CIA-2 - Engagement Planning (50% of the exam) - Section A.4
Determine the appropriate approach for an engagement, evaluating agile, traditional, integrated, and remote auditing methods and applying project management concepts.
Evaluate agile, traditional, integrated, and remote auditing approaches against an engagement's objectives, resources, and constraints to select the most suitable method. Apply project management concepts such as scoping, sequencing, and resource allocation to plan and conduct the engagement efficiently regardless of the approach chosen.
A new internal auditor is applying project management concepts to a six-week compliance engagement. Two testing tasks depend on receiving a data extract that the IT team can only deliver in week three. To keep the engagement on schedule, what should the auditor do when building the plan?
AIdentify the dependency, schedule independent tasks earlier, and sequence the data-dependent tests after the week-three delivery.check_circle Correct
BAssume the extract will arrive in week one and schedule all testing to start then, adjusting only if it slips.
CReport to the audit committee that the engagement cannot be completed within six weeks because of the IT constraint.
DRemove the two data-dependent tests from scope so the engagement avoids relying on the IT extract at all.
Applying project management to an engagement means mapping task dependencies and sequencing work so constraints are absorbed rather than allowed to derail the schedule. Sound scheduling identifies which tasks depend on others, runs independent work in parallel, and orders dependent tests after their inputs arrive, keeping the critical path intact without dropping scope or escalating prematurely.
Why A is correct: Recognising the dependency and reordering work so independent tasks proceed while data-dependent tests follow the extract is exactly how project sequencing protects the timeline.
Why B is wrong: Assuming an earlier delivery than IT has confirmed builds the schedule on a false premise, so slippage is almost guaranteed rather than managed.
Why C is wrong: Escalating a manageable scheduling constraint as a blocker is premature, since the plan can absorb the dependency through sequencing rather than declaring failure.
Why D is wrong: Cutting necessary tests to dodge a dependency narrows coverage and may leave the objective unmet, trading schedule comfort for a weaker engagement.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
They guarantee that every identified risk will be eliminated before the report is issued.
errorWhy it is wrong: Scheduling manages effort, not risk elimination; audit assesses residual risk rather than removing it, so this overstates what project management delivers.
The RACI matrix, which lists who is responsible, accountable, consulted, and informed for each audit task
errorWhy it is wrong: A RACI matrix is a genuine planning tool and useful for roles, but it clarifies responsibility rather than task sequencing, so it does not reveal which activities control the completion date.
The traditional approach reprioritises deliverables every few days, whereas agile fixes them at kick-off.
errorWhy it is wrong: This reverses the two methods; frequent reprioritisation is an agile trait, not a traditional one, so the comparison is inaccurate.