Certified Internal Auditor (CIA) Managing the Internal Audit Activity (Part 2) Syllabus

Managing the Internal Audit Activity (Part 2) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Managing the Internal Audit Activity (Part 2) in Certified Internal Auditor (CIA), not a summary of it.

1. 1

   Managing the Internal Audit Function

   3 topics

   • The Chief Audit Executive Role
     • Strategic leadership and resource oversight
     • Communication with the board and senior management
   • Internal Audit Strategy and Operating Model
     • Alignment with organizational objectives
     • In-house, co-sourced, and outsourced models
   • Policies, Procedures, and People
     • Audit methodology and manuals
     • Staffing, performance, and development
2. 2

   Risk-Based Audit Planning

   4 topics

   • The Audit Universe
     • Identifying auditable entities
     • Mapping to organizational risks
   • Annual Audit Plan
     • Risk-based prioritization
     • Board and management input
   • Resource Management
     • Budgeting and staffing the plan
     • Skills gap analysis
   • Coordination with Assurance Providers
     • Reliance on the work of others
     • Combined assurance
3. 3

   Communicating and Monitoring

   3 topics

   • Reporting to the Board and Senior Management
     • Periodic activity reporting
     • Resource and performance communications
   • Overall Assurance and Opinions
     • Macro-level opinions
     • Communicating significant risk exposures
   • Performance Metrics for Internal Audit
     • Stakeholder satisfaction measures
     • Efficiency and effectiveness indicators

Managing the Internal Audit Activity (Part 2) flashcards for Certified Internal Auditor (CIA)

24 of 51 cards from the Managing the Internal Audit Activity (Part 2) deck — real questions with worked answers.

1. What is the Chief Audit Executive (CAE) responsible for, per IIA Standards?

   The CAE is responsible for effectively managing the internal audit activity to ensure it adds value to the organization, including overseeing its strategy, resources, audit plan, conformance with Standards, and reporting results to the board and senior management.

2. To whom should the CAE report functionally and administratively for organizational independence?

   Functionally to the board (which approves the charter, plan, budget, and CAE appointment/removal/compensation), and administratively to senior management (typically the CEO) for day-to-day operations.

3. What is the difference between functional and administrative reporting for the CAE?

   Functional reporting (to the board) safeguards independence by overseeing audit's mandate and CAE decisions; administrative reporting (to senior management) handles operational support such as budgeting, HR, and internal communications.

4. What must the CAE do if resources are insufficient to execute the audit plan?

   The CAE must communicate the impact of resource limitations to senior management and the board so they can accept the residual risk or provide additional resources.

5. What is an internal audit strategy?

   A high-level plan that aligns the internal audit activity's vision, mission, and objectives with the organization's strategic goals and stakeholder expectations, guiding how audit delivers value over the long term.

6. What is an internal audit operating model?

   The structure and approach defining how the internal audit function is organized and delivers services—covering sourcing, talent, technology, methodology, governance, and how work is performed and reported.

7. List common internal audit sourcing models.

   In-house (fully internal staff), outsourcing (fully external provider), and co-sourcing (a blend of internal staff supplemented by external specialists).

8. What is co-sourcing in internal audit, and when is it used?

   Co-sourcing supplements in-house staff with external specialists; it is used to obtain skills the team lacks (e.g., IT, fraud, data analytics), handle capacity peaks, or provide independent expertise while retaining internal control.

9. What is the purpose of internal audit policies and procedures?

   They guide consistent, quality execution of audit work; the form and content depend on the size, structure, and complexity of the audit activity (smaller activities may rely on informal means).

10. What elements should an internal audit charter contain?

    The purpose, authority, and responsibility of the activity; the nature of assurance and consulting services; functional reporting line to the board; and access to records, personnel, and property relevant to engagements.

11. Who approves the internal audit charter?

    The CAE develops it, but it must be approved by senior management and the board, and periodically reviewed and presented to them.

12. What is the audit universe?

    The collection of all auditable units, entities, processes, systems, or activities within the organization that could potentially be subject to an audit.

13. How is the audit universe typically developed?

    By identifying all auditable areas (by business unit, process, location, system, or risk) and linking them to the organization's objectives and risks, often using organizational charts, strategic plans, and the risk register.

14. What is the relationship between the audit universe and the annual audit plan?

    The audit universe is the full population of auditable areas; the annual audit plan is a risk-prioritized subset selected from the universe to be audited within the period.

15. On what basis must the internal audit plan be established (Standard 2010)?

    On a documented, risk-based assessment, performed at least annually, that incorporates input from senior management and the board and aligns with the organization's goals.

16. What factors are considered when prioritizing engagements in the annual audit plan?

    Risk significance (impact and likelihood), strategic importance, prior audit results, time since last audit, regulatory/compliance requirements, management requests, and emerging risks.

17. How often must the CAE review and adjust the audit plan?

    The plan should be reviewed and adjusted as necessary in response to changes in the organization's business, risks, operations, programs, systems, and controls—not just annually.

18. What is risk-based auditing?

    An approach that allocates audit resources and selects engagements based on the assessed level of risk, focusing effort on areas of greatest significance to organizational objectives.

19. What must the CAE communicate about the audit plan to the board?

    The CAE must communicate the plan and resource requirements (including significant interim changes) to senior management and the board for review and approval, and report the impact of resource limitations.

20. What does internal audit resource management involve (Standard 2030)?

    Ensuring internal audit resources are appropriate (skills/knowledge), sufficient (quantity), and effectively deployed to achieve the approved plan.

21. Distinguish 'appropriate,' 'sufficient,' and 'effectively deployed' resources.

    Appropriate = the right mix of knowledge, skills, and competencies; Sufficient = enough quantity to accomplish the plan; Effectively deployed = used in a way that optimizes achievement of the approved plan.

22. What is a competency framework (skills matrix) used for in internal audit?

    To identify the skills and knowledge the audit team possesses versus those needed for the plan, revealing gaps to address through hiring, training, or co-sourcing.

23. How can a CAE address a competency gap in the audit team?

    Through recruitment, training and professional development, rotational/guest auditor programs, or co-sourcing/outsourcing to external specialists.

24. What is the purpose of coordinating with other assurance providers (Standard 2050)?

    To ensure proper coverage and minimize duplication of effort by sharing information and coordinating activities with internal and external assurance and consulting providers.

See more Managing the Internal Audit Activity (Part 2) flashcards →

Planning Managing the Internal Audit Activity (Part 2) for Certified Internal Auditor (CIA)

Managing the Internal Audit Activity (Part 2) (Certified Internal Auditor (CIA)) FAQ