IIA CIA-Part2-2025 - CIA Part 2 - Internal Audit Engagement Exam
Page: 1 / 20
Total 100 questions
Question #1 (Topic: Exam A)
An internal auditor needs to test logical controls to determine whether all users access the organization's enterprise resource planning system according to the principle of least privilege.
Which engagement procedure would be most effective in carrying out this test?
Which engagement procedure would be most effective in carrying out this test?
A. Obtain the user access list created by management that shows user roles and permissions, and observe the actions of a sample of users for consistency.
B. Generate a user access list from the system that shows roles and permissions, and observe the actions of a sample of users for consistency.
C. Generate a user access list from the system that shows roles and permissions, and use access rights management software to confirm permissions.
D. Obtain the user access list created by management that shows user roles and permissions, and compare with job descriptions for consistency.
Answer: C
Question #2 (Topic: Exam A)
An internal auditor performed a review that focused on the organization's process for vetting vendors. The internal auditor's testing identified that 120 out of 130 vendors had a business relationship with the organization's procurement manager that violated conflict-of-interest policies.
Which of the following conclusions could the internal auditor draw from these results?
Which of the following conclusions could the internal auditor draw from these results?
A. The organization is exposed to significant fraud and abuse risks as a result of the vendor and employee business relationships.
B. Due to improper relationships and favoritism, vendors are not providing goods or services at a reasonable price to meet the objectives.
C. The organization's conflict-of-interest policies are not clear or well communicated throughout the organization.
D. Improper relationships and favoritism means that controls are not effective and significant fraud occurs.
Answer: A
Question #3 (Topic: Exam A)
During planning, the chief audit executive submits a risk-and-control questionnaire to management of the activity under review. Which of the following statements is true regarding the questionnaire?
A. It would be an inefficient way for internal auditors to address multiple controls in the activity under review.
B. It would limit certain members of the internal audit team from being fully involved in the engagement.
C. It would be the most effective way for the internal audit team to obtain a detailed understanding of the processes and controls in the activity to be audited.
D. It would be an efficient way for the internal audit team to determine whether specified control activities are in place.
Answer: D
Question #4 (Topic: Exam A)
What is a control implication for an organization that adopts a flat structure?
A. Mid-level employees are urged to innovate.
B. Available time for supervision is limited.
C. There are many hierarchical levels.
D. The organizational structure is dispersed vertically.
Answer: B
Question #5 (Topic: Exam A)
During engagement planning, which party provides the most accurate and up-to-date description of how organizational processes and key controls operate?
A. The management responsible for the activity under review.
B. The individuals who perform the daily tasks and functions of the activity under review.
C. The external auditors since they understand the key controls behind the financial statements.
D. The board of directors since they provide overall oversight for the organization.
Answer: B
