Internal Audit Plan

At Oakhurst Logistics the chief audit executive plans to rely on control testing performed six months ago by an external assurance provider whose competence and objectivity she has already confirmed. Since that testing, the company migrated the affected process to a new system. How should this change affect her reliance decision?

• AProceed with full reliance, because competence and objectivity were confirmed and those are the criteria that govern reliance
• BDiscard the earlier work completely and treat the migrated process as if no assurance had ever been obtained over it
• CAssess whether the earlier work still covers the current controls given the system change, and perform additional procedures on the parts the change has affected before relyingcheck_circle Correct
• DRely on the earlier work and record the system change as a matter for the next planning cycle rather than the current one

Why A is wrong: Tempting because competence and objectivity are correctly confirmed, but relevance and currency also matter; work performed before a process changed may no longer address the controls now in operation.

Why B is wrong: Tempting because the change reduces the work's value, but portions unaffected by the migration may remain relevant, so discarding everything wastes reliable evidence and overstates the effect of the change.

Why C is correct: Correct. Reliance requires that the work remain relevant and sufficient for the current objective; a system migration since testing means the earlier evidence must be re-evaluated and gaps covered by fresh procedures.

Why D is wrong: Tempting because deferring keeps the current plan simple, but relying on evidence that predates a known process change and postponing the issue leaves a live control area inadequately assured.

The chief audit executive at Pennistone Group has relied on the external financial auditors' control testing to reduce internal audit's own work in the sales cycle, and internal audit's conclusion in that area rests partly on that reliance. When reporting the sales-cycle results to the audit committee, how should the chief audit executive treat the reliance?

• APresent the conclusion as internal audit's own and omit the reliance, since disclosing another provider's involvement could confuse the committee
• BAttribute the sales-cycle conclusion entirely to the external auditors so the committee directs any follow-up questions to them
• CReport only the areas internal audit tested directly and leave the sales cycle out of the communication until internal audit retests it independently
• DDisclose that the conclusion relies on the external auditors' work, describe the extent of that reliance, and retain internal audit's responsibility for the overall conclusioncheck_circle Correct

Why A is wrong: Tempting because a clean single-voice conclusion reads simply, but concealing the basis for the conclusion misrepresents how the assurance was obtained and denies the committee information it needs to judge coverage.

Why B is wrong: Tempting because the external auditors did the testing, but internal audit retains responsibility for a conclusion it drew on leveraged work, so reassigning it to the other provider misstates accountability.

Why C is wrong: Tempting because it avoids explaining shared work, but withholding a completed conclusion the committee expects, and duplicating adequate testing, defeats the purpose of coordinated assurance.

Why D is correct: Correct. Transparent reporting discloses reliance and its extent while the internal auditor keeps ownership of the conclusion, giving the committee an accurate picture of how the assurance was assembled.

At Thackeray Utilities the chief audit executive is presenting the proposed risk-based plan to the audit committee for approval. A committee member asks how the plan will handle risks that arise after approval, given that the organisation operates in a volatile market. Which response best reflects sound risk-based planning?

• AThe plan is fixed once approved to protect its integrity, and any newly arising risk will be captured in the following year's assessment cycle.
• BThe plan delegates authority to line management to decide during the year which emerging risks internal audit should examine, keeping the function responsive to the business.
• CThe plan builds in a fixed contingency of unassigned hours at the start, and once those hours are consumed no further changes to coverage are made during the year.
• DThe plan is reviewed and adjusted periodically as risks change, with significant revisions and their resource impact reported to the audit committee during the year.check_circle Correct

Why A is wrong: Stability sounds like good governance, but treating an approved plan as unchangeable ignores that a risk-based plan is meant to respond to change and would leave new risks uncovered for up to a year.

Why B is wrong: This appears responsive, but handing the decision on audit coverage to management compromises the function's independence and the CAE's ownership of the plan.

Why C is wrong: A contingency reserve is a reasonable tool, but capping responsiveness at a preset number of hours turns a dynamic plan back into a static one the moment the reserve runs out.

Why D is correct: Correct: a dynamic plan is monitored and updated as the risk profile shifts, and material changes are communicated to the committee, keeping coverage aligned with current risk while preserving the reporting line.

The chief audit executive at Pinehurst Retail has completed the annual risk assessment, and the resulting list of high-risk areas would require more engagement hours than the approved audit resources can deliver. Management would prefer that lower-risk retail-store audits continue at their traditional frequency. How should the chief audit executive develop the plan?

• ASpread the available hours evenly across all rated areas so that every part of the audit universe receives some coverage within the year.
• BKeep the traditional store-audit frequency management prefers and fit the high-risk areas into whatever capacity is left over afterwards.
• CAllocate the available resources to the highest-rated risks first, and communicate to the board any significant risks the plan cannot cover given the resource constraint.check_circle Correct
• DReduce the assessed rating of several high-risk areas so that the resulting plan fits within the approved resources without a visible shortfall.

Why A is wrong: Even coverage feels fair, but distributing resources without regard to risk dilutes assurance over the areas that matter most and abandons the whole basis of a risk-based plan.

Why B is wrong: Honouring the historical schedule is tempting for stakeholder relations, but letting tradition and management preference outrank the risk assessment inverts the prioritisation the plan is meant to reflect.

Why C is correct: Correct: risk prioritisation directs limited resources to the greatest exposures, and the CAE must inform the board of the assurance gap created by the shortfall rather than absorb it silently.

Why D is wrong: This makes the plan look balanced, but manipulating risk ratings to match capacity corrupts the assessment and hides a real assurance gap from the board.

At Brayford Utilities the chief audit executive is deciding how to rank candidate engagements for next year's plan. One senior auditor wants to sort areas by the gross exposure that exists before any controls are considered, while another wants to sort by the exposure that remains after existing controls are taken into account. Which basis should primarily drive the ranking for a risk-based plan?

• AInherent risk, because ranking by gross exposure before controls gives the cleanest picture of where the organisation is most vulnerable.
• BThe simple average of inherent and residual risk, so that both the raw exposure and the mitigated exposure carry equal weight in the ranking.
• CControl risk alone, because the likelihood that controls fail to prevent or detect an issue is the decisive factor in where to audit.
• DResidual risk, because the plan should target the exposure that remains after existing controls, which is where assurance effort adds the most value.check_circle Correct

Why A is wrong: Tempting because inherent risk highlights raw exposure, but a plan built on it ignores mitigation already in place and can over-allocate effort to well-controlled areas.

Why B is wrong: Tempting as a compromise, but averaging dilutes the residual signal and has no basis in risk-based planning, which targets uncovered exposure.

Why C is wrong: Tempting because control weakness matters, but control risk is one component of residual risk, not a standalone ranking basis for the whole plan.

Why D is correct: Correct: residual risk reflects the exposure left after mitigation, so prioritising it directs limited audit resources to where uncovered risk is greatest.