CIA Part 2 common mistakes
CIA Part 2 · Understand the traps and how to avoid them.
When a question asks for the auditor's first planning step, selects 'prepare the detailed work program' or 'start fieldwork'; and labels the area to be audited as the 'objective' while calling the steps to be performed the 'scope.'
The three terms sit side by side in the standards and questions deliberately swap them. Candidates memorize a list of planning elements instead of the function each element performs, so any planning-sounding option looks correct.
What to do instead
Anchor each term to the question it answers. Objective = the conclusion the engagement must reach. Scope = the boundaries (processes, locations, period, systems) inside which that conclusion applies. Work program = the documented, approved procedures that generate the evidence. Any option that presents procedures as the objective or scope is a distractor, and the program is approved before fieldwork, not after.
Picks answers that either relieve internal audit of any fraud work ('fraud is solely management's responsibility') or promise that the engagement will detect all fraud in the area.
Both extremes sound defensible. The standards split responsibility in a way that candidates flatten into a single owner, so a plausible-sounding absolute becomes attractive under time pressure.
What to do instead
Hold one sentence: management and the board own the control environment and the fraud risk management program; internal audit must assess fraud risk during planning, design procedures responsive to that risk, evaluate red flags, and apply due professional care - without guaranteeing detection. Eliminate any option promising detection of 'all' fraud, and any option that omits fraud from planning.
Responds 'obtain more evidence' when the actual defect described is that the evidence collected is unreliable, irrelevant, or obtained only by inquiry.
'Sufficient' and 'appropriate' read as synonyms in the standards, and adding more evidence feels like a safe, cautious answer even when the source is the problem.
What to do instead
Split the words: sufficient = quantity; appropriate = relevance plus reliability. Apply the reliability ladder - the auditor's own observation, inspection, or reperformance outranks external evidence, which outranks internal evidence; originals outrank copies; written outranks oral; inquiry alone is never enough. If the evidence is not appropriate, more of it fixes nothing - change the source or the procedure.
Asserts that raising the tolerable (acceptable) deviation rate requires a larger sample, or that raising the confidence level narrows precision.
The inputs move in opposite directions and the relationships are easy to memorize backwards; exam phrasing ('holding all else constant') rewards the candidate who has drilled direction, not the one reasoning it out live.
What to do instead
Drill four rules until automatic: sample size rises when confidence level rises, when tolerable error falls, when expected error rises, and when population variability rises. Keep the vocabulary separate - confidence level is the risk the auditor accepts, precision is the tightness of the estimate, tolerable rate is set in advance by the auditor.
Treats engagement workpapers as the audited unit's records, or assumes they can be released to an external auditor, regulator, or another department on request.
Workpapers are full of the client's data, so ownership feels ambiguous, and access questions look like administrative housekeeping rather than a control decision.
What to do instead
Workpapers are the property of the organization's internal audit activity; they support the auditor's conclusions and never substitute for the entity's own records. Access is controlled by the chief audit executive under organizational policy plus legal and confidentiality constraints, with approval obtained before release to external parties, and retention follows policy. Release is not at the individual auditor's discretion.
Selects 'the CAE must review every workpaper personally' or 'review is a single quality gate completed at the end, just before the report is issued.'
Review is taught as one checkpoint, so candidates default to the strictest-sounding option rather than to how supervision actually scales with risk.
What to do instead
Supervision is continuous across the engagement, and its extent depends on the complexity of the work and the proficiency and experience of the auditor. The supervisor ensures objectives are met and conclusions are supported, and evidence of review is documented. Match review intensity to risk and staff competence, not to a blanket rule, and remember supervision is not deferred to the reporting stage.
Addresses the report only to the manager of the area audited, and holds a serious, still-live issue until the final report is issued.
The area manager 'owns' the corrective action, so that audience looks logically correct, and candidates underweight interim communication because they picture only the closing report.
What to do instead
Communicate to the people who can ensure the findings receive proper consideration, which may be above the area manager. Significant matters go out promptly as interim communication rather than being saved. When management accepts a risk the CAE judges unacceptable, discuss with senior management and, if unresolved, escalate to the board.
Writes or accepts a report that gives an overall conclusion while concealing that the scope was limited, or that omits management's response and the engagement's objectives and scope.
Candidates focus their attention on the findings section and treat the framing sections as boilerplate, so a scope limitation reads as an embarrassment to be minimized rather than a required disclosure.
What to do instead
A complete communication carries objectives, scope including limitations, conclusions, findings with criteria-condition-cause-effect, and management's response or action plan. A scope limitation must be disclosed along with its effect on the conclusion - never smoothed over with a clean assurance statement.
Closes a finding as soon as management supplies an action plan, or records 'management accepts the risk' and moves on to the next engagement.
A written response feels like resolution, and risk acceptance is genuinely management's prerogative - the escalation step is the part candidates drop.
What to do instead
Follow-up verifies that the action was actually implemented and is effective; a plan is not a fix. If management knowingly accepts a risk that exceeds appetite or is unacceptable to the CAE, document the decision and escalate to senior management and then the board. Follow-up is scheduled and tracked, not postponed to the next audit cycle.
When fieldwork runs over budget and an unexpected high-risk condition appears mid-engagement, chooses 'finish the original program to stay on schedule' or 'keep the original staffing allocation.'
Budget discipline is praised throughout training, so the on-schedule option feels like the responsible answer, and candidates forget that monitoring progress exists to serve the engagement objectives.
What to do instead
Monitoring progress means comparing actual time, cost, and coverage against plan and acting on the gap: reallocate staff, adjust the program, or renegotiate scope with the engagement client, with changes approved and documented. Emerging risk outranks the original timetable.