CIA-2 - Information Gathering, Analysis, and Evaluation (40% of the exam) - Section B.3
Evaluate technology options internal auditors may use to develop and support engagement findings and conclusions, including artificial intelligence, machine learning, robotic process automation, continuous monitoring, dashboards, and embedded audit modules.
Recognise efficient and effective technology solutions available to support engagement work, including artificial intelligence and machine learning tools, robotic process automation, continuous monitoring, dashboards, and embedded audit modules built into business systems. Match a technology option to the engagement's information-gathering or analysis need rather than treating any single tool as universally appropriate.
Continuous monitoringEmbedded audit moduleRobotic process automation
Practice question for this objective
lock_openFree sampleInformation Gathering, Analysis, and Evaluationmedium
Which description best characterises an embedded audit module used to support engagement findings?
AA standalone data-analytics tool that auditors run periodically against a copy of production data extracted after each reporting period has closed.
BA dashboard that visualises key risk indicators for senior management using transaction data that the audit team manually re-keys into a spreadsheet each month.
CProgram code built into an application that continuously captures or flags transactions meeting audit-defined criteria as they are processed by the system.check_circle Correct
DA robotic process automation bot that management deploys to perform and then approve routine journal entries without any independent human oversight.
Recognise that an embedded audit module is code within an application that captures or flags transactions against audit criteria as they process. An embedded audit module is distinguished by being integrated into the live application so it monitors and selects transactions continuously at the point of processing, unlike after-the-fact extractions, manual dashboards, or an RPA bot performing an operational control.
Why A is wrong: Tempting because it is a genuine CAAT approach, but it operates on extracted data after the fact rather than being embedded to capture transactions as they process.
Why B is wrong: Tempting as a monitoring aid, but it is a reporting visualisation fed by manual data entry, not code embedded in the application capturing transactions automatically.
Why C is correct: Correct: an embedded audit module lives inside the production application and selects or logs transactions in real time against criteria the auditor has defined.
Why D is wrong: Tempting because it names an automation technology, but it describes an RPA control that both performs and approves work, which is a segregation weakness, not an audit module.
Exam traps in Information Gathering, Analysis, and Evaluation
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
Robotic process automation improves its own decision rules over time, whereas machine learning simply follows the fixed instructions it is given.
errorWhy it is wrong: Tempting because it sounds balanced, but it reverses the technologies: RPA follows fixed rules while machine learning is the one that adapts from data.
Continuous monitoring and continuous auditing are interchangeable labels for one automated control that the internal audit function owns and operates.
errorWhy it is wrong: Tempting because both use automation over the same data, but it is wrong: they differ in ownership and purpose, and audit does not own an operating control.
Build and operate the automated duplicate-payment routine on behalf of management, reviewing its output each quarter.
errorWhy it is wrong: Tempting because it is helpful and uses audit's data skills, but building and operating a control makes internal audit responsible for a management function and impairs objectivity.