Free IIA CIA Part 1 (Internal Audit Fundamentals) Governance, Risk Management, and Control Practice Questions

C is correct. A preventive control stops an error or irregularity before it happens. A system edit that refuses to pay any invoice without a matching approved purchase order stops the unauthorized payment before any money leaves the organization. Detective controls find a problem after it has occurred. Reconciliations and exception-report reviews are detective controls. Corrective controls fix the damage once a problem has been found, as a restoration from backup does. Knowing these three types helps the internal auditor judge whether a process relies mainly on stopping problems or on finding and fixing them afterward.

B is correct. The internal audit function may provide advisory input on the design of the organization's ethical framework, including a whistleblower hotline, but management retains responsibility for approving, owning, and operating it. Keeping approval and implementation with management preserves objectivity so the function can later provide assurance over the hotline's effectiveness. Standard 2.2 requires safeguards over objectivity, and the guidance on advisory services permits input without assuming management responsibility.

D is correct. Under the Three Lines Model, a unit that designs controls and reports through the operations director is performing management activity and is not organizationally independent of the process it evaluates, so its work cannot be treated as equivalent to internal audit assurance. IIA guidance on coordination and reliance requires the chief audit executive to evaluate the competence, objectivity, and methodology of other assurance providers before using their work, and to determine what additional internal audit procedures are needed. Self-monitoring of self-designed controls is a recognized objectivity concern; reliance may remain possible, but only after that assessment and with the scope of reliance adjusted accordingly.