CIA Aptitude Test cheat sheet

Definition: internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations; it helps achieve objectives by bringing a systematic, disciplined approach to evaluate and improve risk management, control, and governance.

The IIA Global Internal Audit Standards (effective 9 January 2025) replaced the prior IPPF; they contain 5 domains, 15 principles, and 52 standards, with the Code of Ethics and the definition of internal auditing as the mandatory core.

Mandatory elements a conformance claim requires: the definition, the Code of Ethics, the Standards (Principles and Requirements), and the standards on internal audit's mandate, governance, and the CAE's role.

Two service lines: assurance (objective examination of evidence for independent assessment) and consulting (advisory, nature and scope agreed with the client); an engagement cannot be both for the same scope simultaneously.

The internal audit activity (IAA) scope is not limited to financial controls; it evaluates governance, risk management, and control processes across the whole organization, including strategy and culture.

The audit charter is a formal document approved by the board that defines the IAA's purpose, authority, and responsibility; it must be reviewed periodically and be consistent with the Standards.

Value proposition: internal audit provides objective assurance and insight, improves processes, and supports the board in oversight; adding value means aligning engagements with organizational objectives and risk.

The CAE reports functionally to the board (or audit committee) and administratively to executive management; functional reporting covers charter approval, audit plan approval, and performance evaluation.

Independence is the freedom from conditions that threaten the ability of the IAA to carry out responsibilities without bias; it has two components: organizational independence and individual objectivity.

Objectivity is an unbiased mental attitude; it is compromised when an auditor evaluates an activity for which they had prior responsibility or performs management duties.

A one-year cooling-off period applies before an auditor may be assigned to audit an activity they previously managed or performed.

Auditors must not design, install, or operate control systems; they may recommend controls and perform consulting, but must not assume management responsibility.

The CAE discloses to the board any interference that limits scope, restricts access to records, or prevents objective work, and escalates unresolved matters.

Impairments must be disclosed to the board; the CAE documents the impairment, its effect on the engagement, and the mitigation or resolution.

Independence may be impaired if the IAA is assigned operational responsibility; if this is unavoidable, the board must be informed and safeguards documented.

Objectivity is supported by rotation of audit staff, independent review of workpapers, and separation of the auditor from the activity being audited.

Proficiency: the IAA collectively must possess or obtain the knowledge, skills, and competencies needed to perform its responsibilities; individual auditors must have the knowledge and skills appropriate to their assignments.

Due professional care is the care and skill expected of a reasonably prudent and competent internal auditor; it does not imply infallibility or that no errors will occur.

Due care requires consideration of the cost of assurance versus the benefit, and the relative materiality and significance of the matter.

Auditors must consider the risk of significant error, fraud, noncompliance, and other exposures when planning and performing work.

Continuing professional education: the Standards require ongoing development; a common benchmark is at least 40 hours per year for internal auditors, with a portion related to the profession.

The CAE must ensure the IAA has sufficient resources and competencies, and must assess whether the team can complete the plan; gaps must be reported to the board.

Auditors may use the work of others (experts, other assurance providers) but must evaluate their competence, objectivity, and the sufficiency of the work performed.

The CAE must obtain competent advice and assistance when the IAA lacks the knowledge or skills required for an engagement.

A QAIP covers all aspects of the IAA and includes both internal assessments and external assessments; it is designed to provide reasonable assurance that the IAA conforms to the Standards and the Code of Ethics.

Internal assessments include ongoing monitoring of performance and periodic self-assessments; ongoing monitoring is continuous, periodic self-assessments are performed at least annually.

External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

External assessment options: a full external assessment or a self-assessment with independent validation (SAIV); both require an independent, qualified reviewer.

The external assessor must be independent of the organization and the IAA, and must not have a conflict of interest (e.g., prior consulting for the IAA within a defined period).

Results of external assessments are reported to the board; the report includes the assessment opinion (generally conforms, partially conforms, does not conform) and any improvement opportunities.

Nonconformance with the Code of Ethics or Standards must be disclosed to the board; significant nonconformance affects the ability to state that the IAA conforms.

The QAIP results feed into the annual audit plan, training, and resource decisions; the CAE monitors corrective actions until closure.

Governance is the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the organization's activities toward its objectives.

Risk management is the process of identifying, assessing, managing, and monitoring risks; the IAA evaluates its effectiveness and contributes to improvement, not ownership.

Control is any action taken by management to enhance the likelihood that objectives are achieved; controls include preventive, detective, and corrective types.

COSO Internal Control framework has 5 components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

COSO ERM framework has 5 components and 20 principles; it addresses strategy, governance, and culture as well as performance and review.

The three lines model: first line owns and manages risk; second line provides oversight, guidance, and monitoring; third line (internal audit) provides independent assurance to the board.

The board provides oversight of risk and control; the audit committee typically oversees internal audit, external audit, and financial reporting.

The IAA must evaluate the adequacy and effectiveness of controls, and consider the organization's risk appetite and tolerance in its assessments.

Fraud is any intentional act involving deception to secure an unfair or unlawful gain; the fraud triangle consists of pressure/incentive, opportunity, and rationalization.

The IAA must consider fraud risk when assessing governance, risk management, and control; it evaluates the organization's fraud risk management program, not just individual incidents.

Auditors are not expected to have the expertise of a fraud examiner; when fraud indicators are found, the CAE must ensure appropriate expertise is engaged.

Fraud red flags include unusual journal entries, lifestyle changes, segregation-of-duties gaps, and management override of controls.

The IAA must not investigate fraud unless it has the competence and authority; investigations are typically led by management or specialists, with internal audit providing assurance.

Fraud risk assessment should consider incentive, opportunity, rationalization, and the organization's fraud risk appetite and tolerance.

Controls to mitigate fraud include segregation of duties, authorization limits, reconciliation, whistleblower hotlines, and mandatory rotation of duties.

The auditor must report suspected fraud to the appropriate level of management and the board, and must not disclose to unauthorized parties.

Engagement planning includes defining objectives, scope, and criteria; identifying risks; and determining the resources and approach needed.

An engagement work program documents the procedures to be performed; it must be approved before work begins and modified with approval if scope changes.

Supervision includes directing, reviewing, and approving work; the supervisor must ensure work is performed as planned and documented.

The engagement plan should consider the organization's objectives, significant risks, and the adequacy of the control environment.

Materiality and significance guide the extent of testing; the auditor considers both quantitative and qualitative factors.

The engagement team must have the collective competence to perform the work; the CAE assigns staff based on skills and independence.

Workpapers must be reviewed by a supervisor before the engagement report is issued; review evidence must be documented.

Engagement planning should include coordination with other assurance providers to avoid duplication and gaps.

Sufficient evidence is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions; it must be relevant, reliable, and sufficient.

Evidence reliability hierarchy: direct observation and inspection generally more reliable than indirect; original documents more reliable than copies; independent third-party evidence more reliable than internal.

Audit procedures include inspection, observation, inquiry, confirmation, recalculation, reperformance, and analytical procedures.

Analytical procedures compare financial and nonfinancial data to expectations; significant variances require follow-up and documentation.

Sampling risk and nonsampling risk must be considered; the auditor documents the sampling methodology and conclusions.

Workpapers must be complete, accurate, and support the conclusions; they are the property of the organization, not the auditor.

The auditor must document the criteria used, the evidence obtained, and the conclusion reached, including any limitations.

Findings must be based on evidence and include the criteria, condition, cause, and effect (or risk) to support recommendations.

Engagement communication must include objectives, scope, and results; it must be accurate, objective, clear, concise, constructive, complete, and timely.

The final report should include the engagement objectives, scope, results, conclusions, and recommendations; it may include management's response and action plan.

Findings should state the criteria, condition, cause, and effect; recommendations should be actionable and addressed to the responsible party.

The CAE must communicate results to the board and management; significant risk exposures and control failures must be escalated.

Management's response should include the action plan and responsible person and target date; the IAA monitors implementation.

Follow-up procedures verify that management actions have been implemented and are effective; unresolved issues are escalated to the board.

Communication should be timely; interim reporting may be used for significant issues before the final report.

The IAA should obtain feedback on engagement performance and use it to improve the QAIP.

Business acumen includes understanding the organization's strategy, operating environment, industry, and key performance drivers.

Organizational behavior concepts relevant to internal audit include motivation, group dynamics, communication styles, and change management.

The auditor must understand the organization's culture and tone at the top, as these affect the control environment.

Stakeholder management requires identifying key stakeholders, understanding their expectations, and communicating effectively.

The auditor should consider the organization's structure, governance, and decision-making processes when assessing risk and control.

Change management principles help the auditor evaluate whether changes are properly controlled and communicated.

Conflict of interest and ethical behavior are influenced by organizational culture and incentives; the auditor assesses these factors.

Effective communication with management requires objectivity, clarity, and respect for confidentiality.