CIA-3 - Internal Audit Operations (25% of the exam) - Section A.4
Recognize the chief audit executive's responsibilities for building relationships and communicating with senior management and the board, including reporting overall effectiveness and quality results.
Explain the importance of formal and informal communication between the chief audit executive and senior management and the board, and the protocol for communicating the audit plan, its changes, independence concerns, and significant risk exposures. Describe the responsibility to report, in a timely manner, the overall effectiveness of the organisation's risk management and control processes, identify themes across engagements, and communicate quality assessment results and remediation plans.
Chief audit executiveBoard reportingQuality assessment communication
Practice question for this objective
lock_openFree sampleInternal Audit Operationshard
The chief audit executive at Ravenshill Group is preparing the annual communication to the board on the overall effectiveness of the internal audit function. A junior analyst suggests the report should simply list the number of engagements completed during the year. What should the annual communication to the board most appropriately convey?
AA count of completed engagements and the total hours charged, so the board can benchmark productivity against the prior year.
BAn assessment of internal audit's performance relative to its plan and objectives, together with significant risk and control issues and conformance with professional requirements.check_circle Correct
CA detailed transcript of every management response received during the year so the board can review each disagreement in full.
DA summary confined to the two or three engagements that produced the most favourable results for management this year.
The chief audit executive's periodic report on internal audit effectiveness covers performance against plan, significant risk and control issues, and conformance. The board judges the function through the chief audit executive's periodic reporting, so that reporting must address performance against the plan and objectives, significant risk and control exposures, and conformance with the professional requirements rather than mere activity volume.
Why A is wrong: Activity counts are tempting because they are easy to compile and look objective, but volume metrics alone say nothing about whether the function achieved its objectives, covered key risks, or conformed with professional requirements.
Why B is correct: An effective annual communication reports the function's performance against its plan and objectives, the significant risk and control matters identified, and its conformance status, giving the board what it needs to judge overall effectiveness.
Why C is wrong: This appears thorough, but flooding the board with raw responses obscures the overall picture; the annual communication should synthesise effectiveness and significant matters, not reproduce every engagement exchange.
Why D is wrong: Highlighting favourable outcomes is tempting for reputational reasons, but a selective good-news summary distorts the assessment and withholds the significant risk and control issues the board relies on.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
Reopen the engagement and gather additional evidence until the senior manager agrees the residual risk is unacceptable, before involving anyone else.
errorWhy it is wrong: More evidence can strengthen the case, but the disagreement is about risk acceptance, not evidence sufficiency, and continuing to negotiate with the same manager who has declined delays the matter from reaching the party able to resolve it.
Remove the finding on the chief executive's assurance and reinstate it later only if the remediation is not completed by the next meeting.
errorWhy it is wrong: This is tempting because it appears to trust management and avoid conflict, but suppressing a current significant weakness at management's request compromises the chief audit executive's duty to report candidly to the board.
Wait until each affected business unit has responded to its individual engagement report before mentioning the pattern to anyone.
errorWhy it is wrong: Waiting for unit-level responses is tempting because it feels orderly, but it delays surfacing an aggregate significant exposure that the board needs to understand at a governance level now, not engagement by engagement.