CIA-2 - Engagement Planning (50% of the exam) - Section A.5
Complete a detailed risk assessment of each activity under review, applying Topical Requirements and recognizing pervasive risks, emerging risks, and the impact of organizational structure and culture on the assessment.
Complete a risk assessment of the activity under review that recognises pervasive financial, operational, IT, cybersecurity, and regulatory risks, and the impact of emerging risks. Determine appropriate methods and criteria to evaluate and prioritise identified risks and controls, and account for how changes in people, processes, and systems, organisational structure such as centralised versus decentralised, and culture and tone at the top affect the control environment.
An auditor planning a review of a bank's small-business lending unit maps risks specific to that unit but omits considering the bank's recent group-wide switch to an aggressive growth incentive plan and a new data-privacy regulation taking effect next year. Which category of risk has the auditor most clearly failed to incorporate into the detailed risk assessment?
ADetection risk arising from the sampling approach the engagement team intends to apply to the loan files during fieldwork later this year.
BResidual risk, because the auditor recorded inherent exposures for the unit without netting them against the controls management operates.
CSampling risk, because omitting the group-level factors changes the population of individual loan files the team must select and test.
DPervasive and emerging risks, because the incentive plan can affect behaviour across the unit and the pending regulation is a developing external exposure.check_circle Correct
A detailed risk assessment must incorporate pervasive risks that cut across an activity and emerging risks from developing external conditions, not only unit-specific risks. A group-wide incentive plan influences conduct throughout the lending activity, making it pervasive, while a regulation that is not yet in force is an emerging risk that could reshape future exposure; both must feed the assessment so planning is not confined to isolated, current, unit-level risks.
Why A is wrong: Tempting because sampling affects assurance quality, but detection risk concerns the audit procedures themselves, not the external and organisation-wide exposures the auditor overlooked.
Why B is wrong: Tempting since residual risk matters, but the omission described is entering wider organisational and external factors, not the separate step of assessing control effectiveness.
Why C is wrong: Tempting as scope shapes populations, but sampling risk is about whether a sample represents a population, not about missing pervasive and emerging exposures in the assessment.
Why D is correct: Correct: an incentive that shifts conduct across the whole activity is pervasive, and a not-yet-effective regulation is an emerging risk; a detailed assessment must consider both alongside unit-specific risks.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
Treat culture as outside the engagement's remit and raise it separately with human resources, keeping the risk assessment focused on transaction-level controls.
errorWhy it is wrong: Tempting because culture feels like an HR matter, but a control environment that tolerates overrides directly raises risk to the procurement activity and belongs inside the assessment.
Keep the pre-restructuring risk assessment, since the fulfilment activity itself has not changed and structure is a governance matter for management.
errorWhy it is wrong: Tempting because the task looks unchanged, but merged responsibilities and an outsourced provider alter control ownership and segregation, so a stale assessment misstates the activity's real risks.
Adopt the enterprise-level risk register as the engagement risk assessment, since it already reflects the organisation's agreed significant risks and avoids duplicating management's work.
errorWhy it is wrong: Tempting because the enterprise register is an authoritative input, but it is pitched at entity level and will miss the activity-specific inherent, emerging, and cultural risks the engagement must assess in detail.