IIA Certification in Risk Management Assurance - IIA-CRMA-ADV Exam Questions [2026]

QUESTION NO: 1
A large trucking organization wants to reduce traffic accidents by improving its system of internal controls.
Which of the following controls is correctly classified?
1. Review of speeding violations to identify repetitive locations and drivers is an example of a preventive control.
2. Defensive driver training is an example of a directive control.
3. The installation of tracking devices in delivery vehicles is an example of a corrective control.
4. Providing a vehicle driver handbook is an example of a detective control.

A. 2 and 3. B. 1 and 2. C. 3 and 4. D. 1 and 4.

Correct Answer: B

QUESTION NO: 2
Which of the following is the most common method of fraud detection?

A. Detective controls built into the daily processes. B. Tips received from employees or citizens. C. Analytical reviews of high-risk areas. D. Unannounced audits or reviews of programs or departments.

Correct Answer: B

QUESTION NO: 3
During the course of an audit, an internal auditor discovers that a valuable employee in the research department has been patenting new developments in the employee's name that are unrelated to the basic business of the organization.
The organization does not have a policy addressing this specific issue, but does have a general policy that all important new discoveries by employees are the property of the organization.
Division management views the employee's actions as extra incentive to retain the employee.
A decision to include the employee's action in the engagement final communication would be:
1. A violation of the IIA Code of Ethics.
2. A violation of the reporting requirements in the Standards.
3. Justified and necessary, according to the IIA Code of Ethics and Standards.

A. 1 only B. 2 only C. 1 and 2 only D. 3 only

Correct Answer: D

QUESTION NO: 4
The audit committee is concerned that the small size of the internal audit activity (IAA) makes it impractical to achieve full conformance with the Standards. To address this concern, which of the following actions is most appropriate for the CAE to take?

A. The CAE should seek sufficient funding to increase audit resources to meet the minimum requirements of the Standards. B. The CAE should explain that conformance with the Standards is essential and not dependent upon the size of the IAA. C. The CAE should agree with the audit committee and implement only those standards appropriate to the size of the IAA. D. The CAE should request the audit committee to review the Standards to identify specifically which are creating the greatest concern.

Correct Answer: B

QUESTION NO: 5
According to IIA guidance, which of the following statements is true when an internal auditor performs consulting services that improve an organization's operations?

A. The services must not be performed by the same internal auditor who performed assurance services, in order to maintain objectivity. B. The services impose no responsibility to communicate information other than to the engagement client. C. The services must be aligned with those defined in the internal audit charter. D. The services may preclude assurance services from the consulting engagement.

Correct Answer: A

QUESTION NO: 6
Which of the following scenarios exemplifies a potential internal control weakness?

A. The same employee who receives cash from customers prepares a prelisting of cash receipts. B. The same employee who records cash receipts in the accounts receivable subsidiary ledger ensures that the ledger automatically updates the information. C. The same employee who makes deposits at the bank prepares the monthly bank reconciliation. D. The same employee who restrictively endorses checks received from customers prepares the bank's check deposit slips.

Correct Answer: C

QUESTION NO: 7
An internal auditor makes a series of observations when performing an analytical review of division operations. The auditor notes the following things: the current ratio is increasing and the quick ratio is decreasing, sales and current liabilities have remained constant, and the number of day sales in inventory is increasing. Which conclusion should the auditor draw from this data?

A. Cash or accounts receivable has decreased. B. The division produced fewer items this year than in prior years. C. The gross margin has decreased. D. The gross margin has increased.

Correct Answer: A

QUESTION NO: 8
According to IIA guidance, which of the following statements is true regarding the reporting of results from an external quality assessment of the internal audit activity?

A. The external assessment results are reported upon completion in confidence directly to the board, and senior management is advised only of the recommendations and improvement action plans. B. The external assessment results are communicated upon completion to senior management and the board, but action plans for recommended improvements do not have to be reported. C. The results of self-assessments with independent external validation are shared with the board upon completion, and monitoring of recommended improvements must be reported monthly. D. The requirements for reporting quality assessment results are the same for external assessments and self-assessments with independent external validation.

Correct Answer: C

QUESTION NO: 9
The director of purchasing, a certified internal auditor (CIA), signs a contract to procure a large order from a supplier whose products provide the best price, quality, and performance. A few days after signing the contract, the supplier presents the CIA with $1, 000 as a gift. Which statement regarding acceptance of the money is correct?

A. Because the CIA is not acting as an internal auditor, accepting the money would be governed only by the organization's code of conduct. B. Because the contract was signed before the money was offered, accepting the money would not violate the IIA Code of Ethics. C. Accepting the money would be prohibited only if it were non-customary. D. Accepting the money would violate the IIA Code of Ethics.

Correct Answer: D

QUESTION NO: 10
What is the primary benefit to the internal audit activity for undertaking an internal quality assessment?

A. To identify key risks and areas of concern within the organization. B. To help the internal audit activity complete its annual assurance plan. C. To help improve the overall quality of the internal audit activity's work. D. To identify inefficiencies within the internal audit team.

Correct Answer: C

QUESTION NO: 11
According to the COSO enterprise risk management framework, which of the following best describes the activity that helps ensure risk responses are carried out effectively?

A. Objective setting. B. Event identification. C. Control activities. D. Information and communication.

Correct Answer: C

QUESTION NO: 12
An organization is facing a financial downturn and needs to impose major budget reductions to all departments. According to MA guidance, which of the following actions is most appropriate for the board to take to evaluate the potential impact on the internal audit activity?

A. Ask management to determine which internal audit engagements are lower risk and could be considered for removal from the annual audit plan. B. Ask appropriate stakeholders for their opinion on the potential impacts of reducing the scope of the internal audit plan. C. Ask The human resources department to determine how the annual compensation and salary of the audit staff could be adjusted to achieve savings. D. Ask the chief audit executive to determine whether budgetary limitations impede the ability of the internal audit activity to execute its responsibilities.

Correct Answer: D

QUESTION NO: 13
An internal auditor wants to sample data to test an audit theory in a cost-effective way. Which of the following sampling strategies should she use?

A. A combination of both statistical and nonstatistical sampling. B. Nonstatistical sampling only C. Neither approach to testing the audit theory would be cost effective. D. Statistical sampling only

Correct Answer: B

QUESTION NO: 14
According to IIA guidance, the results of a formal quality assessment should be reported to which of the following groups?

A. The audit committee and senior management. B. Senior management and the external auditors. C. The audit committee and the external auditors. D. Senior management and management of the audited area.

Correct Answer: A

QUESTION NO: 15
An assurance mapping exercise helps an organization do which of the following?
1. Provide assurance to stakeholders that risks are managed and reported, and regulatory and legal obligations are met.
2. Fulfill best practices in the industry.
3. Identify and address any gaps in the risk management process.
4. Identify fraud.

A. 2 and 3. B. 1 and 3. C. 3 and 4. D. 1 and 4.

Correct Answer: B