CGIA key terms

A governance framework in which operational management owns and manages risk, a risk and compliance function provides independent oversight and challenge, and internal audit gives independent assurance to the governing body.

A formal document approved by the governing body that defines internal audit's purpose, authority, and responsibilities, grants access to records and personnel, and establishes the reporting line.

The freedom of the internal audit function from conditions that threaten its ability to carry out responsibilities objectively, including organizational status, reporting lines, and freedom from operational duties.

An unbiased mental attitude that lets auditors perform engagements without subordinating judgment to others, avoiding conflicts of interest and not auditing activities they recently managed.

The requirement that auditors report to the chief audit executive any situation that may compromise independence or objectivity, including personal or professional relationships, so safeguards can be assessed.

A situation in which an auditor's personal, financial, or professional interest could improperly influence engagement judgments, requiring disclosure and, where necessary, reassignment of duties.

The complete set of auditable entities, processes, systems, and risks within an organization from which the risk-based annual audit plan is derived and prioritized.

A discrete, identifiable area of the organization, such as a process, function, or system, that can be separately assessed and assigned to an engagement.

An annual or periodic plan that allocates audit resources to areas of highest residual risk and significance, considering changes, complexity, and prior audit results.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, used by auditors to judge whether exposures and controls are appropriate.

The risk remaining after management has applied controls and mitigation, which auditors compare with risk appetite to assess whether further action is needed.

The level of risk before considering the effect of controls, used as a starting point when assessing where controls matter most and how much testing is warranted.

Any action, policy, or system designed to reduce risk to an acceptable level, including preventive, detective, and corrective measures applied to processes and information.

A widely used model describing five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities.

The tone set by the governing body and management, including integrity, ethical values, organizational structure, authority, and commitment to competence, which underpins all other controls.

The processes and structures through which an organization directs, controls, and holds itself accountable, including board oversight, strategy setting, and risk management.

The defined boundaries of an audit, specifying which processes, locations, systems, and time periods are included and excluded, and the nature of work to be performed.

Clear statements of what an audit is intended to achieve, expressed as questions or assertions about controls, risk management, or governance that the work will answer.

A documented plan listing the procedures, tests, and sampling approaches needed to achieve engagement objectives and gather sufficient appropriate evidence.

Information gathered through inspection, observation, inquiry, and analysis that supports audit conclusions; it must be sufficient, appropriate, relevant, and reliable.

Two measures of evidence quality: sufficiency concerns quantity needed to support conclusions, while appropriateness concerns relevance and reliability of the information.

Confirming evidence from one source with independent evidence from another, such as matching interview statements against documents or system records.

The documented record of procedures performed, evidence obtained, and conclusions reached, prepared so that another auditor could understand and re-perform the work.

Supervisory examination of engagement documentation for completeness, accuracy, and support for conclusions, performed before the report is issued and evidenced by sign-off.

The risk that conclusions drawn from a sample differ from conclusions that would be reached by testing the entire population, affected by sample size and selection method.

Evaluations of financial or operational information by comparing recorded amounts with expectations, such as trends, ratios, or budgets, to identify anomalies requiring investigation.

A documented audit result describing a condition, the criteria it deviates from, the cause, and the effect or risk, forming the basis for a recommendation.

The standards, policies, laws, or benchmarks against which an auditor evaluates a condition; without agreed criteria, a finding cannot be validly asserted.

The underlying reason a deficiency exists, such as a missing control, unclear ownership, or inadequate training, which determines whether a recommendation will actually resolve the issue.

A proposed action addressing the root cause of a finding, stated specifically enough to be implementable and verifiable, and agreed with management where possible.

Management's documented response to a finding, including the corrective actions to be taken, the responsible owner, and the target completion date.

The process of monitoring whether management has implemented agreed actions, verifying status, and escalating unresolved or overdue issues to appropriate governance levels.

The structured process of raising significant or unresolved risks to senior management and the governing body when normal reporting channels have not produced action.

A committee of the governing body, typically independent, that oversees financial reporting, internal control, risk management, and the internal audit function.

The senior leader responsible for managing the internal audit function, including planning, resourcing, quality, reporting to the governing body, and maintaining independence.

A structured program covering internal and external assessments of the audit function's conformance with standards and its effectiveness, with results reported to the governing body.

An independent review of the internal audit function, conducted at least every five years by a qualified outside assessor, concluding on conformance with professional standards.

An objective review of an engagement's significant judgments and conclusions before the report is issued, performed by someone not involved in the engagement.

The state of complying with mandatory elements of professional internal audit standards, including the code of ethics; deviations must be disclosed and explained.

The level of skill and judgment expected of a reasonably prudent auditor, applied throughout planning, fieldwork, and reporting, without guaranteeing that all irregularities will be found.

A questioning mindset that keeps auditors alert to conditions suggesting possible misstatement, fraud, or control failure, prompting corroboration rather than acceptance of assertions.

The possibility that intentional deception, such as misappropriation or fraudulent reporting, will occur; auditors assess it but do not accept responsibility for detecting all fraud.

An indicator or pattern suggesting increased likelihood of fraud or error, such as unusual journal entries, lifestyle changes, or control overrides, which warrants further investigation.

The coordinated use of assurance from internal audit, risk and compliance functions, and external parties to give the governing body a complete view of risk coverage.

The practice of using work performed by other assurance providers or experts after evaluating their competence, objectivity, and methodology, with the auditor retaining responsibility for conclusions.

The use of automated techniques to test transactions and controls on an ongoing or near-real-time basis, rather than only at periodic intervals.

The application of techniques to large datasets to identify patterns, anomalies, and populations for testing, often replacing or supplementing traditional sampling approaches.

A newly developing or changing risk, such as those from technology, regulation, or business model shifts, that may not yet be captured in existing risk registers or audit plans.

A facilitated process in which process owners evaluate the design and effectiveness of their own controls, providing input to audit planning and risk assessment.

The process of identifying, analyzing, and evaluating risks to determine their likelihood and impact and to prioritize them for management or audit attention.