CIA Part 2 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Engagement objectives

Statements defining what the engagement is to accomplish; must align with the audit plan and address relevant risks, controls, and governance; approved before work begins.

Engagement scope

Defines the boundaries of the engagement: systems, records, personnel, and time period covered; must be sufficient to achieve objectives, and any limitations are disclosed in the report.

Engagement work program

Documented steps and procedures to accomplish the engagement objectives; approved before work begins, and any change is documented with reasons and approval.

Materiality in planning

The level of misstatement or error that could affect a decision; it determines the nature, timing, and extent of procedures and whether findings are reported.

Fraud risk assessment

Consideration of incentives, opportunities, and rationalization during planning to decide whether specific fraud procedures are needed and where controls are weakest.

Due professional care

The care and skill expected of a reasonably prudent auditor; it does not imply infallibility, and procedures are judged against cost versus benefit.

Prior engagement results

Results of previous engagements inform planning by highlighting unresolved findings, recurring issues, and areas where risk has increased since the last review.

Engagement resource planning

Matching staff knowledge, skills, and competencies, plus budgeted hours and technology, to the engagement's risk, complexity, and timeline.

Sufficient audit evidence

Enough factual, adequate information to support conclusions; judged by whether a prudent auditor reviewing the same evidence would reach the same conclusion.

Reliable evidence

Evidence is most reliable when obtained from independent external sources, from original rather than copied documents, and from sources with strong internal controls.

Relevant evidence

Evidence supports the engagement objectives and findings; information unrelated to the stated objectives is not evidence, however interesting it may be.

Engagement workpapers

Records of procedures performed, evidence obtained, and conclusions reached; they remain the organization's property and are retained per policy and legal requirements.

Workpaper review

Supervisory review confirming work supports findings and conclusions; the review is documented with the reviewer's name, date, and scope of review.

Attribute sampling

A statistical method that estimates the rate of deviation from a control, expressed as a percentage, using a sample size based on confidence and tolerable rate.

Confidence level

The probability that the sample result falls within the specified precision; higher confidence levels require larger sample sizes.

Analytical procedures

Comparisons, ratios, and trend analysis used to identify unexpected relationships or fluctuations, which are then investigated and explained or reported.

Final engagement communication

The final report must include objectives, scope, results, conclusions, and recommendations; if objectives or scope are omitted, the reason is disclosed.

Communication quality attributes

Standard criteria for every communication: accurate, objective, clear, concise, constructive, complete, and timely; they reduce misinterpretation and increase acceptance of results.

Interim engagement report

A report issued when a significant matter requires immediate attention, such as a major control failure; it does not replace the final report.

Report distribution

The CAE approves who receives the final report; recipients should be those able to ensure results are given due consideration.

Dissenting views

If the auditee disagrees with findings or recommendations, the disagreement and the auditor's position may both appear in the engagement communication.

Overall engagement conclusion

An expression of the overall condition of the area reviewed, permitted only when supported by sufficient, reliable, relevant, and useful evidence.

Management action plan

Describes the specific steps, responsible owner, and target date for addressing each finding; included in the report and tracked afterward.

Material error correction

When a final report contains a material error or omission, a corrected version is distributed to every recipient of the original report.

Follow-up process

The CAE establishes and monitors a process confirming management actions are implemented or that senior management has accepted the risk.

Risk acceptance escalation

When management decides to accept a risk that exceeds the organization's risk tolerance, the CAE escalates the matter to senior management and the board.

Engagement supervision

Ongoing oversight of staff during the engagement: approving the work program, reviewing evidence, resolving problems, and confirming competence and objectivity.

Quality assurance improvement program

Covers ongoing and periodic internal assessments plus an external assessment at least once every five years by a qualified, independent reviewer.

Engagement performance measures

Measures such as budget versus actual hours, cycle time, percentage of recommendations implemented, and stakeholder feedback used to judge engagement efficiency.

Follow-up in next planning

Prior unresolved findings are re-evaluated during planning, which may change the engagement's scope, objectives, and risk assessment.

Monitoring of action plans

Tracking the status of management commitments on a schedule proportionate to the risk, until the action is verified as implemented and closed.

Matters escalated to board

Significant risk exposures, control failures, governance weaknesses, and unacceptable risk acceptance are reported to the board and senior management.