CIA IIA-CIA-Part2 Passing Score

According to the Institute of Internal Auditors (IIA) guidance, the chief audit executive (CAE) should develop a risk-based audit plan that takes into account the organization's risk management framework, including its risk appetite levels. This aligns with Standard 2010 – Planning, which states that the CAE must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals. Risk appetite levels from management are a critical component of understanding the organization’s risk profile and should be incorporated into the audit plan. Thus, the CAE may incorporate risk information, including risk appetite levels from management, at her discretion.References: IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2010 – Planning.

Step-by-Step Detailed Explanation:

A. The policy for granting, modifying, and deleting user access:Correct. Understanding the policy ensures the auditor knows the framework and controls in place.

B. A sample of change request forms:Useful for testing but not as foundational as reviewing the policy.

C. User access reports reviewed by management:This evaluates monitoring but does not establish a baseline understanding of controls.

D. A current listing of system users and employees:Important for reconciliation but secondary to understanding the control framework.

CIA Exam Syllabus Reference:

Domain V: Performing Internal Audit Services – Preliminary Surveys.

According to IIA guidance, interim reports are typically produced during lengthy audit engagements that involve several organizational units. These reports help keep management informed about the progress of the audit, highlight any significant issues identified early on, and allow for timely corrective actions. Interim reports facilitate communication between the internal audit activity and management, ensuring that any critical issues are addressed promptly rather than waiting for the final report.

References:

The Institute of Internal Auditors (IIA) Practice Guide on "Audit Reports"

IIA Standard 2410 – Criteria for Communicating: "Interim reports may be used to communicate information and issues that require immediate attention."

The internal auditor has primarily obtained testimonial evidence. Testimonial evidence is derived from interviews, discussions, and responses from employees or other parties. It involves collecting and analyzing verbal information to draw conclusions, which is precisely what the auditor did by conducting interviews, documenting them, analyzing the summaries, and drawing conclusions based on this information.

References:

IIA Standards: 2310 - Identifying Information

IIA Practice Guide: Audit Evidence