Free IIA CIA Part 3 (Internal Audit Function) Practice Questions

D is correct. The closing communication, often called the exit conference, brings together the internal auditors who performed the work and the management of the activity reviewed, that is, the people with direct knowledge of the process and the authority to act on the results. Its purpose is to confirm the factual accuracy of the observations, discuss the conclusions and their significance, and agree action plans before the final engagement communication is prepared. Standard 15.1 then makes the chief audit executive responsible for reviewing and approving the final communication and determining its recipients.

A is correct. Standard 9.2 (Internal Audit Strategy) requires the chief audit executive to develop and periodically review a strategy that supports the organization's strategic objectives and stakeholder expectations. A shift in the organization's own strategy changes the risk profile the function must cover, the competencies and technology it needs, and the assurance stakeholders will expect, so it is the trigger that drives the strategy, the resource plan, and the multi-year coverage model to be reconsidered. Operational disruptions are absorbed through normal plan and resource management without revisiting the strategy itself.

C is correct. Disclosure to senior management and the board is required when nonconformance affects the internal audit function's overall scope or operation, and the disclosure states the circumstances, the impact, the actions taken or planned, and the rationale. Operating without a board-approved charter means the function's authority, mandate, access, and reporting lines are not formally established, which is a pervasive condition affecting the entire function and its ability to state conformance (Standards 6.2 and 12.1). Isolated documentation, archiving, or scheduling lapses are corrected through ongoing monitoring and methodology reinforcement.