CIA-2 - Engagement Planning (50% of the exam) - Section A.6
Determine engagement procedures and prepare the engagement work program, including procedures to evaluate control design and test control effectiveness and efficiency.
Determine procedures that evaluate whether a control is well designed to mitigate the risk it targets, and identify procedures that test whether that control is both effective and efficient in operation. Evaluate the adequacy of the resulting engagement work program and identify testing methodologies suited to accounting, finance, IT systems, business operations, or cybersecurity subject matter.
Control design testingControl effectiveness testingEngagement work program
Practice question for this objective
lock_openFree sampleEngagement Planninghard
In planning a controls engagement, an auditor decides to first evaluate whether the organisation's approval control is capable of preventing unauthorised purchases if it works as intended, before later testing whether it actually functioned across the year. What is the auditor evaluating in the first step?
AThe operating effectiveness of the approval control, because the auditor is confirming that the control worked consistently throughout the reporting period.
BThe design effectiveness of the approval control, because the auditor is assessing whether it is suitably designed to prevent unauthorised purchases if operated as intended.check_circle Correct
CThe efficiency of the approval control, because the auditor is measuring whether it processes purchase approvals at an acceptable cost per transaction.
DThe materiality of the approval control, because the auditor is deciding whether unauthorised purchases would be large enough to influence a decision.
Separate control design effectiveness, whether a control could work as intended, from operating effectiveness, whether it actually did over the period. Assessing design effectiveness asks whether a control, operated as intended, is capable of preventing or detecting the risk it targets. This logically comes before testing operating effectiveness, which examines whether the control actually functioned consistently over the reporting period, so the first step is a design assessment.
Why A is wrong: Tempting because operating effectiveness is the eventual goal, but the stem describes the first step of judging whether the control could work as intended, which precedes testing whether it actually did over time.
Why B is correct: Correct because evaluating whether a control could achieve its objective when working as intended is a design assessment, which logically precedes testing whether it operated effectively over the period.
Why C is wrong: Tempting because efficiency sounds like a control attribute, but it concerns cost and speed, not whether the control is capable of preventing unauthorised purchases, which is the design question posed.
Why D is wrong: Tempting because materiality guides scoping, but it concerns the significance of potential misstatement, not whether the control is capable of preventing the purchases, which is a design question.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
Determining, by re-performing the access review over a sample of periods, whether the control functioned consistently throughout the year.
errorWhy it is wrong: This describes testing operating effectiveness over time, not design; re-performance across periods evaluates how the control ran, not whether it is capable.
Testing of operating effectiveness, because the auditor is confirming that controls worked as intended across the period under review.
errorWhy it is wrong: Tempting because approvals feel like an operating control, but examining only the configuration, not actual transactions over time, does not evidence how the control operated.
Design effectiveness measures whether the control ran without exception all year, while operating effectiveness measures whether the control was documented in a policy.
errorWhy it is wrong: This is tempting because both phrases appear, but it swaps the ideas, treating year-long operation as design and documentation as operation, so it is wrong.