The Internal Audit Fundamentals (IIA-CIA-Part1)

The authority element of the internal audit charter establishes internal audit’s right to obtain unrestricted access to records, systems, personnel, physical property, and other information necessary to perform engagements. Here, management’s repeated reluctance to provide requested documents is restricting the scope of audit work. The problem therefore concerns whether the authority granted to internal audit is being respected and enforced. The reporting relationship is already appropriate because the CAE reports functionally to the board. Independence and objectivity are important, but the immediate issue is denial or restriction of access rather than inappropriate influence over audit judgment. Responsibilities describe what internal audit is expected to perform, whereas authority gives it the access required to perform those responsibilities. Consequently, enforcement of the charter’s authority provisions is required.

In responding to a request from senior management for the internal audit activity to review and amend policies when auditing the purchasing department, the chief audit executive would most likely give primary consideration to maintaining internal audit independence. This request potentially places the internal audit activity into a management role, which could impair its independence and the ability to perform unbiased audits in the future. According to IIA standards, internal auditors should avoid taking on operational responsibilities to preserve their independence.

IIA Standards on independence and objectivity.

According to IIA guidance, the chief audit executive is required to report the results of the quality assurance and improvement program, including external assessments, at least annually. This ensures that the board and senior management are kept informed about the internal audit activity’s conformance with the Standards and other aspects of audit quality.

IIA ' s International Standards for the Professional Practice of Internal Auditing on Quality Assurance and Improvement.

Before performing any detailed analysis to identify potential fraud, it is essential to first ensure that the data being analyzed is complete and accurate. This helps to ensure that subsequent tests and analyses are based on reliable information. References:

IIA ' s International Professional Practices Framework (IPPF) - Standards related to data integrity and reliability.

IIA Standard 2320 - Analysis and Evaluation.

Upon completion of an external quality assessment, the chief audit executive is required to report the detailed evaluation results of the external assessment to the board. This disclosure is crucial as it provides the board with insights into the effectiveness and efficiency of the internal audit function, highlighting areas of strength and opportunities for improvement. It facilitates informed decision-making regarding the internal audit activity ' s practices and processes.

IIA Standard 1320 - Reporting on the Quality Assurance and Improvement Program

The Internal Audit Activity ' s Quality Assurance and Improvement Program (QAIP) aims to ensure that the internal audit activities are carried out to the highest standards of quality and comply with the defined audit standards and practices. Sharing the results of the QAIP with the organization ' s external auditors is permissible and can enhance the understanding and reliance on audit processes. It aids in external audit planning and may contribute to more effective and streamlined audit practices across both internal and external teams.

Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

Using knowledge from subject matter experts is an appropriate way to supplement the professional development of internal auditors. Specialists within the organization can provide technical, operational, regulatory, or industry-specific knowledge that expands the audit team’s collective competency. This approach does not transfer audit responsibility to the expert; internal audit remains responsible for exercising professional judgment and evaluating the information obtained. Increasing engagement frequency merely for training purposes may distort risk-based audit planning. An expert from the area under review may provide useful information, but involving that person directly in determining audit scope can create objectivity concerns. Learning how management determines risk tolerance can be useful business knowledge, but it is narrower than structured knowledge transfer from qualified specialists. Therefore, option C provides the most appropriate professional-development supplement.

COSO Enterprise Risk Management organizes its Performance component in a logical sequence: identify risks, assess their severity, prioritize them, implement risk responses, and then develop a portfolio view. A portfolio view allows management to consider individual risks collectively across the organization and understand the combined amount and types of risk being assumed relative to strategy and risk appetite. Prioritizing risks and assessing severity occur before risk responses are selected and implemented. Measuring risk velocity may be useful in risk analysis, but it is not the next COSO ERM principle in this sequence. Therefore, once management has identified risks and implemented appropriate responses, the next step is to develop a portfolio view so management can evaluate aggregate risk exposure across the enterprise.

In assessing the design of a training program for an organization ' s ethics program, the most relevant questions would be those that address the content of the training and the feedback mechanism used to foster ethical decision-making. Questions 1 and 4 directly relate to these aspects, examining if the training includes ethical decision-making scenarios and if there is feedback on the thought processes involved, which are critical for effective ethics training.

IIA guidance on auditing ethics programs, focusing on the effectiveness and design of training components.