IIA IIA-CIA-Part2 - Internal Audit Engagement

When the board requests consulting services to gain insight regarding external risks, the appropriate engagement objective is to assess the organization's ability to minimize these risks. This involves evaluating the organization's risk management framework, including identifying external risks, assessing their potential impact, and reviewing the effectiveness of the strategies and controls in place to mitigate these risks. By doing so, internal auditors provide valuable insights into how well the organization is prepared to handle external threats and ensure the achievement of its annual objectives.

Institute of Internal Auditors (IIA) Standards: Performance Standards 2110: Governance

COSO Enterprise Risk Management (ERM) Framework: Risk Assessment and Risk Response Components

Improper segregation of duties is a fundamental control weakness that significantly increases the risk of fraud. When one individual has control over multiple stages of a financial transaction or operational process, it creates opportunities for fraudulent activities to occur and remain undetected. While incentives and bonus programs (Option B), employee concerns (Option C), and lack of an ethics policy (Option D) are also important indicators of potential fraud risk, they do not present as direct and immediate a vulnerability as improper segregation of duties.

IIA Practice Guide on Fraud Prevention and Detection in an Automated World.

IIA Standard 2120: Risk Management.

Effective risk management and internal control processes are best exemplified by having relevant risk indicators and mitigation plans in place. This demonstrates that the organization not only identifies and assesses risks but also actively monitors and manages these risks through appropriate mitigation strategies. The presence of risk indicators and mitigation plans indicates a proactive approach to risk management, ensuring that potential issues are addressed before they can impact the organization significantly.

The Institute of Internal Auditors (IIA) Standard 2100 – Nature of Work: "The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach."

COSO Enterprise Risk Management Framework

A. Decline the audit engagement, because the Standards prohibit internal auditors from performing engagements where they lack the necessary competencies:The Standards allow for outsourcing or co-sourcing to meet competency gaps. Declining outright is not necessary.

B. Accept the audit engagement and use the engagement as an opportunity to develop the audit team’s IT expertise while performing the audit work:This approach risks compromising audit quality as the team lacks expertise.

C. Temporarily hire an experienced and knowledgeable IT analyst from the organization's IT department to lead the audit:This could create independence issues, as the IT analyst is part of the auditee’s function.

D. Outsource the audit engagement to a reputable IT audit consulting firm:Correct. Outsourcing ensures that the engagement is performed by qualified professionals, maintaining quality and adherence to the Standards.

CIA Exam Syllabus Reference:

Domain IV: Managing the Internal Audit Function – Resourcing and Competency Management.

In a compliance audit, the objective is to assess adherence to laws, regulations, or regulatory requirements. For banking compliance, this means verifying whether business continuity plans comply with mandatory regulations (Option B). Options A, C, and D relate to efficiency, best practices, or operations — not compliance.

To determine the additional cost that the company would incur to make a profit of $1.50 per unit for the new order, we need to calculate the relevant costs and desired profit margin:

Current Cost and Selling Price: The current cost to produce one unit is $26, with $10 being fixed costs and $16 being variable costs. The product is usually sold for $30.

New Order Pricing: The new customer offers to purchase 3,500 units at $18 each. The company needs to make a profit of $1.50 per unit on this order.

Calculation:

Desired selling price to achieve the profit = Cost per unit + Desired profit = $16 + $1.50 = $17.50

Offered price by the customer = $18.00

Additional cost allowed per unit = Offered price - Desired selling price = $18.00 - $17.50 = $0.50

Therefore, the additional cost the company can incur to make the required profit per unit is $2.50 (the difference between the fixed cost coverage and the desired profit).

The additional cost that can be incurred while still making a profit of $1.50 per unit is $2.50

Introduction:

Review notes are comments or questions posed by engagement supervisors during the review of workpapers to ensure audit quality and completeness.

IIA Guidance on Review Notes:

According to the IIA, review notes serve as a tool for engagement supervisors to seek additional evidence or clarification.

Options Analysis:

Option A: This is correct as per IIA guidance, once concerns have been addressed, review notes can be cleared from the final documentation.

Option B: Management does not typically address review notes; these are internal audit processes.

Option C: The CAE does not need to initial or sign the review notes, as the engagement supervisor's review is sufficient.

Option D: While review notes must be addressed, they do not necessarily need to be retained after being resolved.

Conclusion:

The correct procedure allows for review notes to be cleared once the engagement supervisor’s concerns are addressed, streamlining the documentation process.

IIA’s International Professional Practices Framework (IPPF).

ï‚· Corporate Policy Statement: Having the president and the board issue a statement stressing the importance of accurate management reporting and the negative consequences of intentional misreporting can help set a tone at the top. This reinforces the significance of ethical behavior and compliance with reporting policies across the organization.

Strong tone at the top is critical for fostering an ethical culture and compliance within an organization (IIA Standard 2110 – Governance).

ï‚· Business Process Indicators: Assisting the controller in developing and monitoring business process indicators that are historically correlated with, but independent of, sales can provide an objective means to validate sales reports. This reduces the opportunity for management to exaggerate sales figures as these indicators can act as a control mechanism.

If the branch manager decides not to act on a significant risk that was previously acknowledged, the CAE should escalate the issue to the board. The board has ultimate responsibility for risk management and needs to be informed about significant risks and the decisions made by management regarding these risks. This ensures transparency and allows the board to take appropriate action if necessary.

When the internal audit activity lacks the necessary IT expertise to review the information security function, the chief audit executive (CAE) should contract an external service provider with the required experience. This ensures that the audit is conducted effectively and in accordance with the Standards, which require internal auditors to have or acquire the necessary skills to perform their work.

IIA References:

IIA Standard 1210: Proficiency requires internal auditors to possess the knowledge, skills, and other competencies needed to perform their responsibilities. When the necessary expertise is not available within the internal audit activity, the CAE must obtain competent advice and assistance by either contracting external experts or outsourcing the audit.

The Practice Guide on Engaging External Service Providers suggests that when specialized skills are required, engaging an external service provider is a practical solution to ensure the audit's quality and effectiveness.

To prevent the situation where discrepancies identified by the auditor are corrected after being noted, it is essential to preserve the audit evidence. Taking screenshots or extracting tender documents would provide a permanent record of the discrepancies, ensuring that any subsequent changes do not invalidate the auditor's findings. This practice is crucial for maintaining the integrity of the audit evidence and supporting the audit conclusions. Option B is related but not as direct as preserving primary evidence. Options C and D do not address the preservation of evidence effectively.

The IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2310 - Identifying Information.

According to IIA guidance, the CAE has the ultimate responsibility for the internal audit activity but may delegate tasks such as reviewing, approving, and signing engagement reports to qualified internal audit staff. This delegation helps in managing workload and leveraging expertise within the team. However, the CAE should still periodically review the reports to maintain oversight and ensure quality. References: = IIA Standard 2060 - Reporting to Senior Management and the Board, and Standard 2400 - Communicating Results.

When addressing excessive overtime being paid to employees in an organization's customer service call center, the most relevant techniques for the internal auditor to use would be trend analysis, external benchmarking, and internal benchmarking. Trend analysis helps in identifying patterns over time, which can highlight the causes of excessive overtime. External benchmarking compares the organization's overtime data with industry standards to identify discrepancies. Internal benchmarking compares overtime across different departments or similar call centers within the organization to identify best practices and areas needing improvement. Confirmation is not as relevant in this context as it is primarily used to verify the accuracy of information through direct verification. References:

The IIA’s Practice Guide on Data Analytics.

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2320 - Analysis and Evaluation.

When an internal auditor identifies a potential significant weakness in a control and management does not agree with the assessment, the appropriate next step is to perform additional audit work to better articulate the risk. This means gathering more evidence, conducting further analysis, and providing clearer examples of how the weakness could impact the organization. By doing this, the auditor can better communicate the potential consequences and severity of the risk to management, increasing the likelihood of reaching a mutual understanding and agreement on the necessary actions.

The Institute of Internal Auditors (IIA) Practice Guide: Communicating Risk and Control Information

IIA Standard 2310 - Identifying Information

IIA Standard 2410 - Criteria for Communicating