CGIA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Definition of Internal Auditing

An independent, objective assurance and consulting activity designed to add value and improve an organization's operations, helping it achieve objectives through a systematic approach to evaluating risk management, control, and governance.

Three Lines Model

A governance framework where the first line owns and manages risk, the second line provides oversight and challenge, and the third line (internal audit) provides independent assurance to the board.

COSO Internal Control Components

Five components: control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by seventeen principles across the entity's objectives.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and approved by the board.

Residual Risk

The level of risk remaining after management has implemented controls and mitigation measures, compared against risk tolerance to determine acceptability.

Audit Charter

A formal document approved by the board that defines the internal audit activity's purpose, authority, and responsibility, and establishes its position within the organization.

Assurance Engagement

An objective examination of evidence to provide an independent assessment of risk management, control, or governance processes against established criteria, with conclusions communicated to stakeholders.

Consulting Engagement

An advisory activity whose nature and scope are agreed with the client, intended to add value and improve governance, risk management, and control without assuming management responsibility.

Engagement Scope

The boundaries of an engagement, specifying the systems, processes, activities, locations, and time period to be examined in achieving the engagement objectives.

Engagement Objectives

Statements defining what the engagement is intended to accomplish, guiding the design of procedures, evidence gathering, and the conclusions reported to stakeholders.

Audit Work Program

A documented list of procedures to be performed, the criteria applied, and the evidence to be gathered, approved before fieldwork and revised with documented justification.

Risk-Based Audit Plan

An annual plan prioritizing engagements according to the organization's risk profile, updated to reflect changes in risk, and approved by the board.

Sufficient and Appropriate Evidence

Evidence that is sufficient in quantity and appropriate in quality, meaning it is relevant, reliable, and useful in supporting the auditor's conclusions.

Audit Sampling

Applying procedures to less than the entire population to evaluate characteristics and draw conclusions, using statistical or non-statistical approaches with documented selection methods.

Analytical Procedures

Evaluations of financial and operational information through comparisons, ratios, trends, and relationships to identify inconsistencies, anomalies, or unexpected conditions requiring further investigation.

Working Papers

Documentation recording the engagement objectives, scope, procedures performed, evidence obtained, conclusions reached, and the preparer and reviewer of the work.

Audit Finding Elements

The four components of a finding: criteria (what should be), condition (what is), cause (why it happened), and effect (the risk or impact).

Audit Report Attributes

Required qualities of a report: accuracy, objectivity, clarity, conciseness, constructiveness, completeness, and timeliness, ensuring readers understand findings and recommendations.

Follow-Up Process

A monitoring procedure confirming that management implemented agreed corrective actions effectively, with unresolved issues escalated through the reporting line to the board.

Code of Ethics Principles

Four principles governing internal auditors: integrity, objectivity, confidentiality, and competency, each accompanied by rules of conduct that clarify expected behavior.

Independence

The freedom from conditions that threaten the ability of the internal audit activity to carry out responsibilities objectively, assessed at organizational, functional, and individual levels.

Objectivity

An unbiased mental attitude allowing auditors to perform engagements without compromise, subordination of judgment, or conflicts of interest affecting conclusions.

Cooling-Off Period

A waiting period before an auditor who previously managed or operated an activity may audit it, protecting objectivity by preventing self-review.

Fraud Triangle

A model describing three conditions that drive fraud: pressure or incentive, opportunity, and rationalization, used to assess fraud risk during engagements.

IT General Controls

Controls over the IT environment covering access management, change management, IT operations, and program development, which support the reliability of application controls.

Continuous Auditing

An automated approach using recurring tests of controls and transactions to provide timely, ongoing assurance rather than periodic retrospective review.

Quality Assurance Program

A program covering all aspects of the internal audit activity that evaluates conformance with the Standards and Code of Ethics and identifies improvement opportunities.

External Quality Assessment

An independent evaluation of the internal audit activity performed at least every five years by a qualified assessor or team from outside the organization.

Internal Quality Assessment

Ongoing monitoring and periodic self-assessments of audit work, including supervision and working paper review, reported to the board with results.

Conformance Statement

A declaration that the internal audit activity conforms with the Standards, permissible only when supported by quality assurance results and disclosed when nonconformance exists.

Chief Audit Executive

The senior position responsible for managing the internal audit activity, reporting functionally to the board and administratively to senior management to preserve independence.

Risk Assessment at Engagement Level

Evaluation of inherent risk, control design, and residual risk for the activity under review to determine the nature, timing, and extent of audit procedures.