IIA IAP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Definition of internal auditing

Independent, objective assurance and consulting activity designed to add value and improve an organization's operations; it helps achieve objectives by evaluating and improving risk management, control, and governance processes.

Code of Ethics principles

Integrity, objectivity, confidentiality, and competency; these four principles apply to all individuals and entities that perform internal audit services.

Internal audit charter

A formal document that defines the internal audit activity's purpose, authority, and responsibility, is approved by the board, and must be consistent with the Standards.

Organizational independence

Achieved chiefly through the chief audit executive's functional reporting line to the board and administrative reporting to senior management, so audit work proceeds free of interference.

Individual objectivity

An unbiased mental attitude that lets internal auditors perform engagements without compromising quality; it is presumed impaired when an auditor assesses work they previously performed.

Assurance versus consulting services

Assurance engagements involve an objective assessment of evidence against criteria; consulting engagements provide advisory services, and their nature and scope are agreed with the client.

Quality assurance improvement program

Covers all aspects of the internal audit activity, assesses conformance with the Standards and the Code of Ethics, and includes ongoing monitoring, periodic self-assessments, and external assessments.

External quality assessment

An assessment conducted at least once every five years by a qualified, independent assessor or review team from outside the organization, with results reported to the board.

Due professional care

The care and skill expected of a reasonably prudent and competent internal auditor; it does not imply infallibility or that every risk will be identified.

Impairment disclosure

When independence or objectivity is impaired in fact or appearance, the impairment must be disclosed; for the chief audit executive the disclosure goes to the board.

Three Lines Model

Governing body provides oversight; first-line management owns and manages risk; second-line functions provide expertise, monitoring, and challenge; third-line internal audit provides independent assurance.

Risk appetite

The amount of risk an organization is willing to accept in pursuit of its objectives, stated qualitatively or quantitatively.

Risk tolerance

The acceptable variation in performance relative to the risk appetite; it defines the boundaries within which taking on risk is acceptable.

Residual risk

The risk remaining after management implements controls and risk responses; it is compared with the organization's risk appetite and tolerance.

Inherent risk

The level of risk before any management controls, responses, or mitigating actions are applied to the activity or process.

Risk response options

The four ways management addresses identified risk: avoid the activity, accept the risk, share or transfer it, and reduce or mitigate it through controls.

COSO internal control components

Control environment, risk assessment, control activities, information and communication, and monitoring activities; the 2013 framework contains 17 supporting principles.

COSO ERM components

Governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting; the 2017 framework contains 20 principles.

Preventive versus detective controls

Preventive controls stop errors before they occur, such as approvals and segregation of duties; detective controls find errors after occurrence, such as reconciliations and exception reports.

Control limitations

Internal control provides reasonable, not absolute, assurance because of human error, collusion, management override, and the cost of controls relative to their benefits.

Segregation of duties

Separating authorization, custody of assets, recording, and reconciliation so that no single person controls all aspects of a transaction.

Audit committee role

A board committee that oversees financial reporting and external and internal audit, approves the internal audit charter, and supports the chief audit executive's independence.

Engagement planning elements

Establishing objectives, scope, timing, and resource allocation for the engagement, based on a documented assessment of risks relevant to the area under review.

Engagement objectives

Statements defining what the engagement is intended to accomplish, addressing the risks, controls, and governance processes associated with the area reviewed.

Engagement scope

The extent and boundaries of the engagement, such as periods, activities, and systems covered; it must be sufficient to achieve the stated objectives.

Engagement work program

A documented set of procedures to achieve engagement objectives, approved before work begins, with modifications justified by documented reasons and approval.

Engagement documentation

Working papers recording information obtained and analyses performed; they must be complete, accurate, and organized, with access controlled by the chief audit executive.

Final communication content

Engagement communications must include objectives and scope, results including findings, conclusions, and, where appropriate, recommendations and management's action plans.

Engagement conclusion or opinion

A rating or conclusion on the adequacy of controls and risk management for the area reviewed, supported by engagement results and communicated clearly.

Follow-up process

Monitoring whether management actions have been implemented, with escalation to senior management and the board for significant risks left unaddressed.

Communicating risk acceptance

When management accepts a level of risk the chief audit executive judges unacceptable, the matter is reported to the board for resolution.

Preliminary engagement communication

Informing the engagement client about objectives, scope, timing, and expectations before fieldwork begins, to build cooperation and minimize disruption to operations.