CIA Part 1 cheat sheet

Definition: internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations; it helps achieve objectives through a systematic, disciplined approach to evaluate and improve risk management, control, and governance processes.

Mandatory IPPF elements: the Core Principles, the Definition of Internal Auditing, the Code of Ethics, and the International Standards (Attribute and Performance). Implementation and supplemental guidance are recommended, not mandatory.

Attribute Standards (series 1000-1300) govern the organization and the individuals performing internal audit work; Performance Standards (series 2000-2600) describe the nature of internal audit work and its quality criteria.

Internal audit charter: a formal document defining the activity's purpose, authority, and responsibility; it is approved by the board, communicated throughout the organization, and reviewed periodically.

Functional reporting to the governing body covers charter approval, audit plan and budget approval, appointment and removal of the CAE, and receipt of audit communications; administrative reporting goes to senior management.

Assurance engagement: the internal auditor determines the nature and scope of the work. Consulting engagement: the client and auditor agree on nature and scope, with safeguards applied to preserve objectivity.

Three Lines Model: operational management owns and manages risk (first line), risk and compliance functions monitor and advise (second line), and internal audit provides independent objective assurance (third line) to the governing body.

Scope of internal audit covers governance, risk management, and control processes; taking on management responsibilities removes the basis for independent assurance.

Independence is freedom from conditions that threaten the ability to carry out responsibilities objectively; it has two components, organizational status and objectivity (an unbiased mental attitude).

Standard 1110: the CAE reports functionally to the board so that the internal audit activity has direct and unrestricted access to the governing body and is free of management interference.

Standard 1130.A1: internal auditors must not assess specific operations for which they were responsible within the previous 12 months.

Threats to objectivity include self-review, social pressure, economic interest, personal or family relationships, familiarity, undue influence, and conflicting roles.

Dual reporting: a functional line to the governing body protects independence; an administrative line to senior management supports budgeting, staffing, and day-to-day operations.

If independence or objectivity is impaired in fact or appearance, disclosure to the board is required; the CAE may reassign the auditor, add safeguards, or remove the engagement from that auditor.

Consulting work creates a potential self-review threat when the auditor later provides assurance over the same process; safeguards include rotation, disclosure, and separating consulting from assurance staff.

Standard 1112: where the CAE accepts roles or responsibilities beyond internal auditing, safeguards must be in place so that independence or objectivity is not impaired.

Standard 1210: internal auditors must possess the knowledge, skills, and other competencies needed for their responsibilities; proficiency is measured collectively for the internal audit activity, not solely per individual.

Standard 1210.A1: when the internal audit activity lacks the knowledge or skills needed for an engagement, the CAE must obtain competent advice and assistance from within or outside the organization.

Standard 1220 due professional care: the care and competence expected of a reasonably prudent and competent internal auditor; it does not imply infallibility or that all errors and fraud will be detected.

Standard 1220.A1: the extent of work needed to achieve engagement objectives is based on the assessed risk, materiality, and cost-benefit balance of the engagement.

Standard 1220.A2 and 1220.A3: auditors consider the use of technology-based audit and data analysis techniques and remain alert to significant risks, including fraud and information technology risks.

Standard 1210.A2: internal auditors need sufficient knowledge to identify indicators of fraud but are not expected to have the expertise of someone whose primary responsibility is fraud detection and investigation.

Standard 1230 continuing professional development: the IIA requires 40 CPD hours annually, of which at least 20 must be in internal audit subjects, with documentation retained.

Standard 1210.A3: internal auditors need sufficient knowledge of information technology risks and controls and of available technology-based audit techniques to perform their work.

Standard 1300: a QAIP covers all aspects of the internal audit activity and evaluates conformance with the Definition of Internal Auditing and the Standards, and whether the activity adds value and improves operations.

Standard 1311 internal assessments: ongoing monitoring of the performance of the internal audit activity plus periodic self-assessments designed to evaluate conformance with the Definition and Standards.

Ongoing monitoring includes supervision, working paper review, engagement checklists, and stakeholder feedback gathered throughout the year.

Standard 1312 external assessments: conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

Two external assessment approaches exist: a full external assessment, or a self-assessment with independent external validation.

Standard 1320: results of the QAIP, including internal and external assessments, are reported to senior management and the board.

Standard 1321: the internal audit activity may state that it 'conforms with the International Standards for the Professional Practice of Internal Auditing' only when QAIP results support that conclusion.

Standard 1322: nonconformance with the Code of Ethics or the Standards that affects the overall scope or operation of internal audit must be disclosed to senior management and the board.

Standard 2110: internal audit assesses and recommends improvements to governance, covering strategic and operational decision-making, oversight, ethics and values, performance management, and accountability.

Standard 2120: internal audit evaluates the effectiveness of the risk management process, including risk identification, assessment, response, and the potential for fraud (2120.A2).

Standard 2130: internal audit evaluates the adequacy and effectiveness of controls over reliability of financial reporting, effectiveness and efficiency of operations, safeguarding of assets, and compliance with laws and regulations.

COSO Internal Control framework: five components (control environment, risk assessment, control activities, information and communication, and monitoring activities) supported by 17 principles.

COSO ERM (2017): five components (governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting) supported by 20 principles.

Risk appetite is the amount and type of risk an organization is willing to accept in pursuing objectives; risk tolerance is the acceptable variation in performance around that appetite.

Control types: preventive (stops an event before it occurs), detective (identifies after occurrence), directive (causes or guides behavior), and corrective (remedies an event); controls may also be manual or automated, hard or soft.

Standard 2600: when management accepts a level of residual risk the CAE judges unacceptable, the matter is escalated to the board for resolution.