IIA IIA-CIA-Part2 - Internal Audit Engagement

The frequency and approach to assessing residual risk are primarily influenced by the expectations set by the board and senior management. These expectations shape the internal audit function's priorities, including how often residual risk should be assessed and the methods used to evaluate it. This ensures that the internal audit activities are aligned with the strategic objectives and risk appetite of the organization, as defined by its senior leadership.

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2120 - Risk Management

ï‚· IIA Standards on Fraud:

Standard 2120 – Risk Management: Internal auditors must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk.

Immediate Response: When evidence of fraud is discovered, the internal auditor must ensure that appropriate actions are taken promptly.

ï‚· Next Steps for Internal Auditor:

Consult with Supervisor: The internal auditor should discuss the findings with the engagement supervisor. This ensures that the situation is assessed by a more experienced individual who can determine the next steps, including the need for specialized fraud investigation resources.

Specialized Expertise: Determining whether fraud investigation experts are needed is crucial for handling the matter appropriately, as they possess the necessary skills to investigate complex fraud cases.

ï‚· Documenting Evidence:

While documenting the evidence and recommending controls is important (Option C), the immediate step should involve consultation with the supervisor to decide on the investigation approach.

Notifying management directly (Option A) or law enforcement (Option D) should follow internal protocols and often occur after consultation with the supervisor and possibly higher-level approvals.

ï‚· References:

Engaging the engagement supervisor ensures that the appropriate steps are taken to investigate the fraud properly, aligning with professional standards and ensuring a thorough investigation​​​​.

When planning an assurance engagement, especially for a foreign subsidiary, it is essential to communicate effectively with management to ensure transparency and set expectations. According to IIA guidance, the preliminary communication should include critical information that helps the management of the area under review understand the purpose, scope, and logistics of the audit.

IIA Standard 2201 – Planning Considerations:

This standard emphasizes that the internal auditor should plan the engagement to achieve the engagement objectives effectively. It includes discussing the scope, objectives, timing, and resource allocations with management.

Key Elements to Include in Preliminary Communication:

Scope of the Engagement: Clearly defining what the audit will cover ensures that both the auditors and the management understand the boundaries and focus areas of the audit.

Estimated Time Frame: Providing a timeline helps management plan their activities and ensures that the audit process does not interfere with critical operations.

Names of the Auditors: Identifying the audit team helps in establishing a working relationship and allows management to know who will be conducting the audit.

IIA Practice Advisory 2201-1:

This advisory suggests that early communication of the scope, timing, and staffing helps in gaining the management’s cooperation and sets the stage for a successful audit.

Option B and D (Including resources and travel budget): These details are more administrative and do not need to be included in the preliminary communication to management.

Option C (Resources, budget, and scope): While scope is important, resources and budget are internal matters and not essential in preliminary communication with management.

Detailed Explanation:Why Not Other Options?Conclusion: Option A is correct as it ensures that the management is informed about the key aspects of the audit that directly impact them, aligning with IIA’s standards for audit planning and communication.

Comprehensive and Detailed Explanation:

An Integrated Test Facility (ITF) creates fictitious test data within a live system without disrupting actual operations. This allows the auditor to test the processing logic of applications under real conditions, ensuring transactions are processed consistently and correctly.

Utility software (A) supports system operations but does not test logic.

Parallel simulation (C) reprocesses transactions in an auditor-controlled system, but this does not test logic in the live environment.

Generalized audit software (D) analyzes data but does not simulate processing logic.

Therefore, the most effective method to test application logic in real time is Integrated Test Facility (B), as it directly evaluates processing accuracy within the operational system.

The purpose of a planning memorandum for an audit engagement, according to IIA guidance, is to document preliminary information that will be useful to the audit team. This includes background information on the area being audited, key risks identified, the scope of the audit, and any initial observations that might impact the audit's focus. The planning memorandum serves as a foundational document that guides the audit team's efforts and ensures that everyone involved in the engagement has a clear understanding of the audit's objectives and context.

IIA References:

IIA Standard 2200: Engagement Planning and IIA Standard 2201: Planning Considerations require the preparation of documents that summarize the preliminary planning steps, which are critical to ensuring that the audit is well-focused and aligned with the organization's risks and objectives. The planning memorandum is a key output of this process.

According to IIA guidance, reliable information must be factual, adequate, and convincing to ensure that a prudent and informed person would reach the same conclusions as the internal auditor. This means that the information should be supported by sufficient and appropriate evidence that can be independently verified and substantiated. Reliability of information is crucial for the credibility of audit findings and for making informed decisions based on those findings.

The Institute of Internal Auditors (IIA) Standard 2310 – Identifying Information: "Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement’s objectives."

IIA Practice Guide on "Audit Evidence"

Reviewing and initialing internal audit workpapers ensures that the engagement has adequate supervision. This practice demonstrates that the supervisor has reviewed the work performed by the audit team, verified the accuracy and completeness of the documentation, and provided necessary guidance. It is a critical step in the quality assurance process, ensuring that the audit findings and conclusions are supported by sufficient and appropriate evidence.

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2340 – Engagement Supervision.

For audit evidence to be considered reliable, it must be accurate, truthful, and verifiable. The absence of the bank heading, logo, or address on the bank statements raises concerns about the authenticity and integrity of the documents. Without these elements, there is no assurance that the statements are legitimate and have not been tampered with or falsified. Therefore, this evidence may not be reliable for audit purposes.

The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards)

"Auditing: A Risk-Based Approach to Conducting a Quality Audit" by Karla M. Johnstone, Audrey A. Gramling, Larry E. Rittenberg

When a significant risk is identified during a consulting engagement, the most appropriate response is to report the risk to senior management. Even if the engagement is consulting in nature, it is still crucial for the internal audit activity to ensure that significant risks are communicated to those responsible for managing them.

IIA References:

IIA Standard 2120: Risk Management requires that internal auditors evaluate the effectiveness of risk management processes and communicate significant risks to senior management. This applies regardless of whether the engagement is assurance or consulting.

The Practice Guide on Consulting Services advises that internal auditors must ensure that significant risks identified during consulting engagements are brought to the attention of senior management so that they can take appropriate action.

A finding can be removed from the final audit report if management provides additional information that accurately contradicts the initial findings. This indicates that the initial findings may have been based on incomplete or incorrect information. Disagreements (Option A) or beliefs about the insignificance (Option D) of the finding do not justify removal unless they are supported by new, contradicting evidence. Even if corrective actions are already taken (Option B), the original finding may still be relevant for documentation and historical context.

IIA Standard 2410: Criteria for Communicating.

IIA Practice Guide on Communicating Results.

In the context of an internal audit observation, the cause component should be added to explain why the subsidiary has thousands of client contracts on paper instead of in the required electronic system. The cause helps identify the root reason behind the non-compliance with the organization's rules of record management. In this case, the cause could be the lack of sufficient assistants to scan the contracts into the system. Including the cause in the observation provides clarity on the underlying issues and helps in formulating effective recommendations to address the problem.

The Institute of Internal Auditors (IIA) Standard 2410.A1 – Criteria for Communicating: "Final communication of engagement results must, where appropriate, contain the internal auditors’ overall opinion and/or conclusions."

IIA Practice Guide on "Root Cause Analysis"

According to IIA guidance, monitoring customer quality complaints compared to the prior period to identify vendor issues is least likely to be a key financial control in an organization's accounts payable process. Key financial controls in accounts payable typically focus on preventing and detecting fraud and errors in the payment process, such as requiring approval for vendor changes, monitoring payment amounts, and comparing employee and vendor addresses to prevent fraud. Monitoring customer quality complaints is more relevant to quality control and vendor management rather than financial control.

IIA Standards: 2130 - Control

IIA Practice Guide: Auditing the Accounts Payable Process

If a control is found to be poorly designed during the planning stage, testing its operating effectiveness becomes redundant because even a well-implemented but poorly designed control will not achieve its intended objectives. The primary focus should be on redesigning the control to ensure it is effective in mitigating risks. Therefore, the auditor should not have proceeded to test the operational effectiveness of a control that was already deemed poorly designed.

The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards)

"Auditing: A Risk-Based Approach to Conducting a Quality Audit" by Karla M. Johnstone et al.

Stratification groups numeric values into categories.

Gap testing identifies missing values in sequences.

Duplicate testing identifies repeated identical entries within a dataset.

Joining different data sources allows matching of information across disparate systems (e.g., comparing vendor names in accounts payable vs. vendor master records).

Since the question refers to identifying inconsistencies across different systems, the correct technique is joining different data sources (Option C).

ï‚· Contribution Margin: Contribution margin is the amount by which the sales price of a product exceeds its variable costs. After reaching the break-even point, each additional unit sold contributes directly to operating income.

Cost-volume-profit (CVP) analysis, which highlights the role of contribution margin in determining profitability.

ï‚· Operating Income: At the break-even point, fixed costs are covered, so additional units sold increase operating income by the contribution margin per unit.

Fixed Costs: Fixed costs per unit (option A) do not change with additional units sold.

Variable Costs: Variable costs per unit (option B) remain constant and are deducted from sales price to calculate contribution margin.

Gross Margin: Gross margin per unit (option D) includes fixed costs and is less directly relevant than the contribution margin.