PDF IIA-CIA-Part2 Study Guide

According to the International Standards for the Professional Practice of Internal Auditing (Standards) set by the Institute of Internal Auditors (IIA), internal audit functions are allowed flexibility in including consulting engagements in their annual plans. Standard 2010 – Planning states that "the chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals." This risk-based plan should consider the potential value-add of consulting engagements. Consulting engagements that are expected to add significant value or align with strategic objectives are often included, but not all requests need to be automatically included unless they meet these criteria.References:

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2010 – Planning.

In internal auditing, the reliability of evidence is critical. According to IIA standards, evidence that is obtained directly from an external source, such as a customer, is generally considered more reliable, especially when it is timely.

IIA Standard 2310 – Identifying Information:

This standard requires that internal auditors obtain sufficient, reliable, relevant, and useful information to achieve the engagement’s objectives. Evidence obtained directly from external sources is often deemed more reliable because it is less likely to be biased or manipulated.

Direct Evidence:

Evidence obtained directly from a customer is considered highly reliable because it comes from an independent and external party. It is less likely to be influenced by internal pressures or conflicts of interest.

Timeliness:

The timeliness of evidence also affects its reliability. Recent and relevant information is more likely to accurately reflect the current state of affairs, making it more reliable for decision-making.

Option A (Untested third party): Although external, the reliability of evidence from an untested third party is uncertain until their credibility is established.

Option B (Uncorroborated evidence from an employee): This is less reliable as it may be subject to bias or self-interest.

Option C (Undocumented evidence from a manager): Undocumented evidence is generally less reliable as it lacks supporting documentation that can be verified.

Detailed Explanation:Why Not Other Options?

The role of the CAE includes ensuring that all significant risks, including those related to health and safety, are properly managed. Even though the chief health and safety officer reports directly to the CEO, the CAE should still coordinate with and review the work of this officer to understand and evaluate the management of health and safety risks. This helps ensure a comprehensive risk management approach within the organization and supports the overall assurance framework. It is not appropriate for the CAE to have no role (Option A), report directly to the regulator (Option C), or hire an external specialist annually without internal coordination (Option D).References:

IIA Standard 2010: Planning.

IIA Practice Guide on Coordinating Risk Management and Assurance.

The primary reason for an internal auditor to use a risk and control questionnaire when auditing financial processes is to gain an understanding of the control environment. These questionnaires help auditors identify and evaluate the presence and effectiveness of controls within the financial processes. They provide a structured way to gather information about the control environment, helping auditors understand the organization's risk management and control practices before conducting detailed testing.

References:

IIA Standards: 2201 - Planning Considerations

IIA Practice Guide: Internal Auditing and Fraud