CIA Part 1 key terms

An independent, objective assurance and consulting activity that adds value and improves operations by evaluating, through a systematic and disciplined approach, the effectiveness of governance, risk management and control processes.

A formal written document approved by the board that defines the internal audit activity's purpose, authority and responsibility, its position in the organization, and the scope of its work.

The senior individual responsible for managing the internal audit activity and for its conformance with professional standards; the role may carry a different title, such as head of internal audit.

The department, team or individuals that perform internal audit work for the organization; it reports functionally to the board and administratively to senior management.

Objective examinations of evidence that provide independent assessments of governance, risk management and control; examples include financial, compliance, operational and information technology audits.

Advisory and related client-service activities such as advice, facilitation and training, whose nature and scope are agreed with the client and which generally do not involve an independent assessment.

A plan built on a documented assessment of risk that prioritizes potential engagements by exposure and is submitted to the board for review and approval.

A document listing the procedures to be performed during an engagement, tied to the engagement objectives and used to direct and monitor the auditors' work.

Records of the work performed, evidence obtained, analyses made and conclusions reached; they support reported results and demonstrate conformance with standards.

A process by which the chief audit executive monitors and confirms that management actions on reported findings have been implemented, or that senior management has accepted the risk of not acting.

The IIA's framework that organizes professional guidance for internal auditing, including the mission, core principles, definition, Code of Ethics, and the Standards with their interpretations.

The IIA's principles and rules governing internal auditors' conduct, organized around integrity, objectivity, confidentiality and competency, and applicable to individuals and the internal audit activity.

The organization's governing body, such as a board of directors or audit committee, which oversees the internal audit activity, approves its charter and plan, and receives its results.

Freedom from conditions that threaten the internal audit activity's ability to carry out its work objectively; it depends mainly on organizational position and reporting lines.

An unbiased mental attitude that allows internal auditors to perform engagements and report results honestly, without subordinating their judgment to the views of others.

The placement of the internal audit activity so it is free from management interference, typically achieved through functional reporting to the board and administrative reporting to a senior executive.

A reporting line covering approval of the audit charter and plan, appointment and removal of the chief audit executive, and receipt of audit results, protecting the activity's independence.

A situation, such as a conflicting assignment or close personal relationship, that compromises, or appears to compromise, an internal auditor's ability to act without bias; it must be reported to appropriate parties.

A circumstance in which an internal auditor's personal, financial or professional interests could improperly influence judgment or appear to do so; it should be declared and managed.

The knowledge, skills and other competencies internal auditors need to perform their responsibilities; the chief audit executive ensures the activity collectively holds or obtains them.

The care and skill a reasonably prudent and competent internal auditor would apply under similar circumstances; it does not imply infallibility or exemption from error.

The informed application of knowledge and experience when making decisions about engagement scope, testing and reporting, taking relevant facts and circumstances into account.

Ongoing learning, such as relevant training and continuing education hours, that internal auditors undertake to maintain and sharpen the competencies their work requires.

Oversight of engagement work by experienced auditors, including direction, monitoring progress and reviewing documentation, to support quality and staff development.

A person or firm with specialized knowledge, such as information security or actuarial science, engaged to support audit work; auditors evaluate the adequacy of the expert's work.

A program covering all aspects of the internal audit activity that evaluates conformance with the Code of Ethics and Standards and assesses efficiency and effectiveness through internal and external assessments.

Day-to-day supervision, review and performance measurement built into audit processes that evaluates conformance and quality continuously as part of internal assessments.

An internal review performed at planned intervals that examines the activity's conformance with the Code of Ethics and Standards and identifies improvement opportunities, complementing ongoing monitoring.

An evaluation conducted at least once every five years by a qualified, independent reviewer or team from outside the organization, as a full external assessment or a self-assessment with independent validation.

A form of external assessment in which the internal audit activity completes a self-assessment that an independent reviewer then validates, reporting on the extent of conformance.

A declaration in engagement communications that the activity conforms with the Standards, which may be made only when supported by the results of the quality assurance and improvement program.

Reporting, where required, that the internal audit activity has not conformed with the Standards, describing the impact of the nonconformance and any corrective action taken.

The combination of processes and structures implemented by the board to inform, direct, manage and monitor the organization's activities toward achievement of its objectives.

The process of identifying, assessing, responding to and monitoring risks so that objectives are more likely to be achieved and decisions are better informed.

Any action taken by management, the board or others to manage risk and increase the likelihood that objectives will be met, such as policies, approvals, reconciliations and segregation of duties.

The amount and type of risk an organization is willing to accept in pursuit of its objectives; it guides resource allocation and the design of controls and risk responses.

The risk that remains after management acts to reduce the likelihood or impact of an event, commonly compared with risk tolerance when judging acceptability.

A model in which operating management owns and manages risk, an internal risk and compliance function provides oversight, and internal audit gives independent assurance to the governing body.

A structured workshop-based approach in which work teams examine their own processes, risks and controls, often facilitated by internal auditors, to identify gaps and improvements.

Coordination of assurance work from internal audit, risk and compliance functions and external auditors so the board receives a coherent, non-duplicative view of significant risks.