Audit, Assurance, and Compliance Monitoring
What to know
Assurance is about independent, evidence-based confidence. Candidates must understand the audit process: scoping, planning, fieldwork (evidence gathering, sampling, testing), reporting, and follow-up. Distinguish internal audit (independent function reporting to the board/audit committee) from external audit (independent third party) and from compliance monitoring (ongoing management activity). Know the difference between design effectiveness (is the control designed to meet the objective?) and operating effectiveness (did it operate as designed over the period?). Understand sampling risk, materiality, findings, management responses, and remediation tracking.
Traps
Questions often confuse monitoring (continuous, management-owned) with audit (periodic, independent). Another trap: a control that is well designed but not operating effectively - both must be tested. Watch for the assumption that a clean audit means no risk; it means the tested controls met their objectives within scope. Also beware of self-audit: the team that operates a control should not be the sole assurer of it.
Worked example / rule of thumb
An access review control is tested: the auditor inspects the policy and workflow (design) and samples quarterly reviews to confirm sign-offs and removal of inappropriate access (operating). Findings are rated, assigned an owner, and tracked to closure with evidence. Rule of thumb: design + operating effectiveness + evidence + independence = assurance. Monitoring detects drift; audit provides periodic independent verification.
Exam focus
Expect questions on audit types, evidence sufficiency, effectiveness testing, and remediation governance.