CIA-2 - Information Gathering, Analysis, and Evaluation (40% of the exam) - Section B.7

Prepare workpapers, including relevant information to support conclusions and engagement results, organized to be complete and to include sufficient evidence.

Organise information in workpapers so that they are complete, contain sufficient evidence, and clearly link the work performed to the engagement's results and conclusions. Apply the factors that govern how engagement documentation should be organised and retained, including regulatory requirements and internal policies on retention periods and access.

WorkpapersDocumentation retentionSufficient evidence

Practice question for this objective

Free sampleInformation Gathering, Analysis, and Evaluationmedium

Within an assurance engagement, what is the primary purpose of the engagement workpapers?

  • ATo document the information obtained, the analyses performed, and the support for the conclusions reached, providing the principal evidence of the work done. Correct
  • BTo serve as the auditor's private notes, which may be discarded once the final report is issued because only the report matters to stakeholders.
  • CTo record the hours each team member charged to the engagement so that staff appraisal and internal cost recovery can be calculated accurately.
  • DTo satisfy external auditors and regulators alone, holding no internal value once the audit committee has been briefed on the engagement outcome.
Workpapers document the information, analyses, and support for conclusions, providing the principal evidence of the work performed. Workpapers link the engagement objective to the procedures, the evidence gathered, and the conclusions drawn, so any reviewer can trace how each conclusion was reached and confirm the work was performed.

Why A is correct: Correct: workpapers capture the objective, procedures, evidence, and conclusions, forming the auditable trail that substantiates the engagement results.

Why B is wrong: Tempting because reports are the visible output, but workpapers are the record of work performed and cannot simply be discarded when the report issues.

Why C is wrong: Time recording is an administrative by-product; it is not why workpapers exist, so this mistakes a secondary detail for the core purpose.

Why D is wrong: External parties may use workpapers, but their primary value is internal support for conclusions, so limiting them to outside use is wrong.

See more CIA-2 practice questions, answers explained.

Exam traps in Information Gathering, Analysis, and Evaluation

Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.

  • The documentation is stored in an access-controlled system with a retention period defined by the audit function's policy.

    Why it is wrong: Secure storage and a defined retention period govern how workpapers are controlled and kept, but they describe custody rather than whether the recorded evidence is sufficient to support the conclusions.

  • The physical or electronic storage capacity available to the internal audit function at the time.

    Why it is wrong: Storage capacity is an operational constraint that can be expanded or archived; letting available space set retention would risk disposing of records still required by law or policy.

  • Instruct staff to keep every draft and email indefinitely, since retaining more documentation than required always protects the audit function from any future challenge.

    Why it is wrong: Indefinite retention of everything feels safe, but it ignores legal and policy-based retention limits and creates its own risks; the absolute claim overstates the benefit of hoarding drafts.

More in this domain

Back to all Information Gathering, Analysis, and Evaluation objectives, or the CIA-2 cert hub.

Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors. Original, blueprint-aligned practice material only.