IPPC common mistakes
IPPC · Understand the traps and how to avoid them.
Treating the IIA Global Internal Audit Standards as a flat checklist and quoting a single standard number as the complete answer, instead of identifying which principle, standard, and requirement apply and how they interlock (for example, citing Standard 13.1 without linking it to the engagement-level requirements it drives).
Candidates memorise standard numbers under time pressure and assume a number alone earns credit. The exam tests application and interrelation, so a bare citation reads as recognition without understanding, and candidates cannot reason through scenario-based stems that ask what the CAE must do.
What to do instead
Build a one-page map of the Standards by domain (purpose, ethics, governance, managing the function, managing engagements) and for each standard write the requirement in one sentence plus one concrete behaviour it mandates. Practise answering scenario questions by naming the principle, the standard, the requirement, and the action in that order.
Confusing the roles of the audit committee, senior management, and the chief audit executive when a question asks who approves the internal audit charter, the risk-based plan, or the budget, and defaulting to 'management approves everything'.
In many organisations management does control budgets and plans operationally, so candidates import workplace habit rather than the governance model the Standards require. The distinction between governing body oversight and management execution is easy to blur under exam pressure.
What to do instead
Memorise the governance allocation explicitly: the governing body approves the charter, the internal audit plan, and the CAE appointment or removal; management supports and provides information; the CAE owns delivery. For each sample question, first label the actor, then the decision, then the standard that assigns it.
Writing engagement objectives that restate the process ('to review procurement') rather than stating a measurable assurance objective with criteria, scope boundaries, and the risk being addressed.
Candidates draft objectives from the engagement title instead of from the risk assessment. Without explicit criteria, the objective cannot drive test design, and the resulting evidence does not answer the question asked.
What to do instead
Use a fixed template: 'To assess whether [subject] complies with [criteria] for [period/population], addressing the risk of [risk].' Draft three objectives for one process and check each against the four elements. If any element is missing, rewrite before moving to scope.
Selecting a sample or testing approach without justifying it against the population, the control's operating frequency, and the desired confidence, then reporting conclusions that outrun the evidence obtained.
Candidates default to 'judgmental sample of 25' because it appears in study material, without connecting sample size to tolerable deviation, expected deviation, and confidence. When the conclusion is challenged in a scenario, they cannot defend the inference.
What to do instead
For each testing question, state the population, the sampling unit, the method (attribute, MUS, stratified), and the rationale in one line before answering. Practise computing sample sizes from a table and explaining why a lower tolerable rate requires a larger sample. Keep conclusions explicitly bounded to the population tested.
Presenting findings as a list of observations with no condition, criteria, cause, effect, or recommendation, and burying the rating rationale so the reader cannot see how the conclusion was reached.
Candidates write findings the way they would narrate an engagement, chronologically, rather than in the structured form that supports management action. They also omit criteria because the standard was implicit in their own head.
What to do instead
Draft every finding in the five-element structure (criteria, condition, cause, effect, recommendation) and check that the effect quantifies or qualifies the risk. Write three findings from a short scenario and have each reviewed for missing cause or missing criteria.
Treating independence and objectivity as a single concept and answering 'the auditor is independent, so no threat exists' when a scenario describes a self-review, familiarity, or self-interest threat arising from a prior role or a consulting engagement.
Candidates conflate organisational independence (reporting lines, charter) with individual objectivity (mindset and threats). Because independence is organisationally intact in the scenario, they conclude no issue exists and miss the impairment.
What to do instead
Separate the two tests: first assess organisational independence (reporting line, unrestricted access, charter), then assess individual objectivity by naming the threat type and its safeguard. Practise classifying ten short scenarios into self-review, self-interest, familiarity, advocacy, and intimidation, and state the safeguard for each.
Answering quality assurance questions by describing the internal assessment only, omitting the external assessment requirement, its frequency, and who is qualified to perform it.
Internal assessments are visible and frequent in the workplace, so candidates anchor on them and forget the periodic external assessment obligation and its qualifying criteria.
What to do instead
Memorise the quality assurance and improvement programme as two pillars: ongoing and periodic internal assessments, plus an external assessment at least every five years performed by a qualified, independent assessor or assessment team. For each QA question, state both pillars and the reporting route to the governing body.
Responding to a scope-limitation scenario by continuing the engagement and noting the limitation in the report, rather than escalating to the CAE and the governing body as the Standards require.
Candidates want to appear cooperative and solution-oriented, so they choose the 'work around it' option. The exam tests whether the candidate recognises that a significant scope limitation is a governance matter, not a fieldwork inconvenience.
What to do instead
Learn the escalation ladder for scope limitations: discuss with management, escalate to the CAE, communicate to the governing body, and disclose the limitation and its effect in the report. Practise identifying the threshold at which a limitation becomes significant enough to require governing body communication.
Ignoring the follow-up obligation after management accepts a recommendation, and answering that the engagement is closed once the report is issued.
Candidates treat reporting as the end of the audit cycle because that is where most study material stops. Follow-up is a distinct requirement, and the exam tests whether the auditor monitors and reports the status of agreed actions.
What to do instead
Add a follow-up step to every engagement walkthrough: define the monitoring mechanism, the escalation path for overdue or unimplemented actions, and the reporting cadence to the governing body. Practise questions that ask what the CAE does when management accepts a high-risk finding but sets no date.
Misapplying the fraud and risk-assessment standards by assuming internal audit is responsible for detecting fraud or for designing controls, rather than assessing the organisation's fraud risk management and control processes.
Candidates blur the assurance role with the management role, especially in fraud scenarios where the desired answer feels like 'the auditor should investigate'. The Standards assign detection and control design to management.
What to do instead
Write one sentence that fixes the boundary: internal audit provides assurance on how management identifies, assesses, and manages fraud risk; it does not own detection or control design. Apply that boundary to five fraud scenarios and identify the specific assurance activity internal audit should perform in each.