CIA Part 2 key terms

Concise statements of what a specific engagement is meant to achieve, naming the processes, risks or controls to be examined and guiding the design of procedures and the work program.

The boundaries of the work: which entities, processes, systems, locations and time periods are covered, and what is explicitly excluded, so readers understand the limits of the assurance given.

An approach that concentrates audit resources on activities with the greatest likelihood and impact of failure relative to organizational objectives, so depth and frequency of coverage follow assessed risk.

A complete inventory of the auditable entities, processes, systems and locations in the organization, from which the risk assessment and the annual engagement plan are built.

The exposure to error, fraud or loss that exists in an activity before management applies any controls, reflecting the nature, complexity and external environment of the process.

The exposure that remains after management's controls and other responses have been applied; auditors compare it with the organization's risk appetite to judge whether further action is needed.

The level at which the size or nature of an error, omission or control weakness could reasonably change a decision of management or the board, used to focus testing and prioritize findings.

A documented list of the procedures, sample sizes, data sources and timing required to meet the engagement objectives; it is approved before fieldwork and revised when conditions change.

Information gathering at the start of an engagement through interviews, observation and document review, building enough understanding of the activity to refine objectives, risks and the work program.

A structured review of where fraud could occur, who might be motivated to commit it, and which controls reduce the opportunity, used to direct engagement procedures toward high-exposure areas.

Information gathered through inquiry, inspection, observation, confirmation, recalculation or analysis that supports the auditor's findings and conclusions; it must be sufficient and appropriate.

The two tests evidence must pass: enough of it in quantity for the risk involved, and reliable and relevant in quality, meaning it comes from credible sources and actually addresses the objective.

A procedure that checks whether a control was designed and operated effectively during the period under review, usually by inspection, observation, inquiry or re-performance.

Procedures that look directly for errors or misstatements in transactions, balances or operations, rather than relying on the effectiveness of controls to reduce the work.

The chance that conclusions drawn from testing a subset of items differ from what would be concluded if the whole population were tested.

A statistical technique for estimating how often a control fails, where each sampled item is judged simply as conforming or nonconforming, yielding a deviation rate.

The probability, expressed as a percentage, that the true population characteristic lies within the precision range around the sample result; raising it requires a larger sample.

The highest rate of control failure an auditor can accept and still rely on the control; the sample's upper deviation rate is compared with it to decide whether reliance is justified.

Comparisons and ratio or trend analyses of financial and operational data against expectations such as budgets, prior periods or industry norms, used to highlight unusual relationships worth investigating.

Software tools that extract, sort, join and analyze entire data populations, letting auditors test all transactions rather than a sample and identify exceptions, duplicates or gaps.

The record of procedures performed, evidence obtained and conclusions reached, organized so an experienced reviewer can see what was done and why, and supporting the final report.

Ongoing oversight by a more experienced auditor covering planning, fieldwork quality, evidence and reporting, with documented review and coaching of staff throughout the engagement.

A direct written or electronic reply from an independent third party verifying balances, terms or existence of assets; because it comes from outside the organization it is strong evidence.

A facilitated workshop or survey in which process owners identify and rate their own risks and controls, producing evidence while building risk awareness and ownership.

A structured statement of what was found: the condition observed, the criteria it was measured against, the cause, and the effect or risk, usually with a recommendation.

A closing meeting with management at the end of fieldwork to confirm the facts behind findings, hear management's perspective and agree corrective actions before the report is issued.

Communication issued before the engagement ends to alert management and the board to significant issues that cannot wait for the final report.

The formal deliverable presenting objectives, scope, findings, conclusions and recommendations, issued after management has had the chance to respond and distributed to those who need it.

Management's documented response to findings, naming the corrective action, the responsible owner and the target date, which becomes the basis for follow-up.

A restriction, such as denied access to records or staff, that prevents planned procedures; if it blocks a conclusion, it must be disclosed to management and the board.

The auditor's overall judgment on whether the activity reviewed is operating as intended, including any qualification where scope was restricted or significant issues remain unresolved.

The process of checking whether management carried out agreed actions, or that the appropriate authority formally accepted the risk, with results reported to the board.

A documented decision by senior management or the board to live with a risk instead of fixing it; internal audit confirms that it was made at the right level.

Ongoing, largely automated testing of transactions and controls as they occur, giving timely assurance and feeding results back into risk assessment and the next audit plan.

Measures such as engagement cycle time, percentage of recommendations implemented, and stakeholder satisfaction, used to monitor the efficiency and effectiveness of the internal audit activity.

Tracking fieldwork against the time budget and milestones, so delays, scope creep and resource problems are identified and escalated early enough to act on.