CIA-1 - Foundations of Internal Auditing (35% of the exam) - Section A.7
Identify situations where the independence of the internal audit function may be impaired, including inappropriate reporting lines, scope limitations, restricted access, and budget constraints.
Identify threats to organisational independence such as a functional reporting line that does not run to the board, scope limitations, restricted access to records or personnel, and budget constraints that curtail coverage. Explain the board's and the chief audit executive's shared responsibility for protecting independence, including the requirement to communicate an impairment or perceived impairment to the board.
lock_openFree sampleFoundations of Internal Auditingmedium
Aldwick Utilities is redesigning where internal audit sits. Under the current proposal the chief audit executive would report functionally to the chief executive, who would approve the audit plan, the budget, and the appointment and removal of the chief audit executive, while the audit committee would receive only a courtesy copy of finished reports. Advising on the design, which arrangement best preserves the function's organisational independence?
AKeep the functional line to the chief executive but require the chief executive to consult the audit committee before removing the chief audit executive.
BHave the chief audit executive report functionally to the chief financial officer, who is closer to the financial controls that internal audit most often examines.
CHave the chief audit executive report functionally to the audit committee, which approves the plan and budget and oversees the appointment and removal of the chief audit executive.check_circle Correct
DRetain the chief executive as the functional reporting line but transfer approval of the budget alone to the audit committee.
Organisational independence is secured by a functional reporting line to the board or audit committee that controls the plan, budget, and chief audit executive appointment. The functional reporting line is the main structural support for independence. When the board or audit committee, rather than management, approves the plan and budget and oversees the chief audit executive's appointment and removal, the function is insulated from the management it must objectively assess.
Why A is wrong: Adding a consultation step looks like a safeguard, but the chief executive still controls the plan, budget and appointment, leaving the function dependent on a party it audits.
Why B is wrong: Proximity to finance sounds efficient, but the chief financial officer is a senior manager whose area is audited, so this is the same impairment moved to a different seat.
Why C is correct: A functional line to the audit committee that controls the plan, budget and the chief audit executive's appointment is the primary structural support for organisational independence, insulating the function from the management it assesses.
Why D is wrong: Splitting off the budget helps a little, but plan approval and the chief audit executive's appointment still rest with management, so the function's independence remains compromised.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
Accept the finance director's edits but keep an unedited copy of every report on file, so that an accurate record exists in case the audit committee ever asks to compare the two versions.
errorWhy it is wrong: Keeping records is prudent, which makes this tempting, but allowing a reviewed executive to edit reports leaves the impairment in place and hides it from the committee, so a private file does not restore independence and is wrong.
That the function report administratively and functionally to the chief financial officer instead, because finance already reviews most of the areas internal audit examines.
errorWhy it is wrong: Moving the reporting line to another executive keeps internal audit under management and does not create a link to the board, so it fails to deliver the organisational independence the Standards require.
Quietly reallocate the freed audit hours to other approved engagements and record the subsidiary as deferred to next year's plan.
errorWhy it is wrong: Reallocating the time looks pragmatic, but silently absorbing a management-imposed restriction on board-approved coverage lets management dictate the function's scope, which impairs organisational independence.