CIA Question of the Day: Third-Party Vendor Controls

Quiz Yazan Ibrahim
CIA 2026 exam prep workspace with laptop, books, and Certified Internal Auditor study materials.

CIA exam practice question — CIA Question of the Day: Third-Party Vendor Controls

CIA exam practice question: daily practice for the Certified Internal Auditor (CIA) exam — domain: Part 3: Business Knowledge for Internal Auditing.

Question

Your internal audit department is planning an engagement to assess payroll processing that the organization recently outsourced to a third-party provider. Management asserts the vendor's controls are adequate. Which is the most appropriate action for the auditor during engagement planning?

  • A. Obtain and review the vendor's independent assurance reports (e.g., SOC) and verify contractual audit rights, then plan testing based on those findings
  • B. Request that the vendor grant internal auditors full remote access to the vendor's live payroll systems before scheduling fieldwork
  • C. Accept management's representation about vendor controls and limit audit procedures to a reconciliatory review after payroll runs
  • D. Perform only walkthroughs of the outsourced payroll process with management and document their explanations as evidence
Show the answer and explanation

Correct answer: A. Obtain and review the vendor's independent assurance reports (e.g., SOC) and verify contractual audit rights, then plan testing based on those findings

The best action is to obtain and review independent assurance reports (such as SOC) and confirm contractual audit rights, then plan testing accordingly. Independent reports and clear contract terms provide relevant, reliable evidence and indicate whether additional testing at the vendor or alternative procedures are needed. Requiring full remote access may be infeasible or restricted by contract or privacy laws and is not always necessary if independent assurance and other evidence suffice. Relying solely on management representations or only walkthroughs is inadequate because these provide limited, potentially biased evidence and do not verify the vendor's control operating effectiveness.

Want more practice?

Prepare for the Certified Internal Auditor (CIA) exam with CIA 2026 – Certified Internal Auditor Exam Preparation (Parts 1, 2 & 3) – Training Program.