CIA Part 1 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Definition of internal auditing

Independent, objective assurance and consulting activity designed to add value and improve an organization's operations; it helps achieve objectives by bringing a systematic, disciplined approach to evaluate and improve risk management, control, and governance processes.

Mandatory IPPF elements

Core Principles, Definition of Internal Auditing, Code of Ethics, and the International Standards (Attribute and Performance). Other IPPF guidance, such as implementation and supplemental guidance, is recommended rather than mandatory.

Internal audit charter

Formal document defining the internal audit activity's purpose, authority, and responsibility. It must be approved by the board, communicated throughout the organization, and reviewed periodically.

Attribute versus Performance Standards

Attribute Standards (1000-1300) address the organization and the individuals performing internal audit work; Performance Standards (2000-2600) describe the nature of internal audit work and its quality.

Assurance versus consulting engagement

In assurance engagements the internal auditor determines the nature and scope of work; in consulting engagements the client and auditor agree on nature and scope, with safeguards applied to protect objectivity.

Functional reporting to the board

The reporting line covering charter approval, audit plan and budget approval, appointment and removal of the CAE, and receipt of audit results; it protects the organizational independence of internal audit.

Three Lines Model

Governing body, management, and internal audit working together: operational management owns risk (first line), risk and compliance functions monitor it (second line), and internal audit gives independent assurance (third line).

Independence versus objectivity

Independence is freedom from conditions that threaten objectivity and is reflected in organizational status; objectivity is an unbiased mental attitude allowing auditors to reach conclusions without compromising quality.

Twelve-month restriction 1130.A1

Internal auditors must not assess specific operations for which they were previously responsible; Standard 1130.A1 sets that threshold at the previous 12 months.

Objectivity threat categories

Common threats include self-review, social pressure, economic interest, personal or family relationships, familiarity, undue influence, and conflicting roles such as performing management duties.

Impairment disclosure requirement

If independence or objectivity is impaired in fact or appearance, the details must be disclosed to the board; the CAE may reassign the auditor or add safeguards.

CAE roles beyond auditing

When the CAE accepts additional management roles, safeguards such as separate reporting lines, board oversight, or periodic review must prevent impairment of independence or objectivity, per Standard 1112.

Dual reporting structure

Functional reporting to the governing body safeguards independence, while administrative reporting to senior management covering budget, human resources, and daily operations supports routine functioning of the internal audit activity.

Self-review threat in consulting

Performing consulting work on a process the auditor later must assure creates a self-review threat; safeguards include rotation, disclosure, and assigning different auditors to the assurance engagement.

Proficiency standard 1210

Internal auditors must possess the knowledge, skills, and other competencies needed for their responsibilities; the internal audit activity's collective proficiency must be sufficient, not necessarily each individual's.

Obtaining competent advice 1210.A1

When internal auditors lack the knowledge or skills required for an engagement, the CAE must obtain competent advice and assistance from inside or outside the organization.

Due professional care

The reasonable care and competence expected of a reasonably prudent and competent internal auditor; it does not imply infallibility or that every error or fraud will be detected.

Work extent factors 1220.A1

The extent of work needed to achieve engagement objectives depends on the assessed risk, materiality, and the cost-benefit balance of obtaining evidence versus its value.

Fraud knowledge requirement

Internal auditors need enough knowledge to identify indicators of fraud but are not expected to have the expertise of a person whose primary responsibility is fraud detection and investigation.

Continuing professional development hours

The IIA requires 40 hours of continuing professional development annually, of which at least 20 hours must be in internal audit subjects, with completion documented.

QAIP purpose

A quality assurance and improvement program evaluates conformance with the Definition of Internal Auditing and the Standards, and assesses whether the activity adds value and improves operations.

Ongoing internal monitoring

Part of internal assessments: day-to-day supervision, review of working papers, checklists, and stakeholder feedback that continuously monitor the quality of internal audit work.

External assessment frequency

An external assessment must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

Self-assessment with independent validation

One of two external assessment approaches: a structured self-assessment of the internal audit activity validated by an independent external reviewer; the other approach is a full external assessment.

Conformance statement limitation

Under Standard 1321, the internal audit activity may state that it conforms with the International Standards only when the results of the QAIP support that conclusion.

Nonconformance disclosure 1322

Nonconformance with the Code of Ethics or the Standards that affects the overall scope or operation of internal audit must be disclosed to senior management and the board.

Governance assessment 2110

Internal audit assesses governance by evaluating strategic and operational decision-making, oversight structures, ethics, performance management, and accountability, and by recommending improvements.

Risk management assurance 2120

Internal audit evaluates the effectiveness of the risk management process, including risk identification, assessment, and response, plus the potential for fraud under Standard 2120.A2.

Control objectives 2130

Internal audit evaluates controls over reliability of financial reporting, effectiveness and efficiency of operations, safeguarding of assets, and compliance with laws, regulations, and contracts.

COSO internal control structure

Five components: control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by 17 principles.

COSO ERM 2017 components

Governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting: five components comprising 20 principles.

Risk appetite versus tolerance

Risk appetite is the amount and type of risk an organization is willing to accept in pursuing its objectives; risk tolerance is the acceptable variation in performance around that appetite.