactions are not easily tampered with (immutability actually prevents that). Option C is misleading because regulations address data use but do not “overregulate” blockchain specifically. Reference: IIA Global Technology Audit Guide (GTAG): Understanding Blockchain and Related Risks.

Question 9

According to 11A guidance on IT, which of the following spreadsheets is most likely to be considered a high-risk user-developed application?

Accepted Answer

B

Explanation: A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and maintained by end-users (not IT) that are critical to financial reporting, decision-making, or regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the complexity, significance, and control environment of such applications. Analysis of Each Option: (A) Revenue Calculation Spreadsheet Uses price and volume reports from production, meaning it relies on structured, external sources, reducing the risk of significant undetected errors. Less complexity and external verification reduce its risk level. (B) Asset Retirement Calculation Spreadsheet (Correct Answer) Contains multiple formulas and assumptions, making it complex and prone to errors. Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements and compliance. No automated controls or independent validations, making it a high-risk UDA. IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize assessing high-risk spreadsheets that impact financial decision-making. (C) Ad-Hoc Inventory Listing Spreadsheet Used for written-off inventory, which is historical data and not a key financial driver. Limited impact on financial reporting, making it a low-risk UDA. (D) Accounts Receivable Reconciliation Spreadsheet Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial systems. Since external reconciliation exists, the spreadsheet does not pose a high inherent risk. IIA Reference Supporting the Answer: GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial impact, and lack of controls as high-risk. IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and operational risk management, including IT risks. IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user- developed applications. Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial misstatements.

Question 10

Which of the following types of accounts must be closed at the end of the period?

Accepted Answer

A

Explanation: At the end of an accounting period, certain accounts must be closed to prepare financial statements and reset balances for the next period. The accounts that must be closed are temporary accounts, which include all income statement accounts (revenues, expenses, and gains/losses). Why Option A (Income statement accounts) is Correct: Income statement accounts (revenues, expenses, gains, and losses) are temporary accounts that track financial performance for a specific period. At the end of the period, these accounts are closed to the retained earnings account to reset them to zero for the next period. Why Other Options Are Incorrect: Option B (Balance sheet accounts): Incorrect because balance sheet accounts (assets, liabilities, and equity) are permanent accounts that carry their balances forward to the next period. Option C (Permanent accounts): Incorrect because permanent accounts include all balance sheet accounts, which are never closed. Option D (Real accounts): Incorrect because real accounts refer to balance sheet accounts (assets, liabilities, and equity), which remain open. IIA Reference: IIA GTAG – "Auditing Financial Close Processes": Discusses the closing of temporary accounts at the period end. COSO Internal Control – Integrated Framework: Recommends proper financial reporting controls, including account closures. IFRS & GAAP Accounting Standards: Define temporary and permanent accounts in financial reporting. Thus, the correct answer is A. Income statement accounts.

Question 11

An internal auditor identified a database administrator with an incompatible dual role. Which of the following duties should not be performed by the identified administrator?

Accepted Answer

D

Explanation: A database administrator (DBA) should not perform duties that compromise segregation of duties (SoD). A conflict arises when a DBA has both design and security responsibilities, as this creates a risk of unauthorized changes, fraud, or data breaches. Analysis of Each Option: (A) Designing and maintaining the database. Incorrect: These tasks are related but do not create a major conflict, as maintenance follows the design phase. (B) Preparing input data and maintaining the database. Incorrect: While data preparation is typically a business function, maintaining the database does not create a direct security risk. (C) Maintaining the database and providing its security. Incorrect: Maintenance involves technical upkeep, and while security controls are crucial, they do not inherently conflict. (D) Designing the database and providing its security. (Correct Answer) A DBA responsible for both design and security could create backdoors or override security settings, leading to potential data manipulation or fraud. IIA Standard 2120 – Risk Management requires proper control segregation to prevent fraud and security risks. IIA GTAG 4 – Management of IT Auditing recommends separation of design, security, and administration functions to minimize risks. IIA Reference Supporting the Answer: IIA Standard 2120 – Risk Management: Encourages proper separation of duties to mitigate risks. IIA GTAG 4 – Management of IT Auditing: Recommends strict control over database access and security roles. Thus, the correct answer is (D) because combining database design and security responsibilities creates a significant conflict of interest, increasing security risks.

Question 12

Which of the following is the most appropriate way lo record each partner's initial Investment in a partnership?

Accepted Answer

A

Explanation: Recording Initial Investment in a Partnership: When forming a partnership, each partner contributes assets, cash, or services to the business. The initial investment should be recorded at the value agreed upon by the partners, which may differ from fair market value or book value. This is because partnerships are formed based on mutual agreement, and partners decide how to allocate capital and contributions. Why Other Options Are Incorrect: B . At book value: Book value refers to the value recorded in a partner’s individual financial statements. However, in a new partnership, the previous book value is not relevant. C . At fair value: While fair value is commonly used in financial reporting, in partnerships, the agreed-upon value is more relevant as partners may negotiate different terms. D . At the original cost: The original cost of assets contributed may not reflect their current market or partnership-agreed value, making it an inappropriate basis for initial recording. IIA’s Perspective on Financial Recording: IIA Standard 1220 – Due Professional Care requires auditors to ensure that financial transactions are recorded in accordance with agreed terms. COSO Internal Control – Integrated Framework supports the principle that partnership agreements should dictate valuation methods. GAAP & IFRS Accounting Guidelines recognize that partnership accounting is based on agreed-upon contributions rather than standardized valuation methods. IIA Reference: IIA Standard 1220 – Due Professional Care COSO Internal Control – Integrated Framework GAAP & IFRS Partnership Accounting Standards

Question 13

Which of the following techniques would best detect on inventory fraud scheme?

Accepted Answer

B

Explanation: Understanding Inventory Fraud Detection: Inventory fraud typically involves overstatement or understatement of inventory, fictitious inventory transactions, or misappropriation of stock. A key way to detect fraud is analyzing inventory adjustments (e.g., write-offs, missing stock, excess inventory) to identify unusual patterns or discrepancies. Why Stratifying Inventory Adjustments by Warehouse is the Best Approach: Identifies high-risk locations: Certain warehouses may show significantly higher inventory losses or adjustments, indicating possible fraud. Detects manipulation: Fraudsters may manipulate inventory records to cover theft or misstatements. Supports data-driven audit procedures: Stratification allows internal auditors to prioritize high-risk areas for deeper investigation. Why Other Options Are Incorrect: A . Analyze invoice payments just under individual authorization limits – Incorrect, as this technique detects fraudulent disbursements, not inventory fraud. C . Analyze inventory invoice amounts and compare with approved contract amounts – Incorrect, as this method detects pricing or procurement fraud, not inventory manipulation. D . Analyze differences discovered during duplicate payment testing – Incorrect, as this technique is used to detect billing fraud, not inventory fraud. IIA’s Perspective on Fraud Detection and Internal Controls: IIA Standard 2120 – Risk Management requires internal auditors to assess fraud risk, including inventory manipulation. IIA GTAG (Global Technology Audit Guide) on Fraud Detection recommends data analytics for inventory monitoring. COSO Internal Control Framework highlights inventory control as a key component of financial accuracy and fraud prevention. IIA Reference: IIA Standard 2120 – Risk Management & Fraud Detection IIA GTAG – Data Analytics for Fraud Detection in Inventory COSO Internal Control Framework – Inventory and Asset Management Controls Thus, the correct and verified answer is B. Analyze stratification of inventory adjustments by warehouse location.

Question 14

How should a chief audit executive learn about emerging risk areas in an organization?

Accepted Answer

A

Explanation: The CAE should remain aware of emerging risks through ongoing communication and collaboration with senior management and other stakeholders. Building strong relationships allows the CAE to obtain early insights into new and developing risks. Option B (building a risk management process) is management’s responsibility, not internal audit’s. Options C and D involve reviewing processes, but they do not directly expose the CAE to emerging risks in real time. Reference: IIA Standards – Standard 2010: Planning; Practice Guide – Developing a Risk-based Internal Audit Plan.

Question 15

Which of the following should the chief audit executive agree upon with the board before starting an external assessment of the internal audit function?

Accepted Answer

C

Explanation: Before an external assessment of the internal audit activity, the CAE should agree with the board on the qualifications and independence of the external assessor or assessment team. This ensures credibility and compliance with the IIA’s Quality Assurance and Improvement Program (QAIP) requirements. Options A and B (specific audit areas or testing levels) are not matters for board approval in external assessments. Option D (specialized skills) is relevant but not as essential as overall qualifications and competence. Reference: IIA Standards – Standard 1312: External Assessments; Practice Advisory 1312-1.

Free IIA IIA-CIA-Part3 Actual Exam Questions