
CIA exam practice question: daily practice for the Certified Internal Auditor (CIA) exam — domain: Part 2: Practice of Internal Auditing.
Question
While testing vendor payments, an internal auditor notices several suppliers with payments consistently just below the authorization threshold and duplicate-looking invoice formats for a new supplier. What is the most appropriate next step for the auditor?
Show the answer and explanation
Correct answer: B. Expand substantive testing, obtain independent supporting documentation, and evaluate the indicators for potential fraud.
The auditor should respond with professional skepticism by expanding substantive procedures and obtaining independent supporting documentation to determine whether the patterns indicate error or fraud. This approach gathers sufficient, reliable evidence before drawing conclusions. Simply accepting a verbal explanation is inadequate because it does not address the unusual patterns. Reporting immediately to the audit committee as confirmed fraud is premature; escalation may be appropriate after evidence is obtained and management response considered. Issuing a formal negative conclusion about controls is also inappropriate at this stage because it requires comprehensive evaluation and documentation of the extent and root causes before reaching such a judgment.
Want more practice?
Prepare for the Certified Internal Auditor (CIA) exam with CIA 2026 – Certified Internal Auditor Exam Preparation (Parts 1, 2 & 3) – Training Program.
