Certified Internal Auditor (CIA) Foundations of Internal Auditing (Part 1) Syllabus

How is organizational independence of the internal audit function best supported through reporting lines?

Through a dual reporting relationship: the CAE reports functionally to the board (for direction, oversight, and protection) and administratively to senior management (e.g., the CEO) for day-to-day operations.

Name key functional oversight responsibilities the board holds over the CAE.

Approving the audit charter, the audit plan, and the budget/resource plan; approving CAE appointment, removal, and compensation; receiving communications on results; and making appropriate inquiries of management and the CAE.

What is individual objectivity in internal auditing?

An unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and make no quality compromises. It requires auditors not to subordinate their judgment to others.

What is the difference between independence and objectivity?

Independence is freedom from conditions that threaten the ability of the audit function (organizational level) to act without bias; objectivity is the unbiased mental attitude of the individual auditor. Independence supports objectivity but is at the function level.

What is an impairment to independence or objectivity, and what must be done?

An impairment includes personal conflicts of interest, scope limitations, restricted access, or resource limitations. If impaired in fact or appearance, the details must be disclosed to appropriate parties (e.g., the board).

If an auditor previously had operational responsibility for an area, when can they provide assurance on it?

Objectivity is presumed impaired if an auditor provides assurance for an activity for which they had responsibility within the previous year. Such engagements should be overseen by someone outside the audit activity / the impairment disclosed.

What is a safeguard the CAE uses when the CAE's own independence or objectivity may be impaired?

The CAE discloses the impairment to the board and may have the board oversee the engagement or assign it to a party outside the internal audit function (e.g., external auditors or another independent party).

What practice safeguards objectivity by avoiding long-term familiarity with one area?

Periodic rotation of audit staff assignments, so auditors are not assigned to the same area indefinitely, reducing familiarity threats.

How should gifts or favors from auditees be handled to protect objectivity?

Auditors should not accept anything that may impair, or be presumed to impair, their professional judgment. Tokens of nominal value within organizational policy may be acceptable, but significant gifts must be declined or disclosed.

When internal auditors perform consulting (advisory) engagements, how is objectivity maintained?

Auditors must maintain objectivity and should not assume management responsibility. If objectivity may be impaired, it must be disclosed to the engagement client before accepting the engagement.

What is the key restriction on internal auditors taking on operational (non-audit) roles?

Internal auditors should not assume management responsibility or design, install, or operate systems/controls, because doing so impairs objectivity for any future assurance work on those activities.

If internal audit is asked to take on a non-audit role (e.g., interim management), what safeguards apply?

The CAE should disclose the impairment to the board, obtain approval, recognize that objectivity for that area is impaired, and arrange for any related assurance to be performed by an independent party..

How does knowledge gained in consulting engagements relate to assurance work?

Knowledge gained during consulting engagements should be considered when forming assurance opinions and evaluating the organization's risk management and control processes, but the auditor must remain objective.

Define 'proficiency' for internal auditors.

Proficiency is the collective knowledge, skills, and competencies (abilities) required to fulfill internal audit responsibilities effectively. Auditors must possess, or obtain, the proficiency needed to perform their work.

If the internal audit function lacks the proficiency needed for an engagement, what must the CAE do?

The CAE must obtain competent advice and assistance—either by developing staff, hiring, or sourcing external service providers (co-sourcing/outsourcing) who have the needed competencies.

What is the IIA's globally recognized certification demonstrating internal audit proficiency?

The Certified Internal Auditor (CIA) designation.

What knowledge must internal auditors have regarding fraud?

Auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.

Define 'due professional care' for internal auditors.

The care and skill expected of a reasonably prudent and competent internal auditor. It does not imply infallibility; it requires applying reasonable care and skill, not extraordinary performance.

What factors should an auditor consider in exercising due professional care during an assurance engagement?

The extent of work needed to achieve objectives; relative complexity, materiality, or significance of matters; adequacy and effectiveness of governance, risk management, and control; probability of significant errors, fraud, or noncompliance; and the cost of assurance relative to benefits.

How does due professional care apply to consulting engagements specifically?

The auditor should consider the needs and expectations of clients (nature, timing, and communication of results); the relative complexity and extent of work needed; and the cost of the engagement relative to potential benefits.

Does due professional care require detecting all risks or wrongdoing?

No. Due professional care requires alertness to significant risks but does not guarantee that all significant risks, fraud, errors, or irregularities will be identified.

What must auditors apply during engagements alongside due professional care regarding technology?

They should consider the use of technology-based audit and data analysis techniques and other tools to perform work efficiently and effectively.

Define 'continuing professional development' (CPD/CPE) for internal auditors.

The ongoing requirement for internal auditors to enhance their knowledge, skills, and competencies through continuing professional development and education to remain proficient.

Who is responsible for maintaining and developing the proficiency of the internal audit function?

The chief audit executive is responsible for ensuring the function collectively possesses the competencies needed and that individual auditors pursue continuing professional development.

What is a competency framework, as used by an internal audit function?

A structured model (such as the IIA's Internal Audit Competency Framework) that defines the knowledge, skills, and behaviors auditors need, used for assessing competencies, planning development, and recruiting.

What is a Quality Assurance and Improvement Program (QAIP)?

A program that enables an evaluation of the internal audit function's conformance with the Global Internal Audit Standards and an assessment of whether internal auditors apply the Code of Ethics/Ethical Principles. It also assesses efficiency and effectiveness and identifies improvement opportunities.

What are the two components of a QAIP?

Internal assessments and external assessments.

What do internal assessments within a QAIP consist of?

(1) Ongoing monitoring of the performance of the internal audit function, and (2) periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices.

How often must an external assessment be conducted, and by whom?

At least once every five years, by a qualified, independent assessor or assessment team from outside the organization.

What are the two acceptable forms of an external assessment?

(1) A full external assessment conducted by an independent external assessor/team, or (2) a self-assessment with independent external validation (SAIV).

When may the CAE state that the internal audit function 'conforms with the Global Internal Audit Standards'?

Only when the results of the QAIP (both internal and external assessments) support that statement. The CAE communicates the QAIP results, and conformance can only be claimed when assessments demonstrate it.