Part 2, Internal Audit Engagement, has three sections. Engagement Planning, at 50% of the exam, followed by information gathering, analysis and evaluation at 40%.
Questions
100, multiple choice
Time
120 minutes (2 hours)
Where
Pearson VUE test centers
Passing score
600 on a 250 to 750 scale
The sections and their weights
Section
Weight
Questions in our mocks
1. Engagement Planning
50%
about 50
2. Information Gathering, Analysis, and Evaluation
40%
about 40
3. Engagement Supervision and Communication
10%
about 10
What each section includes
Engagement planning: objectives, scope and criteria, key risks and controls, the engagement approach, the risk assessment, the work program and resources.
Information gathering, analysis and evaluation: sources of information, evidence and sampling, data analytics, process mapping, analytical review, findings, workpapers and conclusions.
Engagement supervision and communication: supervising and reviewing the work, and communicating with stakeholders during the engagement.
Where the syllabus comes from
The sections and weights are from the Part 2 expanded test specifications (version V2.09.2024), published on the CIA syllabus page for the 2025 syllabus.
Try 4 questions
Question 1Planning around key risks and controls
A bank carried out thorough due diligence before outsourcing its card dispute handling to a service provider three years ago. Since the contract was signed, no one at the bank has reviewed the provider's performance reports or service level results. Internal audit is planning an engagement on third-party risk. Which weakness is most evident?
Question 2Relevance, sufficiency and reliability of evidence, and sampling
An internal auditor plans a monetary unit sample of a manufacturer's receivables, which have a recorded value of $3,600,000. Tolerable misstatement is $90,000, no misstatement is expected, and the reliability factor is 3.0. The sampling interval equals tolerable misstatement divided by the reliability factor. What is the sampling interval?
Question 3Process mapping and analytical approaches
An auditor combines vendor payment data from two subsidiaries of a manufacturer. One system records dates as day-month-year and the other as month-day-year, and the same vendors are spelled differently in each. Which stage of the data analytics process deals with these differences?
Question 4Supervising the engagement and reviewing workpapers
Early in fieldwork, an audit manager notices that a staff auditor's interview notes do not record who was interviewed or what documents were shown. What should the manager do?