Free IIA CIA Part 3 (Internal Audit Function) Internal Audit Plan Practice Questions
The Internal Audit Plan on CIA Part 3 covers building the risk-based audit plan from the audit universe, prioritizing engagements, aligning the plan with organizational objectives, and communicating and updating it with the board. 15% of Part 3.
66 questions26 easy30 medium10 hard2026 syllabus
Sample Questions
Question 1
Easy
Under the Global Internal Audit Standards, which of the following best describes the audit universe?
🎉
Correct Answer: B
Solution
B is correct. The audit universe is the full population of auditable entities, processes, systems, functions, locations, and relationships that could be subject to an internal audit engagement. Under Standard 9.4 (Internal Audit Plan), the chief audit executive uses the audit universe as the starting population, applies a risk assessment to it, and then selects and prioritizes engagements. Sources such as board and management requests, regulatory mandates, emerging technologies, and applicable Topical Requirements are considered when the universe is built and refreshed.
Question 2
Medium
Six months into the plan year, the organization acquires a competitor and launches a digital payments platform. What should the chief audit executive do?
🎉
Correct Answer: B
Solution
B is correct. The internal audit plan is dynamic. Significant changes in the organization's strategy, structure, operations, technology, or risk profile — an acquisition and a new payments platform qualify on both counts — trigger a reassessment of risk and a corresponding update to the plan. Material changes are communicated to senior management and the board for review and approval (Standard 9.4, Internal Audit Plan).
Question 3
Hard
Senior management asks the chief audit executive to drop two high-risk engagements from the draft plan and add an advisory project on process efficiency, with no change to approved resources. What is the most appropriate response?
🎉
Correct Answer: C
Solution
C is correct. Management requests are a legitimate source of potential engagements, and advisory work may be included where the internal audit mandate permits it, so the request is neither refused outright nor accepted outright. What the request does is trade away coverage of two areas the risk assessment ranked high while resources stay fixed. Standard 9.4 requires the plan to be risk-based and to disclose the effect of resource limitations on coverage, and Standard 6.2 places approval of the plan with the board. The chief audit executive therefore documents the risk rationale and the coverage consequence and takes the trade-off to the board, preserving independent judgment about assurance priorities.
FreeFellow was built by Jeffrey Ting, a credentialed actuary and CFA charterholder who passed thirteen of the hardest exams in finance on the first attempt, and paid four-figure prep fees for every one. The learning itself was always free. The price was a moat.
So he started writing his own questions, then lessons, then mock exams, until it grew into a full prep platform covering 40 finance credentials with more than 44,000 original practice questions. The name says exactly what it is: the question bank is free, and Fellow is what you become once you pass.
01
Cost shouldn't decide who gets in.
The exam is a fair gate. A four-figure prep course is not. FreeFellow takes the second gate down, so the exam is the only one left.
02
Free should mean free.
No trial clock, no email gate, no credit card. The question bank, worked solutions, lessons, and readiness score stay free, and they are enough to pass.
03
Built by someone who sat where you sit.
He paid for the big-name courses, found nothing he respected, and built the prep he wished had existed. Not a marketing team that has never sat an exam.
