Free CIA Business Knowledge for Internal Auditing Practice Questions (2026)

1. Core Question: What makes a goal auditable? The keyword is "audited," which implies a need for objective verification.
2. Key Facts: The goal is vague: "increase market share."
3. Prediction: To audit something, I need to be able to measure it. The goal needs to be specific and quantifiable.
4. Evaluate Options:

• A (Ambitious): Ambition is a subjective quality. I can't audit motivation. Eliminate.
• B (Communicated): I can audit if a communication happened, but if the goal itself is vague, my audit of its achievement is useless. Communication is necessary for execution but not sufficient for auditability. Eliminate.
• C (Measurable KPIs): This directly addresses my prediction. If the goal is "increase market share by 5% in the European market by Q4 2026," I can pull sales reports and verify it. This is auditable. This is the correct answer.
• D (Aligns with mission): Alignment is strategically important, but like ambition, it's a high-level qualitative check. A goal can align perfectly with the mission ("Be the best!") and still be completely unmeasurable. Eliminate.

1. Core Question: What is the primary role of the board in risk management? This is a governance question about the separation of duties between the board and management.
2. Key Facts: The context is a "robust corporate governance framework."
3. Prediction: The board's role is oversight, not execution. They set the strategy and hold management accountable. Management does the actual work.
4. Evaluate Options:

• A (Implementing controls): "Implementing" is a doing word. This is management's job. Eliminate.
• B (Identifying and assessing risks): This is another operational task. Management identifies risks; the board reviews and challenges management's assessment. Eliminate.
• C (Overseeing): The word "overseeing" perfectly matches my prediction. The board ensures management has a proper system in place. This is the correct answer.
• D (Providing assurance): The board receives assurance from internal and external audit. They don't typically provide it directly to external parties; that's the role of the external auditor's report. Eliminate.

1. Core Question: What is the effect on working capital?
2. Key Facts:

• Working Capital Formula: Current Assets (CA) - Current Liabilities (CL)
• Initial CA = $500,000
• Initial CL = $200,000
• Transaction: Cash (a CA) decreases by $100,000. A long-term note payable (a non-current liability) decreases by $100,000.

1. Prediction/Calculation: I need to calculate working capital before and after the transaction. The key is that only current accounts matter.

• Before: Working Capital = $500,000 - $200,000 = $300,000.
• Transaction Analysis:
• Cash (CA) goes down by $100k. New CA = $400,000.
• Long-term note (Non-Current Liability) goes down. This has no effect on Current Liabilities. CL remains $200,000.
• After: New Working Capital = $400,000 (New CA) - $200,000 (Unchanged CL) = $200,000.
• Change: The change is from $300,000 to $200,000, which is a decrease of $100,000.

1. Evaluate Options:

• My calculation shows a decrease of $100,000. Option B matches this.

• C (Remains unchanged): This is the most common trap. Candidates think, "an asset went down by $100k and a liability went down by $100k, so it's a wash." They forget that working capital only cares about current liabilities. Because a non-current liability was paid, the two sides of the working capital equation were not equally affected. This question is a pure test of reading carefully.

1. Core Question: What is the primary objective of IT governance? Governance is a high-level, strategic concept.
2. Key Facts: None, this is a definition-based question.
3. Prediction: Governance is always about linking something (in this case, IT) to the overall business goals and strategy. It's about ensuring IT serves the business, not the other way around.
4. Evaluate Options:

• A (Available and secure): These are important outcomes of good IT management, but they are operational goals, not the overarching strategic purpose of governance. They are the "what," while governance is the "why." Eliminate.
• B (Align IT with business strategy): This perfectly matches my prediction. IT governance exists to make sure technology investments and efforts are pushing the business forward. This is the correct answer.
• C (Minimize spending): Cost is a factor, but not the primary driver. A strategic IT investment might increase costs in the short term to achieve a long-term business goal. Focusing only on cost can be strategically damaging. Eliminate.
• D (Implement policies): This is an operational management task. Governance is about creating the framework for those policies, not the implementation itself. Eliminate.

1. Core Question: How does the risk appetite statement impact the internal audit activity?
2. Key Facts: The board approved a risk appetite statement.
3. Prediction: The risk appetite is the "line in the sand" for how much risk is too much. The internal audit activity's job is to see if the company's actual risk levels are consistent with that line. Therefore, it must guide where we look for problems—our audit plan. You can learn more about this in our detailed guide on CIA Essentials of Internal Auditing: Risk appetite and risk tolerance — Complete Study Guide.
4. Evaluate Options:

• A (Dictates procedures): The statement tells us what to audit (areas where risk might exceed appetite), but not how to audit it. The Chief Audit Executive determines the specific procedures. Eliminate.
• B (Determines staff): Staffing is a result of the overall audit plan, which is influenced by risk appetite, but it's not a direct determination. It's a second-order effect. Eliminate.
• C (Guides audit scope and plan): This matches my prediction perfectly. The risk appetite helps us prioritize our audits on the most critical areas where risk tolerance might be breached. This is the correct answer.
• D (Transfers responsibility): This is fundamentally wrong and violates the principles of internal audit independence and management's role. Management always owns the risk. Eliminate.

1. Core Question: What's the most effective way to reduce resistance to change?
2. Key Facts: A major ERP implementation is happening. Resistance is expected.
3. Prediction: Change management theory consistently shows that participation and communication are key. People support what they help create. So, getting employees involved early is probably the best approach.
4. Evaluate Options:

• A (Announce suddenly): This creates fear and distrust, which increases resistance. Eliminate.
• B (Focus on technical benefits): This ignores the human element. Employees care about "What's in it for me?" and "How does this affect my job?" not just abstract efficiency gains. Eliminate.
• C (Involve employees): This directly matches my prediction. Involvement builds ownership and turns resistors into champions. This is the correct answer.
• D (Training only after deployment): Training is essential, but waiting until after go-live is too late. It should happen before and during the transition. This is a reactive, not a proactive, strategy. Eliminate.

1. Core Question: What is the best way to mitigate the risk of the USD depreciating?
2. Key Facts:

• Liability: Pay ¥10,000,000 in 90 days.
• Risk: USD depreciation. This means it will take more dollars to buy the required ¥10,000,000. For example, if the rate moves to $1 = ¥90, the payment would cost ~$111,111 instead of the current $100,000. The company wants to avoid this.

1. Prediction: The company needs a way to lock in today's exchange rate for a future transaction. This is the definition of a hedging instrument like a forward contract.
2. Evaluate Options:

• A (Delay payment): If the USD is getting weaker, delaying payment will make the final dollar cost higher. This amplifies the risk, it doesn't mitigate it. Eliminate.
• B (Forward contract): This allows the company to lock in a specific exchange rate for the future date, completely eliminating the uncertainty. This perfectly matches my prediction. This is the correct answer.
• C (Purchase now): This converts a foreign exchange risk into an inventory risk (storage costs, obsolescence) and a cash flow problem (paying now instead of in 90 days). It doesn't solve the core FX risk for future transactions. Eliminate.
• D (Invest in Yen assets): This is a valid strategy known as a "natural hedge." However, for a single, specific, known future payment, a forward contract is a more direct and precise tool that perfectly neutralizes the transaction risk without introducing new investment risks. Therefore, B is the best answer for this scenario. Eliminate as less optimal.

1. Core Question: Which weakness most directly risks a data privacy breach? A privacy breach is about unauthorized access or disclosure of sensitive data.
2. Key Facts: The context is data privacy regulations like GDPR. These heavily emphasize principles like "least privilege" and access control.
3. Prediction: The biggest risk is someone seeing data they shouldn't. This points to a failure in access controls. If people who no longer need access still have it ("privilege creep"), that's a direct path to a breach.
4. Evaluate Options:

• A (No backup plan): This is a data availability risk. If the server crashes, you can't get the data back. It's a huge problem, but it's not a privacy breach in itself. Eliminate.
• B (Infrequent access review): This perfectly matches my prediction. If an employee moves from sales to marketing but keeps access to sales databases, they have unnecessary privileges. This is a direct privacy risk. This is the correct answer.
• C (Inadequate physical security): This is a valid risk, but most breaches today are logical (via the network) rather than physical. While important, a failure in logical access control is often considered more pervasive and direct for large-scale data exfiltration. A good answer, but B is more direct for typical privacy breaches.
• D (No disaster recovery site): Like backups, this is about business continuity and data availability after a major event. It doesn't directly cause unauthorized disclosure. Eliminate.

1. Core Question: Calculate the number of units for a target profit. This is a specific formula.
2. Key Facts:

• Selling Price (P) = $50
• Variable Cost (VC) = $30
• Total Fixed Costs (FC) = $200,000
• Target Profit (TP) = $100,000

1. Prediction/Formula: The formula for target profit units is: (Fixed Costs + Target Profit) / Contribution Margin per Unit.

• First, calculate Contribution Margin (CM) per unit = P - VC = $50 - $30 = $20.
• Next, plug everything into the main formula:

($200,000 FC + $100,000 TP) / $20 CM per unit = $300,000 / $20 = 15,000 units.

1. Evaluate Options:

• My calculation is 15,000 units. Option C matches this.

• B (10,000 units): This is the break-even point. It is calculated as Fixed Costs / Contribution Margin per Unit ($200,000 / $20 = 10,000 units). This is the most common trap. Candidates either forget the formula or are in a hurry and only calculate the break-even point, ignoring the target profit component. The examiner always includes the break-even point as a distractor on target profit questions.

1. Core Question: Which risk response strategy is being used? I need to know the definitions of the four main responses.
2. Key Facts: The company is proceeding with the risky activity but is implementing controls to manage it.
3. Prediction: The four responses are: Avoid (don't do it), Transfer (make someone else bear the risk, e.g., insurance), Mitigate (reduce the risk's likelihood or impact), and Accept (do nothing). Since they are doing the activity but adding controls, this is clearly mitigation.
4. Evaluate Options:

• A (Avoidance): They are proceeding, so it's not avoidance. Eliminate.
• B (Transfer): They are not using insurance or outsourcing. The controls are internal. Eliminate.
• C (Mitigation): They are implementing controls (market research, phased rollout) to reduce the likelihood and impact of failure. This matches my prediction. This is the correct answer.
• D (Acceptance): They are actively implementing controls, which is the opposite of acceptance. Eliminate.

1. Core Question: A key risk is missing from the BCP. This points to a failure in which preceding step? This tests my knowledge of the BCM lifecycle.
2. Key Facts: The plan is missing a response for a critical supplier loss.
3. Prediction: The BCM process starts with identifying what's important and what can break it. This is the Business Impact Analysis (BIA). The BIA's job is to identify critical processes (like production) and the resources they depend on (like the critical supplier). If this dependency wasn't identified, the BIA was flawed.
4. Evaluate Options:

• A (DRP): DRP is a subset of BCP focused on IT recovery. The problem is a supplier, which is a business process issue, not just IT. Eliminate.
• B (Crisis Management): This is the high-level response during an event. The plan is flawed because a risk wasn't identified earlier. Crisis management uses the plan; it doesn't create it. Eliminate.
• C (BIA): The BIA is the foundational step where you identify critical functions and dependencies. A failure to identify the supplier dependency is a direct failure of the BIA. This matches my prediction. This is the correct answer.
• D (RTO setting): The RTO is the target recovery time for a function that has been identified as critical. The problem here is that the function's dependency on the supplier wasn't properly analyzed in the first place. You can't set an RTO for a risk you haven't identified. Eliminate.

1. Core Question: What happens when an activity on the critical path is delayed?
2. Key Facts:

• The activity is on the critical path.
• The delay is 2 days.
• There is no slack.

1. Prediction: The definition of the critical path is that it's the longest sequence of dependent tasks, and it has zero slack. Any delay to any activity on this path directly delays the entire project by the same amount. Therefore, a 2-day delay on the path means a 2-day delay for the project.
2. Evaluate Options:

• A (Delayed by two days): This directly matches my prediction based on the definition of the critical path. This is the correct answer.
• B (Delayed by more than two days): This is unlikely unless the delay causes other, unrelated problems. Based purely on CPM logic, the delay is one-to-one. Eliminate.
• C (Not affected if another activity is expedited): The statement is true in theory (this is called "crashing" the project), but the question asks for the most likely impact of the delay itself, not potential mitigation actions. The direct impact is the delay. Eliminate.
• D (Cannot be determined): It can be determined. The total project duration is irrelevant to the impact of a delay on the critical path. Eliminate.

1. Core Question: Which capital budgeting method meets two specific criteria: (1) uses time value of money, and (2) is a percentage?
2. Key Facts: None, this is a definition-based question.
3. Prediction: I need to review the definitions of each method against the criteria.

• Payback Period: How long to get cash back? No time value of money. Expressed in years. Fails both.
• NPV: What is the value of future cash flows in today's dollars? Uses time value of money. Expressed as a dollar amount. Fails the percentage criterion.
• IRR: What discount rate makes the NPV equal to zero? Uses time value of money. Expressed as a percentage. Meets both criteria.
• ARR: What is the average accounting profit / average investment? Does not use time value of money (uses accounting profit, not cash flow). Expressed as a percentage. Fails the time value criterion.

1. Evaluate Options: Based on my analysis, only IRR meets both requirements.

• B (NPV): NPV is an excellent method that uses the time value of money, so it's half right. Candidates who forget the "expressed as a percentage" requirement will choose this.
• D (ARR): ARR is expressed as a percentage, so it's also half right. Candidates who forget the "time value of money" requirement will choose this. The question is specifically designed to make you check both boxes.

1. Core Question: Which element is not required for a valid contract? This is an "exception" question.
2. Key Facts: The context is a basic review of contract validity.
3. Prediction: I know the core elements of a contract are offer, acceptance, consideration, legal purpose, and capacity of the parties. A common misconception is that all contracts must be in writing. Many oral contracts are perfectly valid, although harder to prove.
4. Evaluate Options:

• A (Offer and acceptance): This is the fundamental "meeting of the minds." It's absolutely required. Eliminate.
• B (Consideration): Both sides must give something of value. This is required. Eliminate.
• C (A written document): My prediction was that this isn't always required. While certain types of contracts must be in writing (e.g., for the sale of land, under the Statute of Frauds), it is not a universal requirement for all contracts. Therefore, it is the element not typically required. This is the correct answer.
• D (Legal capacity): The parties must be legally competent (e.g., not minors, not mentally incapacitated) to enter a contract. This is required. Eliminate.

1. Core Question: Classify the type of IT control for a password policy.
2. Key Facts: The control is a system-wide password policy.
3. Prediction: I need to distinguish between general and application controls. General controls apply to the entire IT environment (networks, operating systems, databases). Application controls are specific to one piece of software (e.g., a rule inside the payroll application that flags overtime hours over 20 per week). A password policy applies to logging into the system as a whole, not just one function within the payroll app. Therefore, it's a general control.
4. Evaluate Options:

• A (Application control): This is incorrect because the password policy governs access to the entire system, not a specific transaction or process within the payroll application. Eliminate.
• B (Physical control): This relates to locking doors or securing server rooms. A password is a logical control, not a physical one. Eliminate.
• C (General control): This matches my prediction. Logical access controls like password policies are a classic example of IT general controls (ITGCs) because they provide a secure foundation for all applications running on the system. This is the correct answer.
• D (Detective control): A password policy is a preventive control; it is designed to stop unauthorized access from happening in the first place. A detective control would be a log that shows failed login attempts. Eliminate.

• A (Application control): This is the most common wrong answer. Candidates see "payroll system" and immediately think "application." But the control itself—the password policy—is a general, system-wide rule, even though it affects access to the application.
• D (Detective control): Candidates often mix up preventive, detective, and corrective controls. Remembering that passwords prevent access is key.