How do assurance and advisory work differ?

In assurance work, internal auditors gather and evaluate evidence to provide an independent conclusion about an activity. In advisory work, they offer advice or insight on an agreed subject, such as a proposed process design. Advisory work does not transfer management’s decisions or control ownership to internal audit. If auditors later assess a design they helped create, they must address the resulting objectivity risk.

What is the difference between a control’s design and its operating effectiveness?

Design asks whether the control, if performed as specified, could address the identified risk. Operating effectiveness asks whether it actually operated as intended over the period examined. A required approval before payment may be well designed, but a sample showing approvals after payment demonstrates an operating failure. Evidence about a written procedure alone cannot establish that people followed it.

What happens when management accepts a risk that internal audit considers too high?

Internal audit first evaluates the residual risk against the organization’s risk appetite or other relevant criteria and discusses the concern with the responsible management. If the concern remains unresolved, the chief audit executive follows the applicable escalation process with senior management and, when necessary, the board. Management owns the decision to accept risk; internal audit communicates the concern rather than taking ownership of the response.

Certified Internal Auditor (CIA) Study Guide

Start with concept 1 Choose a topic

Internal auditing gives an organization an independent view of whether its governance, risk management and controls work as intended. The CIA pathway approaches that work from three angles. Part 1 establishes the function’s purpose, professional obligations and core risk concepts. Part 2 follows an engagement from defining its objective through gathering evidence and reaching a supported conclusion. Part 3 addresses how the function is directed, assessed and held accountable for its results. As you study, connect each decision to the risk it addresses: who owns the response, what evidence would test it, and who needs to hear the result. That habit makes a control weakness, a scope restriction or an unimplemented action plan easier to evaluate in context.

Part 1: Foundations of Internal Auditing

1. Why internal audit exists

Internal audit gives the board and management an independent view of whether governance, risk management, and controls work as intended. Its starting point is risk: identify what could prevent the organization from meeting an objective, then gather evidence about the controls that address it. Assurance work evaluates an existing activity and reaches a conclusion. Advisory work offers insight on a proposed change while management keeps responsibility for decisions. Both can improve performance, but neither transfers ownership of risk to auditors. Independence matters because the people preparing a report may have incentives or blind spots that make their own assessment incomplete. The board can use audit results to challenge management, set priorities, and follow up on weaknesses. The Part 1 syllabus places this purpose within the current CIA foundations.

Worked example: A board receives regional inventory totals but doubts their reliability. Auditors observe selected counts, reconcile count sheets to the ledger, and test who can post adjustments. Suppose 8 of 40 sampled adjustments lack required review. The observed exception rate is 8 ÷ 40 = 20%. The board gains evidence of a reporting control weakness and can ask management to fix the review process.

Watch the distinction: A clean audit conclusion is sometimes treated as proof that every inventory balance is correct. It reflects the defined scope and evidence tested, subject to the limits of that work.

Reference: [1]

2. The mandate and its owners

The mandate establishes the internal audit function's authority, role, and responsibilities. The board establishes or updates it, with the chief audit executive helping the board understand what authority is needed to serve the organization's objectives. Senior management contributes its perspective and supports the mandate in practice, including access to people, records, and activities. When a proposed restriction changes where auditors may work, it is a mandate issue, not a scheduling detail for management to settle alone. The chief audit executive should explain the risk, the effect on planned assurance, and possible ways to address legitimate concerns such as confidentiality. The board then determines the appropriate authority. For study, separate three decisions: who grants audit authority, who helps define the needed authority, and who enables auditors to exercise it. Blurring these roles can conceal a scope limitation.

Worked example: Management asks that three subsidiaries be excluded because local leaders dislike duplicate reviews. Those entities hold 30% of the group's inventory. The chief audit executive explains to the board that exclusion would leave a material reporting risk without audit coverage. The board considers the mandate and decides whether to retain access, revise coverage, or accept the limitation with a clear account of its effect.

Watch the distinction: Management's operational authority does not let it quietly rewrite internal audit's mandate. A material exclusion must reach the board, which is responsible for the function's authority.

Reference: [1]

3. Putting authority in a charter

The charter turns the mandate into a usable governance document. It records the function's purpose, its scope and authority, its position in the organization, and the reporting relationships that protect independence. It should describe the access needed to perform engagements and make the board's oversight role clear. Discussing it with the board and senior management helps expose ambiguities before an access dispute arises; board approval gives the charter its authority. In a practical problem, first identify what access the engagement requires, then check whether the charter covers that activity and whether a restriction affects the work. Resolve a routine misunderstanding with the responsible manager, but communicate a persistent or material restriction through the chief audit executive. A team procedure can explain how to request documents; it cannot independently grant or remove the function's authority.

Worked example: A procurement director refuses to release vendor contracts for a pricing audit, citing a local procedure. The board-approved charter gives internal audit access to relevant organizational records. The auditor explains the engagement purpose and arranges secure handling of the contracts. If access remains blocked, the chief audit executive reports the restriction and its effect on the conclusion to the board.

Watch the distinction: An approved charter does not mean auditors may handle sensitive records carelessly. Access authority and duties to protect information apply together; the local procedure may still guide secure transfer.

Reference: [1]

4. Choosing assurance or advice

Choose the service from the decision the recipient needs to make. Assurance evaluates an existing subject against criteria, gathers evidence, and communicates a conclusion. Advisory work helps a stakeholder consider options, such as controls for a new process; its nature and scope are agreed with that stakeholder. Assurance may be reasonable or limited. Reasonable assurance involves enough appropriate work to support a positive conclusion within the engagement's boundaries. Limited assurance uses narrower procedures and provides a correspondingly narrower conclusion. Neither means certainty, and the label should fit the actual evidence rather than the recipient's preferred wording. Before agreeing to advisory work, define the questions to be addressed and who will make and implement decisions. If a request for advice becomes a request for an independent conclusion about controls already operating, reassess the engagement type and evidence needed.

Worked example: The board asks whether current payroll approvals operated effectively last quarter. Auditors define criteria, select transactions, test approvals, and report an assurance conclusion. Separately, management proposes a new payroll workflow and asks where unauthorized changes might occur. Auditors discuss design options as advisory work. If they later assure the new workflow, they must consider whether their earlier advice creates an objectivity threat.

Watch the distinction: Limited assurance is not a failed version of reasonable assurance. It is a distinct level of work and conclusion, agreed and described so readers understand its narrower evidential basis.

Reference: [1]

5. Matching assurance to the risk

The assurance focus follows the risk and the claim being tested. Compliance work asks whether conduct meets a contract, policy, or applicable requirement. Operational work examines how efficiently and effectively a process meets its objective. Reporting work tests the completeness, accuracy, and usefulness of information. Technology work examines matters such as access, system changes, and data protection. An engagement may combine these lenses, but its procedures must answer the central question. Translate a concern into an assertion, choose suitable criteria, and trace transactions or activity to evidence. A system access review may reveal who could change an invoice, yet it cannot establish whether billed rates agree with a contract. Conversely, contract testing alone may miss a system weakness that explains repeated overbilling. State the primary conclusion and supporting control issues separately so the report remains precise.

Worked example: A contractor bills 50 hours at a hypothetical $140 per hour; the contract permits $120. The allowed charge is 50 × $120 = $6,000, while the invoice is 50 × $140 = $7,000. The $1,000 difference warrants investigation under contract compliance criteria. Auditors may also test invoice review controls, but administrator access testing alone cannot establish the overcharge.

Watch the distinction: The presence of software does not automatically make a problem an IT audit. Identify the assertion first; the technology may be a cause or supporting control rather than the main subject.

Reference: [1]

6. Advising without owning controls

Auditors can train staff, map processes, benchmark practices, or comment on proposed control designs. Their value comes from explaining risks, likely failure points, and workable options before decisions are locked in. Management remains accountable for selecting, approving, implementing, and operating controls. This boundary protects later assurance: an auditor who becomes the control owner would be assessing a decision or activity they performed. At the start, record the advisory objective, deliverable, intended users, and management's decision rights. During discussion, distinguish a suggested control from a required action and disclose important assumptions. If management asks auditors to configure approvals, sign transactions, or supervise employees, redirect those duties to an operational owner. The related Part 1 study guide can be used to practice distinguishing advisory services from control ownership.

Worked example: Auditors map purchasing and find that purchase orders can be issued after goods arrive. They suggest a prior approval step and explain how it could prevent unauthorized commitments. The purchasing manager chooses the approval level, configures the workflow, and trains staff. Auditors may later test the workflow, with safeguards if their earlier design advice could affect objectivity.

Watch the distinction: Giving a detailed suggestion does not itself transfer ownership to internal audit. The problem arises when auditors make or execute management's decisions, or later assess their own work without safeguards.

Reference: [1]

7. Independence and the Three Lines

The Three Lines Model distinguishes operational management, specialist management support, and independent assurance. First line roles deliver services and manage the risks they create. Second line roles provide expertise, monitoring, and challenge in areas such as compliance or risk management. Internal audit offers independent assurance and advice to the board and management. A reporting line that lets an audited executive suppress results, restricted access, or an operational assignment can impair independence. Assess both actual control over audit work and how the arrangement would reasonably appear. The chief audit executive should communicate an impairment or perceived impairment to the board and seek safeguards, such as reassignment or independent supervision. An auditor can understand or advise on a compliance control without becoming the person who operates it. The decisive question is who makes the management decision and who later judges its performance.

Worked example: A compliance manager asks an auditor to review daily exception alerts for six months, then audit the alert process. Reviewing and clearing alerts would make the auditor a control operator. Compliance assigns that task to its own staff. A different auditor later examines alert completeness, review timeliness, and resolution evidence, preserving a credible independent assessment.

Watch the distinction: A second line team's monitoring is valuable, but it does not become internal audit assurance simply because its staff use testing methods. Role, accountability, and independence determine the distinction.

Reference: [1]

Part 1: Ethics and Professionalism

8. Integrity under pressure

Integrity requires auditors to represent evidence honestly, including facts that complicate a preferred narrative. Professional courage is the willingness to raise a supported concern despite pressure from someone with influence. Start by checking the evidence and the wording: an exception may be real while its cause or significance remains uncertain. Give the responsible person a fair chance to provide contrary evidence. If the proposed change would omit a material fact or distort the conclusion, retain the workpaper trail and raise the disagreement through audit supervision and, when necessary, the chief audit executive. Keep the communication factual and proportionate; courage does not excuse accusation or speculation. An auditor must also follow lawful and professional conduct when obtaining and using information. The practical sequence is verify, discuss, document, and escalate unresolved pressure, while protecting the integrity of the final communication.

Worked example: A director asks that an unsupported payment exception disappear from the draft report. The auditor checks the approval record and confirms that approval occurred after payment. The director offers no earlier evidence. The auditor keeps the finding, adjusts the wording to state the verified timing, and informs the supervisor of the request. The report describes the control deviation without asserting dishonest intent.

Watch the distinction: Integrity does not mean refusing every correction from management. A demonstrated factual error should be fixed; pressure to hide a supported material exception should be documented and addressed.

Reference: [1]

9. Recognizing objectivity threats

Objectivity is an unbiased mental attitude in making audit judgments. A self-review threat arises when an auditor assesses work they designed or performed. Familiarity can make an auditor too ready to accept a colleague's account. Financial interests, close relationships, or gifts may create real or perceived conflicts even if the auditor believes they can remain fair. Identify the relationship before work begins, assess which judgments it could affect, and choose a safeguard proportionate to the threat. Reassigning the auditor is often clearest for a direct self-review conflict. Independent supervision or an external provider may be suitable where reassignment is impractical. Disclose an impairment when safeguards cannot remove its effect or when readers need to understand a limitation. A gift's value alone is not the whole question; timing and its potential influence matter.

Worked example: An auditor designed access roles last year and is assigned to judge whether those same roles appropriately separate duties. The auditor could be defending their own design. The supervisor assigns another qualified auditor to evaluate role design. The original auditor may explain historical facts, but does not decide the conclusion. The reassignment directly removes the self-review threat from that judgment.

Watch the distinction: An auditor's sincere belief in their fairness does not settle an objectivity concern. Ask whether an informed observer could reasonably doubt the judgment and whether the safeguard addresses that doubt.

Reference: [1]

10. Competence and due care

Competence means having, developing, or obtaining the knowledge and skills needed for assigned work. Due professional care means applying those skills with attention to the organization's objectives, significant risks, evidence quality, and the cost and benefit of the engagement. It does not require exhaustive testing of every transaction. Start with the risk: consider the probability and impact of error, fraud, or noncompliance, then allocate stronger procedures where a weak conclusion would matter most. Professional skepticism calls for an unbiased but critical assessment of claims, particularly when evidence comes from an interested party. If the team lacks specialist knowledge, obtain qualified help and define how the specialist's work will support the audit objective. Supervision should check that staff understand the procedure and can interpret results. Continuing development addresses recurring skill gaps; it does not substitute for expertise needed now.

Worked example: A team reviewing cloud security lacks the skills to assess privileged access. The supervisor engages a qualified specialist to examine role assignments and activity logs, then checks how that testing supports the engagement objective. The vendor's statement that access is secure remains a claim. The team corroborates it with configuration evidence and selected access events before reaching a conclusion.

Watch the distinction: Due care is not measured by the largest possible sample. A well-targeted procedure using reliable evidence may support a stronger conclusion than extensive testing of a low-risk or irrelevant population.

Reference: [1]

11. Protecting information

Engagement information is entrusted to auditors for defined professional purposes. Protect it through access limited to those who need it, secure storage and transfer, appropriate redaction, and retention consistent with applicable requirements and the organization's methods. Before sharing, ask what decision the recipient must make and which details are necessary for it. Personal identifiers may be essential for testing but unnecessary in a management summary. Preserve original evidence so authorized reviewers can trace the finding, while using a safer working copy for wider discussion. Confidentiality also limits informal disclosure to colleagues who are outside the engagement. When evidence contains sensitive data, document how it was obtained and who can access it. Security controls should not make the audit impossible: arrange controlled access that allows testing while respecting privacy and ownership of the information.

Worked example: A workpaper lists customer names, account numbers, and refund dates. The audit team stores the full file in a restricted repository and uses it to trace sampled refunds. A regional manager needs the exception pattern, so the auditor shares a summary with case references and dates but removes customer identifiers. Authorized reviewers can still reach the originals through the workpaper link.

Watch the distinction: Because an auditor may access sensitive data, they do not automatically have authority to share it with every stakeholder. Separate the right to test information from the need to disclose it.

Reference: [1]

Part 1: Governance, Risk Management, and Control

12. Governance, culture and accountability

Governance sets who directs the organization, who is accountable for decisions, and how the board oversees results. Management translates strategy into objectives, incentives, processes, and controls. Culture is visible in what leaders reward, ignore, and challenge, not only in written ethics statements. Those signals shape the control environment: staff may bypass a formal review if meeting a volume target is consistently praised while corrections are discouraged. To assess an apparent control failure, trace the decision chain. Identify the objective and incentive, observe behavior, test the control, and ask whether oversight detects and corrects the pattern. Distinguish an individual exception from a system of incentives that makes similar exceptions likely. Internal audit can report this connection and its consequences, while management and the board decide how to change rewards, accountability, and monitoring.

Worked example: Executives reward shipments but seldom discuss returns. Auditors find that 12 of 80 sampled year-end shipments were recorded before customer acceptance, an observed rate of 12 ÷ 80 = 15%. They test recording criteria and review how managers challenge reversals. The finding links premature reporting to both a transaction control weakness and incentives that may encourage recurrence.

Watch the distinction: A signed code of conduct is not sufficient evidence of a sound culture. Compare stated expectations with decisions, incentives, exception handling, and how leaders respond when results are corrected.

Reference: [1]

13. Classifying and measuring risk

Risk can be classified by the objective affected. Strategic risk threatens a chosen direction; operational risk disrupts delivery; financial risk affects resources or reporting; compliance risk concerns obligations; reputational risk concerns stakeholder trust. One event may span several types. Inherent risk describes exposure before the controls being assessed. Residual risk is the exposure remaining after considering controls that are designed and actually operate. Keep the measurement basis consistent: compare likelihood with likelihood and impact with impact over the same period and scenario. A recovery procedure may reduce outage duration and therefore impact, while a redundancy control may reduce likelihood. Do not assume that a written control produces the planned reduction; seek test evidence. If estimates are uncertain, state their assumptions and ranges. The purpose of a risk figure is to support a decision, not to suggest precision the evidence cannot bear.

Worked example: For a hypothetical single outage, estimated impact without recovery measures is $500,000. Tested restoration capability is expected to limit the same outage's impact to $120,000, assuming the backup remains usable. The estimated impact reduction is $500,000 − $120,000 = $380,000. The $120,000 is residual impact for this scenario; it is not an annual expected loss without a likelihood estimate.

Watch the distinction: Subtracting a control's stated benefit from inherent risk is unsafe if the control has not been tested. Residual exposure depends on both design and operation under the stated scenario.

Reference: [1]

14. Appetite, tolerance and response

Risk appetite is the amount and type of risk the organization is willing to pursue or retain while meeting objectives. Tolerance gives a more specific boundary for variation or exposure in a particular activity. Compare estimated residual risk with the relevant approved boundary, using the same unit, period, and assumptions. Management can avoid an activity, reduce risk through controls, share part of it through contracts or insurance, or accept the remainder. Sharing rarely removes every consequence: exclusions, deductibles, and reputational effects may remain. If residual exposure exceeds tolerance, assess whether further response is feasible and who has authority to accept the risk. Internal audit evaluates and communicates; it does not make the acceptance decision for management. Where the estimate is uncertain, show the range and test whether reasonable changes in assumptions reverse the decision.

Worked example: Suppose the approved tolerance for loss from one system incident is a hypothetical $200,000, while tested controls leave estimated residual impact of $350,000 for the same incident. The excess is $350,000 − $200,000 = $150,000. Management could improve recovery, share part of the exposure, stop the risky activity, or seek explicit consideration of acceptance through the appropriate governance process.

Watch the distinction: Being above tolerance does not automatically dictate one specific control. It signals a decision requiring a suitable response and clear accountability for any remaining exposure.

Reference: [1]

15. Testing risk management as a process

Risk management is a continuing process, not the existence of a register. A sound cycle identifies threats and opportunities, evaluates their likelihood and impact, selects responses, assigns owners, and monitors whether the responses still work. A framework helps functions use comparable terms and escalation routes, but local risks still need specific analysis. To test the process, follow a recent change through the cycle: was the new risk recognized, reassessed, assigned, addressed, and reported? Compare the register with operational evidence such as incidents, project changes, and control results. A risk with no owner may have no one accountable for response. A risk rated once before a major migration may now be misstated. The auditor should evaluate both process design and evidence of use across functions, including how management handles emerging or cross-functional risks.

Worked example: A risk register lists unauthorized access to a customer platform, but no owner is named. After a system migration, privileged roles changed and the register was not reviewed. Auditors trace migration approvals and find that the new roles were never assessed against the old risk response. Identification occurred, yet ownership, reassessment, and monitoring failed; the rating cannot be relied on without updated evidence.

Watch the distinction: A comprehensive list of risks can create false comfort. It says little about whether management evaluates change, assigns responses, or checks that those responses remain effective.

Reference: [1]

16. Selecting a control type

Controls differ by when they act. A preventive control blocks an unwanted event before it occurs, such as an approval that must precede payment. A detective control identifies an event or error after it occurs, such as an independent reconciliation. A corrective control limits damage or restores an acceptable state, such as recovering a mistaken transfer and fixing the account setup. Choose the mix from the risk's speed and consequences. If a loss is difficult to recover, prevention deserves attention; if prevention can be bypassed, timely detection becomes important. A detective control must have a response owner and enough frequency to matter. Evaluate who performs each step, what information they use, and whether evidence of completion is retained. A label alone does not prove effectiveness: a prepayment approval that routinely occurs after release is no longer preventive in operation.

Worked example: A payment workflow requires an authorized manager's approval before the bank file is released. That is preventive. Treasury then matches bank confirmations to approved files each day, a detective control. If an unauthorized transfer is found, staff contact the bank, seek recovery, and correct the compromised access, which are corrective actions. Each addresses a different stage of the same risk.

Watch the distinction: A reconciliation does not prevent an unauthorized transfer merely because it is performed promptly. It detects a transfer already made; prevention requires a control before release.

Reference: [1]

17. Design, operation and efficiency

Design asks whether a control, if performed as specified, could address the stated risk. Operation asks whether it was performed correctly, by the right person, at the right time, throughout the period. Efficiency asks whether the effort and cost are proportionate to the protection gained. Assess these in sequence. First match the control step to the failure it should stop or detect. Then inspect records, observe performance, or retest transactions to see whether the step occurred. Finally consider whether a simpler or automated method could produce comparable protection, without weakening the risk response. A sample exception rate describes the tested items; it does not automatically establish a population rate or a final risk rating. Missing sign-off may mean no review occurred, or that evidence was not retained, so corroborate before stating the condition.

Worked example: A weekly exception review is designed to identify unusual supplier changes and requires reviewer sign-off. In a hypothetical sample of 10 weeks, four have no sign-off. Six of 10, or 60%, show the required evidence; four of 10, or 40%, do not. Auditors check logs and interview reviewers before concluding whether reviews were missed or merely undocumented.

Watch the distinction: A well-written procedure establishes intended design, not operating effectiveness. Conversely, a signed checklist does not prove that the reviewer examined meaningful exceptions.

Reference: [1]

Part 1: Fraud Risks

18. Fraud schemes and opportunity

The fraud triangle is a way to reason about conditions that can enable a scheme: motivation or pressure, opportunity, and rationalization. It does not diagnose a person's intent. Start with a plausible method of misappropriation, corruption, or misstatement, then identify the access and weak controls needed to execute and conceal it. Opportunity is often the most observable element: one employee might create a vendor, enter an invoice, and approve payment. Pressure and rationalization can heighten concern but are rarely established by a single observation. Look for corroborating transaction patterns, vendor details, approval trails, and independent records. Maintain a distinction between a fraud risk, a red flag, and evidence of a completed act. The auditor's role is to assess exposure and report supported concerns, using qualified investigators when allegations require investigative procedures.

Worked example: A buyer can both create vendors and approve invoices. Auditors identify the opportunity for a fictitious-vendor scheme. They compare new vendor addresses with employee records, trace selected invoices to goods receipts, and review payment approvals. A shared address is a red flag requiring investigation; it does not, by itself, prove the buyer created a false vendor or received money.

Watch the distinction: The presence of pressure, opportunity, or rationalization is not proof of fraud. Treat these factors as reasons to design focused procedures, then draw conclusions only from sufficient evidence.

Reference: [1]

19. Planning for fraud exposure

Fraud consideration begins with the process and the likely scheme, rather than a generic fraud checklist. Ask who can initiate, approve, record, and conceal a transaction; where independent review is absent; and whether incentives or unusual activity increase exposure. Then pair the scheme with controls that interrupt it. Segregation of duties and authority limits can prevent an improper transaction. Reconciliations, supervisory review, trend analysis, and reporting channels can detect one. The planned procedure should test a specific assertion, such as whether refunds were authorized and reached the original customer. Analyze the full population when data allow, but investigate alerts before treating them as findings. Consider remote or decentralized work when it changes oversight or access. A control that appears adequate on paper may fail if one person holds multiple system roles or reviews their own exceptions.

Worked example: A remote sales team can issue refunds without independent approval. Auditors extract six months of refunds, compare amounts and recipients with original sales, and flag repeated refunds to the same destination. They select flagged and ordinary items for source testing and check whether supervisors reviewed them. An unusual trend directs testing; matched evidence determines whether a control failed or a refund was improper.

Watch the distinction: A fraud hotline is useful but cannot replace process controls. Some schemes are never reported, so prevention and transaction-based detection still matter.

Reference: [1]

20. Responding to fraud indicators

A red flag calls for careful assessment, evidence preservation, and appropriate referral. First verify the apparent pattern and rule out simple data errors, such as shared service addresses or duplicate records. Record what was observed, the source, the date, and the tests performed, without altering originals. Restrict access to the concern because premature disclosure can damage reputations or compromise a later investigation. Follow the internal audit function's assigned role: auditors may perform focused testing, but interviews, forensic collection, or legal steps may require qualified investigators. Coordinate with those responsible for investigations and communicate the concern through the agreed channel. Keep language neutral: report an unexplained link or transaction pattern, not an allegation of guilt. Later, use the outcome and any control lessons to reassess fraud risk while respecting confidentiality and the investigation's boundaries.

Worked example: Auditors find five payments to a vendor whose recorded address matches an employee's address. They validate both source records and retain controlled copies of payment, vendor, and approval data. They document the match and refer it through the investigation channel. Investigators can determine whether the address has an innocent explanation and whether any payment was improper; the audit team does not accuse the employee.

Watch the distinction: Confronting the employee immediately may alert a suspect, contaminate evidence, or unfairly imply guilt. Verify the indicator, preserve records, and use the function's assigned investigation route.

Reference: [1]

Part 2: Engagement Planning

21. Defining the engagement

Start with the decision the engagement must support: what risk or control question needs an answer, and for whom? Translate that question into an objective, then define the activities, locations, systems, period, and records needed to answer it. Consider organizational objectives, risk appetite, previous findings, other assurance work, and stakeholder requests. Determine whether any applicable Topical Requirement affects the planned work. A requested exclusion deserves scrutiny when it removes a significant exposure: document its reason, assess its effect on the conclusion, and raise it with the appropriate audit leadership. If objectives or scope change during fieldwork, revise the work program and communicate the change. The Part 2 syllabus identifies these planning decisions as part of engagement work.

Worked example: A procurement engagement will assess vendor selection and payment approval across two regions. Region West accounts for $8 million of the $16 million annual spend but denies access to contracts. West represents 50% of spending. The team records the exclusion, seeks access through audit leadership, and cannot present a conclusion covering both regions if the restriction remains.

Watch the distinction: A broad objective does not cure a narrow scope. If a material population is excluded, procedures on the remaining population cannot support an organization-wide conclusion.

Reference: [2]

22. Choosing evaluation criteria

Criteria are the benchmark against which the observed condition is compared. Choose them before judging results, using relevant requirements such as an approved policy, contract term, control objective, or documented performance measure. A useful criterion identifies what should happen, to which population, and when; it must also be practical to test. Check that it supports the engagement objective and permits different auditors to classify the same facts consistently. If management uses an ambiguous phrase, establish its operational meaning with the responsible owner and examine whether the resulting benchmark adequately addresses the risk. Record the source and version of the criterion because requirements can change during the period under review. A deviation becomes a defensible finding only when the benchmark and evidence can be compared on the same basis.

Worked example: Suppose the approved access procedure requires an account to be disabled by the end of an employee’s departure day. HR records show a departure on 12 June; the controlled access log shows deactivation on 14 June. The account remained active beyond the stated deadline. The auditor verifies both timestamps and reports the deviation without assuming it was used.

Watch the distinction: Calling removal 'late' without a defined deadline invites inconsistent judgments. A personal expectation of promptness is not a substitute for an applicable, testable criterion.

Reference: [2]

23. Prioritizing engagement risks

List the events that could prevent the activity from meeting its objectives, then assess each event's likelihood and impact using a consistent scale. Examine change in people, processes, systems, and external conditions; recent change can make historical results less predictive. Next identify existing controls and evidence of their design and operation. A simple likelihood-times-impact score helps order discussion, but its numbered categories are ranks, not precise measurements of expected loss. Investigate high-impact risks even if their estimated likelihood is low, and reconsider priorities when controls are weak or evidence is missing. The work program should concentrate on exposures where testing can most improve the conclusion. For practice applying these judgments, use the Part 2 study guide.

Worked example: On hypothetical five-point scales, unauthorized payments score likelihood 4 and impact 5, giving 4 × 5 = 20. Delayed management reports score 2 × 3 = 6. Payment risk initially takes priority. If a tested dual-approval control reduces its assessed likelihood to 1, its revised rank is 1 × 5 = 5; the auditor still considers the severe impact.

Watch the distinction: Treating a risk score as a dollar loss or an automatic testing rule creates false precision. Scores guide prioritization; control evidence and the consequences of failure still matter.

Reference: [2]

24. Reading business process risks

Follow a transaction through its business purpose, physical movement, system records, and accounting entry. In purchasing, a purchase order authorizes terms, a receipt supports quantity received, and an invoice states the supplier's claim. Matching those records can expose overbilling, duplicate payment, unauthorized price changes, or goods recorded in the wrong period. Inventory records connect purchases with custody and financial reporting, while payables record the obligation. Identify where one employee can create or alter evidence used by another step, especially vendor records and receipt confirmations. An exception is a question for investigation, not proof of wrongdoing: partial deliveries, approved price changes, returns, and timing differences may explain it. The audit procedure should identify which assertion is at risk, such as occurrence, completeness, accuracy, or valuation.

Worked example: A purchase order specifies 1,000 units at a hypothetical $20 each. The receiving record supports 900 units, while the invoice bills 1,000. The unmatched quantity is 1,000 − 900 = 100 units; the disputed amount is 100 × $20 = $2,000. The auditor checks for another receipt or approved advance billing before concluding that payment is overstated.

Watch the distinction: An invoice agreeing with a purchase order does not establish delivery. The receiving evidence tests a different assertion and may reveal an overpayment hidden by the two-document match.

Reference: [2]

25. Cybersecurity and privacy in scope

When a process depends on software, trace the business risk into the technology that creates, changes, stores, or transmits its records. Identify sensitive data, privileged users, interfaces, outsourced services, and changes to application logic. Then select controls tied to specific claims: unique accounts and access reviews support attribution and least privilege; approved changes and testing protect processing integrity; encryption and restricted sharing protect data; logs and monitoring help detect misuse. Privacy assessment also asks whether collection, access, retention, and disclosure match the organization's stated purposes and applicable obligations. A policy may describe intended safeguards, but an engagement needs evidence that they exist and operate in the relevant system. Where administrators share credentials, transaction logs may identify an account without identifying the person responsible.

Worked example: A customer database holds contact and payment details. Four administrators use one shared account, and its log records a large export at 22:10. The auditor can establish that the account exported data, but cannot attribute the action to one administrator from that log alone. The plan adds credential assignment, privilege, export approval, and independent log evidence to testing.

Watch the distinction: A detailed security policy does not prove individual accountability. Shared privileged credentials weaken attribution even when every database action is logged under the shared account.

Reference: [2]

26. Continuity and recovery readiness

Begin with a business impact analysis: identify critical activities, their dependencies, and the consequences of interruption over time. That gives a basis for deciding which systems, people, facilities, suppliers, and records require recovery arrangements. Examine incident roles, decision authority, communication paths, alternative processing, and recovery procedures. A backup is only one input to recovery; its value depends on usable data, available infrastructure, and a successful restore within the organization's required window. Compare test results with the recovery objectives management has adopted, and investigate failures, skipped steps, and dependencies absent from the test. Distinguish data recovery from service resumption: a restored database may still be unusable if applications, network access, or staff procedures fail. The engagement should test the full chain relevant to the critical activity.

Worked example: An order platform takes nightly backups, but its latest restore test loaded the database without restoring the application interface. Staff could read stored orders but could not accept new ones. The auditor concludes that backup creation occurred, while service recovery remains unproven, and plans testing of the interface and order processing after restoration.

Watch the distinction: A successful backup job is not a successful recovery test. It shows a copy was made, while restoration and business processing require separate evidence.

Reference: [2]

27. Choosing an engagement approach

Choose the work pattern according to the risk, rate of change, access to evidence, and dependencies among specialists. A traditional sequence can suit a stable process with a defined period and records. Short, repeated cycles can suit a rapidly changing product, provided each cycle has clear objectives, criteria, evidence, and follow-up. An integrated engagement coordinates business and technology procedures around one risk; it does not mean every auditor tests everything. Remote work can improve reach through system access and video observation, but the team must evaluate authenticity, completeness, and what cannot be observed remotely. Set milestones for evidence collection, review, stakeholder decisions, and reporting. Change the approach when the chosen method stops supporting the objective, and document how coverage remains adequate.

Worked example: An application releases changes every two weeks. A single review at year-end might miss controls that operated differently across releases. The team selects short cycles, checking approval and testing records for each release, while IT and operations auditors jointly trace how a pricing change reaches customer invoices. The approach covers both system and business effects.

Watch the distinction: Calling an engagement 'agile' does not justify informal evidence or an undefined conclusion. Each short cycle still needs a testable objective and reviewed work.

Reference: [2]

28. Testing control design

A design test asks whether a control, if performed exactly as specified, could prevent or detect the identified failure. State the risk and the control objective first. Then inspect the control's trigger, data inputs, decision logic, responsible person, timing, and treatment of exceptions. Use a walkthrough or hypothetical adverse transaction to challenge the design. For automated controls, inspect configuration and dependencies such as master data quality and change access. If the rule cannot recognize a plausible error, testing many instances of its operation will not solve the design problem. Separate this assessment from operating effectiveness: a well-designed control may be skipped, while a consistently performed control may be incapable of addressing the risk. The work program should contain distinct procedures for those questions.

Worked example: A proposed duplicate-payment control blocks identical invoice numbers for one vendor. An auditor tests two hypothetical invoices from the same vendor, both for $4,800 on the same date, numbered 7841 and 7841-A. Both pass the rule. The design cannot detect this plausible duplicate, so the team evaluates added attributes such as amount, date, vendor, and receipt.

Watch the distinction: Finding that a control ran every day does not establish sound design. A rule that consistently checks the wrong attribute can consistently miss the targeted error.

Reference: [2]

29. Testing operation and efficiency

Operating testing asks whether the control worked as designed across the period and population relevant to the objective. Define the population, select an appropriate sample or full-population test, and obtain evidence of who performed the control, when, and how exceptions were resolved. Choose coverage that reflects frequency, changes, and risk; a one-day sample cannot establish year-long operation without further support. Calculate observed deviations accurately, then examine their causes and significance before deciding whether reliance is justified. Efficiency is a separate judgment: compare the effort and cost of the control with the risk reduction achieved, while considering simpler controls that could produce comparable protection. High compliance in a sample does not create a guarantee about untested items, and an observed rate should not be called a population rate without a valid basis.

Worked example: In a hypothetical sample of 40 system changes, 36 show approval before deployment and four do not. The observed approval rate is 36 ÷ 40 = 90%; the deviation rate is 4 ÷ 40 = 10%. The auditor investigates the four changes, their risk and timing, and whether the sample represents the review period before relying on the approval control.

Watch the distinction: Reporting '90% effective' from this sample overstates the evidence. Ninety percent describes observed approvals; effectiveness also depends on exception significance and sample design.

Reference: [2]

30. Resourcing and revising the plan

Translate each planned procedure into hours, skills, data access, technology, and review time. A specialist may be needed when the team can identify a risk but cannot competently test the underlying technology or accounting judgment. Schedule that expertise at the stage where its findings can shape later work, rather than at reporting. Track actual effort against the plan and investigate overruns or unavailable resources. When a constraint prevents an objective from being met, identify the procedures affected, alternatives, and resulting limitation. Additional staff, narrower scope, staged work, or changed timing may be reasonable, but each option changes cost or coverage. Obtain the appropriate approval for material revisions and communicate their effect to stakeholders. The final conclusion must match the evidence the revised program can actually produce.

Worked example: A review is budgeted for 80 hours, including 30 hours of cloud expertise. Only 10 specialist hours are available, leaving a 20-hour gap. The supervisor seeks 20 additional hours. If unavailable, the team narrows the cloud procedures with approval, documents the coverage lost, and avoids a broad conclusion on cloud controls.

Watch the distinction: Keeping the original conclusion after cutting essential procedures conceals the resource constraint. The objective, scope, and wording of results must reflect the work completed.

Reference: [2]

Part 2: Information Gathering, Analysis, and Evaluation

31. Gathering information deliberately

Choose an information source by asking what assertion it can establish. Interviews reveal how participants understand a process and where exceptions might occur. Observation shows an activity at a particular time; a walkthrough connects a transaction from initiation to recording. Documents and system data can show historical operation, provided their completeness and integrity are checked. Combining methods often resolves their weaknesses: a claimed count procedure can be observed, then supported with signed count sheets and adjustment records. Design questions and requests before fieldwork so each item connects to an objective and criterion. Record who supplied information, its period, and any limits. The CIA practice questions can help you rehearse choosing evidence for a particular assertion.

Worked example: A warehouse manager says counts occur weekly. The auditor observes one Friday count, obtains signed sheets for four earlier weeks, and traces recorded differences to approved inventory adjustments. Observation supports the current procedure; the dated records support historical occurrence. If one week has no sheet, the auditor investigates before concluding the weekly control operated throughout.

Watch the distinction: An interview about past activity supplies a description, not proof that the activity happened. Corroborate it with observation or records tied to the relevant period.

Reference: [2]

32. Judging evidence quality

Evidence must answer the question asked, be sufficient for the conclusion, and be dependable enough to use. Relevance concerns the link to the assertion: a refund total says little about approval. Sufficiency concerns quantity and coverage in light of risk and variation. Reliability improves when information comes directly from an independent source, is corroborated, or originates from a system with effective controls. An apparently complete report can be misleading if users can edit its source records or exclude transactions through filters. Trace selected items back to underlying records, reconcile population totals, and understand how the report was produced. For a consequential finding, document the trail so another competent auditor could follow the same criteria, evidence, and reasoning to the conclusion.

Worked example: Management states that all 2,400 refunds were approved. The auditor reconciles the refund extract to the ledger, then joins it to a controlled approval log using unique refund IDs. Twenty entries have no matching approval. After checking for timing or ID errors, those twenty remain exceptions. The matched data provides stronger evidence than the verbal assurance.

Watch the distinction: A large file is not automatically sufficient evidence. If its population is incomplete or its source can be altered without trace, more rows do not fix the weakness.

Reference: [2]

33. Mapping the real workflow

Map what actually happens, including handoffs between people, systems, and outside parties. Begin with a real transaction and follow its documents, approvals, data changes, and exceptions. Mark each step's owner using a responsibility assignment matrix so the team can see who initiates, approves, records, and reviews. Compare the observed route with the written procedure; informal workarounds often explain why a control fails. Concentrated duties matter when one role can both create a risky change and approve or conceal it. Examine compensating review only if the reviewer has independent information and acts before harm becomes hard to reverse. A map is most useful when it points to a testable risk, such as an unreviewed master-data change, rather than merely depicting boxes and arrows.

Worked example: A walkthrough of supplier bank changes shows one clerk receives emailed instructions, edits the master record, and clicks the approval field. A second employee only reviews monthly payment totals, which cannot identify an unauthorized bank change. The auditor identifies a duty conflict and plans to test independent callback evidence and approval before payment.

Watch the distinction: Two recorded steps do not mean two independent people performed them. Inspect role permissions and actual transaction logs before treating the workflow as segregated.

Reference: [2]

34. Preparing data for analysis

State the analytic question before requesting data: a duplicate-payment test, for example, needs payment identity, vendor, invoice, amount, and date. Establish the population and period, reconcile record counts and totals to a trusted source, and identify missing or repeated keys. Normalize formats, units, dates, names, and codes without silently changing their meaning. Validate joins by checking unmatched records and one-to-many relationships; an incorrect join can create false exceptions or hide genuine ones. Keep raw data and documented transformations so another auditor can reproduce the result. After cleaning, inspect flagged transactions against source records and business explanations. Analytics narrows investigation, but the result is only as sound as the population, transformation rules, and interpretation of matched fields.

Worked example: Two hypothetical payment files produce 12 apparent duplicate pairs when dates are compared as text. One uses day/month/year and the other month/day/year. After standardizing dates and joining on vendor ID, amount, and invoice reference, only three pairs match. The auditor traces those three to invoices and payment records; nine formatting artifacts are removed from the exception list.

Watch the distinction: A join result is not self-validating. Mismatched date formats or nonunique keys can manufacture duplicates, so inspect transformations and unmatched records before reporting.

Reference: [2]

35. Selecting an analytic method

Select analysis according to the question. Descriptive analysis shows what happened; diagnostic analysis examines why; predictive analysis estimates a future outcome from patterns; prescriptive analysis compares possible actions. Anomaly detection flags observations unlike a baseline, while text analysis extracts patterns from unstructured comments or documents. Dashboards and automated routines can monitor many transactions, but they inherit data quality, model, and threshold limitations. Define the criterion behind an alert, inspect false positives and missed cases, and corroborate material exceptions with source records. If a model ranks cases, understand which inputs drive the ranking and whether process changes have made historical patterns stale. The finding should state the verified condition, not merely repeat the software's label or score.

Worked example: A dashboard flags five approvals as late because approval timestamps follow posting timestamps. The auditor traces each case to the source workflow: three were approved after posting, while two have a time-zone conversion error in the dashboard. The supported finding concerns the three verified cases; the other two call for correcting the analytic rule.

Watch the distinction: An automated alert is a lead, not a finding. Without checking the underlying record and rule, a data error can be mistaken for control failure.

Reference: [2]

36. Explaining variances and ratios

Choose a measure whose numerator and denominator reflect the same activity and period. Calculate it consistently, then compare with a relevant baseline, such as a prior period, budget, peer group, or management target. Separate absolute change from percentage-point change and relative percentage change. Ask whether volume, product mix, seasonality, pricing, data definitions, or genuine control problems explain the movement. Ratios are useful screening tools, but a changed ratio does not identify its cause. Follow an unusual result with transaction testing, interviews, or operational evidence. State any limitation in the comparison, particularly when the underlying populations differ. A well-chosen measure points the audit toward a risk; it does not by itself establish that a control failed or that management caused the change.

Worked example: Returns increase from 40 of 1,000 sales to 90 of 1,500. The earlier rate is 40 ÷ 1,000 = 4%; the later rate is 90 ÷ 1,500 = 6%. The increase is 2 percentage points, or 50% relative to the earlier rate. The auditor checks product mix and defect records before attributing it to quality control.

Watch the distinction: Saying returns rose by 2% confuses a percentage-point difference with a relative change. State the denominator and investigate causes before interpreting the movement.

Reference: [2]

37. Building a supported finding

Build a finding from a clear comparison: the criterion says what should occur, and the condition states what evidence shows occurred. Test plausible causes rather than accepting the first explanation. Distinguish a missing control, a sound control that was bypassed, poor system configuration, and unreliable evidence, because each calls for a different response. Describe the effect as observed harm when supported, or as a specific exposure when harm has not been established. Judge significance using frequency, financial or operational impact, sensitivity, and the strength of other controls. Make sure the conclusion stays within the tested population and period. A useful finding lets management see exactly what failed, why it matters, and which cause an action plan should address.

Worked example: An approved procedure requires manager approval before privileged access begins. Six of 30 sampled accounts were activated before approval. Configuration records show the system permits activation without an approval flag, and logs confirm the sequence. The observed deviation rate is 6 ÷ 30 = 20%. The finding identifies an access exposure; it does not claim those users misused access.

Watch the distinction: A deviation alone does not establish its cause or actual loss. Label an effect as potential when the evidence shows exposure but no confirmed misuse or damage.

Reference: [2]

38. From workpapers to conclusion

Workpapers should let a reviewer retrace the engagement from objective to procedure, population, evidence, exception, and conclusion. Record source, date, selection method, criteria, calculations, and how contradictory evidence was resolved. Cross-reference each reported finding to its support, and retain documentation under applicable requirements and the function's methodology. Then step back from individual exceptions: several findings may share a cause, affect one critical objective, or combine to weaken a control process. Aggregation requires judgment, not simple counting. Three minor errors in unrelated tasks may matter less than two linked failures that permit a high-impact transaction without independent review. State the overall conclusion at the level the evidence supports, including areas that worked and important scope limits.

Worked example: Three workpapers document unauthorized access grants, overdue access removals, and missing privileged-account reviews. All affect the same administrator role, and the same manager owns each control. The auditor links the records and concludes that oversight of privileged access is weak. The conclusion is limited to that role and the period tested, rather than every access control.

Watch the distinction: Three exceptions do not automatically equal three independent problems. Look for a shared process or cause, then explain the aggregate risk without extending beyond the evidence.

Reference: [2]

Part 2: Engagement Supervision and Communication

39. Supervising the engagement

Supervision begins when objectives, scope, skills, and assignments are set, then continues through evidence collection and reporting. Match tasks to competence, provide direction on difficult judgments, and review work early enough to correct a flawed population or test. A reviewer should check whether procedures answer the objective, whether evidence is relevant and sufficient, and whether conclusions follow from results. Review notes need resolution, with changes traceable in the workpapers. Supervisors also monitor timing, coordinate specialists, and give feedback that improves future work. Their review does not transfer responsibility for accurate documentation away from the auditor who performed the test. If evidence is inadequate, extend or redesign procedures before communicating a firm conclusion; polished wording cannot repair a weak test.

Worked example: A staff auditor samples 25 sales approvals from a weekday report and finds one exception. The supervisor discovers that the report excludes weekend sales, which represent 18% of annual transactions. The team obtains the complete population, selects a revised sample across all days, and retests. The original one-in-25 result cannot support a conclusion about all sales.

Watch the distinction: Reviewing only the final report is too late to fix a biased sample efficiently. Supervision must challenge populations, procedures, and evidence while the engagement is underway.

Reference: [2]

40. Communicating during fieldwork

Match communication to the decision and urgency. Routine progress can be handled through scheduled discussions; a disputed fact calls for a documented exchange of records and criteria. A serious active exposure may require prompt notice to the responsible manager and audit leadership before the final report. Separate verified facts from preliminary indications, identify who can contain the risk, and protect sensitive information. Record significant conversations, decisions, and follow-up so the engagement trail is clear. Escalation should follow the organization's governance path when a responsible party cannot or will not address a material concern. Early communication gives management a chance to act, while later verification ensures the final result accurately describes what happened and any corrective action already taken.

Worked example: An auditor finds that a departed administrator's account is still active and has privileged access. HR confirms the departure date; the access system confirms the account status. The auditor promptly informs the access owner and audit leadership, requests containment, and preserves the records. Subsequent log review determines whether the account was used before the final finding is written.

Watch the distinction: Waiting for the final report can leave an active exposure open. Equally, an urgent notice should distinguish confirmed access from unverified claims that the account was misused.

Reference: [2]

Part 3: Internal Audit Operations

41. Setting internal audit strategy

An internal audit strategy translates the function's mandate into the capabilities and services it will need over time. Start with the organization's objectives and how management expects to manage the risks to them. Then compare those needs with stakeholder expectations, the audit universe, available skills and the function's independence. A mission states the function's purpose; a vision describes the capability it aims to build. The strategy should guide recruitment, training, technology and the balance of assurance and advisory work. It should also identify which important exposures require coverage during the transition. Revisit it when the business model, risk profile or stakeholder needs change materially. The Part 3 syllabus identifies strategy alignment as a function management topic; the practical decision is how to turn that alignment into credible coverage.

Worked example: A retailer launches online payments. Its chief audit executive identifies payment security and settlement accuracy as new coverage needs. The team trains two auditors, recruits payments expertise and plans a specialist review. It retains a scheduled inventory audit because shrinkage remains significant. The revised strategy links both areas to business risks and states when the new capability will be available.

Watch the distinction: Treating strategy as a list of next year's engagements misses its purpose. The strategy also determines what services the function can deliver and which skills and resources it must develop.

Reference: [3]

42. Managing methods and providers

Consistent methods help separate a genuine difference in risk from a difference in how teams work. The chief audit executive sets methods for planning, evidence, supervision and reporting, then monitors whether teams apply them and revises them when circumstances expose weaknesses. An external provider can supply specialist knowledge or capacity, but the function must direct the assignment: define the objective and criteria, agree on access and deliverables, assess the provider's competence and objectivity, and review the evidence behind its conclusions. Decide in advance who will resolve disputed results and protect information. A provider's report may support an engagement conclusion only to the extent its scope, methods and evidence support that conclusion. Responsibility for the internal audit service remains with the function, including how the specialist's work is communicated.

Worked example: An encryption specialist tests a payment platform. Internal audit specifies that the review must cover stored data and key access, checks the specialist's independence, and obtains test records rather than a summary alone. The records support a conclusion about the tested platform, while an untested backup environment remains outside it. The audit team reports that boundary.

Watch the distinction: Hiring an expert does not transfer accountability for the engagement. Forwarding the expert's conclusion without checking scope and evidence may leave a material gap hidden.

Reference: [3]

43. Budgeting the function

Build the budget from the work required to deliver the risk-based plan. Estimate engagement and supervision hours, then add time for planning, reporting, follow-up, quality work and staff development. Convert hours into realistic capacity after leave and other commitments. Price specialist support, travel, data access and technology separately, because staff hours cannot replace every missing skill or tool. Compare the required resources with available funding and capacity. Where there is a gap, explain which engagements will be delayed, narrowed or removed and what risk coverage is lost. A budget variance can also indicate that the plan or its assumptions need revision. Communicating a material limitation gives the board a basis to decide whether to provide resources or accept the proposed coverage change; the arithmetic alone does not make that decision.

Worked example: Assume a proposed plan needs 4,000 staff hours, including supervision and reporting, and realistic capacity is 3,200 hours. The shortfall is 4,000 − 3,200 = 800 hours, or 20% of planned effort. The chief audit executive proposes additional capacity or identifies 800 hours of work to defer, showing which risks would then lack planned coverage.

Watch the distinction: Using paid hours as audit capacity overstates what the team can deliver. Leave, supervision, quality work and development consume time that cannot also be assigned to engagements.

Reference: [3]

44. Developing people and tools

A skills inventory should match the risks and methods in the audit plan, not merely record job titles. For each engagement, identify the judgment, technical knowledge and supervision needed; then decide whether to assign trained staff, develop capability, recruit or obtain specialist support. Training is useful when the need will recur and there is time to develop competence. An immediate, complex review may require qualified outside help while staff learn alongside the specialist. Coaching, feedback and workable job design help retain capability. Technology choices follow the same logic: select tools that improve evidence collection, analysis or documentation, and assess access controls, data handling, reproducibility and user competence. A powerful analytic tool adds little if the team cannot validate its input data or explain its output.

Worked example: A function has experienced financial auditors but must review a new cloud platform next quarter. The chief audit executive assigns a qualified cloud specialist to the immediate work, pairs an auditor with that specialist and funds training for later reviews. A proposed log analysis tool is tested for complete data extraction and restricted access before the team relies on its alerts.

Watch the distinction: A short course does not automatically make an auditor competent for a specialized engagement. Match the immediate assignment to demonstrated skill while developing longer-term capability.

Reference: [3]

45. Reporting to the board

The board needs a view of whether internal audit can fulfill its mandate and what its work says about significant risks. The chief audit executive therefore communicates the plan and material changes, resource or access limits, independence concerns, important exposures, quality results and themes across engagements. A theme is supported by a recurring cause or weakness, not simply by counting findings. Explain its scope, the evidence across activities, its possible organization-wide effect and management's response. Timely informal contact can alert leaders to an urgent matter, while formal reporting preserves a clear record and supports oversight. Tailor detail to the board's decisions: which risk remains, who owns it, whether the response is credible and what support the function needs. Keep the distinction between management's risk ownership and internal audit's independent assessment.

Worked example: Three reviews find that former contractors retain access in separate systems. The chief audit executive compares the underlying handoffs and finds each relies on late departure notices. The board report identifies the common process weakness, affected systems, residual exposure and management's coordinated action. It also explains why the annual plan now includes a broader identity review.

Watch the distinction: Sending the board three isolated reports may conceal a shared cause. Aggregate supported patterns, while preserving differences in scope and evidence between engagements.

Reference: [3]

Part 3: Internal Audit Plan

46. Building the audit universe

The audit universe is an organized inventory of activities that could be audited. It can include entities, processes, programs, systems, projects and third-party arrangements, with relationships between them made visible. Build it from organizational structure, strategy, risk information, mandates, past work and discussions with the board and management. Include changes such as acquisitions and new technology, and identify whether a relevant Topical Requirement affects planned coverage. An item in the universe is a candidate for assessment, not a promise to audit it every year. Set boundaries so items are neither so broad that risks disappear nor so narrow that the list becomes unmanageable. Record ownership, objectives, important dependencies and available assurance. This structure lets the function assess risk consistently and spot activities that an inherited audit calendar overlooks.

Worked example: After an acquisition, a subsidiary continues using its own payroll platform. The chief audit executive adds the subsidiary, platform and payroll integration process to the universe, linking them to employee data and financial reporting. Last year's list covered only the parent's payroll. The revised universe exposes a coverage gap; a risk assessment determines when and how to review it.

Watch the distinction: A prior year's engagement list is not a complete audit universe. It omits activities that were never selected and can miss new entities, systems and dependencies.

Reference: [3]

47. Making a dynamic risk-based plan

A risk-based plan selects work from the audit universe using a consistent assessment of impact, likelihood, change, control strength and the assurance already available. Scores can help compare candidates, but the chief audit executive must examine what each score represents; a simple product can hide a rare, severe exposure or unreliable control information. Consider board and management requests, applicable mandates and Topical Requirements, and how proposed work supports organizational and internal audit strategies. Document important work left uncovered. The plan is dynamic: an acquisition, incident, new product, weak control or major delay may change priorities. Reassess the affected activities, compare the benefit of new work with what would be displaced, and communicate material plan changes through the established board and management process. The Part 3 study guide provides related practice on function-level decisions.

Worked example: A new customer-data product goes live after the plan is approved. On a hypothetical five-point scale, its impact is 5 and likelihood 4, giving 20; a planned low-risk review scores 2 × 2 = 4. After checking existing controls and other assurance, the chief audit executive proposes moving the product review forward and explains the displaced coverage.

Watch the distinction: An approved plan is not frozen. Keeping its original order after a material change can leave the most significant current risk unexamined.

Reference: [3]

48. Coordinating assurance coverage

An assurance map shows which risks and controls are examined by management monitoring, compliance, risk functions, external auditors and internal audit. It helps reveal duplication and gaps, but a provider's work is useful only for the objective it actually addressed. Before relying on it, assess the provider's competence, objectivity, scope, timing, testing method, evidence quality and findings. A review of policy design, for example, cannot establish that transactions complied with the policy. Internal audit may use another provider's risk assessment to plan work, test a portion of its results or rely on suitable procedures where evidence is strong. Document the extent of reliance and remaining work. Coordination can reduce unnecessary testing, but the internal audit function still needs sufficient evidence for its own conclusion and should avoid assuming that similarly named reviews cover the same assertion.

Worked example: Compliance reports that sanctions screening is satisfactory, but its work inspected policy wording only. Internal audit's objective is to assess whether transactions were screened and exceptions resolved. It uses the policy review as context, then tests screening logs and selected transactions. The separate procedures answer different questions, so the compliance report cannot replace transaction evidence.

Watch the distinction: A favorable report from another assurance provider is not automatically evidence for your objective. Read its scope and procedures before reducing internal audit testing.

Reference: [3]

Part 3: Quality of the Internal Audit Function

49. Assessing function quality

A quality assurance and improvement program asks whether the function conforms to the Global Internal Audit Standards, meets stakeholder needs and improves its work. Ongoing monitoring is built into routine operations, such as supervision, workpaper review and performance analysis. Periodic self-assessment steps back to examine patterns across engagements and the function's methods. An external assessment adds a suitably qualified, independent perspective on the function as a whole. Each level should produce evidence, findings, an action owner and a way to verify improvement. Consider applicable Topical Requirements when assessing relevant work. The chief audit executive communicates quality results and remediation to the board. A file defect can be local, or it can signal a method, training or supervision problem; looking across files helps distinguish those explanations.

Worked example: Routine reviews find missing links from findings to supporting records in four files. A periodic self-assessment confirms the issue across teams and traces it to unclear workpaper guidance. The function revises its template and coaches reviewers. Later file reviews check whether conclusions can now be traced to evidence; the initial revision alone does not prove improvement.

Watch the distinction: Counting completed file reviews is not the same as assessing quality. Examine what reviewers found, whether causes were addressed and whether later work improved.

Reference: [3]

50. Disclosing nonconformance

A departure from the Global Internal Audit Standards requires analysis of its cause and effect, not just a label. Identify the requirement, what happened, which engagements or function activities were affected, and whether conclusions, independence or stakeholder decisions may have been compromised. Determine why the departure occurred and what immediate safeguards and lasting corrections are needed. Communicate the circumstances, rationale, impact and actions to the appropriate senior management and board recipients. The seriousness of the communication should match the significance of the effect; an omitted review affecting several conclusions deserves attention beyond a minor documentation correction. Reassess affected work if its evidential basis is uncertain. Be precise about what has been remediated and what remains open, because a future process change does not repair an unsupported past conclusion by itself.

Worked example: An independent review was omitted from three engagements. The chief audit executive checks whether the findings and conclusions have sufficient evidence, arranges qualified review of the affected files and corrects any unsupported report. The board and senior management receive the cause, potential impact and remediation status. A new review checklist addresses future work but does not substitute for examining the three files.

Watch the distinction: Disclosing a departure without assessing its effect leaves stakeholders unable to judge the results. A procedural fix for future engagements may also leave earlier conclusions unresolved.

Reference: [3]

51. Measuring audit function performance

Performance measures should answer whether the function delivers its plan, maintains quality, uses resources well and helps stakeholders act on risk. Define each measure's numerator, denominator, period and target before reporting it. Quantitative measures include completed engagements, cycle time, plan coverage and budget variance. Qualitative evidence includes file review results, stakeholder feedback and whether reports support decisions. Read measures together: faster reports may reflect better methods or weaker review, and a high completion rate may hide skipped high-risk work. Targets should be meaningful for the function's capacity and purpose, then adjusted when the plan changes substantially. Explain the reasons for a variance and the action taken. A scorecard is most useful when it prompts decisions about staffing, methods and coverage rather than rewarding an attractive number.

Worked example: The team completes 18 of 20 planned reviews, so delivery is 18 ÷ 20 = 90% for that plan. Two high-risk reviews remain unfinished, while file reviews show strong evidence quality on completed work. The chief audit executive reports both facts and the reasons for delay. The 90% figure alone cannot establish whether risk coverage was adequate.

Watch the distinction: A single productivity percentage cannot stand in for function effectiveness. It says little about the importance, quality or usefulness of the work completed.

Reference: [3]

Part 3: Engagement Results and Monitoring

52. Writing useful results

Useful results let a reader see what was tested, what was found, why it matters and what action follows. Accuracy requires matching each statement to evidence; objectivity requires fair treatment of contrary facts. Clear, concise language identifies the condition and criteria without burying the decision in detail. Completeness includes material scope limits, uncertainty and management's response. Constructive wording focuses on the control problem and feasible improvement rather than blame. Timeliness matters because a sound finding delivered after the risk changes may lose value. When reporting a sample rate, name the sample and period, distinguish observed exceptions from a population estimate, and investigate their cause and effect before assigning significance. State conclusions at the level the evidence supports. A finding about tested payments does not prove every vendor control failed.

Worked example: A draft claims all vendor controls failed. Testing actually found seven missing approvals among 50 selected payments: 7 ÷ 50 = 14% of that sample. The revised result names the approval requirement, period, selection method and exceptions. It explains the potential unauthorized-payment exposure without claiming a 14% rate across all payments unless the sampling design supports that inference.

Watch the distinction: Strong wording cannot compensate for weak scope. Generalizing a sample exception to every control or every transaction makes an otherwise valid finding less reliable.

Reference: [3]

53. Completing the final report

A final engagement communication connects the objective to the work performed and the conclusion reached. It identifies the scope and period, significant findings, the conclusion, recommendations or agreed management actions, and who is responsible for action. The conclusion should reflect the evidence for each objective and account for material qualifications. A scope restriction is especially important when unavailable records, denied access or an excluded location could change the overall judgment. Describe what was omitted, why it matters and how the conclusion is limited; do not silently treat the untested area as satisfactory. Management's response can clarify planned action, but it does not alter the observed condition without evidence. Use language about conformance with the Global Internal Audit Standards only when the function has a basis for that statement under its quality program.

Worked example: A review covers three regions, but the team cannot obtain records for a fourth region that represents a substantial share of sales. The final report states the objective, tested period, three covered regions and the records unavailable for the fourth. Its conclusion addresses only the tested regions and explains that the restriction prevents an organization-wide conclusion.

Watch the distinction: Putting a limitation in a footnote while making a broad conclusion misleads readers. The conclusion itself must reflect the evidence that was unavailable.

Reference: [3]

54. Choosing corrective action

Corrective action should remove or reduce the cause of a finding to an acceptable level. Start by separating the condition from the cause: late account removal is the condition; delayed notice from human resources may be the cause. Check that explanation against records and people involved before recommending a fix. Then compare possible actions for effectiveness, feasibility, ownership, timing and cost relative to the risk. Management may propose its own plan or agree on one with internal audit, but it owns the decision and implementation. An action that only repeats testing, reminds staff or clears old exceptions may improve detection while leaving the source of new failures intact. Specify what evidence will demonstrate implementation and operation, such as a working system trigger and later transaction results.

Worked example: Ten departed employees kept access after their departure dates. Record review shows HR notices reached IT days late. Management proposes retesting the ten accounts, which would confirm cleanup but leave the handoff unchanged. A stronger plan sends departure events directly to the access system, assigns an exception owner and tests later departures to show the trigger works.

Watch the distinction: A recommendation that fixes existing exceptions may leave the next batch exposed. Judge the proposed action against the verified cause and remaining risk.

Reference: [3]

55. Closing and distributing results

A closing discussion gives the people responsible for an activity a chance to verify facts, explain causes, discuss risk and commit to action before final communication. It is a quality check, not a negotiation to remove supported findings. Resolve factual disputes against source evidence and document significant disagreements that remain. The chief audit executive ensures the final result reaches recipients who need it for action or oversight, with information shared according to its sensitivity and their roles. If a significant error or omission is discovered after distribution, assess its effect, correct the communication promptly and send the correction to the recipients of the original result. A finding already resolved before the report may still be relevant if its earlier effect or root cause matters; clearly state its current status.

Worked example: At the closing meeting, management shows that one access exception used the wrong departure date. The auditor checks the personnel record, removes that unsupported exception and recalculates the finding before final issue. If the mistake is found after issue, the chief audit executive sends a corrected communication to the original recipients and explains any changed conclusion.

Watch the distinction: Accepting a verbal correction without checking the record weakens the report. Equally, leaving a known material error in a distributed report can misdirect decisions.

Reference: [3]

56. Assessing residual engagement risk

Residual risk is the exposure remaining after existing controls are considered. Assess whether each control is designed to address the relevant failure and whether evidence shows it operated during the period. A control with sound design but repeated missed execution may offer little dependable reduction. Aggregate related findings by asking whether weaknesses share a cause, affect the same objective or remove independent layers of protection. Multiple failures can compound exposure: if approval fails before payment and reconciliation fails afterward, both prevention and detection are weakened. An overall rating should follow the function's defined scale and explain the judgment behind it, including severity, breadth, control dependence and compensating controls. Avoid simply averaging finding ratings, because a single severe weakness or connected failures may dominate the engagement conclusion.

Worked example: In a high-value payment process, sampled transactions lack required approval and monthly reconciliations are incomplete. Approval should prevent unauthorized payment; reconciliation should detect it afterward. With both controls unreliable, the remaining exposure is greater than either finding viewed alone. The chief audit executive assesses the combined risk and explains the overall rating using the function's criteria.

Watch the distinction: Counting two findings as two separate minor issues can miss their interaction. Consider whether one failed control was supposed to compensate for the other.

Reference: [3]

57. Escalating risk acceptance

Management may decide to accept residual risk, but internal audit must assess whether that acceptance could exceed the organization's stated appetite or tolerance. First verify the exposure estimate, the effectiveness of existing controls and the applicable criterion; an uncertain estimate should be described as such. Discuss the concern with management, including its rationale and any alternative response. If the chief audit executive concludes that management has accepted risk that may be unacceptable and the matter remains unresolved, communicate it to the board through the appropriate process. Internal audit informs and escalates; it does not take ownership of the operational risk or make management's decision. Distinguish a management decision to delay action from evidence that the risk is acceptable. The Part 3 CIA syllabus identifies this communication sequence as a study topic.

Worked example: Suppose a documented risk estimate is $600,000 of potential loss and the relevant hypothetical tolerance is $250,000. The excess is $600,000 − $250,000 = $350,000. Management accepts the exposure without further action. The chief audit executive checks the estimate and criterion, discusses management's reasons, then informs the board if the apparent excess remains unresolved.

Watch the distinction: Management's signature on an action plan or risk register does not settle acceptability. Compare the remaining exposure with organizational criteria and escalate unresolved concerns.

Reference: [3]

58. Tracking promised actions

An action tracker preserves the link from each finding to the response management promised. Record the agreed action, accountable owner, original due date, evidence expected, current status, revised dates and reason for change. Follow-up frequency should reflect the significance of the remaining risk and how quickly circumstances may change. A status update is useful but does not prove completion; record management's claim separately from internal audit's verification. Keep the original commitment visible when dates move so repeated delays do not disappear into a refreshed schedule. Analyze whether an overdue action leaves material risk exposed, and report that fact to the appropriate management and board recipients. A tracker should also flag actions that no longer address the root cause because the process or system changed.

Worked example: An access-control fix was due June 30. In August, management reports it is still in progress and proposes September 30. The tracker retains June 30, records the revised date, owner and reason, and marks verification pending. Internal audit assesses whether access remains exposed during the three-month delay and raises the overdue action according to its significance.

Watch the distinction: Replacing the original due date with the latest promise erases evidence of delay. Preserve the history and assess the risk while the action remains unfinished.

Reference: [3]

59. Confirming implementation

Confirmation asks whether the promised change exists and works, not merely whether management says it is complete. Review the action against the original cause and agreed outcome. Inspect configuration or procedure changes, determine when they took effect, and test later activity from the relevant population. Choose enough evidence for the risk and control frequency; a screenshot may show a setting but cannot prove that users cannot bypass it. If the fix is partial, document what works, what fails and the residual exposure. Some actions need time to generate operating evidence, so a status of installed but not yet verified may be more accurate than closed. Keep management responsible for operating the control, while internal audit independently confirms implementation using evidence it can trace and reproduce.

Worked example: Management says a new payment approval rule is active. Internal audit checks its configuration and tests ten payments processed after activation. Two reached payment without approval, so the observed bypass rate is 2 ÷ 10 = 20% of the tested items. The rule exists, but its operation is not confirmed; the team investigates the bypass route before closing the action.

Watch the distinction: A completed project ticket proves that someone recorded completion, not that the control works. Test activity after the change and investigate exceptions before closure.

Reference: [3]

60. Escalating unresolved actions

When an agreed action remains incomplete, assess the risk that remains rather than escalating lateness as an administrative issue alone. Verify current conditions, whether compensating controls exist, how long exposure has persisted and whether the original risk assessment still fits. Discuss the failure and a realistic response with the responsible manager, then raise significant unresolved exposure through senior management and, when appropriate, the board. Explain the history of commitments, management's rationale, current risk and decisions needed. If management elects to accept risk that may exceed organizational criteria, apply the risk acceptance communication sequence as well. Internal audit should keep tracking the action or revised response until it has sufficient evidence to confirm implementation or has clearly communicated the unresolved risk.

Worked example: A privileged-access fix misses two agreed deadlines. Internal audit verifies that former administrators can still sign in and that no effective compensating review operates. It discusses an immediate restriction and revised plan with management, records the remaining exposure, and escalates the unresolved high-risk condition through senior management to the board as appropriate. The item stays open pending evidence of a working fix.

Watch the distinction: Closing an overdue action because leaders know about it confuses communication with remediation. Track the remaining risk until implementation is verified or risk acceptance is addressed.

Reference: [3]

Official references and further reading

All study guides

Choose your exam version

CIA Part 1

CIA Part 2

CIA Part 3

Part 1: Foundations of Internal Auditing

1. Why internal audit exists

2. The mandate and its owners

3. Putting authority in a charter

4. Choosing assurance or advice

5. Matching assurance to the risk

6. Advising without owning controls

7. Independence and the Three Lines

Part 1: Ethics and Professionalism

8. Integrity under pressure

9. Recognizing objectivity threats

10. Competence and due care

11. Protecting information

Part 1: Governance, Risk Management, and Control

12. Governance, culture and accountability

13. Classifying and measuring risk

14. Appetite, tolerance and response

15. Testing risk management as a process

16. Selecting a control type

17. Design, operation and efficiency

Part 1: Fraud Risks

18. Fraud schemes and opportunity

19. Planning for fraud exposure

20. Responding to fraud indicators

Part 2: Engagement Planning

21. Defining the engagement

22. Choosing evaluation criteria

23. Prioritizing engagement risks

24. Reading business process risks

25. Cybersecurity and privacy in scope

26. Continuity and recovery readiness

27. Choosing an engagement approach

28. Testing control design

29. Testing operation and efficiency

30. Resourcing and revising the plan

Part 2: Information Gathering, Analysis, and Evaluation

31. Gathering information deliberately

32. Judging evidence quality

33. Mapping the real workflow

34. Preparing data for analysis

35. Selecting an analytic method

36. Explaining variances and ratios

37. Building a supported finding

38. From workpapers to conclusion

Part 2: Engagement Supervision and Communication

39. Supervising the engagement

40. Communicating during fieldwork

Part 3: Internal Audit Operations

41. Setting internal audit strategy

42. Managing methods and providers

43. Budgeting the function

44. Developing people and tools

45. Reporting to the board

Part 3: Internal Audit Plan

46. Building the audit universe

47. Making a dynamic risk-based plan

48. Coordinating assurance coverage

Part 3: Quality of the Internal Audit Function

49. Assessing function quality

50. Disclosing nonconformance

51. Measuring audit function performance

Part 3: Engagement Results and Monitoring

52. Writing useful results

53. Completing the final report

54. Choosing corrective action

55. Closing and distributing results

56. Assessing residual engagement risk

57. Escalating risk acceptance

58. Tracking promised actions

59. Confirming implementation

60. Escalating unresolved actions

Official references and further reading

Frequently Asked Questions

Related Study Guides

Certified Bank Auditor (CBA)

Certified Information Systems Auditor (CISA)