ExamFinch.com My Study

Cheat sheet

CIA Part 1 Cheat Sheet

Practice this exam

Foundations

  • 35% of exam
  • Purpose Mandate Charter Assurance vs Advisory Three Lines

Ethics + Professionalism

  • 20% of exam
  • Integrity Objectivity Competency Due Care Confidentiality

Governance Risk Control

  • 30% of exam
  • Governance Risk Types Risk Responses Controls Control Picker

Fraud Risks

  • 15% of exam
  • Fraud Triangle Fraud Schemes Red Flags Fraud Controls Investigation Role

Quick Facts

  • Exam CIA Part 1
  • Credential Certified Internal Auditor
  • Part Internal Audit Fundamentals
  • Questions 125 MCQ
  • Time 150 min
  • Pass 600 scaled
  • Owner The IIA
  • Delivery Pearson VUE test center

Three Lines Model FO

  • Board -> Management -> IA
  • Board: oversight Management: owns risk IA: independent assurance + advice

Assurance vs Advisory FO

Assurance

  • Objective assessment
  • Auditor determines work
  • Opinion or conclusion

Advisory

  • Advice requested
  • Scope agreed
  • No management duty
  • Opinion vs advice

Service Picker FO

  • Need opinion → Assurance ( Objective assessment )
  • Need advice → Advisory ( No ownership )
  • Need advice on process design → Advisory ( Safeguards needed )
  • Need implementation → Management ( Not audit )
  • Need external users → Charter ( Define assurance )
  • Need scope agreement → Advisory ( Client input )

Purpose + Mandate FO

  • Purpose Improve GRC processes
  • Value Assurance, advice, insight, foresight
  • Mandate Board-authorized role
  • Authority Access and scope
  • Responsibility Expected audit services
  • CAE Leads audit function
  • Board Approves mandate

Internal Audit Charter FO

  • Charter Formal mandate document
  • Position Function placement
  • Scope Service boundaries
  • Access Records and personnel
  • Board approval Final authority
  • Senior management Discuss expectations
  • Update trigger Mandate changes

Assurance + Advisory FO

  • Assurance Objective assessment
  • Reasonable Higher confidence
  • Limited Narrower confidence
  • Advisory Advice without ownership
  • Scope Agreed with client
  • Design work Advisory risk
  • Management duty Never assume

Three Lines FO

  • Governing body Stakeholder oversight
  • First line Owns operations
  • Second line Supports risk control
  • Third line Independent assurance and advice
  • External assurance Outside assurance providers
  • Collaboration Aligned responsibilities
  • Independence Third-line safeguard

Independence Impairments FO

  • Functional line Board reporting
  • Admin line Operational support
  • Budget cut Resource limitation
  • Scope limit Audit boundary block
  • Access limit Evidence restriction
  • CAE disclosure Tell board
  • Safeguard Reduce impairment

Ethics Five ET

  • I O C D C
  • Integrity Objectivity Competency Due care Confidentiality

Independence vs Objectivity ET

Independence

  • Function-level freedom
  • Board access
  • Structural safeguard

Objectivity

  • Individual mindset
  • Unbiased judgment
  • Conflict free
  • Structure vs mindset

Impairment Picker ET

  • Own prior work → Reassign auditor
  • CAE owns area → Outside oversight
  • Gift offered → Refuse and disclose
  • Access blocked → Disclose limitation
  • Budget restricts work → Tell board
  • Skill missing → Obtain expertise

Ethics Principles ET

  • Integrity Honesty and courage
  • Objectivity Unbiased judgment
  • Competency Needed skills
  • Due care Prudent audit effort
  • Confidentiality Protect information
  • Skepticism Question evidence
  • CPD Continual development

Objectivity Threats ET

  • Self-review Auditing own work
  • Familiarity Too close
  • Conflict Competing interest
  • Gift Appearance threat
  • Reassignment Remove threat
  • Outsource Independent performance
  • Disclosure Report impairment

Professional Skills ET

  • Communication Clear messages
  • Critical thinking Analyze issues
  • Research Find reliable data
  • Persuasion Influence stakeholders
  • Negotiation Resolve conflict
  • Relationship Build trust
  • Curiosity Seek insight

Risk Sequence GR

  • Inherent -> controls -> residual
  • Before controls Apply responses Remaining risk

Appetite vs Tolerance GR

Appetite

  • Broad risk amount
  • Strategy aligned
  • Board-set boundary

Tolerance

  • Acceptable variation
  • Measured threshold
  • Operational limit
  • Amount vs range

Control Picker GR

  • Stop before occurrence → Preventive control
  • Find after occurrence → Detective control
  • Fix known issue → Corrective control
  • Set spending limits → Authorization
  • Catch cash mismatch → Reconciliation
  • Reduce fraud chance → Segregation

Governance GR

  • Governance Oversight structures
  • Board Ultimate oversight
  • Senior management Executes strategy
  • Culture Control tone
  • Ethics framework Expected conduct
  • Compliance Rules followed
  • Assurance map Coverage view

Inherent vs Residual GR

Inherent

  • Before controls
  • Raw exposure
  • Initial risk

Residual

  • After controls
  • Remaining exposure
  • Acceptance decision
  • Before vs after

Risk Basics GR

  • Risk Objective uncertainty
  • Strategic Goal failure
  • Operational Process failure
  • Financial Money impact
  • Compliance Rule breach
  • Reputation Trust damage
  • ESG Sustainability impact

Preventive vs Detective GR

Preventive

  • Blocks event
  • Before loss
  • Approval limits

Detective

  • Finds event
  • After activity
  • Reconciliations
  • Stop vs find

Risk Management GR

  • Appetite Acceptable risk level
  • Tolerance Allowed variation
  • Inherent Before controls
  • Residual After controls
  • Avoid Exit activity
  • Reduce Apply controls
  • Share Transfer impact

Controls GR

  • Control Risk response activity
  • Preventive Stops event
  • Detective Finds event
  • Corrective Fixes event
  • Design Control structure
  • Effectiveness Works as designed
  • Efficiency Cost-benefit balance

Fraud Triangle FR

  • M O R
  • Motivation Opportunity Rationalization

Fraud Risk vs Investigation FR

Fraud risk

  • Plan consideration
  • Red flags
  • Control focus

Investigation

  • Fact finding
  • Specialist techniques
  • Coordinate experts
  • Assess vs investigate

Fraud Picker FR

  • Pressure cue → Motivation
  • Weak control cue → Opportunity
  • Excuse cue → Rationalization
  • Report received → Assess red flag
  • Specialist needed → Coordinate investigation
  • Prevent override → Authority levels

Fraud Basics FR

  • Fraud risk Intentional deception exposure
  • Motivation Pressure to act
  • Opportunity Control weakness
  • Rationalization Justifies misconduct
  • Scheme Fraud method
  • Red flag Warning indicator
  • Special risk Extra attention

Fraud Response FR

  • Tone Top-level example
  • SOD Split incompatible duties
  • Authority levels Approval boundaries
  • Hotline Report channel
  • Reconciliation Detect mismatch
  • Review Supervisor check
  • Investigation Specialist fact-finding

Common Traps

Old syllabus trap

  • 2019 had six domains ≠ 2025 has four domains

Charter vs mandate

  • Mandate grants authority ≠ Charter documents mandate

Advice vs ownership

  • Audit may advise ≠ Management must own

Independence vs objectivity

  • Function is independent ≠ Auditor stays objective

Risk vs control

  • Risk threatens objectives ≠ Control mitigates risk

Fraud role trap

  • Audit assesses risk ≠ Specialists investigate facts

Conformance wording

  • Use conforms language ≠ Avoid casual compliance

Last Minute

  • 1. Weights: 35 / 20 / 30 / 15
  • 2. Part 1 = 125 MCQ
  • 3. Time limit = 150 minutes
  • 4. Assurance = opinion; advisory = advice
  • 5. Independence = structure; objectivity = mindset
  • 6. Mandate grants; charter documents
  • 7. Inherent before controls
  • 8. Residual after controls
  • 9. Appetite broad; tolerance measured
  • 10. Fraud = motivation opportunity rationalization
  • 11. Audit advises; management owns