IIA CIA Course Notes

PART 2A = 50% of Part 2. Engagement planning converts risk into an executable audit. Define objectives and scope from the engagement's purpose and preliminary risk assessment, establish suitable criteria, identify key controls, build a work program that will produce enough evidence, and assign appropriate resources/time while coordinating with stakeholders and other assurance providers.

• Writing detailed test steps before understanding engagement risks.

• Planning order: Purpose → Risks → Objectives → Scope → Criteria/Controls → Work Program → Resources.

PART 3D = 45% of Part 3. Results must be evidence-based, appropriately approved, communicated to the right audience, and followed through to resolution. Management owns corrective action and may accept risk. If the CAE concludes management has accepted a level of risk beyond the organization's appetite/tolerance, the CAE discusses it with senior management and, if unresolved, communicates it to the board—the CAE does not personally resolve the risk.

• Assuming the CAE must personally perform every final report review step.

• Result cycle: Communicate → Action → Monitor → Verify → Close/Escalate.

PART 1A = 35% of Part 1. Internal auditing strengthens an organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, objective assurance, advice, insight, and foresight. For exam scenarios, separate the internal audit mandate, charter, organizational independence, and the nature of assurance versus advisory work.

• Treating the charter and mandate as identical concepts.

• When unsure, ask WHO OWNS the decision. Management owns operations and risk; internal audit assesses and advises.

PART 2B = 40% of Part 2. Fieldwork is about evidence quality and disciplined evaluation. Collect sufficient, reliable, relevant, and useful information; choose testing/sampling/analytics methods that fit the population and risk; compare condition with criteria; distinguish design from operating effectiveness; identify root causes; and document enough work that a knowledgeable reviewer can understand how the conclusion was reached.

• Equating 'more evidence' with 'better evidence.'

• Evidence = S-R-R-U: Sufficient, Reliable, Relevant, Useful.

PART 1C = 30% of Part 1. Separate governance, risk management, and control. The board is accountable for governance and oversight; management owns objectives, operations, and risk; internal audit provides independent assurance and advice. Control questions frequently distinguish design adequacy from operating effectiveness.

• Saying internal audit owns risk because it evaluates risk management.

• Three Lines: management manages; oversight/support challenges; internal audit assures independently.

PART 1B = 20% of Part 1. Ethics and professionalism questions test integrity, objectivity, competency, due professional care, and confidentiality. The best answer protects impartial judgment, discloses impairments, uses competent resources, applies reasonable professional care, and safeguards information without using it for personal benefit.

• Assuming objectivity means merely being polite or 'fair.'

• Ethics question? Protect integrity, disclose impairments, preserve objectivity, and avoid management ownership.

PART 3A = 25% of Part 3. The CAE manages the internal audit function as a professional operation: strategy, methodologies, budget, staffing, technology, service providers, talent, and performance. Resources must be sufficient in quantity and appropriate in capability. If constraints threaten fulfillment of the mandate or plan, the impact must be communicated to senior management and the board.

• Assuming sufficient resources means only headcount.

• Resources = enough people/tools AND the right capability.

PART 1D = 15% of Part 1. Internal audit evaluates fraud risk and the adequacy of prevention/detection controls, applies professional skepticism to red flags, and follows established escalation/investigation protocols. Internal audit is not automatically the organization's fraud investigator or guarantor that all fraud will be detected.

• Treating a red flag as conclusive proof.

• Red flag = investigate appropriately, not accuse.

PART 3B = 15% of Part 3. The internal audit plan is risk-based and dynamic. The CAE assesses organizational strategy, objectives, and risks; considers board/senior-management input and other assurance coverage; proposes a plan and resource requirements; and communicates significant interim changes or limitations for appropriate approval.

• Using last year's plan as the main basis for this year's plan.

• Plan = Objectives + Risks + Coverage + Resources.

PART 3C = 15% of Part 3. A Quality Assurance and Improvement Program (QAIP) covers the entire internal audit function and evaluates both conformance with the Global Internal Audit Standards and performance toward objectives. It combines ongoing monitoring, periodic self-assessment, and an independent external quality assessment at least once every five years.

• Treating QAIP as a once-every-five-years activity.

• QAIP = Ongoing + Periodic + External.

PART 2C = 10% of Part 2. Supervision is continuous quality control over the engagement, not just a final workpaper sign-off. Supervisors guide staff, review evidence and conclusions, resolve issues, and ensure communications remain accurate, objective, clear, concise, constructive, complete, and timely. Management responses should identify accountable owners and realistic action dates.

• Waiting until the end of fieldwork to supervise.

• Supervise early and continuously.