IIA Updated IIA-CIA-Part2 Exam Questions and Answers by ismaeel

The most important determinant of the objectives and scope of assurance engagements is the preliminary risk assessment performed by internal auditors. This assessment identifies the key risks that the engagement should address and ensures that the audit is focused on areas of highest risk and significance to the organization. While organizational charts, business objectives, and management requests are important inputs, the internal auditors' preliminary risk assessment ensures that the audit addresses the most critical areas. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2210 - Engagement Objectives.

The IIA’s Practice Guide on Engagement Planning.

Due diligence engagements are crucial when planning an acquisition, as they evaluate the financial, operational, and legal aspects of the target entity. This ensures informed decision-making and minimizes acquisition risks. Performance engagements (Option A) focus on efficiency and effectiveness of operations, while system security engagements (Option B) and compliance engagements (Option D) do not address the comprehensive assessment required for acquisitions. The CIA syllabus emphasizes due diligence as a specialized type of consulting engagement (Part 2: Section II).

Application software tracing and mapping tracks the program logic line by line to detect unauthorized code, errors, or inconsistencies. Utility software (A) supports system operations, generalized audit software (B) is used for testing data, and audit expert systems (D) assist with decision-making. For identifying unauthorized code, the best tool is Option C.

According to IIA guidance, the primary purpose of the exit conference is to ensure timely communication of observations and findings, especially those that require immediate management action. This meeting allows auditors to discuss their findings with management, address any disagreements, and clarify the facts before the final report is issued. It does not require the attendance of both the chief audit executive and the chief executive over the activity (B), nor is it solely for reviewing anticipated results (C) or the performance of the internal auditors (D). References: IIA Standard 2440 – Disseminating Results, IIA Practice Advisory 2440-1