IIA IAP common mistakes
IIA IAP · Understand the traps and how to avoid them.
Reads the stem as a general management question and selects the option that reflects good practice, rather than the option the IIA Standards actually require in that situation.
The scenarios are written to sound like ordinary business judgment calls, so candidates answer from workplace experience; several distractors are genuinely sound practice but are not what the Standards mandate or what the chief audit executive is required to do.
What to do instead
Before evaluating options, underline the operative cue ('according to the Standards', 'required', 'first', 'primary', 'most appropriate') and eliminate any option that is merely desirable rather than mandated. When two options are both good, pick the one the Standards assign as a duty of the auditor or the audit function.
Uses 'independence' and 'objectivity' interchangeably, for example claiming an auditor's objectivity is impaired because the internal audit function reports administratively to the CFO.
The two concepts are taught together and both concern freedom from bias, so candidates memorize them as one idea and apply whichever label appears in the option list.
What to do instead
Anchor each term to its level: independence is an attribute of the internal audit function (charter, reporting lines, freedom from operational responsibility and interference); objectivity is an attribute of the individual auditor (state of mind, no conflicts of interest, no impairments). An administrative reporting line is an independence issue; a personal conflict or a recent operational role is an objectivity issue.
Treats assurance and consulting work as interchangeable, assumes consulting automatically destroys independence, or agrees to implement the very controls internal audit recommended.
Both service types are defined in the same body of standards and both produce advice, so candidates over-apply the independence rule to consulting and under-apply it to the real impairment - taking on management responsibility.
What to do instead
Sort by output and ownership: assurance is an independent, objective evaluation against criteria with a conclusion reported to the governing body; consulting is advisory work whose nature and scope are agreed with the client. Consulting is permitted and does not by itself impair independence; the impairment arises from designing, implementing, or operating controls or processes, which internal audit must not do.
Places internal audit inside the second line of the Three Lines Model, or accepts accountability for designing or operating the organization's risk management and control processes.
Simple organization charts and the older 'three lines of defense' diagram suggest audit sits somewhere in the management hierarchy, and candidates confuse oversight of controls with ownership of controls.
What to do instead
Internal audit is not a line: management (first line) owns and manages risk, a risk or compliance function (second line) supplies complementary expertise and oversight, and internal audit provides independent assurance to the governing body. Any option in which internal audit owns, designs, or operates a control or risk process is wrong even when it sounds efficient.
Uses risk appetite, risk tolerance, inherent risk, and residual risk as if they were synonyms - for example calling the risk remaining after controls 'the organization's risk appetite'.
The four terms appear in one cluster and differ only by small qualifiers, and distractors are built by deliberately swapping them.
What to do instead
Write a one-line definition of each before answering: appetite is the amount and type of risk the organization is willing to accept in pursuit of its objectives; tolerance is the acceptable variation around a specific objective; inherent risk is exposure before controls; residual risk is exposure after controls. Then check which definition the stem actually invokes.
Labels a written policy or a monthly reconciliation as a 'preventive control' because it is about stopping problems, and calls any documented procedure a control.
Everyday use of the word 'control' is loose, and candidates classify by the activity's intent rather than by its timing relative to the event and its mechanism.
What to do instead
Classify by timing: preventive (before the event - segregation of duties, authorizations, access restrictions), detective (after the event - reconciliations, exception reports, management reviews), directive (guides behavior - policies, training), corrective or mitigating (limits impact after detection - contingency plans). A policy is a directive that sets expectations; the specific check that enforces it is the control.
Begins an engagement by drafting the detailed audit program or listing test steps, skipping over engagement objectives, scope, and criteria.
Testing feels like the productive part of the work and program templates are easy to reuse, while planning outputs look like paperwork that can be filled in later.
What to do instead
Follow the prescribed sequence: understand the area and its risks, establish the engagement objectives and scope, identify the criteria, and only then build the program as the documented set of procedures that achieves those objectives. If a question asks what comes first in planning, choose understanding the area and defining objectives over selecting procedures.
Treats quantity of evidence as quality - answering 'collect more samples' when the problem is reliability - and uses sufficiency and appropriateness as if they meant the same thing.
Both are described as properties of information and audit training heavily emphasizes sample sizes, so more evidence feels like the safe answer.
What to do instead
Sufficiency is quantity (is there enough?); appropriateness is relevance plus reliability (does it address the objective, and is the source trustworthy?). More of a weak source does not repair reliability: shift to a stronger source - external rather than internal, direct observation rather than hearsay, original document rather than a copy.
Writes up an observation as condition plus effect only - 'cash counts were not performed, increasing the risk of loss' - with no criteria and no cause, then recommends refresher training.
Visible symptoms dominate the working notes and root cause analysis takes extra effort, so the recommendation gets attached to the symptom instead of the underlying driver.
What to do instead
Force every element: criteria (the standard or expectation), condition (what is), cause (why it happened), effect (risk or consequence), and a recommendation tied to the cause. When the cause is unknown, the best answer is usually to investigate the cause before recommending action.
Assumes internal audit must itself correct the deficiency, or that following up on agreed management actions is optional and done only when someone asks for it.
Auditors who moved from operations are used to owning fixes, and follow-up gets squeezed out by the next engagement, so it feels discretionary.
What to do instead
Management owns the corrective action and the risk decision, including accepting the risk; internal audit monitors and confirms implementation and reports status to the governing body. Follow-up is a required part of the process, and the auditor escalates when actions are not taken or accepted risk exceeds the appropriate authority level.