CIA Part 2 cheat sheet

Objectives state what the engagement will accomplish; they must be consistent with the audit plan and address risks, controls, and governance of the activity under review.

Scope must be sufficient to satisfy the objectives and covers systems, records, personnel, physical property, and the time period; scope limitations are disclosed in the final communication.

A complete engagement plan documents objectives, scope, timing, budgeted hours, staffing, an understanding of the activity, the risk assessment, and the work program.

The work program lists the procedures to be performed; it is approved by the CAE or designee before work begins, and any change is documented with its reason and approval.

Engagement-level risk assessment weighs likelihood and impact and considers fraud exposure, IT dependency, third parties, recent changes, complexity, and prior findings.

Engagement criteria - the standards or expectations used to evaluate condition - are identified during planning so that findings are judged against an agreed benchmark.

Materiality sets the depth of testing and the threshold for reporting; lowering materiality increases the nature, timing, and extent of procedures.

Due professional care means the competence and care of a reasonably prudent auditor, not infallibility; procedures are weighed against their cost and benefit.

Evidence must be sufficient, reliable, relevant, and useful; failing any one attribute weakens the support for the engagement's conclusions.

Reliability hierarchy: independent external sources over internal; original documents over copies; direct auditor observation over indirect report; strong source controls over weak.

Workpapers record procedures performed, information obtained, analysis, and conclusions; they are the organization's property and are retained per policy and legal requirements.

Workpaper quality criteria: complete, accurate, clear, legible, properly indexed, cross-referenced, and prepared on a timely basis.

Supervisory review is documented before the final communication is issued, with evidence of the reviewer's identity, date, and the extent of the review.

In attribute sampling, sample size increases when confidence level rises or the tolerable deviation rate falls; precision is the allowance for sampling risk.

Analytical procedures compare current data with prior periods, budgets, or industry norms, use a defined investigation threshold, and require documented explanations for significant variances.

Fraud indicators - missing documents, unusual journal entries, control overrides, unexplained lifestyle changes - call for expanded procedures and escalation, not confrontation by the auditor.

The final communication includes objectives, scope, results, conclusions, and recommendations or action plans; if objectives or scope are omitted, the reason is disclosed.

Seven quality attributes apply to every communication: accurate, objective, clear, concise, constructive, complete, and timely.

The CAE approves distribution of the final report; recipients are those able to ensure results receive due consideration, subject to confidentiality requirements.

Auditee disagreement is not suppressed: dissenting views may be included in the report alongside the auditor's position and supporting evidence.

Interim reports are issued when a significant matter requires prompt attention and never replace the final engagement communication.

An overall conclusion or opinion is expressed only when supported by sufficient, reliable, relevant, and useful evidence, and it uses a defined rating scale.

Recommendations should address root causes and be paired with a management action plan naming a responsible owner and a target completion date.

If a final report contains a material error or omission, a corrected report is issued to every recipient of the original version.

Follow-up verifies that management actions were implemented effectively or that senior management has accepted the risk; the CAE establishes and monitors this process.

Follow-up is risk-based: findings with higher risk exposure and larger potential impact are tracked more frequently and escalated sooner.

Significant findings that remain unresolved after the agreed timeline are escalated to senior management, and ultimately to the board.

Unresolved prior findings are re-evaluated during planning and can change the scope, objectives, and risk assessment of the next engagement.

Supervision is ongoing monitoring inside an engagement: approving the work program, reviewing evidence, resolving problems, and confirming staff competence.

Engagement performance measures include budget versus actual hours, cycle time, recommendation implementation rate, and stakeholder feedback.

The quality assurance and improvement program combines ongoing and periodic internal assessments with an external assessment at least once every five years.

Monitoring results feed back into the annual audit plan, the entity-level risk assessment, and the resourcing of future engagements.