IIA IIA-CIA-Part1 Online Access

An effective governance process requires that risk is considered in strategic decision-making, ensuring that all significant risks are identified, assessed, and managed appropriately. This integration of risk management into the strategic planning process helps align risk appetite and strategy, improving the overall governance and risk management framework of the organization.

The internal audit charter should include the Definition of Internal Auditing, along with the Core Principles, Code of Ethics, and Standards. This definition provides clarity on the purpose, authority, and responsibility of the internal audit function within the organization. References:

IIA ' s International Professional Practices Framework (IPPF) - Internal Audit Charter requirements.

ISO 31000 outlines risk management principles and guidelines, including the consideration of external context in the risk management process. The external context refers to the environment in which the organization operates. This includes, but is not limited to, cultural, social, political, legal, regulatory, financial, technological, economic, and competitive environments, both international and national. Therefore, option C, " The regulatory and competitive environment, " is part of the external context for risk management according to ISO 31000.

ISO 31000:2018, Risk management - Guidelines

Critical thinking skills are essential for internal auditors when designing audit procedures and selecting samples. The situation described indicates that the auditor relied on a sampling method without thoroughly considering the potential risks and the specific context of the transaction population. Improved critical thinking skills would help the auditor better assess the representativeness of the sample, identify potential fraud risks, and ensure a more thorough and effective audit approach, potentially preventing the oversight that led to undetected fraud.

The IIA Standards: Standard 1220 – Due Professional Care: " Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor. Due professional care includes consideration of the use of technology-based audit and other data analysis techniques. "

IIA Practice Guide: " Assessing the Adequacy of Risk Management and Controls " : Emphasizes the importance of critical thinking in evaluating risks and controls.