Skip to content
// EXAM HALL24 QUESTIONS · 30 MINUTES

Internal Audit Practice Test

The method, one test sheet to read, and the conversations nobody in the business enjoys.

BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED

// THE SHORT ANSWER

An internal audit practice test asks whether you understand why a control exists as well as whether it does, and whether you can hold a finding under pressure. This paper has three parts: the three lines, sampling and evidence; one audit's test sheet set on an exhibit; and calls on independence, fraud indicators and a draft the business wants softened. Every question is original, and none comes from any bank's test. Sit it against a thirty-minute clock with the reads held to the end, or take it as practice.

BASIS  Practitioner judgment from sixteen years in commercial banking, set out in How Bankers Think (Highbank Press, 2026). Every borrower on this site is a composite constructed for teaching, not a client. The market is mid-market commercial lending as practised in New Zealand and Australia; where a convention differs elsewhere, the page says so.

// HOW TO SIT IT

Answer below as practice, and each read opens as you go. Or sit it as a test: 30 minutes, with every read held back until you finish.

PART A

The method

How an audit knows what it says it knows.

PART A · QUESTION 1

Credit officers apply a policy. A risk team writes it and checks on it. You, in internal audit, test whether all of that works.

Who owns the risk in a lending decision?

PART A · QUESTION 2

A policy says every payment over US$50,000 needs two approvers. The system has a second approver field, and it is filled in on every payment you look at.

What have you shown so far?

PART A · QUESTION 3

You need to test 40 of 6,000 account openings for the year. The team offers you the last 40, which are easiest to pull and were done by its best people.

What do you do?

PART A · QUESTION 4

You test 60 items from a year's 3,000, picked at random, and find 3 exceptions.

What can you reasonably say?

PART A · QUESTION 5

You find two issues. A US$2,000 expense was miscoded. A control over access to the payment system failed for a month, and nothing is known to have been lost.

Which ranks higher, and why?

PART A · QUESTION 6

You want to know whether month-end reconciliations are reviewed. You have the manager saying they are, a signed checklist, and the system log of who opened each file and when.

Which is the strongest evidence?

PART A · QUESTION 7

You are told to audit a trade finance process you have not worked in. The team's manager offers to draft your scope, as they know the risks best.

What do you do?

PART A · QUESTION 8

A reconciliation was late three months running. The team says a staff member was on leave. Your draft finding reads: 'Reconciliation late; staff reminded.'

What is missing?

PART B

The test sheet

One audit, eight questions. Read how the sample was chosen before you read the results.

EXHIBIT I · THE TEST SHEET

You are auditing credit limit increases at a bank's business lending arm. There were 480 increases in the year. Your team tested 25: 15 from December, because those files were to hand, and 10 picked at random from the rest of the year.

Results on the 25 files
DetailsPassed
Approved by someone with the authority24 of 25
Approved before the limit was loaded20 of 25
Annual review paper on file23 of 25

On the 5 files loaded before approval: all were keyed by the same two officers, 3 of them show one user ID both keying and approving, and together they carry US$3.4m of limits. No loss so far.

PART B · QUESTION 9

From Exhibit I.

What is the exception rate on approval before the limit was loaded?

BACK TO EXHIBIT I ↑
PART B · QUESTION 10

Exhibit I's draft says: 'About 96 of the year's 480 increases were loaded before approval.' 96 is 20% of 480.

Can the sentence stand?

BACK TO EXHIBIT I ↑
PART B · QUESTION 11

In Exhibit I, on 3 of the 5 exceptions the same user ID keyed the limit and approved it.

What do you ask first?

BACK TO EXHIBIT I ↑
PART B · QUESTION 12

Exhibit I's head of credit says: 'Those 5 were urgent, all were approved within days, and we have lost nothing.'

What are you hearing?

BACK TO EXHIBIT I ↑
PART B · QUESTION 13

You must rate the Exhibit I finding as high, medium or low. US$3.4m of limits were involved, and no loss has occurred.

What decides the rating?

BACK TO EXHIBIT I ↑
PART B · QUESTION 14

In one of Exhibit I's exceptions, you notice that a director of the borrower shares a surname and address with the officer who keyed and approved the limit.

What do you do?

BACK TO EXHIBIT I ↑
PART B · QUESTION 15

The head of credit reads Exhibit I's draft and asks you to replace 'control failure' with 'opportunity to enhance the process', and to drop the rating. They are senior to your boss.

Your move?

BACK TO EXHIBIT I ↑
PART B · QUESTION 16

Last year's audit of the same process raised the same issue as Exhibit I, and the action was closed as done. The closing evidence was an email saying staff had been told.

Signal or noise?

BACK TO EXHIBIT I ↑

PART C

The calls

Being evidenced and unpopular at the same time.

PART C · QUESTION 17

You are assigned to audit the team your close friend now leads. You have lunch together most weeks. Nobody has asked about it.

Your move?

PART C · QUESTION 18

You moved to audit six months ago from a lending team. Your first assignment includes credit files you approved yourself.

What do you do?

PART C · QUESTION 19

In a corridor, a junior staff member says: 'Off the record, the numbers in that monthly report get adjusted before they go up. Please do not say it came from me.'

What do you do?

PART C · QUESTION 20

A business head says: 'You know what good looks like. Design our new control for us, and we will implement it before you audit us next year.'

Your answer?

PART C · QUESTION 21

On a credit review, a file has a sound approval and every form signed. Reading it, you would not have lent: the cash flows do not support the story in the paper.

What do you do?

PART C · QUESTION 22

A week before fieldwork, the chief executive's office asks you to drop a branch it calls 'in a delicate phase' from your scope, and offers to explain in person.

Your move?

PART C · QUESTION 23

At the closing meeting, a manager says: 'You found one small thing in a month of work. Frankly, I would be more worried about how much this cost us.'

What do you do?

PART C · QUESTION 24

A regulator, in a routine meeting, asks if you are aware of any significant control issues. You know of one still in draft, and the business is arguing about it.

Your answer?

0 OF 24 ANSWERED · 0 WITH THE SENIOR READ · 0 STANDS UP · 0 OFF THE LINE

// THE REST OF THE ROUND

Every question here is original; none is any bank's real test. Written for: Internal auditor.