CIA Exam Syllabus, Part 2 – Internal Audit
Practice
100 questions | 2.0 Hours (120 minutes)
The new CIA exam Part 2 topics tested include managing the internal audit function via the
strategic and operational role of internal audit and establishing a risk-based plan; the steps to
manage individual engagements (planning, supervision, communicating results, and monitoring
outcomes); as well as fraud risks and controls. Note: All items in this section of the syllabus will
be tested at the Proficiency knowledge level unless otherwise indicated below.
I. Managing the Internal Audit Function (40-50%)
A. Strategic Role of Internal Audit
1. Initiate, manage, be a change catalyst, and cope with change
2. Build and maintain networking with other organization executives and the audit
committee
3. Organize and lead a team in mapping, analysis, and business process improvement
4. Assess and foster the ethical climate of the board and management
4..1Investigate and recommend resolution for ethics/compliance complaints, and
determine disposition of ethics violations
4..2Maintain and administer business conduct policy (e.g., conflict of interest), and
report on compliance
5. Educate senior management and the board on best practices in governance, risk
management, control, and compliance
6. Communicate internal audit key performance indicators to senior management and the
board on a regular basis
7. Coordinate IA efforts with external auditor, regulatory oversight bodies and other internal
assurance functions
8. Assess the adequacy of the performance measurement system, achievement of corporate
objective – Awareness Level (A)
B. Operational Role of IA
1. Formulate policies and procedures for the planning, organizing, directing, and monitoring
of internal audit operations
2. Review the role of the internal audit function within the risk management framework
3. Direct administrative activities (e.g., budgeting, human resources) of the internal audit
department
4. Interview candidates for internal audit positions
5. Report on the effectiveness of corporate risk management processes to senior
management and the board
6. Report on the effectiveness of the internal control and risk management frameworks
7. Maintain effective Quality Assurance Improvement Program
