Free CIA-3 flashcards

An engagement uncovers a significant matter causing ongoing loss, but the final report is weeks away. What does timely communication require?

Timeliness is judged by whether stakeholders receive results soon enough to act. A significant matter causing continuing harm warrants an interim communication to management and the board, because waiting for the scheduled final report defeats the purpose of communicating at all.

Bundling a significant finding into the final report is fine because it can then be presented with full context and a documented management response.

Presenting with full context feels tidy, but timeliness means communicating significant findings soon enough for action. A six-week delay lets a known loss continue, so an interim communication is needed instead.

How does the audit universe differ from the annual audit plan?

The audit universe is the complete population of entities, processes and systems that could be audited. The annual plan applies a risk assessment to that population to select and schedule the engagements the function can actually resource, so the plan is always a risk-prioritised subset of the universe.

The audit universe is the risk-prioritised set of engagements approved for the year, and the audit plan is the broader catalogue of everything that could be audited.

This inverts the two terms. Both involve lists, which makes the swap tempting, but the universe is the full catalogue of what could be audited and the plan is the selected, scheduled subset.

Before relying on another assurance provider's work, what must an internal auditor evaluate first?

The provider's competence, its objectivity, and the relevance and adequacy of the work performed. Efficiency and governance approvals do not substitute for that judgement, and responsibility for the conclusion stays with internal audit.

Reliance is justified once the audit committee has formally approved the external auditors' engagement letter for the year.

Engagement approval is a real governance step, but committee approval of the external audit engagement says nothing about whether that work is competent, objective, or relevant to internal audit's control objective.

Under a quality assurance and improvement programme, how can the external assessment obligation be discharged?

By a full external assessment or a self-assessment with independent external validation. Either way it must occur at least once every five years and use a qualified reviewer who is independent of the organisation, which is what supplies the objectivity.

The external assessment must be a full assessment performed every year by a reviewer employed elsewhere within the same organisation.

An annual cadence is stricter than required, and a reviewer from inside the same organisation is not independent of it, so this fails the independence expectation. The rule is at least every five years by a qualified reviewer from outside the organisation.