Certified Internal Auditor (CIA) Foundations of Internal Auditing (Part 1) Flashcards

24 sample cards from the Foundations of Internal Auditing (Part 1) deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What practice safeguards objectivity by avoiding long-term familiarity with one area?

   Periodic rotation of audit staff assignments, so auditors are not assigned to the same area indefinitely, reducing familiarity threats.

2. How should gifts or favors from auditees be handled to protect objectivity?

   Auditors should not accept anything that may impair, or be presumed to impair, their professional judgment. Tokens of nominal value within organizational policy may be acceptable, but significant gifts must be declined or disclosed.

3. When internal auditors perform consulting (advisory) engagements, how is objectivity maintained?

   Auditors must maintain objectivity and should not assume management responsibility. If objectivity may be impaired, it must be disclosed to the engagement client before accepting the engagement.

4. What is the key restriction on internal auditors taking on operational (non-audit) roles?

   Internal auditors should not assume management responsibility or design, install, or operate systems/controls, because doing so impairs objectivity for any future assurance work on those activities.

5. If internal audit is asked to take on a non-audit role (e.g., interim management), what safeguards apply?

   The CAE should disclose the impairment to the board, obtain approval, recognize that objectivity for that area is impaired, and arrange for any related assurance to be performed by an independent party..

6. How does knowledge gained in consulting engagements relate to assurance work?

   Knowledge gained during consulting engagements should be considered when forming assurance opinions and evaluating the organization's risk management and control processes, but the auditor must remain objective.

7. Define 'proficiency' for internal auditors.

   Proficiency is the collective knowledge, skills, and competencies (abilities) required to fulfill internal audit responsibilities effectively. Auditors must possess, or obtain, the proficiency needed to perform their work.

8. If the internal audit function lacks the proficiency needed for an engagement, what must the CAE do?

   The CAE must obtain competent advice and assistance—either by developing staff, hiring, or sourcing external service providers (co-sourcing/outsourcing) who have the needed competencies.

9. What is the IIA's globally recognized certification demonstrating internal audit proficiency?

   The Certified Internal Auditor (CIA) designation.

10. What knowledge must internal auditors have regarding fraud?

    Auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.

11. Define 'due professional care' for internal auditors.

    The care and skill expected of a reasonably prudent and competent internal auditor. It does not imply infallibility; it requires applying reasonable care and skill, not extraordinary performance.

12. What factors should an auditor consider in exercising due professional care during an assurance engagement?

    The extent of work needed to achieve objectives; relative complexity, materiality, or significance of matters; adequacy and effectiveness of governance, risk management, and control; probability of significant errors, fraud, or noncompliance; and the cost of assurance relative to benefits.

13. How does due professional care apply to consulting engagements specifically?

    The auditor should consider the needs and expectations of clients (nature, timing, and communication of results); the relative complexity and extent of work needed; and the cost of the engagement relative to potential benefits.

14. Does due professional care require detecting all risks or wrongdoing?

    No. Due professional care requires alertness to significant risks but does not guarantee that all significant risks, fraud, errors, or irregularities will be identified.

15. What must auditors apply during engagements alongside due professional care regarding technology?

    They should consider the use of technology-based audit and data analysis techniques and other tools to perform work efficiently and effectively.

16. Define 'continuing professional development' (CPD/CPE) for internal auditors.

    The ongoing requirement for internal auditors to enhance their knowledge, skills, and competencies through continuing professional development and education to remain proficient.

17. Who is responsible for maintaining and developing the proficiency of the internal audit function?

    The chief audit executive is responsible for ensuring the function collectively possesses the competencies needed and that individual auditors pursue continuing professional development.

18. What is a competency framework, as used by an internal audit function?

    A structured model (such as the IIA's Internal Audit Competency Framework) that defines the knowledge, skills, and behaviors auditors need, used for assessing competencies, planning development, and recruiting.

19. What is a Quality Assurance and Improvement Program (QAIP)?

    A program that enables an evaluation of the internal audit function's conformance with the Global Internal Audit Standards and an assessment of whether internal auditors apply the Code of Ethics/Ethical Principles. It also assesses efficiency and effectiveness and identifies improvement opportunities.

20. What are the two components of a QAIP?

    Internal assessments and external assessments.

21. What do internal assessments within a QAIP consist of?

    (1) Ongoing monitoring of the performance of the internal audit function, and (2) periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices.

22. How often must an external assessment be conducted, and by whom?

    At least once every five years, by a qualified, independent assessor or assessment team from outside the organization.

23. What are the two acceptable forms of an external assessment?

    (1) A full external assessment conducted by an independent external assessor/team, or (2) a self-assessment with independent external validation (SAIV).

24. When may the CAE state that the internal audit function 'conforms with the Global Internal Audit Standards'?

    Only when the results of the QAIP (both internal and external assessments) support that statement. The CAE communicates the QAIP results, and conformance can only be claimed when assessments demonstrate it.

What this deck covers

Foundations of Internal Auditing (Part 1) flashcards FAQ