CIA-3 - Internal Audit Plan (15% of the exam) - Section B.3
Recognize the importance for internal auditors to coordinate with other assurance providers and leverage their work, including criteria for evaluating reliance on that work.
Identify internal and external assurance providers operating alongside the internal audit function, and identify examples of and methods for coordinating assurance coverage to avoid duplication or gaps. Identify the criteria used to evaluate an assurance provider's competence and objectivity to determine how much reliance can be placed on their work.
The chief audit executive at Brindle Manufacturing is building next year's audit plan and learns that the external financial auditors already test controls over the revenue cycle each year. She wants to reduce duplicated testing by relying on that work. Before deciding how much to rely on it, what should she evaluate first?
AWhether the audit committee has formally approved the external auditors' engagement letter for the current financial year
BWhether relying on the external auditors' testing will reduce the internal audit function's own budgeted hours for the year
CThe external auditors' competence, objectivity, and the scope and adequacy of the work they performed on those controlscheck_circle Correct
DWhether the external auditors are willing to sign a statement accepting responsibility for the revenue-cycle conclusion
Before relying on another assurance provider's work, evaluate that provider's competence, objectivity, and the relevance and adequacy of the work performed. Reliance is justified only when the internal auditor has judged the other provider's competence and objectivity and confirmed the work's scope covers the objective; efficiency and approvals do not substitute for that judgement, and responsibility for the conclusion stays with internal audit.
Why A is wrong: Tempting because engagement approval is a real governance step, but committee approval of the external audit engagement says nothing about whether that work is competent, objective, or relevant to internal audit's control objective.
Why B is wrong: Tempting because efficiency motivates coordination, but cost saving is a benefit of reliance, not a criterion for it; the decision to rely must rest on the quality and relevance of the other provider's work.
Why C is correct: Correct. Reliance criteria require assessing the other provider's competence and objectivity and confirming that the work's scope, timing, and rigour actually cover the internal audit objective before placing reliance on it.
Why D is wrong: Tempting because shared responsibility sounds prudent, but the internal auditor retains responsibility for conclusions even when leveraging others' work, so seeking a transfer of responsibility misstates how reliance operates.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
Whether the compliance function reports to the same audit committee that oversees the internal audit function.
errorWhy it is wrong: A shared oversight body may aid coordination, but a common reporting line does not by itself establish that the compliance work is competent, objective, or well executed enough to rely on.
Rely on the work in full, because the documentation quality already demonstrates the competence needed for reliance
errorWhy it is wrong: Tempting because competence is genuine and evidenced, but reliance requires both competence and objectivity; strong documentation does not offset a reporting line that threatens the reviewers' independence from the area tested.
Remove the vendor controls from the internal audit plan entirely, since two other providers already intend to cover them
errorWhy it is wrong: Tempting because avoiding duplication is the goal, but dropping the area outright before assessing whether the others' work is reliable and sufficient could leave a coverage gap the internal auditor is accountable for.