Free Practice Questions for IIA IAP

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card

120+ Questions

100% Free

Loading practice questions...

Same family resources

Explore More IIA Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

More From This Family

Videos and articles for deeper review.

VideoCIA Part 1 Exam Guide 2026: Internal Audit Fundamentals ArticleCIA Part 1 Exam Guide 2026: Internal Audit Fundamentals28 min read ArticleCIA Part 1 GIAS Question Strategy: Ethics, Objectivity, and Governance (2026)14 min read

Exam Review

Key Facts: IIA IAP Exam

125 Qs

Exam Questions

150-minute time limit

600/750

Passing Score

IIA scaled scoring

4 Domains

Exam Content Areas

35% / 20% / 30% / 15% weighting

No Prereqs

Eligibility

No education or experience required

$430

Member Total Cost

$120 app + $310 exam (USD)

Permanent

Designation Status

20 CPE hours/yr from 2026 (IIA)

IAP is a 125-question, 2.5-hour entry-level IIA certification ideal for students and new auditors — no education or work experience required. As of May 2025, it uses the CIA Part 1 (Internal Audit Fundamentals) exam and the 2024 Global Internal Audit Standards (effective January 9, 2025). Delivered by Pearson VUE at test centers (online proctoring ended May 2025). IAP is a permanent designation, holders need 20 CPE hours/year from 2026, and active holders can pursue CIA Parts 2 and 3 for the full CIA without repeating Part 1.

Sample IIA IAP Practice Questions

Try these sample questions to review concepts for the IIA IAP exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 120+ question experience with AI tutoring.

1According to the Purpose Statement in Domain I of the Global Internal Audit Standards (2024), how does internal auditing strengthen an organization's ability to create, protect, and sustain value?

A.By detecting and preventing fraud for the board through continuous testing of high-risk transactions and accounts

B.By providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight

C.By giving the board, management, and regulators a guarantee that the organization complies with all applicable laws and policies

D.By preparing reliable, objective financial statements and management reports for the board and senior management

Explanation: Domain I of the Global Internal Audit Standards (2024) contains the Purpose Statement: internal auditing strengthens the organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight. This wording replaced the older IPPF Mission of Internal Audit ('enhance and protect organizational value'), adding 'create' and 'sustain' value and the word 'foresight'.

2Which document formally establishes the internal audit function's authority, position, and scope of activities within the organization?

A.The annual audit plan

B.The internal audit charter

C.The board resolution

D.The internal audit policy manual

Explanation: The internal audit charter is the formal document that establishes the internal audit function's position within the organization, its authority, access to records and personnel, and the scope of activities. The charter must be approved by senior management and the board. Annual audit plans detail specific engagements but do not establish authority.

3What is the key distinction between assurance services and advisory services provided by internal audit?

A.Assurance services are mandatory under law; advisory services are always voluntary

B.Assurance services involve an independent objective assessment; advisory services provide counsel without the auditor assuming management responsibility

C.Assurance services focus only on financial risks; advisory services cover operational risks

D.Assurance services require external auditor involvement; advisory services do not

Explanation: Assurance services involve the internal auditor providing an independent, objective assessment of evidence to render an opinion or conclusion. Advisory services provide counsel, recommendations, or facilitation without the internal auditor assuming management responsibility for implementation. The nature of the engagement and auditor role differ — not the subject matter.

4To which body should the Chief Audit Executive (CAE) functionally report to preserve organizational independence?

A.The Chief Financial Officer

B.The Chief Executive Officer

C.The board or audit committee

D.The external auditors

Explanation: The Global Internal Audit Standards require the CAE to functionally report to the board or its audit committee. This reporting line gives internal audit the independence needed to objectively assess management activities. The CAE may administratively report to the CEO for day-to-day matters, but functional reporting to the board is essential for independence.

5Which of the following best describes the concept of organizational independence for the internal audit function?

A.Internal auditors must never communicate with management during an engagement

B.The internal audit function is free from conditions that threaten its ability to carry out its responsibilities impartially

C.Internal auditors must be located in a separate building from all other departments

D.The internal audit function reports to the external auditors to ensure independence

Explanation: Organizational independence means the internal audit function is free from conditions that threaten its ability to carry out responsibilities in an unbiased manner. This includes having an appropriate reporting structure (functional reporting to the board) and freedom from management interference in scope, work, and reporting. Physical separation or reporting to external auditors is not required.

6According to the Global Internal Audit Standards, what does individual objectivity require of internal auditors?

A.Auditors must avoid all personal relationships with anyone in the organization

B.Auditors must have an impartial, unbiased attitude and avoid conflicts of interest

C.Auditors must obtain approval from the board before expressing any opinion

D.Auditors must rotate to a new organization every three years

Explanation: Individual objectivity requires internal auditors to have an impartial, unbiased attitude and to avoid situations that compromise or appear to compromise their ability to make objective assessments. Conflicts of interest — whether actual or perceived — must be disclosed and managed. Objectivity is a state of mind, not a structural arrangement requiring rotation or external approval.

7What does due professional care require of an internal auditor when conducting an engagement?

A.Absolute assurance that no fraud or errors exist

B.Auditing every area of the organization at least once per year

C.Applying the care and skill expected of a reasonably prudent and competent internal auditor

D.Obtaining external certifications in every discipline audited

Explanation: Due professional care requires internal auditors to apply the care and skill expected of a reasonably prudent and competent internal auditor — not perfection or absolute assurance. This includes exercising professional skepticism, considering potential risks, and planning appropriate procedures. It does not require auditors to be experts in every area or guarantee the discovery of all errors.

8Which of the following is an example of an assurance service performed by internal audit?

A.Facilitating a risk assessment workshop for management

B.Providing training to employees on internal controls

C.Conducting an independent evaluation of the effectiveness of an organization's internal control system

D.Assisting in the design of a new accounting information system

Explanation: An independent evaluation of internal control effectiveness is a classic assurance service — the auditor objectively examines evidence and renders an opinion without management directing the conclusion. Risk workshops, employee training, and system design assistance are advisory or consulting services because the auditor provides guidance rather than independent assessment.

9Which of the following best describes the internal audit mandate under the Global Internal Audit Standards?

A.Authority granted by law to compel management to implement audit recommendations

B.The authority conferred by the governing body that defines the purpose, authority, and responsibility of the internal audit function

C.Management's right to direct the scope and findings of internal audit engagements

D.The external auditor's delegation of financial statement testing to internal audit

Explanation: The internal audit mandate is the authority conferred by the governing body (typically the board) that defines the purpose, authority, and responsibility of the internal audit function — most commonly formalized in the audit charter. This mandate gives internal audit the standing to access records, personnel, and operations needed to fulfill its responsibilities.

10The Global Internal Audit Standards (2024) replaced which prior framework?

A.COSO Internal Control — Integrated Framework (2013)

B.The International Professional Practices Framework (IPPF) Standards (2017)

C.ISO 31000:2018 Risk Management Standard

D.The Sarbanes-Oxley Act Section 404 requirements

Explanation: The Global Internal Audit Standards, effective January 9, 2025, replaced the prior International Standards for the Professional Practice of Internal Auditing contained in the IPPF (2017 version). The new Standards are organized around 5 Domains and 15 Principles. COSO, ISO 31000, and SOX are related frameworks but were not replaced by the 2024 Standards.

About the IIA IAP Exam

The IIA's Internal Audit Practitioner (IAP) is an entry-level, foundational certification open to university students, early-career auditors, and professionals without degrees. As of May 28, 2025, the IAP exam is the CIA Part 1 — Internal Audit Fundamentals exam. The 125-question exam covers four content domains: Foundations of Internal Auditing (35%), Ethics and Professionalism (20%), Governance, Risk Management, and Control (30%), and Fraud Risks (15%). It is graded on a 250-750 scaled scoring basis with 600 required to pass.

Exam sponsor: The Institute of Internal Auditors (IIA) / Pearson VUE. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Questions

125 questions

Time Limit

2.5 hours (150 minutes)

Passing Score

600/750 (scaled)

Exam / Certification Fees

$310 members / $445 non-members / $165 students (USD)

Exam sponsor website

Reported exam pass rate: Not publicly disclosed. IIA does not release IAP-specific pass rates Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Official sources

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

35%

Foundations of Internal Auditing

Purpose of internal auditing (Global Internal Audit Standards Domain I), internal audit mandate, board and CAE responsibilities, internal audit charter, assurance vs. advisory services, limited vs. reasonable assurance, types of assurance and advisory engagements, independence impairments, Three Lines Model and first/second line safeguards

20%

Ethics and Professionalism

Global Internal Audit Standards Domain II — five principles: Integrity, Objectivity, Competency, Due Professional Care, Confidentiality; self-review and familiarity bias, conflicts of interest, disclosure of impairments, gifts, professional skepticism, continuing professional development

30%

Governance, Risk Management, and Control

Organizational governance and the roles of the board, senior management, and assurance providers; organizational culture and the control environment; ethical and compliance issues; risk types; inherent vs. residual risk; risk appetite and tolerance; risk management cycle and frameworks; control types (preventive/detective/corrective); design, effectiveness, and efficiency of internal controls; internal control frameworks

15%

Fraud Risks

Fraud triangle (motivation/opportunity/rationalization), common fraud schemes, fraud risk in engagement planning, red flags at organizational and process level, tone at the top, segregation of duties, authority levels, whistleblower hotlines, reconciliations, supervisory reviews, internal audit's role in fraud investigations, interviewing and fraud testing methods

Preparing for the IIA IAP Exam

What You Need to Know

Passing score: 600/750 (scaled)
Exam length: 125 questions
Time limit: 2.5 hours (150 minutes)
Exam / certification fees: $310 members / $445 non-members / $165 students (USD) Official sources

Using Our Practice Resources

Work through all 120 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

IIA IAP: Suggested Study Strategy

1Memorize the 5 Domains and 15 Principles of the 2024 Global Internal Audit Standards (effective January 9, 2025)

2Know the five Domain II (Ethics and Professionalism) principles of the Global Internal Audit Standards: Integrity, Objectivity, Competency, Due Professional Care, and Confidentiality

3Master the Three Lines Model (2020): First Line = operations, Second Line = oversight functions, Third Line = internal audit

4Distinguish COSO IC 2013 (5 components, 17 principles) from COSO ERM 2017 (5 components, 20 principles) — do not mix them up

5Know the fraud triangle elements as the IAP syllabus names them — motivation (pressure), opportunity, and rationalization — plus common fraud schemes and red flags

6Distinguish design deficiencies (control is flawed in design) from operating deficiencies (control is correctly designed but not working)

7Understand control types: preventive controls stop events before they occur, detective controls identify them afterward, and corrective controls remedy the damage

8Differentiate assurance services from advisory services, and limited assurance from reasonable assurance, and decide which service fits a given scenario

Frequently Asked Questions

How many questions are on the IAP exam and how long is it?

As of May 28, 2025, the IAP exam is the CIA Part 1 — Internal Audit Fundamentals exam: 125 multiple-choice questions in 2.5 hours (150 minutes). It is administered at Pearson VUE test centers. A scaled score of 600 out of 750 is required to pass.

What are the IAP exam content domains?

The IAP/CIA Part 1 exam covers four domains: Foundations of Internal Auditing (35%), Ethics and Professionalism (20%), Governance, Risk Management, and Control (30%), and Fraud Risks (15%). The IIA syllabus is based on the 2024 Global Internal Audit Standards, effective January 9, 2025.

What are the eligibility requirements for the IAP?

The IAP has no education or work experience requirements — it is one of the most accessible professional credentials available. Candidates simply need a valid government-issued photo ID to apply through the IIA's CCMS portal. They have two years from application approval to pass the exam.

How much does the IAP cost?

IIA members pay $430 total ($120 application + $310 exam fee). Non-members pay $685 total ($240 + $445). Students at accredited colleges or universities pay $210 total ($45 + $165). Prices are in USD and apply in the US, Canada, and select countries.

Is the IAP a permanent credential?

Yes. The IIA describes the IAP as a permanent credential. Beginning in 2026, IAP holders must earn 20 hours of CPE each year and complete an annual certification renewal to keep the designation active.

How does the IAP relate to the CIA?

Passing the IAP (CIA Part 1) fulfills the first part of the three-part CIA program. Active IAP holders can apply for the CIA without meeting the standard education prerequisite and only need to complete CIA Parts 2 and 3, but they must still meet the CIA experience requirement (five years of internal audit experience or equivalent for IAP-pathway candidates).