Certified Internal Auditor (CIA) — Questions and Answers

Question 1: Which of the following QAIP components provides the MOST objective evaluation of the internal audit activity?

External assessment by an independent, qualified assessor (Correct answer)
Peer reviews conducted by CAEs from similar organizations
CAE self-declaration of conformance
Engagement-level supervisory reviews

Correct answer: External assessment by an independent, qualified assessor

An external assessment by a qualified, independent assessor provides the most objective evaluation because it is free from internal bias and organizational familiarity.

Question 2: How do Certified Internal Auditor professionals transfer knowledge from training to practice?

Knowledge transfers automatically
Training and practice are unrelated
By passing the certification exam only
Through supervised practice, mentoring, gradual independence, and ongoing feedback (Correct answer)

Correct answer: Through supervised practice, mentoring, gradual independence, and ongoing feedback

This is fundamental to Certified Internal Auditor practice. Through supervised practice, mentoring, gradual independence, and ongoing feedback represents the professional standard for practical in the Certified Internal Auditor certification framework.

Question 3: When benchmarking audit findings against industry peers, the MOST significant limitation is:

Benchmarking is prohibited under IIA Standards
Industry averages always understate actual performance
Benchmarks are always freely available and thus unreliable
Peer data may not be comparable due to differences in size, structure, or risk appetite (Correct answer)

Correct answer: Peer data may not be comparable due to differences in size, structure, or risk appetite

Differences in organizational size, business model, risk tolerance, and reporting practices can make peer benchmarks misleading if applied without careful contextualization.

Question 4: The IIA's attribute standard on 'proficiency' requires that internal auditors:

Hold a CIA certification before performing any audit work
Specialize in financial auditing exclusively
Possess the knowledge, skills, and competencies needed to perform their responsibilities (Correct answer)
Complete at least 80 hours of training per year

Correct answer: Possess the knowledge, skills, and competencies needed to perform their responsibilities

Proficiency requires that internal auditors possess or obtain the knowledge, skills, and other competencies necessary to fulfill their individual responsibilities.

Question 5: In the COSO Enterprise Risk Management framework, governance is best described as:

A financial reporting process managed by the controller's office
The risk appetite statement issued annually by senior management
The structures, authorities, and responsibilities that enable an organization to establish ERM practices (Correct answer)
The internal audit charter that defines audit scope and authority

Correct answer: The structures, authorities, and responsibilities that enable an organization to establish ERM practices

In COSO ERM, governance encompasses the structures, authorities, and responsibilities that enable an organization to manage its enterprise risks effectively and align ERM with strategy.

Question 6: Which of the following is the MOST important factor in determining audit universe prioritization during risk-based audit planning?

Prior year audit findings
Requests from senior management
Availability of audit staff
Results of the organization's risk assessment (Correct answer)

Correct answer: Results of the organization's risk assessment

Risk-based audit planning aligns audit resources with areas of highest risk as identified through the organization's risk assessment process.

Question 7: When should the CAE communicate significant risk exposures to senior management and the board if management does not address them?

Promptly, regardless of whether management has acted (Correct answer)
Only at the next regularly scheduled board meeting
After two or more follow-up reminders to management
When the external auditor identifies the same issue

Correct answer: Promptly, regardless of whether management has acted

The CAE has a duty to escalate significant unmitigated risks to the board promptly to ensure appropriate governance oversight.

Question 8: How do Certified Internal Auditor professionals evaluate research quality?

By publication date only
Research quality cannot be evaluated
By assessing methodology, sample size, peer review status, and relevance to practice (Correct answer)
By the reputation of the author only

Correct answer: By assessing methodology, sample size, peer review status, and relevance to practice

This is fundamental to Certified Internal Auditor practice. By assessing methodology, sample size, peer review status, and relevance to practice represents the professional standard for research in the Certified Internal Auditor certification framework.

Question 9: What is the primary competency framework for Certified Internal Auditor professionals?

Employer-specific requirements only
Structured competency standards defined by the certifying body (Correct answer)
Self-assessed capabilities only
Ad-hoc skill development

Correct answer: Structured competency standards defined by the certifying body

This is fundamental to Certified Internal Auditor practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the Certified Internal Auditor certification framework.

Question 10: Which internal control framework is most widely used for compliance evaluations under the Sarbanes-Oxley Act in the United States?

COBIT 2019
COSO Internal Control – Integrated Framework (Correct answer)
ISO 31000
Basel III Capital Framework

Correct answer: COSO Internal Control – Integrated Framework

The COSO Internal Control – Integrated Framework is the most widely adopted standard for internal control evaluation in the U.S. and is explicitly referenced in SEC/SOX guidance.

Question 11: The IIA Standards require an external quality assessment of the internal audit function at least once every:

Seven years
Five years (Correct answer)
Three years
Two years

Correct answer: Five years

Standard 1312 requires external assessments to be conducted at least once every five years by a qualified, independent assessor or assessment team.

Question 12: When internal audit's final report contains errors discovered after distribution, Standard 2421 requires the CAE to:

Issue a corrected report to all parties that received the original (Correct answer)
Notify only senior management of the error
Reopen the engagement and re-perform all procedures
Document the error in the next audit's working papers

Correct answer: Issue a corrected report to all parties that received the original

Standard 2421 requires the CAE to communicate a corrected final report to all parties who received the original erroneous report.

Question 13: Standard 1111 (Direct Interaction with the Board) requires the CAE to:

Report exclusively to the board bypassing management
Communicate and interact directly with the board (Correct answer)
Obtain board approval for every audit plan change
Submit all reports to the board before management

Correct answer: Communicate and interact directly with the board

Standard 1111 requires the CAE to communicate and interact directly with the board to support independence and governance.

Question 14: In evidence-based auditing, 'reliability' of evidence refers to:

How easy it is for management to reproduce the evidence
The cost of obtaining the evidence relative to its value
The probability that evidence accurately reflects the underlying condition (Correct answer)
The degree to which evidence is available on time

Correct answer: The probability that evidence accurately reflects the underlying condition

Reliability reflects whether evidence faithfully represents the actual conditions or transactions being audited, which is fundamental to drawing valid conclusions.

Question 15: During an IT audit, the auditor wants to assess completeness of data migration from a legacy system to a new ERP. Which procedure is MOST effective?

Observing the go-live cutover process
Comparing record counts and control totals between the source and target systems (Correct answer)
Reviewing the vendor's migration documentation
Interviewing the project manager about the migration approach

Correct answer: Comparing record counts and control totals between the source and target systems

Comparing record counts and control totals between source and target systems provides direct evidence that all data was transferred completely and accurately.

Question 16: Which of the following categories of audit evidence best exemplifies the ability to establish a fact without relying on supporting assumptions?

Circumstantial
Direct (Correct answer)
Conclusive
Corroborative

Correct answer: Direct

Direct evidence establishes a fact without the need for inference or additional assumptions. For example, observing an inventory count directly proves the existence of inventory at that moment. In contrast, circumstantial evidence requires logical deduction to connect it to the fact in question, and corroborative evidence supports other evidence but doesn't stand alone as direct proof.

Question 17: What is the difference between assurance and consulting engagements in internal auditing?

Assurance provides independent assessment of risks/controls; consulting provides advisory services at management's request (Correct answer)
Consulting is mandatory; assurance is optional
They are identical types of engagements
Assurance involves only financial audits; consulting involves only IT audits

Correct answer: Assurance provides independent assessment of risks/controls; consulting provides advisory services at management's request

Assurance engagements involve objective examination of evidence to provide independent assessments, while consulting engagements are advisory in nature, designed to add value at management's request.

Question 18: Which characteristic of audit report writing is MOST critical to ensure recommendations are accepted by management?

Findings should be ranked by the auditor's personal judgment of severity
Recommendations must be constructive, practical, and cost-effective (Correct answer)
Reports should be lengthy to demonstrate thoroughness
Reports should use persuasive language that pressures management to act

Correct answer: Recommendations must be constructive, practical, and cost-effective

Constructive, practical, and cost-effective recommendations are more likely to gain management acceptance and result in actual improvements.

Question 19: The primary purpose of a literature review in an audit research project is to:

Identify existing knowledge, frameworks, and gaps relevant to the audit topic (Correct answer)
Replace primary data collection with secondary sources
Satisfy documentation requirements in the working papers
Demonstrate the auditor's academic credentials

Correct answer: Identify existing knowledge, frameworks, and gaps relevant to the audit topic

A literature review establishes what is already known, identifies relevant frameworks, and reveals gaps that the current research aims to address.

Question 20: When distributing an audit report containing sensitive findings, the CAE should PRIMARILY consider:

The preferences of the process owner regarding distribution
Minimizing distribution to protect the audit department's reputation
Established policies on report distribution and need-to-know (Correct answer)
Ensuring all employees are aware of control weaknesses

Correct answer: Established policies on report distribution and need-to-know

Report distribution should follow established organizational policies that balance transparency with appropriate confidentiality based on sensitivity.

Question 21: Which of the following audit evidence is generally considered most reliable?

Copies of documents provided by process owners
Oral representations from management
Internal documents created by the auditee
External confirmations obtained directly by the auditor (Correct answer)

Correct answer: External confirmations obtained directly by the auditor

External confirmations obtained directly by the auditor are most reliable because they are independent of the auditee.

Question 22: How does continuous improvement apply to Certified Internal Auditor quality management?

It involves ongoing incremental enhancements to processes based on data and feedback (Correct answer)
It is a one-time initiative
It applies only to products
It means constant major changes

Correct answer: It involves ongoing incremental enhancements to processes based on data and feedback

This is fundamental to Certified Internal Auditor practice. It involves ongoing incremental enhancements to processes based on data and feedback represents the professional standard for quality in the Certified Internal Auditor certification framework.

Question 23: The concept of 'tone at the top' in corporate governance primarily refers to:

The ethical climate and values visibly modeled and enforced by senior leadership and the board (Correct answer)
The seniority threshold required before employees receive ethics training
The volume and frequency of compliance communications issued by internal audit
The number of board and committee meetings held each fiscal year

Correct answer: The ethical climate and values visibly modeled and enforced by senior leadership and the board

'Tone at the top' refers to the ethical culture and values established and visibly demonstrated by senior leadership and the board, which permeates throughout the organization.

Question 24: Which type of IT audit procedure would BEST verify that terminated employees' access has been revoked?

Observing the IT team process a new termination
Comparing active user accounts to current employee records (Correct answer)
Interviewing the IT security manager about procedures
Reviewing the HR termination policy document

Correct answer: Comparing active user accounts to current employee records

Comparing active system accounts against current HR records directly tests whether terminated employee access has actually been removed.

Question 25: Which of the following is a primary responsibility of the audit committee within corporate governance?

Setting product pricing strategies and revenue targets
Day-to-day operational management of finance department activities
Directly managing the internal audit department's budget and staffing
Oversight of financial reporting integrity, internal controls, and external auditors (Correct answer)

Correct answer: Oversight of financial reporting integrity, internal controls, and external auditors

The audit committee's primary responsibility is overseeing financial reporting processes, the adequacy of internal controls, and the relationship with and work of external auditors.

Question 26: Which approach is MOST aligned with evidence-based practice when an auditor disagrees with management's risk assessment?

Escalate immediately to the audit committee without further discussion
Document the disagreement and support the auditor's position with objective evidence (Correct answer)
Remove the finding from the report to avoid conflict
Accept management's view to maintain the relationship

Correct answer: Document the disagreement and support the auditor's position with objective evidence

Evidence-based practice requires that audit conclusions be supported by objective evidence; disagreements with management should be documented with supporting evidence.

Question 27: A healthcare organization's auditor reviews patient billing and finds that claims for a specific procedure code increased 300% in one quarter with no corresponding increase in patient volume. What should the auditor do?

Note the finding and schedule a follow-up audit next year
Conclude that billing productivity improved
Investigate whether the code is being upcoded or applied to ineligible services (Correct answer)
Report directly to CMS without informing management

Correct answer: Investigate whether the code is being upcoded or applied to ineligible services

A dramatic increase in a specific billing code without corresponding patient volume growth is a red flag for upcoding fraud requiring immediate investigation.

Question 28: The three lines of defense model assigns compliance monitoring as a primary responsibility of which line?

External audit
Second line (compliance and risk functions) (Correct answer)
Third line (internal audit)
First line (operational management)

Correct answer: Second line (compliance and risk functions)

The second line of defense includes compliance and risk management functions responsible for establishing policies and monitoring adherence.

Question 29: A self-assessment with independent validation (SAIV) differs from a full external assessment primarily because:

It is performed less frequently than a full external assessment
An external reviewer validates the self-assessment work performed internally (Correct answer)
It is conducted entirely by internal staff without any external involvement
It does not result in a conformance opinion

Correct answer: An external reviewer validates the self-assessment work performed internally

In SAIV, the internal audit activity performs the self-assessment, and a qualified external reviewer validates the process and conclusions.

Question 30: The IIA's definition of internal auditing emphasizes that the function is designed to:

Ensure compliance with all applicable laws and regulations
Detect and report all instances of fraud to regulatory authorities
Add value and improve an organization's operations through assurance and consulting (Correct answer)
Provide independent verification of the external audit opinion

Correct answer: Add value and improve an organization's operations through assurance and consulting

The IIA defines internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

Question 31: Standard 2010 requires the CAE to establish a risk-based audit plan. Which factor should be the PRIMARY driver of this plan?

The organization's risk assessment (Correct answer)
Prior year's audit findings
Management's requested areas for review
Available internal audit resources

Correct answer: The organization's risk assessment

Standard 2010 requires the audit plan to be based on a documented risk assessment, ensuring coverage is aligned with the organization's highest risks.

Question 32: Which metric is MOST useful for measuring the efficiency of the internal audit activity as part of a QAIP?

Ratio of planned audit hours to actual hours incurred per engagement (Correct answer)
Percentage of staff holding advanced degrees
Number of audit committee meetings attended by the CAE
Total number of recommendations issued across all engagements

Correct answer: Ratio of planned audit hours to actual hours incurred per engagement

Comparing planned versus actual hours per engagement measures scheduling accuracy and resource efficiency, both key QAIP efficiency metrics.

Question 33: A control that reduces the likelihood of a risk event occurring is classified as a:

Compensating control
Corrective control
Preventive control (Correct answer)
Detective control

Correct answer: Preventive control

Preventive controls are designed to stop risk events from happening, reducing their probability of occurrence.

Question 34: A company implements a new ERP system and the internal audit team is asked to assess implementation controls. The auditor finds that parallel testing was skipped due to go-live timeline pressure. What risk does this create?

The ERP system may not integrate with existing applications
Staff training costs will increase post-implementation
The ERP vendor may void the support contract
Data migration errors and system configuration issues may not be detected before the system goes live, compromising data integrity (Correct answer)

Correct answer: Data migration errors and system configuration issues may not be detected before the system goes live, compromising data integrity

Skipping parallel testing removes the primary detective control for identifying data migration errors and misconfigured processes before they affect production operations.

Question 35: Which type of audit engagement focuses on whether an organization's activities comply with applicable laws, regulations, and policies?

Operational audit
Compliance audit (Correct answer)
Financial audit
IT audit

Correct answer: Compliance audit

A compliance audit evaluates the extent to which the organization adheres to laws, regulations, and internal policies.

Question 36: Standard 1220 (Due Professional Care) requires internal auditors to consider which factor when planning an engagement?

Number of staff days available for fieldwork
Probability of significant errors, irregularities, or noncompliance (Correct answer)
The auditee's satisfaction scores from prior audits
Cost of audit procedures relative to budget

Correct answer: Probability of significant errors, irregularities, or noncompliance

Standard 1220 requires auditors to consider the probability of significant errors, fraud, or noncompliance when applying due professional care.

Question 37: The IIA's International Professional Practices Framework (IPPF) categorizes its guidance into mandatory and recommended. Which element is MANDATORY?

The Code of Ethics and Standards (Correct answer)
Implementation Guides
Practice Advisories
Supplemental Guidance

Correct answer: The Code of Ethics and Standards

The Core (Code of Ethics and International Standards for the Professional Practice of Internal Auditing) constitutes the only mandatory guidance in the IPPF.

Question 38: When a CAE states that the internal audit activity 'conforms with the International Standards for the Professional Practice of Internal Auditing,' this statement requires support from:

Results of the QAIP, including both internal and external assessments (Correct answer)
A self-declaration filed with the IIA annually
Approval by the audit committee only
The external auditor's attestation letter

Correct answer: Results of the QAIP, including both internal and external assessments

Per Standard 1321, the CAE may only make this conformance statement when supported by QAIP results that include both internal assessments and a current external assessment.

Question 39: Under the IIA Standards, 'due professional care' requires internal auditors to consider which of the following during planning?

The personal qualifications of each audit team member
The probability of significant errors, fraud, or noncompliance (Correct answer)
The budget approved by the audit committee
The number of prior engagements performed in the area

Correct answer: The probability of significant errors, fraud, or noncompliance

Standard 1220 requires auditors to consider the likelihood of significant errors, irregularities, or noncompliance when applying due professional care.

Question 40: The IIA Code of Ethics applies to:

External auditors who rely on internal audit work
All individuals and entities that provide internal audit services (Correct answer)
Only CIA-certified professionals
Only members of the IIA

Correct answer: All individuals and entities that provide internal audit services

The Code of Ethics applies to all individuals and entities that provide internal audit services, whether or not they are IIA members or hold IIA certifications.

Question 41: Which of the following best illustrates 'impairment to independence or objectivity' as described in the IIA Standards?

A CAE who reports to both the CFO and the audit committee
An audit team that has not received training in data analytics
An auditor who has not yet passed the CIA exam performing an engagement
An auditor auditing a process they designed and implemented two years ago (Correct answer)

Correct answer: An auditor auditing a process they designed and implemented two years ago

Auditing a process the auditor personally designed creates a self-review threat—a direct impairment to objectivity because auditors cannot objectively assess their own work.

Question 42: Which practice BEST demonstrates effective upward communication between the internal audit function and the audit committee?

Limiting communication to formal written reports submitted annually
Presenting only positive audit outcomes to maintain committee confidence
Providing periodic, candid reports on audit plan progress and significant risks (Correct answer)
Routing all communications through management before reaching the committee

Correct answer: Providing periodic, candid reports on audit plan progress and significant risks

Effective upward communication includes regular, candid updates on audit activities, emerging risks, and resource constraints to support the audit committee's oversight role.

Question 43: Which framework provides guidance specifically for enterprise risk management and is considered an extension of the COSO Internal Control framework?

Basel III
ISO 31000
COBIT
COSO ERM (Correct answer)

Correct answer: COSO ERM

COSO ERM (Enterprise Risk Management–Integrating with Strategy and Performance, 2017) extends COSO's internal control framework to address risk at an enterprise level.

Question 44: A CIA candidate is reviewing IT general controls (ITGCs). Which of the following is an example of an ITGC?

Automated calculation of depreciation in the ERP system
Segregation of duties in the cash receipts process
User access management and periodic access recertification (Correct answer)
Three-way matching of purchase orders, receiving reports, and vendor invoices

Correct answer: User access management and periodic access recertification

User access management and recertification are IT general controls that provide a foundation for the reliability of all application controls.

Question 45: An internal auditor who lacks expertise in a specialized area needed for an engagement should:

Obtain competency through training, use a specialist, or outsource that portion (Correct answer)
Decline to perform the engagement entirely
Expand the engagement scope to compensate for the knowledge gap
Rely solely on management's representations in that area

Correct answer: Obtain competency through training, use a specialist, or outsource that portion

Standard 1210 allows auditors to address competency gaps by seeking appropriate training, engaging a qualified internal or external specialist, or outsourcing the work.

Question 46: What is organizational independence in the context of internal auditing?

Internal auditors work from home independently
The audit team has no interaction with management
The internal audit department operates as a separate legal entity
The internal audit function reports to a level that allows it to fulfill responsibilities without interference (Correct answer)

Correct answer: The internal audit function reports to a level that allows it to fulfill responsibilities without interference

Organizational independence means the internal audit function reports functionally to the board or audit committee, ensuring it can perform its work without management interference or undue influence.

Question 47: The IIA's 'Three Lines Model' positions internal audit in which line?

First line — operational management
Fourth line — external oversight
Third line — independent assurance (Correct answer)
Second line — risk and compliance functions

Correct answer: Third line — independent assurance

In the IIA's Three Lines Model, internal audit occupies the third line, providing independent assurance to the governing body and senior management.

Question 48: Standard 2050 requires the CAE to share information and coordinate activities with other internal and external providers of assurance to:

Eliminate the need for external audit
Reduce the internal audit budget
Standardize audit methodologies across providers
Ensure adequate coverage and minimize duplication (Correct answer)

Correct answer: Ensure adequate coverage and minimize duplication

Standard 2050 aims to ensure adequate coverage of risk areas and minimize duplication of effort among assurance providers.

Question 49: Under the IIA Standards, which type of engagement is NOT within the typical scope of internal audit work?

Preparation of financial statements for management (Correct answer)
Consulting engagements
Assurance engagements
Compliance audits

Correct answer: Preparation of financial statements for management

Preparing financial statements is a management function and would create a self-review threat; internal auditors provide assurance and consulting services, not accounting preparation services.

Question 50: What role does data analytics play in Certified Internal Auditor practice?

It creates unnecessary complexity
It is only for IT professionals
It replaces professional judgment
It supports evidence-based decision making by identifying patterns and trends in relevant data (Correct answer)

Correct answer: It supports evidence-based decision making by identifying patterns and trends in relevant data

This is fundamental to Certified Internal Auditor practice. It supports evidence-based decision making by identifying patterns and trends in relevant data represents the professional standard for technology in the Certified Internal Auditor certification framework.

Question 51: Which type of audit report format is MOST appropriate for communicating high-level results to a board with limited time?

An executive summary highlighting key findings, risks, and recommended actions (Correct answer)
A raw data dump of all test results for the board to analyze
A comprehensive report with detailed methodology and all working paper references
A technical report written in audit terminology for rigor

Correct answer: An executive summary highlighting key findings, risks, and recommended actions

An executive summary tailored to board members focuses on risk-significant findings and decisions needed, respecting their limited time and strategic focus.

Question 52: The COSO Internal Control–Integrated Framework identifies how many components of internal control?

Four
Five (Correct answer)
Three
Seven

Correct answer: Five

COSO's framework includes five components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

Question 53: A nominating/governance committee of the board is primarily responsible for:

Monitoring and approving enterprise risk management policies and limits
Overseeing financial reporting quality and managing the relationship with external auditors
Identifying and recommending director candidates and overseeing corporate governance practices (Correct answer)
Designing and approving executive compensation and incentive packages

Correct answer: Identifying and recommending director candidates and overseeing corporate governance practices

The nominating/governance committee oversees board composition, leads director nominee identification and vetting, and monitors corporate governance practices and policies.

Question 54: What is the most effective communication approach for Certified Internal Auditor professionals?

Only written communication
Using technical language exclusively
Minimizing all communications
Adapting communication style to the audience while maintaining accuracy and clarity (Correct answer)

Correct answer: Adapting communication style to the audience while maintaining accuracy and clarity

This is fundamental to Certified Internal Auditor practice. Adapting communication style to the audience while maintaining accuracy and clarity represents the professional standard for communication in the Certified Internal Auditor certification framework.

Question 55: During a payroll audit, the auditor finds 15 employees whose direct deposit accounts were changed in the two weeks before payroll processing, with no corresponding HR change requests. What is the most likely risk indicated?

System configuration error in payroll software
Normal employee banking changes during open enrollment
Duplicate payment processing error
Unauthorized redirection of payroll funds, possibly via compromised credentials (Correct answer)

Correct answer: Unauthorized redirection of payroll funds, possibly via compromised credentials

Bank account changes without HR authorization are a strong indicator of payroll fraud through unauthorized account redirection.

Question 56: Under the IIA Standards, which statement about the internal audit charter is CORRECT?

The charter specifies the annual audit plan
The charter must be approved by external auditors
The charter defines the purpose, authority, and responsibility of the internal audit activity (Correct answer)
The charter must be updated annually by the CAE

Correct answer: The charter defines the purpose, authority, and responsibility of the internal audit activity

Standard 1000 requires the charter to define the internal audit activity's purpose, authority, and responsibility; it is approved by the board, not external auditors.

Question 57: A company migrating its ERP system to the cloud should ensure which control is in place to prevent unauthorized data access during migration?

Increased system performance monitoring
Data encryption in transit (Correct answer)
Employee background checks
Updated software licensing agreements

Correct answer: Data encryption in transit

Encrypting data in transit protects sensitive information from interception during the cloud migration process.

Question 58: According to the IIA Standards, which element is required in the internal audit charter?

The list of audits planned for the year
The names of all internal auditors
The purpose, authority, and responsibility of internal audit (Correct answer)
The budget for the internal audit department

Correct answer: The purpose, authority, and responsibility of internal audit

The IIA Standards require the internal audit charter to define the purpose, authority, and responsibility of the internal audit activity.

Question 59: The Sarbanes-Oxley Act of 2002 imposed which of the following penalties for CFOs and CEOs if the financial statements misled investors?

Being barred from holding the position of CEO
Prison time (Correct answer)
We provide free consulting services in their areas of expertise for the community
Fines up to the amount of the misstatement

Correct answer: Prison time

The Sarbanes-Oxley Act of 2002 (SOX) significantly increased the accountability of corporate executives. Section 906 of SOX, in particular, introduced severe criminal penalties, including substantial prison time, for CEOs and CFOs who knowingly sign off on false or misleading financial statements. This provision aimed to deter corporate fraud and restore investor confidence.

Question 60: The Office of Inspector General (OIG) model compliance program guidance for healthcare organizations emphasizes which of the following as the cornerstone of an effective program?

Annual external audits
Commitment by senior and middle management (Correct answer)
Financial penalties avoidance
Real-time regulatory monitoring technology

Correct answer: Commitment by senior and middle management

OIG guidance consistently identifies management commitment and a strong ethical culture as the foundation upon which all other compliance elements depend.

Question 61: A control self-assessment (CSA) workshop generates data that is BEST classified as:

Primary qualitative data collected directly by the auditor (Correct answer)
Secondary data sourced from published benchmarks
External quantitative evidence
Conclusive proof of control effectiveness

Correct answer: Primary qualitative data collected directly by the auditor

CSA workshops produce primary qualitative data because the auditor directly facilitates and collects the information from participants, though it requires corroboration.

Question 62: What is the primary purpose of a data loss prevention (DLP) solution?

Encrypting data at rest
Monitoring and preventing unauthorized transfer of sensitive data (Correct answer)
Detecting malware on endpoints
Backing up critical business data automatically

Correct answer: Monitoring and preventing unauthorized transfer of sensitive data

DLP solutions monitor, detect, and block unauthorized transmission of sensitive data outside the organization.

Question 63: The IIA's Code of Ethics principle of 'integrity' primarily requires internal auditors to:

Maintain confidentiality of information acquired during engagements
Disclose all material facts known to them in reports
Refrain from accepting gifts of any monetary value
Perform work with honesty and avoid acts that discredit the profession (Correct answer)

Correct answer: Perform work with honesty and avoid acts that discredit the profession

The integrity principle requires auditors to perform work with honesty, diligence, and responsibility, and to avoid acts that discredit the profession.

Question 64: An internal auditor communicates audit results to a stakeholder who has a conflict of interest with the subject matter. The auditor should:

Disclose the results per standard distribution protocols and note the conflict (Correct answer)
Allow the stakeholder to edit the findings before distribution
Seek the stakeholder's approval before finalizing the report
Withhold the results from that stakeholder entirely

Correct answer: Disclose the results per standard distribution protocols and note the conflict

Standard distribution protocols should be followed, but the conflict of interest should be flagged appropriately to ensure governance integrity.

Question 65: During a contract management audit, an auditor finds that a vendor's performance metrics consistently fall below SLA thresholds but no penalties have been assessed. The contract owner says the vendor 'always makes it up.' What risk does this represent?

Vendor dependency risk only
Operational risk from service disruption
Financial loss, contractual rights waiver, and potential favoritism or conflict of interest (Correct answer)
Reputational risk from poor vendor management

Correct answer: Financial loss, contractual rights waiver, and potential favoritism or conflict of interest

Failure to enforce SLA penalties risks financial loss, may legally waive contractual rights, and can indicate undisclosed conflicts of interest.

Question 66: A manufacturing company's auditor reviews inventory controls and finds that cycle count adjustments average 8% of inventory value per month. What does this pattern indicate?

The inventory valuation method needs to be changed to FIFO
Significant control weaknesses in receiving, storage, or recording that require root cause investigation (Correct answer)
Normal inventory shrinkage within acceptable industry ranges
The cycle count program is working effectively by catching discrepancies

Correct answer: Significant control weaknesses in receiving, storage, or recording that require root cause investigation

Persistent high-value cycle count adjustments signal systematic control failures in inventory management processes, not a healthy counting program.

Question 67: According to the IIA's definition, which of the following best describes organizational governance?

The process of identifying and mitigating enterprise risks
Management's internal process for setting annual strategic objectives
The audit committee's exclusive oversight of financial reporting
The combination of processes and structures implemented by the board to inform, direct, manage, and monitor activities (Correct answer)

Correct answer: The combination of processes and structures implemented by the board to inform, direct, manage, and monitor activities

The IIA defines governance as the combination of processes and structures implemented by the board to inform, direct, manage, and monitor activities toward achieving organizational objectives.

Question 68: What does the term 'data integrity' mean in an IT audit context?

Data is encrypted to prevent unauthorized disclosure
Data is available whenever needed by users
Data is accessible only to authorized users
Data is accurate, complete, and unaltered during processing (Correct answer)

Correct answer: Data is accurate, complete, and unaltered during processing

Data integrity ensures that data remains accurate, complete, and consistent throughout its lifecycle and is not improperly modified.

Question 69: Which recovery metric defines the maximum acceptable data loss measured in time after a disaster?

Maximum Tolerable Downtime (MTD)
Mean Time to Recover (MTTR)
Recovery Time Objective (RTO)
Recovery Point Objective (RPO) (Correct answer)

Correct answer: Recovery Point Objective (RPO)

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, determining backup frequency requirements.

Question 70: Which of the following BEST describes the concept of triangulation in audit research?

Corroborating findings using multiple independent data sources or methods (Correct answer)
Applying three-way matching for accounts payable transactions
Dividing the audit population into three equal strata
Using three auditors to review the same workpapers independently

Correct answer: Corroborating findings using multiple independent data sources or methods

Triangulation involves using multiple sources, methods, or perspectives to corroborate findings, thereby increasing the validity and reliability of audit conclusions.

Question 71: An internal auditor who performs an operational role (e.g., approving transactions) during an engagement would violate which Standard?

Standard 2200 — Engagement Planning
Standard 1130 — Impairment to Independence or Objectivity (Correct answer)
Standard 2500 — Monitoring Progress
Standard 1000 — Purpose, Authority, and Responsibility

Correct answer: Standard 1130 — Impairment to Independence or Objectivity

Assuming operational responsibilities impairs the auditor's objectivity and independence, which is governed by Standard 1130.

Question 72: Which of the following represents a key governance challenge specific to decentralized organizations?

Maintaining consistent policies, ethical standards, and controls across relatively autonomous business units (Correct answer)
Excessive concentration of decision-making authority in a single executive
Over-reliance on centralized information systems for all reporting
Lack of functional specialization among management roles

Correct answer: Maintaining consistent policies, ethical standards, and controls across relatively autonomous business units

Decentralized organizations face the governance challenge of ensuring consistent application of policies, controls, and ethical standards across business units operating with significant autonomy.

Question 73: Which of the following actions by a CAE would BEST demonstrate compliance with Standard 1111 (Direct Interaction with the Board)?

Inviting board members to observe fieldwork on high-risk engagements
Providing the board with the external auditor's management letter
Sending the board a copy of all audit reports prepared for management
Meeting privately with the audit committee at least quarterly without management present (Correct answer)

Correct answer: Meeting privately with the audit committee at least quarterly without management present

Standard 1111 requires the CAE to communicate and interact directly with the board; regular private sessions (executive sessions) with the audit committee ensure unfiltered communication.

Question 74: How do Certified Internal Auditor professionals contribute to advancing their field?

By maintaining current practices
By conducting research, sharing outcomes, mentoring others, and participating in professional forums (Correct answer)
Individual contribution is not possible
By competing with colleagues

Correct answer: By conducting research, sharing outcomes, mentoring others, and participating in professional forums

This is fundamental to Certified Internal Auditor practice. By conducting research, sharing outcomes, mentoring others, and participating in professional forums represents the professional standard for research in the Certified Internal Auditor certification framework.

Question 75: In a qualitative audit study, 'saturation' refers to the point at which:

The audit budget has been fully expended
All employees in the organization have been interviewed
The auditor has reviewed 100% of the transaction population
Additional data collection no longer produces new themes or insights (Correct answer)

Correct answer: Additional data collection no longer produces new themes or insights

Data saturation in qualitative research occurs when additional data gathering yields no new themes, indicating sufficient depth of understanding has been achieved.

Question 76: Under Sarbanes-Oxley and stock exchange rules, an audit committee should be composed of:

Exclusively members of the external audit firm
A majority of independent directors, with at least one member qualifying as a financial expert (Correct answer)
At least one internal auditor and two senior executives
Equal representation of management nominees and major shareholders

Correct answer: A majority of independent directors, with at least one member qualifying as a financial expert

SOX Section 301 and NYSE/NASDAQ listing rules require audit committees to consist entirely of independent directors, with at least one member designated as a financial expert.

Question 77: An auditor discovers that the results of two different data analysis techniques conflict. The BEST next step is to:

Use whichever result supports the preliminary audit hypothesis
Investigate the conflicting results to determine which technique is more appropriate (Correct answer)
Discard both results and rely solely on interviews
Report both results without further analysis

Correct answer: Investigate the conflicting results to determine which technique is more appropriate

Conflicting analytical results must be investigated to understand why the discrepancy exists and to determine which technique is most appropriate for the data.

Question 78: How has digital technology transformed Certified Internal Auditor practice?

It only affects large organizations
It has replaced all traditional methods
It has enhanced data collection, analysis, communication, and operational efficiency (Correct answer)
It has had no impact

Correct answer: It has enhanced data collection, analysis, communication, and operational efficiency

This is fundamental to Certified Internal Auditor practice. It has enhanced data collection, analysis, communication, and operational efficiency represents the professional standard for technology in the Certified Internal Auditor certification framework.

Question 79: During a QAIP review, an internal auditor notes that engagement objectives were not clearly linked to the risks identified in the planning phase. This finding MOST likely indicates a deficiency in:

Engagement planning quality controls (Correct answer)
External assessment procedures
Audit report formatting standards
Workpaper retention policies

Correct answer: Engagement planning quality controls

Failure to align engagement objectives with identified risks reflects a weakness in engagement planning quality controls, a core QAIP component.

Question 80: A control that prevents errors or irregularities from occurring is BEST classified as:

Compensating control
Detective control
Corrective control
Preventive control (Correct answer)

Correct answer: Preventive control

Preventive controls are designed to stop errors or irregularities before they occur, as opposed to detecting or correcting them after the fact.

Question 81: During a fraud investigation, the internal auditor's role is BEST described as:

Gathering and evaluating evidence to determine whether fraud occurred (Correct answer)
Prosecuting the suspected fraudster
Imposing disciplinary sanctions on employees
Notifying law enforcement without informing management

Correct answer: Gathering and evaluating evidence to determine whether fraud occurred

Internal auditors gather and objectively evaluate evidence to determine whether fraud has occurred, then report findings to appropriate parties.

Question 82: A company's IT general controls audit reveals that privileged user access reviews are performed annually. Industry best practice recommends quarterly reviews. How should the auditor classify this finding?

A significant deficiency requiring immediate remediation
Not a finding, since annual reviews are better than no reviews
A material weakness automatically because it deviates from best practice
A control gap with risk rated based on the sensitivity of systems and data accessed (Correct answer)

Correct answer: A control gap with risk rated based on the sensitivity of systems and data accessed

The severity of a control gap should be assessed based on actual risk exposure, not simply deviation from best practice.

Question 83: The THREE lines of defense model assigns which role to internal audit?

First line — operational management
Fourth line — external audit
Third line — independent assurance (Correct answer)
Second line — risk and compliance functions

Correct answer: Third line — independent assurance

Internal audit serves as the third line of defense by providing independent assurance on the effectiveness of governance, risk management, and controls.

Question 84: Which quantitative technique estimates potential losses by simulating thousands of possible outcomes using random variables?

Monte Carlo simulation (Correct answer)
Failure mode and effects analysis (FMEA)
Decision tree analysis
Sensitivity analysis

Correct answer: Monte Carlo simulation

Monte Carlo simulation runs many iterations with randomly sampled inputs to produce a probability distribution of potential outcomes.

Question 85: Which of the following BEST describes 'inherent risk' in the context of internal auditing?

Risk caused by auditor error
Risk remaining after management applies controls
Risk existing before management takes action to reduce it (Correct answer)
Risk that the auditor will fail to detect a material misstatement

Correct answer: Risk existing before management takes action to reduce it

Inherent risk is the level of risk present in an activity or process before considering the effect of controls or other mitigating factors.

Question 86: An internal auditor is offered a substantial gift by a vendor being audited. Under the Code of Ethics, the auditor should:

Accept the gift and disclose it to the CAE
Decline the gift to avoid compromising objectivity and integrity (Correct answer)
Accept the gift after the audit is completed
Accept the gift if it is below the organization's materiality threshold

Correct answer: Decline the gift to avoid compromising objectivity and integrity

The Code of Ethics requires auditors to avoid accepting gifts that could impair or appear to impair their professional judgment, regardless of value.

Question 87: Standard 2340 requires that engagement working papers be:

Retained according to the organization's retention policies and applicable regulations (Correct answer)
Approved by the board audit committee before filing
Shared with external auditors upon request
Destroyed after the final report is issued

Correct answer: Retained according to the organization's retention policies and applicable regulations

Standard 2340 requires the CAE to develop and maintain record retention policies consistent with organizational guidelines and applicable regulations.

Question 88: An organization's data classification policy assigns 'confidential' to certain records. Which control is MOST directly aligned with enforcing this classification?

Role-based access control restricting confidential data to authorized roles (Correct answer)
Network firewall rules blocking inbound traffic
Antivirus scanning of all incoming email attachments
Regular vulnerability scans of web-facing servers

Correct answer: Role-based access control restricting confidential data to authorized roles

Role-based access control directly enforces data classification by ensuring only authorized roles can access confidential information.

Question 89: When an internal auditor uses meta-analysis to synthesize findings from multiple prior audits, the PRIMARY benefit is:

Eliminating the need for professional judgment
Satisfying regulatory reporting requirements
Reducing the time required for fieldwork
Identifying patterns and trends not visible in individual audits (Correct answer)

Correct answer: Identifying patterns and trends not visible in individual audits

Meta-analysis aggregates results across multiple studies or audits to reveal overarching patterns and trends that single audits cannot detect.

Question 90: What is the primary purpose of the International Standards for the Professional Practice of Internal Auditing?

To set accounting standards for publicly traded companies
To provide a framework for performing and promoting internal audit activities (Correct answer)
To establish tax filing requirements for corporations
To regulate external financial reporting

Correct answer: To provide a framework for performing and promoting internal audit activities

The IIA Standards provide a framework for conducting internal audits consistently, ensuring quality, and promoting the value of internal auditing to organizations worldwide.

Question 91: In a containerized application environment, which security risk is MOST specific to container technology?

Cross-site scripting in web interfaces
SQL injection in application code
Container escape allowing access to the host system (Correct answer)
Weak password policies for user accounts

Correct answer: Container escape allowing access to the host system

Container escape vulnerabilities allow malicious processes to break out of the container sandbox and gain access to the underlying host system.

Question 92: A CAE needs to maintain objectivity while presenting audit results to an executive who funds the audit department. Which approach BEST preserves independence?

Omit minor findings to maintain a positive relationship
Present all findings factually regardless of the executive's preferences (Correct answer)
Delay the report until the executive reviews a draft
Soften findings to avoid conflict with the funding executive

Correct answer: Present all findings factually regardless of the executive's preferences

Objectivity requires internal auditors to present findings factually without bias, regardless of the stakeholder's position or influence.

Question 93: According to the IIA Standards, which of the following best describes the purpose of the internal audit activity's quality assurance and improvement program (QAIP)?

To replace the need for external quality assessments every five years
To ensure compliance with regulatory requirements imposed by external bodies
To measure the efficiency of audit report distribution to the board
To enable an evaluation of the internal audit activity's conformance with the Standards and assess whether auditors apply ethical principles (Correct answer)

Correct answer: To enable an evaluation of the internal audit activity's conformance with the Standards and assess whether auditors apply ethical principles

The QAIP is designed to evaluate conformance with the Standards and the Code of Ethics and to assess whether internal auditors apply ethical principles.

Question 94: Which statistical concept is MOST relevant when an auditor wants to determine whether a difference in error rates between two departments is statistically meaningful?

Regression to the mean
Hypothesis testing with significance testing (Correct answer)
Stratified random sampling
Confidence interval estimation

Correct answer: Hypothesis testing with significance testing

Hypothesis testing with significance testing (e.g., t-tests or chi-square tests) determines whether observed differences are statistically significant or likely due to chance.

Question 95: An internal auditor discovers during fieldwork that a control tested as effective last year is now completely absent — the responsible employee left and the process was never reassigned. What does this situation illustrate about control environments?

Controls dependent on specific individuals without succession planning are fragile and susceptible to breakdown when personnel change (Correct answer)
The former employee should be held responsible for the control failure
Last year's audit conclusions were incorrect and should be restated
The current audit should be immediately halted and reported as a crisis

Correct answer: Controls dependent on specific individuals without succession planning are fragile and susceptible to breakdown when personnel change

Person-dependent controls without documented procedures or succession planning are a systemic fragility — personnel changes routinely cause them to collapse.

Question 96: Which of the following is a benefit that computer-assisted audit techniques give to the audit process?

Ability of auditors to analyze large amounts of data (Correct answer)
Ease of training for auditors
Ability of auditors to deploy software solutions quickly
Ease of access to systems

Correct answer: Ability of auditors to analyze large amounts of data

Computer-assisted audit techniques (CAATs), such as data analytics software, significantly enhance an auditor's ability to process and analyze vast quantities of data quickly and efficiently. This allows for more comprehensive testing, identification of trends or anomalies, and a deeper understanding of business processes than manual methods could achieve, thereby improving audit effectiveness and efficiency.

Question 97: An internal auditor is using data analytics to test for duplicate payments. Which technique is MOST appropriate for this objective?

Control chart analysis
Fuzzy matching algorithms (Correct answer)
Monte Carlo simulation
Regression analysis

Correct answer: Fuzzy matching algorithms

Fuzzy matching algorithms detect near-duplicate records even when minor variations exist in vendor names or invoice numbers, making them ideal for duplicate payment testing.

Question 98: Which type of evidence is considered MOST persuasive when evaluating internal control effectiveness?

Internal memos prepared by the auditee
Oral representations from management
Auditor observations recorded in working papers
Externally generated documentation obtained directly by the auditor (Correct answer)

Correct answer: Externally generated documentation obtained directly by the auditor

Externally generated evidence obtained directly by the auditor is most persuasive because it is independent of the auditee and obtained through the auditor's own procedures.

Question 99: Which scenario represents a violation of the IIA's principle of 'Integrity'?

Declining to audit a department managed by a close relative
Consulting with legal counsel on a sensitive finding
Seeking additional training before performing an IT audit
Omitting an unfavorable finding from a report to avoid conflict (Correct answer)

Correct answer: Omitting an unfavorable finding from a report to avoid conflict

Integrity requires auditors to be honest and not suppress findings; omitting an unfavorable finding directly violates this principle.

Question 100: A risk culture assessment by internal audit would MOST likely include evaluating:

Whether employees feel safe reporting risk concerns without retaliation (Correct answer)
The adequacy of cyber insurance coverage limits
The mathematical accuracy of the risk register scores
Accuracy of financial statement disclosures about risk

Correct answer: Whether employees feel safe reporting risk concerns without retaliation

A healthy risk culture requires psychological safety; auditors assess whether employees can raise concerns freely, which underpins the entire risk management system.

Question 101: The 'confidentiality' principle in the IIA Code of Ethics prohibits internal auditors from disclosing information EXCEPT when:

The information is requested by senior management of the audited entity
The auditor believes the information would improve organizational performance
Another auditor working on a related engagement requests access
A regulatory authority subpoenas the information or disclosure is legally or professionally obligated (Correct answer)

Correct answer: A regulatory authority subpoenas the information or disclosure is legally or professionally obligated

The confidentiality rule permits disclosure only when there is a legal or professional obligation to do so, such as a lawful subpoena or mandatory reporting requirement.

Question 102: An auditor is testing controls over financial statement close. She finds that journal entries posted after period-end cutoff lack supporting documentation 40% of the time. Management says this is due to time pressure. What is the primary audit concern?

Risk of unsupported or fraudulent manual journal entries manipulating reported results (Correct answer)
Whether the close timeline should be extended
Staff training on documentation requirements
Whether the auditor's sample size was large enough

Correct answer: Risk of unsupported or fraudulent manual journal entries manipulating reported results

Unsupported post-close journal entries represent a high risk for earnings manipulation and are a key fraud indicator in financial reporting audits.

Question 103: As defined by COSO, the 'control environment' component of internal control refers to:

The set of standards, processes, and structures that provide the foundation for all other internal control components (Correct answer)
The risk assessment methodologies used to identify control gaps
Only the information technology controls and logical access management policies
The documentation of financial reporting procedures and audit trails

Correct answer: The set of standards, processes, and structures that provide the foundation for all other internal control components

COSO defines the control environment as the set of standards, processes, and structures that establish the foundation for carrying out internal control across the organization.

Question 104: A root cause analysis tool that visually maps contributing causes into categories such as people, process, and technology is known as a:

Fishbone (Ishikawa) diagram (Correct answer)
Scatter diagram
Pareto chart
Box-and-whisker plot

Correct answer: Fishbone (Ishikawa) diagram

The fishbone (Ishikawa or cause-and-effect) diagram organizes potential root causes into categories to help auditors identify the underlying source of a problem.

Question 105: In a survey used to gather audit evidence, which factor MOST threatens the validity of responses?

Leading questions that suggest a desired answer (Correct answer)
Keeping the survey anonymous
Using a Likert scale for attitude measurement
High response rate from the target population

Correct answer: Leading questions that suggest a desired answer

Leading questions bias respondents toward a particular answer, undermining the validity and objectivity of the data collected.

Question 106: When results of a QAIP indicate that the internal audit function does NOT conform with the IIA Standards, the CAE is required to:

Disclose the non-conformance and its impact to senior management and the board (Correct answer)
Suspend all audit activities until conformance is achieved
Engage an external firm to take over audit operations
File a formal non-conformance notice with the IIA

Correct answer: Disclose the non-conformance and its impact to senior management and the board

Standard 1322 requires the CAE to disclose non-conformances and their impacts to senior management and the board, allowing governance stakeholders to take remedial action.

Question 107: What distinguishes a peer-reviewed study in Certified Internal Auditor literature?

It was published in any format
Independent experts in the field evaluated the methodology and conclusions before publication (Correct answer)
It was written by multiple authors
It was published quickly

Correct answer: Independent experts in the field evaluated the methodology and conclusions before publication

This is fundamental to Certified Internal Auditor practice. Independent experts in the field evaluated the methodology and conclusions before publication represents the professional standard for research in the Certified Internal Auditor certification framework.

Question 108: What is a quality assurance and improvement program (QAIP)?

A software testing methodology
A quality control program for manufacturing products
A customer satisfaction survey program
A program to evaluate and continuously improve the internal audit activity's performance and conformance (Correct answer)

Correct answer: A program to evaluate and continuously improve the internal audit activity's performance and conformance

The QAIP includes ongoing internal monitoring and periodic external assessments to evaluate the internal audit activity's conformance with standards and the effectiveness of its processes.

Question 109: In CIA exam context, 'risk-based internal auditing' means that audit resources are allocated based on:

Rotating coverage of all departments on an equal-time basis
Management's specific requests for audit services
A systematic evaluation of the likelihood and impact of risks across the organization (Correct answer)
The number of employees in each auditable unit

Correct answer: A systematic evaluation of the likelihood and impact of risks across the organization

Risk-based auditing directs resources toward areas with the highest likelihood and potential impact of risk, ensuring the audit plan addresses the organization's most significant exposures.

Question 110: Which type of malware encrypts an organization's files and demands payment for the decryption key?

Rootkit
Ransomware (Correct answer)
Adware
Spyware

Correct answer: Ransomware

Ransomware encrypts victim files or systems and extorts payment in exchange for providing the decryption key.

Certified Internal Auditor (CIA)

The CIA is the only globally accepted certification for internal auditors, awarded by The IIA. It validates knowledge across internal audit fundamentals, the practice of internal auditing, and business knowledge including IT, security, and financial management.

110

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds