Free CIA-1 flashcards

In an advisory engagement requested by management, how does internal audit protect its ability to give assurance on the same area later?

It advises on options and facilitates the decision but leaves the design choices and implementation firmly with management. Not assuming management responsibility is the defining safeguard that keeps objectivity intact, so the activity can still provide independent assurance on that area afterwards.

In an advisory engagement, is it fine for internal audit to redesign the workflow and put the new steps into operation so the fix lands quickly?

Speed is tempting, but designing and implementing the workflow makes internal audit the process owner and assumes a management responsibility. That impairs objectivity for any later assurance, so it is wrong.

An accepted residual risk exceeds the board's stated risk appetite. What is internal audit's role in responding to it?

Risk appetite is the board's stated boundary, so an accepted residual risk above it is a governance exception. Internal audit's independent role is to evaluate the response against appetite and escalate the exception to senior management and the board as the accountable owners, never to select or implement the response itself.

If an accepted residual risk breaches appetite, the auditor should just direct the IT manager to change the response from accept to reduce.

Selecting and changing the risk response is a first line management decision. Directing it would breach the Three Lines Model and impair the auditor's objectivity, so it is wrong despite seeming decisive.

The internal audit team lacks a required competency and cannot recruit the specialist in time. How can it still run a competent engagement?

Competency can be satisfied collectively. When in-house skills fall short, the function may procure the expertise externally, for example through a guest auditor or specialist, keeping the engagement competent while internal audit retains its independent assurance role.

If the team lacks the expertise, is it fine to narrow the scope to controls the team already understands and leave the specialist area untested?

Tempting because it lets the work start on time, but scoping around a competency gap leaves the very risk the engagement exists to examine unassessed and does not fulfil the mandate. Procuring the missing skill is the proper response.

What makes a fraud risk management process adequate: the existence of an annual assessment, or something more?

Adequacy turns on whether identification, assessment and response track the organisation's actual exposure. When new markets create fresh fraud risks the assessment never captured, the responses cannot match the exposure, so the process is inadequate even though a documented assessment exists.

A documented annual fraud risk assessment and anti-fraud controls, completed on schedule, mean the fraud risk management process is adequate. Right?

The presence of an assessment is reassuring, but adequacy depends on whether it reflects current exposure. An assessment that ignores materially changed fraud risks, such as new bribery and procurement exposures from overseas expansion, is not adequate simply because it exists.