CIA-3 - Internal Audit Operations (25% of the exam) - Section A.3
Describe the key elements required to align internal audit strategy to stakeholder expectations, including the purpose of mission and vision statements and resource planning alignment.
Describe how the internal audit function's strategy supports the organisation's broader business strategy and risk management practices, and explain the purpose of the function's mission and vision statements in anchoring that strategy. Describe how internal audit resource planning is aligned to the strategy, and identify the conditions that warrant reviewing and revising it.
Internal audit strategyMission and visionStakeholder expectations
The chief audit executive at Rawcliffe Foods is finalising the internal audit strategy and wants to be sure it supports, rather than conflicts with, what the organisation and its stakeholders are trying to achieve. Which consideration should most guide the strategy's design?
AThe strategy should link the function's priorities to the organisation's objectives and its stakeholders' expectations, so audit effort supports the organisation's direction.check_circle Correct
BThe strategy should mirror the finance department's operating plan, since finance oversees much of the organisation's external reporting.
CThe strategy should focus on the areas where the audit team already holds the deepest expertise, to make the plan easier to deliver.
DThe strategy should be built to keep audit findings low so that relationships with auditees and management remain comfortable.
An aligned internal audit strategy links the function's priorities to the organisation's objectives and its stakeholders' expectations. Strategy alignment means the function's direction supports, rather than competes with, the organisation's goals and what stakeholders expect assurance to cover. Anchoring the strategy to organisational objectives keeps audit effort relevant, which is why it is not tied to one department, to the team's convenience, or to keeping findings comfortably low.
Why A is correct: An internal audit strategy is aligned when it connects the function's priorities to the organisation's objectives and stakeholder expectations, keeping audit effort relevant to where the organisation is heading.
Why B is wrong: Copying finance's operating plan ties the function to one department's agenda rather than the organisation's overall objectives and its broader stakeholder expectations.
Why C is wrong: Designing around existing expertise favours delivery convenience over the organisation's priorities and can leave significant risks uncovered.
Why D is wrong: Shaping the strategy to minimise findings compromises the function's objectivity and misreads what stakeholders actually expect from assurance.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
The annual audit plan, because a stakeholder expectation is satisfied by scheduling individual engagements in the current year rather than by any longer-term direction.
errorWhy it is wrong: Tempting because the plan is where engagements appear, but a multi-year expectation about capability and focus is a strategic input that should shape the strategy before it drives yearly plans.
Draft the strategy from the previous year's audit plan and circulate it to the board once it is complete for their information.
errorWhy it is wrong: Reusing last year's plan feels efficient, but building the strategy from a prior plan without first learning current expectations risks misaligning it with what stakeholders now value.
The strategy expresses the enduring purpose of the function, while the mission lists the tactical steps to be completed within the current year.
errorWhy it is wrong: This is tempting through familiarity with both terms, but it swaps their roles: enduring purpose belongs to the mission and time-bound direction belongs to the strategy.