IIA-CIA-Part2 Exam Questions Tutorials

The observation provided in the final engagement communication includes the criteria (competitive bidding requirements), condition (three of the 10 contracts reviewed did not meet these requirements), and cause (senior management deemed these purchases critical and awarded them as sole-source). However, it lacks the effect, which would explain the potential consequences or impact of not meeting the competitive bidding requirements, such as increased costs, lack of transparency, or potential for favoritism. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2410 - Criteria for Communicating.

The IIA’s Practice Guide on Communicating Results.

According to IIA guidance, there is no specific frequency mandated for conducting organization-wide risk assessments. Instead, the internal audit activity should perform risk assessments as necessary to reflect significant changes in the organization's business environment, risk profile, and operations. This flexibility allows the internal audit activity to remain responsive and relevant in a dynamic risk landscape.

IIA References:

IIA Standard 2010: Planning requires the CAE to establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals. The frequency and timing of risk assessments should be adapted to the organization’s changing conditions.

The IIA Practice Guide on Risk Assessment in Audit Planning emphasizes that risk assessments should be updated as needed, particularly when there are significant changes in the organization or external environment.

According to the IIA guidance, when determining the need to follow-up on recommendations, the internal audit activity should consider factors such as the degree of effort and cost needed to correct the reported condition, the complexity of the corrective action, and the impact that may result should the corrective action fail. These factors are critical in assessing the importance and urgency of follow-up. However, the amount of resources required to conduct the follow-up activities should not be a primary consideration, as the focus should be on the significance of the issues and the potential risks associated with them. References: IIA Standard 2500 – Monitoring Progress, IIA Practice Advisory 2500.A1-1

The primary weakness of internal control questionnaires (ICQs) is that the respondents, who are often managers or personnel responsible for specific areas, may have incentives to indicate that internal controls are in place, even when they might not be effective or fully operational. This can occur due to a desire to present their department in a positive light, avoid scrutiny, or because of misunderstandings about what constitutes a control. This bias in responses can lead to inaccurate assessments of the internal control environment.

IIA References:

IIA Standard 2310: Identifying Information and its accompanying guidance highlight the importance of obtaining accurate, reliable, and unbiased information when assessing controls. The potential for biased responses in ICQs is a known risk that can undermine the quality of the audit evidence gathered.

The Practice Guide on Evaluating Internal Controls notes that while ICQs are useful for gathering information, auditors should be aware of the limitations and potential biases inherent in this method.