CS Professional · December 2025 · Paper 4.2
CS Professional Internal and Forensic Audit December 2025: paper analysis
Our own analysis of the official paper, as of 12 October 2026. The questions and answers belong to ICSI; read them on ICSI's website.
Chapter-wise marks
Where the marks were in this paper (out of 100; internal-choice alternatives not double counted).
What each question tested
In our words, by question number. Open the official paper for the full question.
| Q | Marks | Tests | Chapter |
|---|---|---|---|
| 1(a) | 5 | Key steps for establishing internal controls in a decentralising manufacturing company | Internal Controls |
| 1(b) | 5 | Aspects to examine when evaluating the effectiveness and efficiency of internal controls | Internal Controls |
| 1(c) | 5 | Role of internal audit in internal control and in risk management | Internal Audit: Introduction and Overview |
| 2(a) | 5 | Internal control questionnaire method and sample questions on controls over creditors | Internal Audit Tools and Techniques |
| 2(b) | 5 | Matters an auditor considers in planning before identifying and assessing risks of material misstatement | Internal Audit Engagements and Planning |
| 2(c)(i) | 2 | Eligibility of a retired government audit officer to be appointed chief internal auditor under the Companies Act | Internal Audit: Introduction and Overview |
| 2(c)(ii) | 3 | Whether an internal auditor may run compliance tracking and correspond with regulators without impairing independence | Practices related to Internal Auditing |
| 3(a) | 5 | Skills and competencies internal auditors must possess | Practices related to Internal Auditing |
| 3(b) | 5 | Sources for understanding the client business and environment in planning an internal audit | Internal Audit Engagements and Planning |
| 3(c) | 5 | Importance of assessing the control environment and factors to consider | Internal Controls |
| 4(a) | 5 | Audit programme points for donation receipts and onward remittances by an NGO | Special Points relating to Internal Audit in various Entities |
| 4(b) | 5 | Internal audit focus areas when auditing digital platforms and new technologies | Emerging Issues and Challenges |
| 4(c) | 5 | Areas and procedure for investigating suspected inventory defalcation | Audit and Investigations |
| 4A(a) | 5 | Contents of an internal audit report to the audit committee under SIA 370 | Reporting under Internal Audit |
| 4A(b) | 5 | Internal auditor review points for a bank proposal to sell non-performing assets | Special Points relating to Internal Audit in various Entities |
| 4A(c) | 5 | Steps to overcome business complexity as a challenge in internal audit | Emerging Issues and Challenges |
| 5(a) | 4 | Applying Benford law to vendor and reimbursement data and the red flags it reveals | Fraud Detecting Techniques |
| 5(b) | 4 | Layering in money laundering and tracing circular fund transfers through group entities | Forensic Audit: Laws and Regulations |
| 5(c) | 4 | Data analytics techniques to detect anomalies and collusion in employee reimbursements | Fraud Detecting Techniques |
| 5(d) | 4 | Preservation and analysis of email evidence to prove document manipulation | Cyber Forensics |
| 5(e) | 4 | Internal audit measures and controls that would have flagged the irregularities earlier | Internal Controls |
| 6(a) | 5 | Identifying fraud red flags and green flags from branch staff behaviour in a bank audit | Fraud Detecting Techniques |
| 6(b) | 5 | Digital incident response and its key steps | Cyber Forensics |
| 6(c)(i) | 2 | Data mining technique for detecting abnormal out-of-hours system log-ins | Fraud Detecting Techniques |
| 6(c)(ii) | 1 | Data mining technique for flagging fraud using a set of criteria | Fraud Detecting Techniques |
| 6(c)(iii) | 1 | Data mining technique for uncovering complex hidden fraud patterns | Fraud Detecting Techniques |
| 6(c)(iv) | 1 | Data mining technique for detecting suspicious tone in emails | Fraud Detecting Techniques |
| 6(d) | 5 | Identifying types of cyber crime from short descriptions | Cyber Forensics |
| 6A(a) | 5 | Difference between forensic audit and regular audit for suspected purchase irregularities | Basic Concepts of Forensic Audit |
| 6A(b) | 5 | Consequences of a broken chain of custody for electronic evidence in a forensic engagement | Forensic Audit and Indian Evidence Law |
| 6A(c) | 5 | Special issues for a forensic professional handling product liability insurance claims with a claim series clause | Audit and Investigations |
| 6A(d) | 5 | Steps in a regulator-ordered forensic audit of fund siphoning through shell companies | Basic Concepts of Forensic Audit |
What stood out
- The paper splits evenly by part: Q1 to Q4 (60 marks) on internal audit and Q5 to Q6 (40 marks) on forensic audit and fraud detection.
- Internal Controls is the most frequent internal audit chapter, appearing in the Q1 case, Q3(c) and Q5(e).
- Fraud Detecting Techniques dominates Part II: Benford analysis, reimbursement analytics, red flag identification and four data mining sub-parts.
- Digital evidence is a clear theme: email evidence preservation, incident response, cyber crime identification and chain of custody all appear.
- Questions are overwhelmingly applied; only a handful of parts are pure theory, consistent with the open-book format.
Practise the chapters that carried the marks
Internal Controls, Fraud Detecting Techniques, Cyber Forensics: study guides and practice questions in the CS Professional format.