CGIA cheat sheet

IPPF structure: Mission of Internal Audit, Core Principles (10), Code of Ethics, Definition of Internal Auditing, and the Standards (Attribute, Performance, Implementation).

Definition of internal auditing: independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

Mandatory elements of the IPPF: Core Principles, Code of Ethics, Definition, and Standards; supplemental guidance is recommended, not mandatory.

Attribute Standards (1000 series) address purpose, authority, responsibility, independence, objectivity, proficiency, and quality; Performance Standards (2000 series) address managing the activity and engagements.

Two types of services: assurance engagements (independent assessment of evidence against criteria) and consulting engagements (advisory, nature and scope agreed with the client).

Objectivity is a state of mind; independence refers to organizational position and is assessed at the individual auditor, engagement, functional, and organizational levels.

The internal audit activity's mandate is defined in the charter, approved by the board, and must state purpose, authority, and responsibility.

Chief Audit Executive (CAE) reports functionally to the board and administratively to senior management; functional reporting preserves independence.

Conformance is achieved by following all mandatory elements; the Standards use "must" for mandatory requirements and "should" for expected practice subject to professional judgment.

COSO Internal Control - Integrated Framework: five components (control environment, risk assessment, control activities, information and communication, monitoring) across 17 principles and three objective categories.

COSO ERM (2017): five components - governance and culture, strategy and objective-setting, performance, review and revision, information/communication/monitoring - supported by 20 principles.

Three lines model: first line owns and manages risk; second line provides expertise, monitoring, and challenge; third line (internal audit) provides independent assurance.

Control types: preventive, detective, directive, and corrective; controls may be manual or automated, and key controls are those essential to reducing risk to an acceptable level.

Inherent risk is assessed before controls; residual risk is what remains after controls; residual risk above the tolerance level signals a control gap.

Risk appetite is the amount of risk an organization is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation around that appetite.

Governance is the combination of processes and structures implemented by the board to inform, direct, manage, and monitor activities toward objectives.

Control is any action taken by management to enhance the likelihood that established objectives will be achieved; management owns the control system, internal audit evaluates its effectiveness.

Fraud risk management (per IIA guidance) rests on three pillars: governance, risk assessment, and prevention/detection, with a fraud risk assessment covering incentives, opportunities, and rationalization.

Engagement planning sequence: establish objectives and scope, understand the activity, perform a risk assessment, define criteria, allocate resources, and prepare the engagement work program.

Engagement objectives state what the audit will achieve; engagement scope defines boundaries - systems, processes, time period, locations, and activities to be covered.

Engagement-level risk assessment considers inherent risk, control design, and residual risk to determine the nature, timing, and extent of procedures.

Audit work program lists the procedures to be performed, the criteria, and the evidence to be gathered; it is approved before fieldwork begins and revised with documentation of changes.

Materiality drives the extent of testing: the greater the risk or materiality, the more extensive the evidence required.

A risk-based audit plan prioritizes engagements by risk exposure and is updated at least annually, reflecting changes in the organization's risk profile.

Coordination with external auditors and other assurance providers reduces duplication; reliance on their work requires documented assessment of competence, objectivity, and scope.

Scope limitations must be communicated to the board, typically in writing, when they impair the ability to achieve engagement objectives.

Resource planning considers staff knowledge, skills, and competencies; the CAE must ensure appropriate resources are available to complete the engagement.

Evidence must be sufficient (quantity) and appropriate (quality: relevant, reliable, and useful) to support conclusions.

Reliability hierarchy (generally most to least reliable): auditor's direct observation/recalculation, external documents, internal documents, oral testimony.

Evidence types: physical (observation), testimonial (interviews), documentary, analytical, and electronic.

Sampling methods: statistical (random, systematic, stratified) allows projection with quantified sampling risk; non-statistical judgmental sampling does not.

Analytical procedures include trend analysis, ratio analysis, variance analysis, and benchmarking; they are used in planning, fieldwork, and overall review.

Working papers must document the engagement: objectives, scope, procedures performed, evidence obtained, conclusions, and who performed/reviewed the work.

Data analytics techniques: CAATs, full-population testing, exception testing, duplicate testing, gap detection, and Benford's law analysis for anomaly detection.

Interview technique: use open questions to gather context, closed questions to confirm, and corroborate oral evidence with independent documentation.

Flowcharts, narratives, and control matrices are tools for documenting and evaluating the design of internal controls.

A finding contains: criteria, condition, cause, and effect (recommendation is often added as a fifth element).

Engagement communication includes the engagement plan, progress updates, significant risk/control issues, and the final report; the final report is issued when the engagement is complete.

Report quality elements: accuracy, objectivity, clarity, conciseness, constructiveness, completeness, and timeliness.

The CAE determines report distribution; reports should go to those who can ensure results are given due consideration, and significant issues are escalated to the board.

An opinion or conclusion is provided when the engagement objectives require it; the report must state the scope, criteria, and any qualification or restriction.

Management's response to findings includes action, responsible party, and target date; the CAE confirms whether responses are adequate.

Follow-up is a monitoring process to confirm corrective actions were implemented and effective; unresolved issues are escalated through the reporting line.

Draft reports are shared with management for validation of factual accuracy; disagreement with management is documented and management's position may be included in the final report.

Interim reporting communicates significant matters during the engagement to allow timely corrective action.

IIA Code of Ethics: four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct.

Integrity requires honesty, diligence, and responsibility; auditors must not knowingly be party to illegal activity or engage in discreditable conduct.

Objectivity requires avoiding conflicts of interest, not accepting gifts that impair judgment, and disclosing all material facts that could distort reporting.

Confidentiality: information is used only for the intended purpose, and disclosure requires consent or legal/regulatory obligation.

Competency: engage only in services for which the auditor has the necessary knowledge, skills, and experience, and pursue continuing professional development.

Independence is impaired by auditing an activity the auditor recently operated or managed; a cooling-off period is applied before reassignment (commonly at least 12 months).

Objectivity is presumed impaired when the auditor has a conflict of interest or has performed consulting work for an area that later becomes an assurance engagement.

Accepting gifts, hospitality, or favors that could influence judgment impairs objectivity; even the appearance of impairment must be managed.

The CAE must confirm organizational independence to the board annually, including any interference with scope or reporting.

Fraud triangle: pressure/incentive, opportunity, and rationalization; the fraud diamond adds capability.

Auditor's fraud role: assess fraud risk, evaluate controls that prevent and detect fraud, and investigate suspected fraud with due professional care; internal audit does not have primary responsibility for fraud prevention.

Red flags: unusual journal entries, lifestyle changes, control overrides, missing documentation, segregation-of-duties conflicts, and management reluctance to provide information.

IT general controls (ITGCs) cover access management, change management, IT operations, and program development; application controls include input, processing, and output controls.

Cybersecurity risk frameworks: NIST CSF (identify, protect, detect, respond, recover) and ISO 27001 for information security management systems.

Cloud and third-party risk: assess vendor due diligence, data residency, access controls, service-level agreements, and exit strategies.

Emerging risks include AI/model risk, data privacy regulation, ransomware, supply chain disruption, ESG/sustainability reporting, and remote-work controls.

Data governance and privacy: assess data classification, retention, consent, and compliance with applicable privacy law.

Continuous auditing uses automated, recurring tests of controls and transactions to provide real-time assurance.

Quality assurance and improvement program (QAIP) covers all aspects of the internal audit activity and evaluates conformance with the Standards and the Code of Ethics.

QAIP has two parts: internal assessments (ongoing monitoring plus periodic self-assessments) and external assessments.

External assessment is performed at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

Internal assessments include ongoing supervision, review of working papers, and periodic self-assessment; results are reported to the board.

An "in conformance with the Standards" statement may be used only if results of the QAIP support it; nonconformance is disclosed to the board.

Performance metrics include engagement cycle time, budget versus actual, recommendation implementation rate, stakeholder satisfaction, and audit plan completion.

Audit management covers planning, organizing, directing, and monitoring the internal audit activity to ensure it adds value.

Staffing and development: the CAE ensures the activity has the right mix of knowledge and skills, and provides development and performance evaluation.

Continuous improvement uses lessons learned, root-cause analysis of recurring findings, and benchmarking against leading practices.