CIA-3 - Engagement Results and Monitoring (45% of the exam) - Section D.3
Determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on actions, including protocol for disagreements about findings.
Recognise the appropriate protocol for internal auditors when management disagrees with an engagement's findings or proposed action plans. Recognise the purpose of recommendations and action plans, including weighing their costs against their benefits, and determine whether a proposed action plan genuinely addresses the root cause of a finding rather than only its symptoms.
lock_openFree sampleEngagement Results and Monitoringhard
Management at Calloway Retail submits an action plan in response to a finding that customer refunds were processed without authorisation. The plan commits to reversing the specific unauthorised refunds the engagement already identified. The chief audit executive reviews the plan. What should the chief audit executive conclude?
AThe plan is adequate, because it remediates the specific exceptions that the engagement identified during fieldwork.
BThe plan should be rejected and replaced with the auditor's own remediation steps, since management's proposed response is incomplete.
CThe plan addresses the symptom but not the cause, because it corrects the known instances without preventing further unauthorised refunds from occurring.check_circle Correct
DThe plan should be accepted on condition that management commits to a follow-up audit, because re-auditing will confirm that the refunds were reversed.
An action plan that corrects known instances without treating the control cause addresses the symptom, not the root cause. Evaluating an action plan means testing whether it treats the condition that produced the finding. Reversing identified refunds resolves the visible exceptions but leaves the authorisation gap, so the plan is symptom-level and the chief audit executive should have management extend it to the cause.
Why A is wrong: Tempting because the plan does fix what was found, but adequacy requires treating the cause so the issue does not recur, which this plan does not do.
Why B is wrong: Tempting because the plan is deficient, but substituting the auditor's own steps takes over management's ownership of the response rather than flagging the gap for management to close.
Why C is correct: Correct: reversing the identified refunds treats the observed exceptions, yet it leaves the authorisation control gap that allowed them, so the plan misses the root cause.
Why D is wrong: Tempting because follow-up is legitimate, but a later audit that confirms reversals still does not treat the authorisation weakness, so accepting the plan on that basis misses the cause.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
The auditor specifies the exact corrective steps and control changes management is expected to implement, then leaves management to execute them.
errorWhy it is wrong: This describes developing detailed recommendations, not requesting an action plan; it also underuses management's process knowledge by prescribing the fix for them.
The plan is adequate because recovering the overpayment and reminding staff corrects the specific instances the engagement identified.
errorWhy it is wrong: It is tempting because the observed cases are indeed remedied, but correcting instances leaves the underlying weakness in place, so an action plan that stops at the symptoms is not adequate.
State the recommendation as the specific steps, owners, and dates management must follow, so the recommendation and the action plan are a single instruction.
errorWhy it is wrong: This is tempting because one combined instruction seems efficient, but it collapses the auditor's suggested course into management's committed plan and removes management's ownership of how the risk is addressed.