CBA (CNCF) common mistakes
CBA · Understand the traps and how to avoid them.
Treating the internal audit charter as a formality and answering questions about audit independence or scope as if management's wishes or the audit committee's preferences could override the charter; for example, agreeing that the chief audit executive may report functionally to the CFO when the charter says the audit committee.
Candidates skim the governance material and rely on general corporate intuition, in which the finance function often appears to be the natural owner of internal audit. They conflate administrative reporting lines with functional reporting lines and forget that the charter is the formal mandate defining purpose, authority, and responsibility.
What to do instead
Before answering, restate the charter's three elements (purpose, authority, responsibility) and the dual-reporting model: functional reporting to the audit committee (approving the charter, plan, budget, and CAE appointment) and administrative reporting to senior management. Test each answer option against whether it preserves organizational independence and the CAE's unrestricted access.
Classifying a situation as a conflict of interest or a confidentiality breach based on the job title involved rather than on the facts of the relationship; for example, assuming any gift from a vendor is prohibited regardless of value, intent, or the institution's written policy thresholds, or assuming a loan officer's referral to an affiliated title agency is acceptable because it is 'common practice'.
Candidates memorize labels (gift, outside employment, related party) without the decision criteria that distinguish permissible from impermissible conduct. They substitute moral intuition for the institution's code of ethics and the IIA Code of Ethics principles.
What to do instead
Apply a fixed sequence: identify the ethical principle at stake (integrity, objectivity, confidentiality, competency), identify the specific policy provision and any disclosure/approval requirement, then evaluate whether a reasonable and informed third party would see objectivity as impaired. Answer the option that requires disclosure and recusal when objectivity is threatened.
Confusing the stages of the internal audit engagement: drafting the engagement objectives as if they were the audit program, or jumping to fieldwork procedures before assessing risk and defining scope, and answering 'test of controls' where the question is asking for a risk assessment or engagement planning step.
The audit process is taught as a list, so candidates memorize the names of the phases without the inputs and outputs that link them. Under time pressure, any answer containing the word 'test' or 'documentation' looks plausible.
What to do instead
Memorize the flow as input-to-output pairs: engagement planning consumes the risk assessment and prior findings and produces objectives, scope, and criteria; the audit program translates objectives into procedures; fieldwork produces evidence and workpapers; reporting produces conclusions and ratings; follow-up verifies remediation. When stuck, ask which document the question says exists and which document is being produced.
Selecting the strongest-sounding audit evidence or the largest sample without regard to relevance and reliability; for example, accepting management's verbal assurance as sufficient evidence for a control conclusion, or choosing a haphazard sample and describing it as statistical.
Candidates treat evidence questions as common sense and pick the option that feels most thorough. They do not apply the reliability hierarchy (external over internal, documentary over oral, auditor-observed over client-represented) or the distinction between statistical and non-statistical sampling.
What to do instead
Rank evidence by independence of source and directness of observation, and prefer corroborated documentary evidence over representation. For sampling, check whether the question requires projection of error rates or a confidence level; only probabilistic selection supports statistical conclusions, and only a representative frame supports extrapolation to the population.
Treating inherent risk, control risk, and residual risk as interchangeable, and answering that a strong control environment eliminates risk; for example, stating that residual risk is zero once controls are documented, or that a high-likelihood, low-impact risk should always be avoided rather than accepted or mitigated.
Candidates learn the risk terms as definitions but never practice the arithmetic and logic that connect them (residual risk is inherent risk after the effect of controls). The word 'eliminate' in an option is attractive because it sounds like good control.
What to do instead
Work every risk question through the chain: identify the event and its likelihood and impact, identify the control and whether it is preventive or detective and design versus operating effectiveness, then compute residual exposure. Reject any option claiming controls eliminate risk; controls reduce likelihood or impact to a residual level that must still be compared to the risk appetite.
Answering segregation-of-duties questions by counting people rather than functions; for example, concluding that duties are properly separated because two different employees handle a transaction, when one employee can both initiate and approve it, or when the same person reconciles an account they can post to.
Candidates look for the presence of multiple named individuals and stop there. They miss that the incompatible functions are authorization, custody, recording, and reconciliation, and that compensating controls (such as independent review or system-enforced limits) can change the conclusion.
What to do instead
Map each role in the scenario to the four incompatible functions and check whether any single person spans two of them. Then check for compensating controls: system access restrictions, supervisory review with evidence, and independent reconciliation. Choose the option that separates the conflicting functions or, if impossible, adds a documented independent review.
Assuming a product or transaction is exempt from BSA/AML requirements because the customer is long-standing, the amount is below a round-number threshold, or the customer is a known local business; for example, deciding no suspicious activity report is needed because the transaction was only slightly under the reporting threshold.
Candidates fixate on dollar thresholds and forget that structuring, unusual patterns, and lack of economic sense are the real triggers. Familiarity bias in the scenario ('valued customer for 20 years') pulls answers toward no action.
What to do instead
Separate the two decisions: currency transaction reporting is threshold-driven, while suspicious activity reporting is behavior-driven and has no dollar minimum. Ask whether the transaction lacks apparent lawful purpose, deviates from the customer's profile, or suggests structuring; if so, the answer is to escalate and file, and never to tip off the customer.
Confusing the roles of the three lines of defense and assigning a control-testing or risk-owning responsibility to internal audit; for example, answering that internal audit should design the control that mitigates a newly identified risk, or that the business line is responsible for independent assurance.
The model is learned as a diagram without the accountability logic. Candidates see internal audit as the most competent party and therefore assign it whatever task requires expertise, ignoring the independence impairment that results.
What to do instead
Anchor each line to its accountability: the first line owns and operates controls and accepts risk; the second line sets frameworks, monitors, and challenges; the third line provides independent assurance and must not design or operate the controls it audits. Any option that has internal audit owning, designing, or operating a control is wrong regardless of how sensible it sounds.
Treating regulatory capital and accounting capital as the same number, or ignoring the distinction between the leverage ratio and risk-based capital ratios; for example, answering that a certain asset sale improves the Tier 1 leverage ratio when it only changes risk-weighted assets.
Candidates memorize ratio names without the denominators. Risk-weighted ratios respond to asset risk weights, while the leverage ratio responds to total exposure regardless of risk weight, so the same balance-sheet change moves them differently.
What to do instead
For every capital question, write down numerator and denominator before evaluating the options: common equity tier 1, tier 1, and total capital over risk-weighted assets versus tier 1 over average total consolidated assets. Then check whether the proposed transaction changes the numerator (earnings, deductions, distributions) or the denominator (risk weights, exposure), and whether buffers or prompt corrective action thresholds are implicated.
Answering IT and data-security questions by naming the control category without matching it to the threat or the control objective; for example, recommending encryption as the fix for unauthorized transaction approval, or treating a business continuity plan as equivalent to a disaster recovery plan for restoring systems.
Candidates associate security with a short list of buzzwords (encryption, firewall, backup) and pick whichever appears. They do not distinguish confidentiality, integrity, and availability objectives, nor preventive, detective, and corrective controls.
What to do instead
State the objective first (confidentiality, integrity, or availability), then the threat (unauthorized access, alteration, or outage), then choose the control type that addresses it: access controls and segregation of system duties for unauthorized approval, integrity checks and change management for alteration, tested recovery plans for outage. Keep business continuity (continuing critical operations) distinct from disaster recovery (restoring technology), and require evidence of testing for either.