IIA-CIA-PART1 · Question #159
Which of the following is an indicator that the internal audit activity does not fully conform with the Standards?
The correct answer is B. In lieu of an external assessment, the internal audit activity performed a self-assessment with. Option B indicates non-conformance because the IIA Standards (specifically Standard 1312) require that external assessments be conducted at least once every five years by a qualified, independent assessor from outside the organization. While a self-assessment with independent…
Question
Which of the following is an indicator that the internal audit activity does not fully conform with the Standards?
Options
- AThe quality assurance and improvement program identified several opportunities for the internal
- BIn lieu of an external assessment, the internal audit activity performed a self-assessment with
- CDuring an internal quality assessment, it was identified that rotational auditors often perform
- DExternal assessments are performed every five years by a competent internal audit team from the
How the community answered
(55 responses)- A2% (1)
- B82% (45)
- C5% (3)
- D11% (6)
Explanation
Option B indicates non-conformance because the IIA Standards (specifically Standard 1312) require that external assessments be conducted at least once every five years by a qualified, independent assessor from outside the organization. While a self-assessment with independent validation is a permissible alternative to a full external assessment, the "independent validation" component must still involve an external party - performing the entire process internally strips it of the independence required, meaning the external assessment obligation is not satisfied.
Option A is wrong because a QAIP identifying opportunities for improvement is exactly what it is designed to do - this signals the program is functioning as intended, not that it is deficient.
Option C is wrong because using rotational auditors is a standard practice and does not inherently conflict with any IIA Standard requirement.
Option D is wrong because conducting external assessments every five years aligns with the Standards' timing requirement; if that team is genuinely from outside the organization, the assessment is valid.
Memory tip: Anchor the word external to outside - any time an "external" assessment is performed by people inside the organization (or validated only internally), that is your non-conformance signal. Ask yourself: "Did someone from outside do this or verify this?"
Community Discussion
No community discussion yet for this question.