Certified Internal Auditor (IIA) 2 — Questions and Answers
Question 1: According to the IIA Standards, which element is required in the internal audit charter?
- The budget for the internal audit department
- The purpose, authority, and responsibility of internal audit (Correct answer)
- The names of all internal auditors
- The list of audits planned for the year
Correct answer: The purpose, authority, and responsibility of internal audit
The IIA Standards require the internal audit charter to define the purpose, authority, and responsibility of the internal audit activity.
Question 2: When assessing the adequacy of a risk management process, the internal auditor should PRIMARILY evaluate:
- Whether all risks have been eliminated
- Whether management has identified and responded to key risks (Correct answer)
- Whether the external auditors agree with the risk assessment
- Whether risks are documented in the annual report
Correct answer: Whether management has identified and responded to key risks
Internal auditors evaluate whether management has appropriately identified, assessed, and responded to significant risks facing the organization.
Question 3: Which type of engagement provides independent assessments of conformance with plans, policies, and regulations?
- Consulting engagement
- Assurance engagement (Correct answer)
- Advisory engagement
- Facilitation engagement
Correct answer: Assurance engagement
Assurance engagements involve objective assessments of evidence to provide independent opinions on governance, risk, and control processes.
Question 4: An internal auditor discovers a significant control deficiency during a consulting engagement. What should the auditor do?
- Ignore it because consulting engagements don't cover controls
- Report it only to the manager who requested the engagement
- Communicate it to senior management and the board (Correct answer)
- Document it only in personal notes
Correct answer: Communicate it to senior management and the board
The IIA Standards require internal auditors to communicate significant control deficiencies discovered during consulting engagements to senior management and the board.
Question 5: The IIA's Code of Ethics principle of 'objectivity' requires that internal auditors:
- Never discuss findings with auditees
- Not subordinate their judgment on audit matters to others (Correct answer)
- Rotate assignments every six months
- Avoid all social contact with company employees
Correct answer: Not subordinate their judgment on audit matters to others
Objectivity requires internal auditors to make independent assessments without subordinating their professional judgment to the influence of others.
Question 6: Which of the following BEST describes the concept of 'due professional care' in internal auditing?
- Guaranteeing that all errors will be detected
- Applying the care and skill expected of a reasonably prudent auditor (Correct answer)
- Performing every possible audit procedure
- Obtaining a second opinion on all findings
Correct answer: Applying the care and skill expected of a reasonably prudent auditor
Due professional care means applying the skill and diligence that a reasonably prudent and competent internal auditor would apply under similar circumstances.
Question 7: When planning an audit of a complex area where the internal audit team lacks expertise, the CAE should:
- Cancel the audit until expertise is developed
- Use external service providers to supplement the team's skills (Correct answer)
- Rely solely on management's representations
- Limit the audit scope to areas of existing competency
Correct answer: Use external service providers to supplement the team's skills
The IIA Standards allow the CAE to obtain competency through external service providers when internal expertise is insufficient.
