CIA-3 - Internal Audit Plan - Section B.1

Identify sources of potential engagements, including the audit universe, board and management requests, applicable laws and regulations, and emerging market, technology, and industry trends.

Describe the process for defining the audit universe and its key components, and recognise the applicability of Topical Requirements when identifying potential engagements. Describe how the function considers board and management requests, applicable laws and regulatory mandates, market and industry trends, organisational changes, and emerging technologies such as artificial intelligence, blockchain, and robotic process automation, and explain the reasons behind audit cycle requirements.

Audit universeTopical RequirementsEmerging technology risk

Practice question for this objective

Free sampleInternal Audit Planmedium

The chief audit executive at Camberwell Logistics observes that competitors are rapidly shifting to third-party electric-vehicle fleets and that a related industry risk is emerging. None of this is yet reflected in the audit universe. What is the most appropriate next step in the planning process?

  • AWait for senior management to formally request coverage of the fleet strategy before taking any planning action.
  • BAnalyse the emerging trend, update the audit universe with any newly relevant auditable areas, and weight the related risk in the assessment supporting the plan. Correct
  • CAdd an electric-vehicle fleet engagement to the current year's plan without first assessing its relative risk.
  • DRecord the trend but exclude it from planning because it reflects competitor activity rather than the organisation's own operations.
Emerging market and industry trends are a source of engagements the chief audit executive proactively analyses to refresh the audit universe and risk assessment. A structural industry shift alters the organisation's future risk even before its own operations change. Scanning for it, updating the audit universe, and weighting the risk keeps the plan forward-looking rather than reactive to management requests.

Why A is wrong: Management requests are one input, but relying on them to trigger scanning cedes the chief audit executive's own duty to monitor emerging trends and keep the audit universe current.

Why B is correct: Emerging market and industry trends are a named source of engagements; analysing the trend, refreshing the audit universe, and reflecting the risk in the assessment is the proactive, evidence-based response.

Why C is wrong: Acting quickly seems responsive, but inserting an engagement without weighing its risk against others can displace higher-priority work and skips the risk-based method.

Why D is wrong: The trend does originate with competitors, but industry shifts change the organisation's own risk profile, so excluding it from planning ignores a legitimate emerging source of engagements.

See more CIA-3 practice questions, answers explained.

More in this domain

Back to all Internal Audit Plan objectives, or the CIA-3 cert hub.

Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors. Original, blueprint-aligned practice material only.