Certified Internal Auditor (CIA) Managing the Internal Audit Activity (Part 2) Syllabus

Distinguish 'appropriate,' 'sufficient,' and 'effectively deployed' resources.

Appropriate = the right mix of knowledge, skills, and competencies; Sufficient = enough quantity to accomplish the plan; Effectively deployed = used in a way that optimizes achievement of the approved plan.

What is a competency framework (skills matrix) used for in internal audit?

To identify the skills and knowledge the audit team possesses versus those needed for the plan, revealing gaps to address through hiring, training, or co-sourcing.

How can a CAE address a competency gap in the audit team?

Through recruitment, training and professional development, rotational/guest auditor programs, or co-sourcing/outsourcing to external specialists.

What is the purpose of coordinating with other assurance providers (Standard 2050)?

To ensure proper coverage and minimize duplication of effort by sharing information and coordinating activities with internal and external assurance and consulting providers.

What are the Three Lines Model's three lines?

First line: operational management that owns and manages risk; Second line: risk and compliance functions that monitor and oversee risk; Third line: internal audit, which provides independent assurance.

How does internal audit's role differ from second-line functions in the Three Lines Model?

Second-line functions (risk, compliance, quality) support and monitor risk management as part of management; internal audit (third line) provides independent and objective assurance and advice on the effectiveness of governance, risk management, and control.

What is reliance/'using the work of others,' and what must the CAE assess before relying on it?

Relying on another assurance provider's work to reduce duplication; the CAE must assess the provider's competence, objectivity, and due professional care, and retain responsibility for conclusions.

How can internal audit coordinate with external auditors?

By sharing audit plans and findings, aligning scope/timing, exchanging working papers where appropriate, and reducing duplicate testing—while internal audit maintains its independence and responsibility.

What is assurance mapping?

A technique that plots all assurance activities across the organization's key risks to identify coverage gaps and overlaps among the various assurance providers.

What must the CAE report periodically to senior management and the board (Standard 2060)?

The internal audit activity's purpose, authority, responsibility, and performance relative to its plan and conformance with the Code of Ethics and Standards, including significant risk and control issues, fraud risks, governance issues, and matters requiring board attention.

How should engagement results be communicated (Standard 2400 series)?

Communications must include objectives, scope, and conclusions/recommendations and action plans; they must be accurate, objective, clear, concise, constructive, complete, and timely.

What should the CAE do when senior management has accepted a level of risk that may be unacceptable to the organization?

The CAE must discuss the matter with senior management; if not resolved, the CAE must communicate the matter to the board.

What is the difference between findings (observations) and recommendations in audit reporting?

A finding/observation describes the condition (with criteria, cause, and effect); a recommendation proposes corrective action to address the cause and remediate the condition.

What are the elements of a complete audit finding?

Criteria (the standard), Condition (the actual state), Cause (why the gap exists), and Effect/Consequence (the impact or risk)—often plus a recommendation.

What is the purpose of follow-up monitoring (Standard 2500)?

The CAE must establish and maintain a process to monitor the disposition of results communicated to management, ensuring corrective actions were effectively implemented or that risk was accepted.

What is an overall opinion in internal auditing?

A professional judgment by the CAE that provides a broad conclusion on the organization's governance, risk management, and/or control processes as a whole, rather than on a single engagement.

What must an overall opinion include (Standard 2450)?

It must take into account strategies/objectives and stakeholder expectations, and be supported by sufficient, reliable, relevant, and useful information; it should state the scope, time period, limitations, and the basis/criteria used.

What is the difference between an engagement-level opinion and an overall (macro) opinion?

An engagement-level opinion (micro) conveys conclusions about a single audit's objectives; an overall/macro opinion aggregates results across many engagements to conclude on governance, risk, and control organization-wide.

What forms can an overall assurance opinion take?

It may be expressed as positive assurance (a high level of confidence, e.g., 'controls are effective'), or as a rated/graded conclusion (e.g., satisfactory/needs improvement/unsatisfactory).

What is the difference between positive and negative (limited) assurance?

Positive (reasonable) assurance expresses a clear opinion based on sufficient evidence ('controls are effective'); negative/limited assurance states only that nothing came to attention indicating a problem—a lower level of assurance.

Why must the CAE consider limitations when issuing an overall opinion?

Because the opinion's reliability depends on scope coverage; the CAE must disclose scope limitations, the period covered, and any areas not examined so users do not over-rely on the conclusion.

What are performance metrics (KPIs) for internal audit used for?

To measure the efficiency and effectiveness of the audit activity, demonstrate value, support continuous improvement, and report performance to the board and senior management.

Give examples of internal audit efficiency (input/process) metrics.

Percentage of plan completed, budget-to-actual hours, audits completed on time/on budget, average cycle time per engagement, cost per audit, and staff utilization rate.

Give examples of internal audit effectiveness (outcome) metrics.

Percentage of recommendations implemented, number/severity of findings, stakeholder satisfaction scores, value/savings identified, audit coverage of key risks, and reduction in repeat findings.

What is a balanced scorecard approach for internal audit performance?

Measuring performance across multiple perspectives—e.g., stakeholders/customers, internal processes, innovation/learning (staff), and financial/value—rather than relying on a single dimension.

What distinguishes a lagging from a leading performance indicator for internal audit?

Lagging indicators measure past results (e.g., percent of plan completed, findings closed); leading indicators predict future performance (e.g., staff training hours, certification rates, pipeline of skills).

What is a Quality Assurance and Improvement Program (QAIP)?

A program covering all aspects of the internal audit activity that enables an evaluation of conformance with the Standards and Code of Ethics; it includes both internal and external assessments.

What are the two types of internal assessments within a QAIP?

Ongoing monitoring (built into day-to-day supervision, review, and metrics) and periodic self-assessments performed by individuals within the activity.

How frequently must an external quality assessment be conducted?

At least once every five years by a qualified, independent assessor or assessment team from outside the organization.

When may the CAE state that the internal audit activity 'conforms with the Standards'?

Only when the results of the QAIP support that statement; the activity must have completed appropriate internal and external assessments demonstrating conformance.

What is a staffing plan, and how does it relate to the audit plan?

A staffing plan maps available auditor hours and competencies against the engagements in the annual audit plan to confirm resources are sufficient and appropriate; gaps trigger hiring, training, or co-sourcing decisions.