Free IIA CIA Part 3 (Internal Audit Function) Internal Audit Plan Practice Questions

B is correct. The audit universe is the full population of auditable entities, processes, systems, functions, locations, and relationships that could be subject to an internal audit engagement. Under Standard 9.4 (Internal Audit Plan), the chief audit executive uses the audit universe as the starting population, applies a risk assessment to it, and then selects and prioritizes engagements. Sources such as board and management requests, regulatory mandates, emerging technologies, and applicable Topical Requirements are considered when the universe is built and refreshed.

B is correct. The internal audit plan is dynamic. Significant changes in the organization's strategy, structure, operations, technology, or risk profile — an acquisition and a new payments platform qualify on both counts — trigger a reassessment of risk and a corresponding update to the plan. Material changes are communicated to senior management and the board for review and approval (Standard 9.4, Internal Audit Plan).

C is correct. Management requests are a legitimate source of potential engagements, and advisory work may be included where the internal audit mandate permits it, so the request is neither refused outright nor accepted outright. What the request does is trade away coverage of two areas the risk assessment ranked high while resources stay fixed. Standard 9.4 requires the plan to be risk-based and to disclose the effect of resource limitations on coverage, and Standard 6.3 places approval of the plan with the board. The chief audit executive therefore documents the risk rationale and the coverage consequence and takes the trade-off to the board, preserving independent judgment about assurance priorities.