CIA-1 - Ethics and Professionalism (20% of the exam) - Section B.5
Demonstrate due professional care and professional skepticism, including assessing strategy, governance, costs versus benefits, and the probability of significant errors, fraud, or noncompliance.
Apply due professional care as the care and skill a reasonably prudent and competent internal auditor would exercise, weighing the assessment of the organisation's strategy and objectives, the adequacy of governance, risk, and control processes, and the cost of an engagement against its potential benefits. Maintain professional scepticism by keeping an unbiased mental attitude and critically assessing the reliability of information rather than accepting it at face value.
Due professional careProfessional skepticismCost-benefit assessment
Practice question for this objective
lock_openFree sampleEthics and Professionalismmedium
While planning an engagement at Sennen Logistics, the internal auditor must decide how much work to perform over two areas: a peripheral petty-cash process with minor exposure, and a core freight-pricing process central to the organisation's strategy and carrying significant risk. Exercising due professional care, how should the auditor allocate the depth of work?
AApply identical, maximum-depth procedures to both areas so that neither area can be said to have received less attention than the other.
BConcentrate the work on the petty-cash process because small balances are easier to test exhaustively and produce a cleaner engagement conclusion.
CSet the depth of work for both areas at whatever level keeps the engagement within its original time budget, irrespective of relative risk.
DDirect greater depth to the freight-pricing process, reflecting its strategic significance and its higher probability of significant error, while scaling petty-cash work to its lower risk.check_circle Correct
Due professional care directs the depth of work to areas most significant to strategy, objectives, and risk, weighing the probability of significant error rather than treating all areas equally. A reasonably prudent, competent auditor exercising due care considers the organisation's strategy and objectives, the adequacy of governance, risk management, and control, and the probability of a significant error, so effort is concentrated where exposure is greatest rather than spread uniformly or capped by the time budget.
Why A is wrong: Uniform maximum effort seems even-handed, but it ignores relative significance and the cost against benefit balance that due professional care requires.
Why B is wrong: Ease of testing is a poor guide to effort, and steering work toward a low-risk area leaves the significant freight-pricing risk under-examined.
Why C is wrong: Letting the time budget dictate depth is convenient, but due care is driven by significance and risk, not by fitting the work to a preset schedule.
Why D is correct: A prudent, competent auditor exercising due care weighs strategy, objectives, and the probability of significant error, concentrating effort where exposure to the organisation is greatest.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
Accept the report as presented, on the basis that it was produced by the organisation's own system rather than prepared by hand.
errorWhy it is wrong: A system source feels trustworthy, but a report can still be incompletely scoped or misconfigured, and accepting it at face value is exactly the credulity professional scepticism guards against.
The seniority of the managers whose area is being audited relative to the grade of the auditor performing the work.
errorWhy it is wrong: The relative rank of auditor and auditee has no bearing on the diligence required; letting it drive the extent of work would compromise objectivity rather than reflect due care.
It shows the auditor breached due professional care, because exercising due care guarantees that all fraud will be detected during an engagement.
errorWhy it is wrong: This is a common misconception, but due professional care is not a guarantee of detection, so treating any undetected fraud as an automatic breach misstates the standard.