Certified Internal Auditor (CIA) Performing the Engagement (Part 2) Syllabus

What does 'reliable' mean as an attribute of audit evidence?

The evidence is the best attainable information through the use of appropriate engagement techniques; reliability generally increases with auditor-obtained, externally sourced, and corroborated evidence.

Rank by reliability: evidence obtained directly by the auditor, internally generated evidence, and externally generated evidence held by the client.

Most reliable: evidence obtained directly by the auditor; then externally generated/third-party evidence; least reliable: internally generated evidence under client control.

What is the difference between physical, testimonial, documentary, and analytical evidence?

Physical: direct inspection/observation of assets; Testimonial: statements from interviews/inquiries; Documentary: records such as invoices and contracts; Analytical: derived from analysis, comparisons, and computations of relationships.

Why is testimonial evidence generally considered the least reliable type of evidence?

It is based on statements that may be biased, incomplete, or inaccurate, so it should be corroborated with other forms of evidence.

What is the difference between an analytical procedure and a substantive test of detail?

An analytical procedure evaluates information by studying plausible relationships among data (ratios, trends, comparisons); a test of detail examines individual transactions, documents, or balances directly.

Name four common types of analytical procedures used in audit engagements.

Ratio analysis, trend (time-series) analysis, comparison to budgets/benchmarks/prior periods, and reasonableness tests (predictive/regression analysis).

When are analytical procedures most effective and reliable?

When relationships among data are stable and predictable, data is reliable and disaggregated, and the auditor has developed a precise expectation against which to compare actual results.

What is the purpose of investigating significant differences found during analytical procedures?

Unexpected variances may signal errors, fraud, control weaknesses, or unusual transactions, so they must be corroborated with additional evidence to explain the difference.

What is the difference between statistical and non-statistical (judgmental) sampling?

Statistical sampling uses random selection and probability theory to objectively measure sampling risk and project results to the population; non-statistical sampling relies on auditor judgment and cannot objectively quantify sampling risk.

What is sampling risk?

The risk that the auditor's conclusion based on a sample differs from the conclusion that would result from testing the entire population.

In attribute sampling versus variables sampling, what is each used to estimate?

Attribute sampling estimates the rate of occurrence (deviation rate) of a control or characteristic; variables sampling estimates a numerical amount or dollar value (e.g., monetary balance).

What is data analytics in the context of an internal audit engagement?

The use of analysis techniques and technology to examine large volumes of data to identify patterns, anomalies, trends, and relationships that support audit objectives.

What is continuous auditing?

The automated, ongoing performance of audit-related activities (control and risk assessments) on a more frequent or real-time basis, enabling timelier detection of issues.

What is the difference between continuous auditing and continuous monitoring?

Continuous auditing is performed by internal audit to provide assurance; continuous monitoring is performed by management as part of its ongoing responsibility to oversee controls and operations.

What is CAATs (computer-assisted audit techniques)?

Tools and software (e.g., generalized audit software, test data, parallel simulation) that auditors use to extract, analyze, and test data directly from information systems.

What are common data analytics applications in auditing (give three examples)?

Identifying duplicate payments, detecting outliers/anomalies, testing 100% of a population, gap/sequence analysis on documents, Benford's Law analysis, and matching across data sets.

What is the purpose of engagement workpapers (working papers)?

They document the information obtained, analyses made, and support the bases for observations, conclusions, and recommendations, providing evidence the engagement was conducted in accordance with Standards.

Per IIA Standards, who controls access to engagement records, and what governs their retention?

The chief audit executive controls access to engagement records and develops retention requirements consistent with the organization's guidelines and applicable regulatory/legal requirements.

What must the chief audit executive obtain before releasing engagement records to external parties?

Approval of senior management and/or legal counsel prior to releasing such records to external parties, as appropriate.

What essential attributes should be present in well-prepared workpapers?

They should be clear, complete, concise, relevant, and accurate; properly indexed/cross-referenced; and show evidence of preparation and supervisory review.

Per IIA Standards, who must review engagement workpapers and why?

They must be reviewed by appropriate supervisory personnel (the CAE or designee) to ensure work is properly performed and supports observations, conclusions, and recommendations; review evidence must be documented.

What are the four attributes (elements) of a well-developed audit finding/observation?

Condition (what is), Criteria (what should be), Cause (why it happened), and Effect (the impact/consequence); often a fifth—Recommendation—is added.

In a finding, what is the difference between 'condition' and 'criteria'?

Condition is the factual evidence of the current state ('what is'); criteria is the standard, benchmark, or expectation against which the condition is measured ('what should be').

Why is identifying the root cause of a finding important?

The cause explains why the gap between condition and criteria occurred and is essential for developing recommendations that effectively correct and prevent recurrence of the problem.

What is the difference between the 'effect' of a finding and a 'recommendation'?

Effect is the actual or potential consequence/risk resulting from the condition (often used to gain attention and prioritize); the recommendation is the auditor's suggested corrective action to address the cause.

What must final engagement communications include per IIA Standards?

The engagement's objectives, scope, and results (conclusions, recommendations, and action plans); applicable conclusions; and, where appropriate, the auditor's overall opinion.

What five criteria define quality engagement communications?

They must be accurate, objective, clear, concise, constructive, complete, and timely.

What is the purpose of an exit (closing) conference with management before issuing the final report?

To discuss observations, conclusions, and recommendations, confirm facts are accurate, obtain management's responses/action plans, and resolve disagreements before the report is finalized.

Per IIA Standards, what must be disclosed when an engagement does not conform with the Standards?

Nonconformance must be disclosed in the final communication, including the principle(s)/standard(s) not met, the reason for nonconformance, and the impact on the engagement and communicated results.

If a final communication contains a significant error or omission, what must the chief audit executive do?

The CAE must communicate corrected information to all parties who received the original communication.

What is the purpose of the monitoring and follow-up process, and who is responsible for it?

To ensure management has taken effective action on reported observations and recommendations (or that senior management accepted the risk of not acting); the CAE must establish and maintain this follow-up system.

Per IIA Standards, what should the CAE do when senior management accepts a level of risk that may be unacceptable to the organization?

The CAE must discuss the matter with senior management; if not resolved, the CAE must communicate the matter to the board.