CIA-3 - Internal Audit Plan (15% of the exam) - Section B.1
Identify sources of potential engagements, including the audit universe, board and management requests, applicable laws and regulations, and emerging market, technology, and industry trends.
Describe the process for defining the audit universe and its key components, and recognise the applicability of Topical Requirements when identifying potential engagements. Describe how the function considers board and management requests, applicable laws and regulatory mandates, market and industry trends, organisational changes, and emerging technologies such as artificial intelligence, blockchain, and robotic process automation, and explain the reasons behind audit cycle requirements.
The chief audit executive at Camberwell Logistics observes that competitors are rapidly shifting to third-party electric-vehicle fleets and that a related industry risk is emerging. None of this is yet reflected in the audit universe. What is the most appropriate next step in the planning process?
AWait for senior management to formally request coverage of the fleet strategy before taking any planning action.
BAnalyse the emerging trend, update the audit universe with any newly relevant auditable areas, and weight the related risk in the assessment supporting the plan.check_circle Correct
CAdd an electric-vehicle fleet engagement to the current year's plan without first assessing its relative risk.
DRecord the trend but exclude it from planning because it reflects competitor activity rather than the organisation's own operations.
Emerging market and industry trends are a source of engagements the chief audit executive proactively analyses to refresh the audit universe and risk assessment. A structural industry shift alters the organisation's future risk even before its own operations change. Scanning for it, updating the audit universe, and weighting the risk keeps the plan forward-looking rather than reactive to management requests.
Why A is wrong: Management requests are one input, but relying on them to trigger scanning cedes the chief audit executive's own duty to monitor emerging trends and keep the audit universe current.
Why B is correct: Emerging market and industry trends are a named source of engagements; analysing the trend, refreshing the audit universe, and reflecting the risk in the assessment is the proactive, evidence-based response.
Why C is wrong: Acting quickly seems responsive, but inserting an engagement without weighing its risk against others can displace higher-priority work and skips the risk-based method.
Why D is wrong: The trend does originate with competitors, but industry shifts change the organisation's own risk profile, so excluding it from planning ignores a legitimate emerging source of engagements.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
Management requests take precedence over board requests, because management has direct operational knowledge of where the risks actually sit.
errorWhy it is wrong: This is tempting because management holds operational detail, but that does not give management requests automatic precedence, and it ignores the independence considerations attached to them.
An emerging technology trend and an established process are treated identically, because both are simply line items awaiting a scheduled audit date.
errorWhy it is wrong: This is tempting because both eventually appear in planning, but a trend is a forward-looking signal that may spawn new auditable areas, not an already-defined entity awaiting a date.
Remove the area from the plan without further action, because management's formal acceptance transfers responsibility away from internal audit entirely.
errorWhy it is wrong: Tempting because acceptance is management's prerogative, but internal audit's duty to escalate an appetite-exceeding acceptance does not simply disappear.