CGIA common mistakes
CGIA · Understand the traps and how to avoid them.
Treating the IIA Global Internal Audit Standards as a numbered checklist and citing an old attribute/performance standard number (e.g., 'Standard 1100') instead of the current principle-based structure when a question asks which standard governs objectivity or independence.
Candidates study from summaries written before the 2024 Standards took effect and memorize the legacy IPPF numbering rather than the current 5 domains, 15 principles, and standards architecture.
What to do instead
Rebuild your mental map around the current Global Internal Audit Standards: the five domains (Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, Performing Internal Audit Services), the 15 principles, and how the topical standards (e.g., independence, objectivity, engagement planning, evidence, communication) sit under them. When a question references a standard, answer from the principle's intent rather than a memorized number.
Choosing 'report the issue to the audit committee' or 'escalate to the CEO' as the default answer whenever an independence or objectivity conflict appears, regardless of what the scenario actually asks.
Escalation sounds like the most ethical option, so candidates stop reading the stem carefully and pick the most dramatic response instead of the one the standards actually prescribe for that situation.
What to do instead
Classify the conflict first: is it a threat to objectivity (self-review, familiarity, undue influence), a resource/scope limitation, or an impairment of independence? Then apply the specific safeguard the standards name - reassigning the auditor, disclosing the impairment, declining the engagement, or escalating only when the CAE cannot resolve it. Practice distinguishing 'disclose' from 'escalate' from 'decline'.
Confusing the three lines model roles - assigning risk ownership, control design, or risk appetite setting to internal audit, or letting management 'own' the assurance conclusion.
The vocabulary overlaps (everyone 'manages risk'), and candidates map audit activities onto governance roles by intuition rather than by the model's definitions.
What to do instead
Memorize the division of labor: governing body sets direction and oversight; first line owns and manages risk; second line provides expertise, monitoring, and challenge; internal audit provides independent assurance and advises without taking management responsibility. For any scenario, ask 'who is accountable if this fails?' - if the answer is internal audit, the option is wrong.
Treating inherent risk, residual risk, and control risk as interchangeable, or rating risk as 'high' purely because the process handles a lot of money or is IT-related.
Candidates conflate impact with risk and skip the likelihood and existing-controls assessment, producing risk rankings that ignore residual exposure.
What to do instead
For every risk question, decompose explicitly: inherent risk = likelihood × impact before controls; control risk = likelihood controls fail to prevent/detect; residual risk = what remains after controls. Rank engagements on residual risk and explain the reasoning. Practice writing one-sentence justifications that name likelihood, impact, and control effectiveness separately.
Writing engagement objectives that describe tasks ('review the procurement policy', 'walk through the payment process') rather than the assurance question and criteria the engagement will answer.
Candidates draft objectives from the audit program they plan to execute, which is activity-focused, instead of from the risk-based question the stakeholders need answered.
What to do instead
Frame each objective as a statement of what will be evaluated against which criteria and why it matters (e.g., 'Evaluate whether vendor payments were authorized and supported in accordance with Policy X, to provide assurance over payment integrity'). Test each objective: could a reader tell what evidence would satisfy it and what conclusion would follow? If not, rewrite.
Accepting management's spreadsheet, verbal explanation, or a screenshot as sufficient audit evidence without testing completeness, accuracy, or the reliability hierarchy of the source.
Evidence from inside the organization feels authoritative, and candidates underweight the standards' requirement to evaluate sufficiency and appropriateness (relevance and reliability).
What to do instead
Apply the reliability hierarchy: externally obtained evidence > internally generated with strong controls > internally generated with weak controls > oral representations. For every piece of evidence, state its source, how you tested completeness and accuracy, and whether corroboration is needed. Treat management assertions as a starting point requiring corroboration, not as evidence.
Drafting findings that state the condition but omit the criteria, cause, effect, or a specific actionable recommendation - or that soften the conclusion so much the reader cannot tell whether a deficiency exists.
Candidates write findings as narratives of what they saw rather than as structured arguments, and fear of conflict pushes them toward vague language.
What to do instead
Build every finding on the five elements: criteria (what should be), condition (what is), cause (why it happened), effect/risk (so what), and recommendation (now what). Write the effect in quantified or clearly risk-stated terms, and make the recommendation address the root cause, not the symptom. Have a peer check whether the conclusion is unambiguous.
Assuming a fraud question is answered by 'increase skepticism' or 'refer to the fraud team' instead of identifying the specific red flags, the audit function's detection versus investigation role, and the required escalation and documentation steps.
Fraud content feels like a values question, so candidates give values-based answers and miss the procedural distinctions the exam tests.
What to do instead
Study fraud from the auditor's role boundary: internal audit assesses fraud risk and controls and detects indicators; it does not normally investigate or interrogate. Learn common red flags by cycle (procurement, payroll, revenue, expenses), the concept of the fraud triangle and management override, and the sequence when indicators appear - document, escalate to the CAE and those charged with governance, preserve evidence, and coordinate with specialists.
Treating IT general controls, data analytics, and emerging risks (cyber, third-party, AI, ESG) as a separate technical topic disconnected from the audit plan, or skipping them because they seem too technical.
Candidates without an IT background defer these questions, but the exam tests how IT risk integrates into scoping, evidence, and reporting rather than deep technical configuration.
What to do instead
Learn ITGC categories at the conceptual level (access management, change management, IT operations, program development) and how each affects reliance on automated controls and reports. Practice linking a technology or emerging risk to a specific audit objective, evidence source, and control expectation so the answer is audit reasoning, not technical trivia.
Ignoring the quality assurance and continuous improvement domain - treating conformance as a one-time external assessment and forgetting ongoing internal monitoring, supervision, and the CAE's quality responsibilities.
Candidates allocate study time to planning and reporting and assume QA is a minor administrative topic, so they miss questions on internal assessments, supervision, and the external assessment cycle.
What to do instead
Learn the QA structure: ongoing internal monitoring, periodic internal self-assessments, and an external assessment at least every five years (with the conformance opinion and disclosure requirements), plus supervision as a day-to-day quality control. Connect QA to the audit process - how supervision, working paper review, and follow-up on prior findings demonstrate continuous improvement.