CIA Part 2 Practice Questions

Original scenario practice

How to use this set

These are original scenarios written for this guide. They do not reproduce secure IIA questions or claim to match the live exam interface. Work each item without notes, choose an answer, and state the decisive fact before reading the rationale.

The cases cover five common Part 2 decisions: population validation, criteria, nonstatistical selection, operating evidence, and supervision. The real 2025 blueprint also tests resources, communication, and other procedures; use this set as a reasoning drill, not as a complete syllabus review.

A reliable scenario method

First identify the engagement objective and what the question requests. Then identify the stage of work and the facts that make the choice difficult. Ask what evidence is available, what remains missing, and what conclusion that evidence can support.

Finally, eliminate options that assume intent, generalize from an unsuitable sample, skip criteria, or assign management work to internal audit. The best answer usually advances the objective while preserving evidence quality and appropriate authority.

Review the distractors

Do not stop after seeing that your selected answer is correct. Explain why each wrong answer fails. It may rely on an unverified list, skip a policy exception, use a sample outside its inference limits, or treat inquiry as proof of performance. This process builds transferable judgment instead of answer-letter memory.

Mark uncertain correct responses. A correct guess can expose the same gap as a wrong answer, especially when two choices were confused. Revisit the concept later with changed facts and verify that the reasoning still holds.

Build learning from errors

Tag each miss as planning, criteria, population, evidence, sampling, analysis, conclusion, supervision, or role boundary. If several errors involve population completeness, practice reconciling system data to independent records. If they involve conclusions, practice writing a sentence that precisely states what the test established and what it did not.

Keep a short log of the controlling fact and correction. After a day, try to explain the answer without looking. Then solve a new scenario involving a different process so the concept transfers beyond vendor changes or expenses.

Question 1 reasoning: validate before selection

The population mismatch affects the foundation of the test. A sample drawn from a report that omits system updates cannot answer whether all bank-detail changes were approved. Reconcile sources, understand the difference, and establish a complete population before selecting the sample. The key word is “first”: do not conclude from the mismatch alone.

The strongest distractor is to sample the process owner’s spreadsheet because it appears organized. A management-prepared list can be useful, but its completeness must be tested. System logs also need validation; they are not automatically complete merely because they come from a system.

Question 2 reasoning: apply the full criterion

Policy contains a general rule and a defined exception. The auditor must test against the whole applicable criterion, including the emergency pathway, rather than treating the general rule as absolute. Determine the emergency definition and required documentation, then conclude for the tested transactions.

Changing policy after discovering exceptions would move the benchmark and give management a chance to shape criteria around results. Removing exceptions from scope because they are unusual could omit the very risk the engagement should evaluate.

Question 3 reasoning: respect selection limits

The auditor deliberately selected high-risk items, so the result can establish facts about those items and help target additional testing. It cannot be reported as a 20% population failure rate without a sample design that supports that estimate. Validate the approval requirement and evidence, evaluate exposure, and decide whether a broader selection is needed.

A fraud conclusion requires evidence of more than an approval exception. Unauthorized or poorly documented activity can indicate a control weakness; intent and responsibility require appropriate investigation. Do not dismiss an exception, but do not make an accusation before facts support it.

Question 4 reasoning: test operation over time

The objective explicitly asks whether reviews operated during the last year. Dated review records matched to account populations for the relevant periods directly address operation and coverage. Follow-up evidence shows whether reviewers resolved inappropriate or unexplained access.

A current policy is design evidence, not proof of prior operation. A current account list can omit removed accounts and prior-period populations. Another manager’s agreement is still inquiry; it does not establish that quarterly reviews occurred.

Question 5 reasoning: review the support

A reviewer must understand the population, selection, period, evidence, and inference before accepting a conclusion. The 8-of-30 result could be serious, but the numerator and denominator mean little if the source list is incomplete or the selection method is unknown. Require a complete workpaper and decide whether additional work is necessary.

Sampling is an appropriate audit method when designed and interpreted for the objective. Rejecting it categorically is as unsound as extrapolating without basis. A supervisor should preserve useful work, fill documentation gaps, and require more testing only when evidence or risk warrants it.

A final reasoning checklist

Across the set, the best answer usually fixes a validity problem before drawing a conclusion. Verify criteria before labeling a violation, verify a population before sampling, verify evidence before reporting a control result, and verify the inference before stating its scope.

These questions are original study material. Do not treat a practice result as an official prediction. The purpose is to rehearse the reasoning and build a habit of explaining what the evidence does and does not establish.