Online IIA-CIA-Part2 Questions Video

The best possible engagement objectives are those derived from a comprehensive risk assessment that incorporates inputs from both senior management and the company's risk function experts. This approach ensures that the internal audit objectives are aligned with the organization's strategic priorities and risk landscape. By combining insights from senior management with the technical expertise of risk function experts, the internal audit activity can develop well-rounded and relevant engagement objectives that address the most significant risks facing the organization.

References:

The Institute of Internal Auditors (IIA) Standard 2010 – Planning: "The chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals."

IIA Practice Guide on "Internal Audit Planning"

In the initial risk assessment phase, it is critical for the internal auditor to understand the current policies and procedures in place. By obtaining the most current approved copies of the organization's privacy policy, the auditor can assess whether these policies are in compliance with privacy laws and are effectively implemented. This approach provides a solid foundation for understanding the existing controls and identifying areas where there may be gaps or weaknesses. Consulting with legal counsel or a specialist can be subsequent steps if further expertise is needed, but understanding the internal policies is the primary and essential first step.References:

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2210 – Engagement Objectives.

In internal auditing, when assessing the accuracy and completeness of employee time reporting, auditors often use sampling to determine the overall compliance of the process. In this scenario, the internal auditor sampled 30 employee time reports and found 5 incorrect and 4 unsupported reports. This indicates that a majority (21 out of 30) were accurate, suggesting that the organization generally ensures accurate reporting. However, the presence of incorrect and unsupported reports indicates deficiencies that need to be addressed, but do not point to systemic fraud or abuse. Thus, option D accurately reflects the findings by acknowledging both the general accuracy and the instances of errors.References:

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing

COSO Framework - Control Activities and Monitoring

A draft internal audit report citing deficient conditions should be reviewed with relevant stakeholders to ensure accuracy, address concerns, and plan corrective actions. This includes the client manager and her superior (Option 1) to inform them of the findings and obtain their perspective. It should also be reviewed with anyone who may object to the report’s validity (Option 2) to address potential disagreements or misunderstandings early in the process. Finally, it should include anyone required to take action (Option 3) so they are aware of their responsibilities and can begin planning remediation efforts. While it may be beneficial to review with those who receive the final report (Option 4), it is not essential for the draft stage. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2440 - Disseminating Results.