IIA CIA Part 1 Practice Test

Certified Internal Auditor (CIA) Part 1 focuses on internal audit essentials, professional standards, governance, risk management, control, fraud risk, and the role of internal audit.

Use these 12 original sample questions for initial self-assessment. They are not official IIA questions and do not reproduce a live exam; they are designed to preview independence, governance, risk, control, and professional-standards judgment before you choose whether this Finance Prep route is the one you want next.

What CIA Part 1 practice should test

• applying internal audit standards, independence, objectivity, and ethics to scenarios
• distinguishing governance, risk management, and control responsibilities
• recognizing fraud-risk, assurance, and advisory boundaries
• choosing the audit response that preserves evidence, independence, and stakeholder trust

Sample Exam Questions

Use these questions to check whether your weaknesses are independence, governance roles, risk-control language, fraud indicators, or the boundary between assurance and management ownership.

Question 1

Topic: independence and objectivity

An internal auditor is assigned to review a payroll process that the auditor redesigned six months ago. What is the best concern to raise?

• A. The auditor knows the process too well, so the audit will be faster
• B. Objectivity may be impaired because the auditor would be reviewing recent work they performed
• C. Payroll processes are never auditable
• D. The auditor should complete the engagement but remove all findings

Best answer: B

Explanation: Objectivity can be impaired when auditors review work they recently designed or performed. The issue should be disclosed and managed through reassignment, supervision, or other safeguards.

Question 2

Topic: governance responsibilities

Who owns the design and operation of risk management and control processes?

• A. External auditors only
• B. The internal audit activity
• C. The audit committee secretary
• D. Management

Best answer: D

Explanation: Management owns risk management and controls. Internal audit provides assurance and advisory support, but it should not assume management’s responsibility for designing or operating controls.

Question 3

Topic: internal audit charter

Why is an internal audit charter important?

• A. It formally defines the internal audit activity’s purpose, authority, and responsibility
• B. It replaces the need for audit planning
• C. It guarantees every engagement will find fraud
• D. It lets internal audit approve all management decisions

Best answer: A

Explanation: The charter clarifies internal audit’s mandate, access, reporting lines, authority, and responsibilities. It supports independence and helps stakeholders understand the role of internal audit.

Question 4

Topic: fraud risk

During a purchasing review, an auditor notices a vendor with a personal address matching an employee’s address. What is the best first response?

• A. Ignore it because address matches are always coincidental
• B. Accuse the employee immediately in the draft report
• C. Preserve evidence, expand testing appropriately, and follow the organization’s investigation protocol
• D. Ask the employee to delete the vendor record

Best answer: C

Explanation: A red flag is not proof of fraud, but it requires careful handling. The auditor should preserve evidence, avoid premature accusations, and follow established escalation or investigation procedures.

Question 5

Topic: control design

A company requires manager approval before payments are released, but the system allows the payment clerk to override approval without review. What is the control issue?

• A. Approval controls are unnecessary for payments
• B. The issue affects strategy but not control
• C. The control is perfect because it exists in a written policy
• D. The approval control may be ineffective because override access can bypass it

Best answer: D

Explanation: A control’s design must consider how it can be bypassed. Unreviewed override access can defeat approval requirements and increase fraud or error risk.

Question 6

Topic: assurance versus advisory work

Internal audit is asked to facilitate a risk workshop for management. What safeguard is most important?

• A. Internal audit should make all final risk-response decisions
• B. Internal audit should clarify that management remains responsible for risk ownership and decisions
• C. Internal audit should avoid documenting the workshop
• D. Internal audit should approve the risk appetite

Best answer: B

Explanation: Advisory work can be appropriate if internal audit does not assume management responsibility. Management must own risk decisions, responses, and control operation.

Question 7

Topic: audit committee reporting

Why should the chief audit executive have functional reporting access to the board or audit committee?

• A. To support independence from management being audited
• B. To eliminate all interaction with management
• C. To make the audit committee perform every audit procedure
• D. To avoid risk-based planning

Best answer: A

Explanation: Functional reporting to the board or audit committee helps protect internal audit independence, especially when audit results involve senior management or significant control concerns.

Question 8

Topic: risk and control language

Which statement best distinguishes risk from control?

• A. Risk is the action management takes to reduce uncertainty
• B. Control is the possibility that objectives may not be achieved
• C. Risk is uncertainty that can affect objectives; a control is a process or activity designed to manage that risk
• D. Risk and control are identical terms

Best answer: C

Explanation: Risk is the possibility that events affect objectives. Controls are designed and operated to prevent, detect, correct, or otherwise manage risk.

Question 9

Topic: professional due care

An auditor accepts management’s explanation for a major variance without reviewing support because management is trusted. What principle is most at issue?

• A. Professional due care
• B. Marketing strategy
• C. Inventory pricing
• D. Dividend policy

Best answer: A

Explanation: Professional due care requires appropriate evidence, skepticism, and judgment. Trust in management does not replace audit procedures when risk is significant.

Question 10

Topic: risk-based planning

Why should internal audit use a risk-based plan?

• A. To audit every process with equal frequency
• B. To focus limited audit resources on areas most relevant to organizational objectives and risk
• C. To avoid discussing the plan with stakeholders
• D. To eliminate the need for engagement objectives

Best answer: B

Explanation: Risk-based planning aligns audit coverage with significant risks and objectives. It helps allocate limited resources where assurance is most valuable.

Question 11

Topic: control effectiveness

A control is well designed but is performed only when the supervisor remembers. What is the key issue?

• A. Design effectiveness is always enough
• B. The audit objective should be cancelled
• C. The control should be ignored because it is manual
• D. Operating effectiveness is weak or inconsistent

Best answer: D

Explanation: A control can be well designed but ineffective in operation if it is not performed consistently, by the right person, at the right time, and with adequate evidence.

Question 12

Topic: ethical pressure

Management asks internal audit to remove a significant finding because it may affect a bonus pool. What is the best response?

• A. Remove the finding if the bonus impact is material
• B. Delay the report until bonuses are paid
• C. Follow evidence, reporting, and escalation protocols while preserving objectivity
• D. Let management rewrite the conclusion

Best answer: C

Explanation: Internal audit should not alter conclusions because of compensation pressure. The appropriate response is to rely on evidence, maintain objectivity, and use escalation channels if needed.

CIA Part 1 quick checklist

• Can you separate management ownership from internal audit assurance or advisory work?
• Can you identify independence and objectivity threats before choosing an audit response?
• Can you explain whether a control problem is design, operation, access, override, or evidence-related?

Related IIA pages

• CIA Part 2
• CIA Part 3
• IIA certification updates