Free Access IIA IIA-CIA-Part1 New Release

The organization’s decision to cease operations in a market due to increasing volatility and uncertainties represents a risk avoidance technique. Risk avoidance involves actions taken to eliminate the exposure to risk entirely, often by discontinuing the activities that generate the risk. In this scenario, by exiting the market, the organization avoids the potential negative impacts associated with the volatile and uncertain environment.

The IIA Standards: Standard 2120 – Risk Management: " The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. "

COSO ERM Framework: Describes risk avoidance as a strategy where organizations opt to avoid risk by discontinuing the activities that produce the risk.

The scenario described involves a violation of the principle of confidentiality as defined in The IIA ' s Code of Ethics. The internal auditor misused information obtained during the course of an audit (salary data of colleagues) for personal gain (requesting a salary raise). This breaches the ethical principle of confidentiality, which mandates that auditors respect the value and ownership of information they receive and do not disclose information without appropriate authority unless there is a legal or professional obligation to do so.

The IIA ' s Code of Ethics on Confidentiality.

In analyzing the situation where a key account manager failed to register a large number of contracts, a competent internal auditor should evaluate whether attributes such as intent and personal gain were present. This involves assessing whether the individual ' s actions were deliberate and motivated by personal benefits. Understanding these attributes is crucial for determining the root cause of the issue and identifying potential fraud or misconduct. It also helps in making recommendations to prevent future occurrences.

IIA Practice Guide: Fraud and Internal Audit

IIA Standard 1210.A2: Proficiency – Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization