CIA-3 - Quality of the Internal Audit Function (15% of the exam) - Section C.2
Identify appropriate disclosure of nonconformance with The IIA's Global Internal Audit Standards, including what must be communicated and the steps for communicating it to senior management and the board.
Identify the information that must be disclosed when the internal audit function does not conform with the Global Internal Audit Standards, including the circumstances, actions taken, impact, and rationale for the nonconformance. Describe the key steps for communicating that nonconformance to senior management and the board in a timely and transparent way.
lock_openFree sampleQuality of the Internal Audit Functionmedium
At Kelsington Mutual the chief audit executive concludes, following an internal assessment, that a persistent shortage of resources has left several assurance engagements unperformed and has narrowed the internal audit function's overall coverage. The chief audit executive judges that this nonconformance affects the function's overall scope and operation. To whom must the chief audit executive disclose the nonconformance and its impact?
ATo senior management and the board, together with the impact of the nonconformance on the function's overall scope and operation.check_circle Correct
BTo the external quality assessor at the next external assessment, so an independent party can validate the finding before it is escalated further.
CTo the audit committee chair informally, keeping the matter off the formal record until resourcing is resolved so the report is not prematurely alarming.
DTo operational line management responsible for the underfunded areas, so the resource gap can be corrected before any wider communication is made.
Nonconformance that affects the internal audit function's overall scope or operation must be disclosed to both senior management and the board. Because the resource shortfall degrades the function's overall coverage, it meets the threshold for mandatory disclosure, and the standards designate senior management and the board as the recipients so those charged with oversight understand the limitation and its impact.
Why A is correct: When nonconformance affects the overall scope or operation of the internal audit function, the standards require the chief audit executive to disclose both the nonconformance and its impact to senior management and the board.
Why B is wrong: It is tempting because external assessors do evaluate conformance, but it wrongly defers a required current-year disclosure and treats the assessor as the primary recipient rather than senior management and the board.
Why C is wrong: It is tempting because a quiet word feels proportionate, but an informal aside is not the required disclosure and withholding it from the formal record undermines the board's oversight of the function.
Why D is wrong: It is tempting because line management controls some resources, but disclosure of function-wide nonconformance is owed to senior management and the board, not routed to the managers whose areas went unaudited.
Exam traps in Quality of the Internal Audit Function
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
Both matters must be disclosed to senior management and the board, because any deviation from the Standards is nonconformance that requires escalation to that level.
errorWhy it is wrong: Tempting because both are genuine deviations from the Standards, but it is wrong: only nonconformance that affects the overall scope or operation of the function reaches the senior management and board threshold.
The engagement client and the process owner responsible for the restricted information, so the access barrier can be lifted at its source.
errorWhy it is wrong: Tempting because those parties can practically remove the restriction, but resolving the cause operationally is not the same as the governance disclosure the Standards require for functionwide nonconformance.
Record the gap in the internal quality working papers and address it through the routine action plan, since the assessor has already documented it externally.
errorWhy it is wrong: It is tempting because an action plan is genuinely required, but confining a nonconformance that affects scope and operation to working papers withholds it from the senior management and board who need to know.