Certified Internal Auditor (IIA) 3 — Questions and Answers
Question 1: Under the IIA Standards, a quality assurance and improvement program (QAIP) must include:
- Annual external assessments only
- Both internal and external assessments (Correct answer)
- Peer reviews every two years
- Monthly reporting to the board
Correct answer: Both internal and external assessments
A QAIP must include both ongoing internal assessments and periodic external assessments to evaluate the effectiveness of the internal audit activity.
Question 2: Which of the following BEST describes 'inherent risk' in the context of internal auditing?
- Risk remaining after management applies controls
- Risk that the auditor will fail to detect a material misstatement
- Risk existing before management takes action to reduce it (Correct answer)
- Risk caused by auditor error
Correct answer: Risk existing before management takes action to reduce it
Inherent risk is the level of risk present in an activity or process before considering the effect of controls or other mitigating factors.
Question 3: An internal auditor who previously worked as the controller of an audited department should:
- Lead all audits of that department to leverage expertise
- Be prohibited from ever auditing that department
- Avoid auditing that department for at least one year after leaving the role
- Disclose the prior role and assess whether objectivity is impaired (Correct answer)
Correct answer: Disclose the prior role and assess whether objectivity is impaired
The auditor must disclose the former position and the CAE should evaluate whether objectivity is impaired before assigning the auditor to that engagement.
Question 4: Which audit sampling method gives each item in the population an equal chance of selection?
- Judgmental sampling
- Stratified sampling
- Random sampling (Correct answer)
- Cluster sampling
Correct answer: Random sampling
Random sampling ensures every item in the population has an equal and known probability of being selected, reducing selection bias.
Question 5: The THREE lines of defense model assigns which role to internal audit?
- First line — operational management
- Second line — risk and compliance functions
- Third line — independent assurance (Correct answer)
- Fourth line — external audit
Correct answer: Third line — independent assurance
Internal audit serves as the third line of defense by providing independent assurance on the effectiveness of governance, risk management, and controls.
Question 6: A preliminary survey conducted before an audit engagement is PRIMARILY used to:
- Select statistical samples
- Gain familiarity with the audited activity and identify risk areas (Correct answer)
- Finalize the audit report format
- Determine disciplinary actions for control failures
Correct answer: Gain familiarity with the audited activity and identify risk areas
A preliminary survey helps auditors understand the activity being audited, identify potential risks, and determine the focus of the engagement.
Question 7: Which of the following is an example of a detective control?
- Requiring dual authorization before processing payments
- Conducting monthly bank reconciliations (Correct answer)
- Encrypting sensitive data files
- Performing background checks on new employees
Correct answer: Conducting monthly bank reconciliations
Bank reconciliations detect discrepancies after they occur, making them detective controls rather than preventive or corrective controls.
Certified Internal Auditor (IIA) 3
Under the IIA Standards, a quality assurance and improvement program (QAIP) must include: