The document provides study notes for Certified Internal Auditor (CIA) Part 2 exam covering the Practice of Internal Auditing. It includes an index and sections on managing the internal audit activity, planning engagements, conducting engagements, and communicating results. The mentor introduces himself and provides background before delving into the material for each exam section.
The document provides study notes for Certified Internal Auditor (CIA) Part 2 exam covering the Practice of Internal Auditing. It includes an index and sections on managing the internal audit activity, planning engagements, conducting engagements, and communicating results. The mentor introduces himself and provides background before delving into the material for each exam section.
The document provides study notes for Certified Internal Auditor (CIA) Part 2 exam covering the Practice of Internal Auditing. It includes an index and sections on managing the internal audit activity, planning engagements, conducting engagements, and communicating results. The mentor introduces himself and provides background before delving into the material for each exam section.
The document provides study notes for Certified Internal Auditor (CIA) Part 2 exam covering the Practice of Internal Auditing. It includes an index and sections on managing the internal audit activity, planning engagements, conducting engagements, and communicating results. The mentor introduces himself and provides background before delving into the material for each exam section.
The document provides study notes for the Certified Internal Auditor (CIA) Part 2 exam, covering topics such as managing the internal audit activity, planning engagements, conducting audits, and communicating results.
The document is intended to provide study material for the CIA Part 2 exam, covering the practice of internal auditing.
The main sections covered include: Section A on managing the internal audit activity, Section B on planning engagements, Section C on conducting audits, and Section D on communicating results and managing progress.
CERTIFIED INTERNAL AUDITOR (CIA), US
PART 2 – PRACTICE OF INTERNAL AUDITING –
2019 STUDY NOTES
MUHAMMAD ZAIN CPA, CMA, CIA FOUNDER OF ZAIN ACADEMY
WhatsApp (Messaging & Call): +92 311 222 4261
Facebook: https://web.facebook.com/mzainhabib LinkedIn: https://www.linkedin.com/in/mzainhabib/ Twitter: https://twitter.com/mzaincpacmacia Email: [email protected] Web: www.zainacademy.us CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
INDEX
ABOUT THE MENTOR ...................................................................................... 4
LETTER FROM MUHAMMAD ZAIN ............................................................. 5
CIA PART 2 – BASIC INFORMATION...........................................................6
SECTION A – MANAGING THE INTERNAL AUDIT ACTIVITY ......... 7
SECTION B – PLANNING THE ENGAGEMENT .................................... 32
BOOKS WRITTEN BY MUHAMMAD ZAIN ............................................. 63
QUOTES THAT WILL CHANGE YOUR LIFE .......................................... 64
From the Desk of Muhammad Zain – Founder of Zain Academy Page 3 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
ABOUT THE MENTOR
Muhammad Zain has passed Uniform Certified Public Accountant (CPA) exams from the American Institute of Certified Public Accountants (AICPA), US in February 2018, Certified Management Accountant (CMA) exams from Institute of Management Accountants (IMA), US and Certified Internal Auditor (CIA) exams from Institute of Internal Auditors (IIA), US in March 2014. He completed his Masters of Business Administration (MBA) in March 2010 from University of Karachi, Pakistan. He earned his Bachelors of Commerce (BCom) from the same University in November 2007. He has working experience of twelve years which includes five years of Public Accounting experience of working in EY Ford Rhodes, Pakistan – a member firm of Ernst & Young Global Limited (big4) and more than six years of working experience in Industry. He founded Zain Academy in 27 February 2017 with the mission “Knowledge for ALL” and objective to “disseminate education for all candidates who wish to change the landscape of our working environment, believe in continuous education and strive for the best.” The idea is not to live forever but to create something that will. He has trained many candidates around the globe and has helped them in attaining their true potential. Readers are welcomed to contact him for online interactive sessions for any part of CPA, CMA or CIA. Furthermore, do visit the Zain Academy’s YouTube channel for informative videos.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 4 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
11 April 2019
Dear CIAs,
May Peace, Blessings and Mercy of Allah be upon you and in particular on the Noble Messenger Prophet Muhammad (Peace Be Upon Him), his Family and his Companions
I am feeling very excited to present you the 2019 edition of Certified Internal Auditor (CIA) – Part 2 – Practice of Internal Auditing Study Book. This Study Book covers all the important and relevant concepts and topics that will be tested in the exams. This book can also be used for review, revision and rehearsal purposes. After reading this book, you will be needing is the sufficient and quality practice of test bank questions.
I have tried very hard to keep the materials simple, clear and concise so that the candidates enjoy reading the book. Please do check the Facebook page https://www.facebook.com/zainacademy for updates. Extreme care is required when rendering professional advice to clients.
Readers are encouraged to provide a review, rating, and feedback on the study book on https://www.facebook.com/zainacademy/reviews/. This review will help me and prospective candidates to benefit from improvements in the materials over time.
Those candidates who wish to submit their Character Reference Forms to the Institute can fill the required particulars and email me the same. I will attest the same and reply back through email.
I dedicate this work to the Prophet Muhammad (Peace Be Upon Him), Mercy to all the Creation, who has been the source of inspiration and guidance to the whole of humanity.
May ALLAH, Creator of the Heavens and Earth, Master of the Day of Judgement and to whom the Sovereignty belongs bless you ALL in this Life and in particular the Life Hereafter as well.
With Love and Care,
Muhammad Zain CPA, CMA, CIA From the Desk of Muhammad Zain – Founder of Zain Academy Page 5 of 64 CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
CIA PART 2 – BASIC INFORMATION
SYLLABUS
S.No Sections Description Weightage
1. Section A Managing the Internal Audit Activity 20% 2. Section B Planning the Engagement 20% 3. Section C Conducting Internal Audit Engagements 40% 4. Section D Communicating Results and Monitoring Progress 20%
There will be 100 MCQs being tested in the exam in the 120 minutes (2 hours) time period.
PREPARATION TIME PERIOD
CIA Part 2 requires complete two months of study and practice with the assumption that the candidates are able to give at least three hours on weekdays and five hours on weekends.
PASSING SCORE
The IIA will conduct a standard-setting study based on the revised CIA syllabi. The IIA’s Professional Certifications Board will use these results to determine the passing score of the exams. For each CIA exam part, a raw score (the number of items answered correctly) will be converted into a scaled score ranging from 250 to 750 points. A scaled score of 600 or higher is required to pass a CIA exam.
IMPORTANCE OF CIA CERTIFICATION
CIA Certification is the premium internal auditing qualification that is respected
globally. Holders of CIA designation can work in Internal Auditing, Risk Management, Compliance, Forensic Auditing, Fraud Investigation functions.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 6 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
SECTION A – MANAGING THE INTERNAL AUDIT ACTIVITY
(WEIGHTAGE 20%)
S.No Questions Answers
1. Define Internal Internal auditing is an independent, objective assurance Auditing? and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. 2. What is Internal The internal audit activity must evaluate and contribute Auditing’s nature to the improvement of the organization’s governance, of work? risk management, and control processes using a systematic, disciplined, and risk-based approach. Internal audit credibility and value are enhanced when auditors are proactive, and their evaluations offer new insights and consider the future impact. 3. What are the From an operational standpoint, the chief audit operational executive (CAE) has to make sure that: duties of CAE? 1. Planned engagements are carried out in a timely manner. 2. Resources needed to carry out the planned engagements are properly allocated. 3. Results of the engagements are properly communicated to all interested parties. 4. What does the The chief audit executive must effectively manage the Standard 2000 – internal audit activity to ensure it adds value to the Managing the organization. Internal Audit Activity The internal audit activity is effectively managed when: elaborates? 1. It achieves the purpose and responsibility included in the internal audit charter. 2. It conforms with the Standards. 3. Its individual members conform with the Code of Ethics and the Standards. 4. It considers trends and emerging issues that could impact the organization.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 7 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
The internal audit activity adds value to the
organization and its stakeholders when it considers strategies, objectives, and risks; strives to offer ways to enhance governance, risk management, and control processes; and objectively provides relevant assurance. 5. What does The chief audit executive must establish policies and Standard 2040 - procedures to guide the internal audit activity. Policies and Procedures say? The form and content of policies and procedures are dependent upon the size and structure of the internal audit activity and the complexity of its work.
The size, structure, and complexity of the IAA will
determine the necessary extent, depth, and formalization of the policies and procedures. 6. With whom the It is essential to ensure that internal audit policies and Internal Audit procedures are aligned with: Activity policies and procedures 1. The Mandatory Guidance of the International must be aligned Professional Practices Framework (IPPF). with? 2. The internal audit charter. 3. The organization’s strategies, policies, and processes. 4. What is generally Internal Audit policies include the: included in Internal Audit 1. The overall purpose and responsibilities of the policies? internal audit activity. 2. ii. Adherence to the Mandatory Guidance of the IPPF. 3. iii. Independence and objectivity. 4. iv. Ethics. 5. v. Protecting confidential information. 6. vi. Record retention. 5. What is generally Internal Audit procedures include the: included in 1. Preparing a risk-based audit plan. Internal Audit 2. Planning an audit and preparing the engagement procedures? work program. 3. Performing audit engagements. 4. Documenting audit engagements. 5. Communicating results/reporting. 6. vi. Monitoring and follow-up processes. 6. Who develops the The chief audit executive develops policies and policies and procedures. Formal administrative and technical audit procedures of
From the Desk of Muhammad Zain – Founder of Zain Academy Page 8 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
Internal Audit manuals may not be needed by all internal audit
Activity? activities. 7. What is the role The following are other functions of the audit of Audit committee regarding the internal audit activity: Committee 1) Selecting or removing the CAE and setting his or her regarding the compensation Internal Audit 2) Approving the internal audit charter Activity? 3) Reviewing and approving the internal audit activity’s work plan 4) Ensuring that the internal audit activity is allocated sufficient resources 5) Resolving disputes between the internal audit activity and management 6) Communicating with the CAE, who attends all audit committee meetings 7) Reviewing the internal audit activity’s work product (e.g., interim and final engagement communications) 8) Ensuring that engagement results are given due consideration 9) Overseeing appropriate corrective action for deficiencies noted by the internal audit activity 10) Making appropriate inquiries of management and the CAE to determine whether audit scope or budgetary limitations impede the ability of the internal audit activity to meet its responsibilities 8. What is the role The following are other functions of the audit of Audit committee regarding the external auditor: Committee regarding the 1. Selecting the external auditing firm and negotiating External its fee Auditors? 2. Overseeing and reviewing the work of the external auditor 3. Resolving disputes between the external auditor and management 4. Reviewing the external auditor’s internal control and audit reports 9. What does the The audit manual covers everything from the Internal Audit Manual Audit Charter to performance reviews and evaluations covers? and provides guidance from planning the engagement to the final report.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 9 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
10. What does The chief audit executive must establish risk-based Standard 2010 - plans to determine the priorities of the internal audit Planning say? activity and to make certain that they are consistent with the organization’s goals.
To develop the risk-based plan, the chief audit
executive consults with senior management and the board and obtains an understanding of the organization’s strategies, key business objectives, associated risks, and risk management processes. The chief audit executive must review and adjust the plan, as necessary, in response to changes in the organization’s business, risks, operations, programs, systems, and controls. 11. What are the Factors the internal auditor considers when developing factors that the internal audit plan include: Internal Auditor considers while • Inherent risks—Are they identified and assessed? developing • Residual risks—Are they identified and assessed? Internal • Mitigating controls, contingency plans, and Audit plan? monitoring activities—Are they linked to individual events and/or risks? • Risk registers—Are they systematic, completed, and accurate? • Documentation—Are the risks and activities documented?
In addition, the internal auditor coordinates with other
assurance providers and considers planned reliance on their work.
An internal audit activity’s plan will normally focus on:
• Unacceptable current risks where management action is required. These would be areas with minimal key controls or mitigating factors that senior management wants to be audited immediately. • Control systems on which the organization is most reliant. • Areas where the differential is great between inherent risk and residual risk. • Areas where the inherent risk is very high. 12. What are the The planning process and specific work schedules for characteristics of engagements should include the following:
From the Desk of Muhammad Zain – Founder of Zain Academy Page 10 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
Engagement Work • Which engagements should be performed. Schedule? • When engagements should be performed. • The time required for each engagement, taking into account the scope of the planned engagement work and the nature and extent of related work performed by others. • Which engagements should receive priority over others. 13. What does the The chief audit executive must ensure that internal Standard audit resources are appropriate, sufficient, and 2030 - Resource effectively deployed to achieve the approved plan. Management say? Appropriate refers to the mix of knowledge, skills, and other competencies needed to perform the plan.
Sufficient refers to the quantity of resources needed to
accomplish the plan.
Resources are effectively deployed when they are used
in a way that optimizes the achievement of the approved plan. 14. What is the When an external service provider serves as the internal responsibility of audit activity, the provider must make the organization External Service aware that the organization has the responsibility for provider for maintaining an effective internal audit activity. Internal Auditing? 15. What are the 1. Operational Management three lines of 2. Business Enabling Functions defenses? 3. Internal Auditors 16. What are the Some factors to consider when assigning staff to factors individual engagements are: to consider when assigning staff to • The complexity of the engagement. individual • The resources that are available in the IAA. assignments? • The experience and skill level of the staff. • The training and developmental needs of the audit staff. 17. What is the The size of the budget for the internal audit activity is Internal determined by the internal audit plan, the Audit Budget? organizational structure, and the staffing strategy. The budget must include all of the activities that are needed to accomplish the objectives of the IAA, including:
From the Desk of Muhammad Zain – Founder of Zain Academy Page 11 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• Paying staff. • Training and staff development. • Hiring external specialists as needed. • Any other expenses that the department will incur in the performance of its duties. 18. What are the Hiring from inside the organization has advantages: repercussions • It is faster because the employee is already familiar of hiring with company’s policies and procedures. candidates • There is less risk because the CAE has already worked in IAA from inside with the employee and is more aware of his or her the organization? capabilities and limitations. • Hiring from within provides motivation for the IAA staff to do good work and earn a promotion. If, however, the wrong people are promoted, or people are promoted because of reasons other than their work skills, then hiring from inside may have a negative effect on the entire department. 19. What are the Hiring from outside the organization is riskier, but it repercussions also has advantages: of hiring candidates • The outside person could bring new ideas and new in IAA from perspectives to the job and the organization. outside the • The new person may have skills or experience that are organization? not currently within the organization. • Management training costs could be lowered because it is assumed that the person is already qualified and will not require additional training. 20. What does the Training gives the staff the necessary skills to perform Training purpose their jobs in the short term and also develop and serve? broaden their skills for their long-term development. Training should benefit the individual and also help the IAA meet its organizational goals. Therefore, some staff may be trained in areas where the IAA does not currently have all of the required skills, even if the staff does not have a personal interest in those areas. Also, a well-developed training program is an excellent recruiting tool for the company. 21. What does the Counseling, or mentoring, is an important element of Counseling staff development. In a large internal audit department, purpose there may be a formal counseling and mentoring serve? program and, in such a situation, the CAE most likely is responsible for the oversight and management of the
From the Desk of Muhammad Zain – Founder of Zain Academy Page 12 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
process. Additionally, the CAE may be the counselor for
some of the higher-level staff members in the department. 22. What is the Performance evaluations should be made at least purpose annually, or more often if needed. The performance of Performance evaluations need to focus on the skills that are Evaluation? necessary for the individual to perform his or her work and for IAA as a whole to perform its duties. These staff evaluations should be seen as a means of giving internal audit employees the opportunity to identify their weaknesses and give them an opportunity to improve their performance. The evaluation should not be based on personal likes or dislikes or other non-employment related factors. 23. What are the The advantages are: advantages of decentralization a) Reduced travel time and expense, of Internal Audit b) Improved service in the operating locations served by Department? the field offices, c) Better morale of internal auditors as a result of increased authority, and d) The possibility of employing persons who do not wish to travel. 24. What is the Audit The Audit Universe is the list of all possible Universe? engagements that could be performed, and the list will need to be refined over time with changes in management’s objectives. There are a number of sources that the CAE will use to establish the audit universe. Among them are:
• Previously-performed engagements. • Engagements that were considered in the past but not performed for some reason. • New engagements that are connected to new business lines, departments, or business activities. • Engagements that are legally required, or newly required because of a new law or regulation. • New engagements that are needed because of new technology or changes in the technologies used by the company. 25. What is the Risk Risk Assessment is a systematic process for assessing Assessment? and integrating professional judgments about probable adverse conditions and/or events. The risk assessment
From the Desk of Muhammad Zain – Founder of Zain Academy Page 13 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
process should provide a means of organizing and
integrating professional judgments for development of the audit plan. 26. What are the Risk Assessment has both quantitative (numerical) and quantitative qualitative (characteristic) factors. Quantitative and qualitative assessments include the dollar value of the assets at risk assessment of or potential monetary loss, while qualitative Risk assessments include the risk of fraudulent behavior or Assessment? the importance of the section to the operations of the business as a whole.
Risks are prioritized based on likelihood and impact.
27. What are the Checklists and questionnaires are often used as part of limitations the risk assessment process, but they have a few of Checklists and limitations: Questionnaires? 1) Staff members may get a false sense of security that all issues have been addressed when the checklist is filled out. 2) The reader of the checklist may assume that all items listed are of equal importance. 3) The use of the checklist may weaken the professional skepticism and judgment of the auditor, who may be more attentive to a specific item listed and not to the larger picture. 28. What are the Other factors besides risk that should be considered other factors when prioritizing engagements include: for prioritizing Audit • The length of time since the last engagement was Engagements? performed in this area and audit cycle requirements. Many companies establish a system in which specific engagements are conducted at set intervals (for example, every year, every two years, or every three years). How often each engagement is conducted depends largely on the assessed risk of the area. • Requests from senior management, the audit committee, or other governing and regulatory bodies. • An engagement’s relation to the external audit. • Changing circumstances in the business, operations, programs, systems, or controls. • Changes in the risk environment or control procedures in the department.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 14 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• The potential benefit that could be achieved from the
engagement. • Changes in the skills of the available staff (through new employees or recent training), because new skills may enable different types of engagements. 29. What are the There are three basic levels of planning: three levels of Planning of 1. Internal audit plan – for each period, an internal audit Internal Auditors? plan is developed that covers the planned audits of the internal audit activity during the period. This plan would be the result of the risk assessment of the entire organization. The plan would detail what engagements are planned to be performed during the period.
2. Engagement Plan – for each engagement, the internal
auditor develops an audit plan which is based on a detailed risk assessment of the engagement area and identifies the engagement objectives.
3. Engagement Work Program – lists detailed
procedures that should be conducted by the auditor to achieve specific audit objectives that will achieve the engagement objectives. 30. What are Assurance services. “An objective examination of Assurance and evidence for the purpose of providing an independent Consulting assessment on governance, risk management, and services? control processes for the organization. Examples may include financial, performance, compliance, system security, and due diligence engagements.”
• Consulting services. “Advisory and related client
services activities, the nature and scope of which are agreed with the client, are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility. Examples include counsel, advice, facilitation, and training.” 31. At what levels, Assurance engagements can be performed at any of the Assurance following three levels: Engagements can be performed? • Organizational, which is a department-by- department review.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 15 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• Functional, which follows a single process across
organizational lines. • Cycle, which is primarily a financial systems review. Cycle-level engagements have been expanded to cover non-financial systems, such as HR or environmental impact. 32. What is Risk and Risk and Control Self-Assessments (RCSA) examine and Control Self- assess the effectiveness of a company’s risk and control Assessments? system. Although auditors are presumed to have the knowledge and expertise to assess controls accurately, RCSA begins with the premise that the scope of control is so broad, and the pace of change so great, that properly assessing the control system requires the knowledge and expertise of all the employees who perform the specific work that needs to be assessed.
RCSA procedures include the following:
• Identifying potential risks and exposures.
• Assessing the control processes that mitigate or manage those risks. • Developing action plans to reduce risks to acceptable levels. • Determining the likelihood of achieving business objectives.
The primary advantages of an RCSA program are:
• It increases employee understanding of the
company’s risks and controls. • It raises employee control consciousness. • It provides a mechanism for early risk detection. • It encourages more open communication, teamwork, and continuous improvements. • It empowers employees and enhances accountability. 33. What is a Survey Surveys or Questionnaires can be used when budgets or are limited or if individuals who would normally Questionnaire? participate are too widely dispersed to participate in a workshop. Survey questions need to be customized for any specific circumstances or needs, including the regulatory environment. Regardless of the type or nature of the questions, they should relate to the primary internal controls and the way in which they are
From the Desk of Muhammad Zain – Founder of Zain Academy Page 16 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
monitored. Furthermore, the process owners
themselves (that is, those who fill out the original questionnaire) should interpret the data after it is collected. 34. What are the • Questions can sometimes be worded to suggest or limitations of imply a “correct” or desired answer. Such manipulative Questionnaire? questions can pressure the respondent to give an answer that the questionnaire designer prefers rather than an honest answer. Therefore, questions should be carefully worded.
• Lack of interest may limit the number of
questionnaires that are filled out and returned, potentially skewing results and rendering the entire exercise invalid. If the number of returned questionnaires is unacceptably low, supervisors might consider gathering feedback in person, because some people may dislike questionnaires but would be forthcoming in an interview. 35. Who should A third-party audit may be performed either by internal perform the auditors or by an independent auditor. The decision Third Party whether to audit internally or to contract for the third- Audit? party audit depends on a number of factors. For example, the risk assessment made by management should provide guidance as to whether internal or external auditors should conduct third-party audits. In instances where specialized knowledge is required to complete the audit, management might prefer the work of a particular external auditor with a specific skill set. Therefore, if outside auditors for a third-party audit are employed, then the company should ensure that the independent auditor is qualified to perform the work, that the scope satisfies their own audit objectives, and that any significant reported deficiencies are corrected. 36. What is Total TQM pursues the approach of “right first time” and Quality zero-tolerance of waste with the objective of both Management? increasing revenue through improved client satisfaction and decreasing costs with improved efficiency. Continuous improvement is one of the internal audit’s key objectives, and therefore the internal audit activity has a critical role in TQM. Teamwork, training, empowerment, and innovation are key components of TQM.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 17 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
A quality audit engagement assesses whether or not a
function or unit meets its defined quality standards. If there are no defined standards, then the auditor should coordinate with management to establish quantifiable standards before moving forward with the audit engagement. 37. What are the A properly implemented and effective TQM system advantages of a should result in: properly implemented and a. Greater customer satisfaction effective TQM? b. Fewer defects and thus less waste c. Improved total productivity d. Reduced costs and thus better profitability 38. What is the scope The scope of an ISO 9000 quality audit covers a number of ISO Audit of areas, such as physical location, organizational units, Engagements? activities and processes to be audited, and the time period to be covered.
The audit will determine conformity with applicable
policies, procedures, standards, laws and regulations, management requirements, contract requirements, and industry or business sector codes of conduct. Preparation for the audit should include a review of the auditee’s documentation, including management system records and previous audit reports.
The audit itself includes:
• Interviews with employees.
• Observations of activities, the work environment, and work conditions. • A review of inspection records, records of monitoring programs, and results of measurements. • Inquiries into the auditee’s sampling programs, control of sampling, and measurement procedures. • Customer and supplier feedback. • Information from databases and websites. 39. What is Due Due diligence assurance engagements are often Diligence performed for a potential acquisition, joint venture, or Assurance divestiture. The purpose of the engagement is to Engagements? validate the reasons for making the transaction or identify problems that need to be resolved prior to
From the Desk of Muhammad Zain – Founder of Zain Academy Page 18 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
undertake the transaction. External professional
advisors are normally part of the team, often leading it. 40. What is Environmental due diligence audits were first Environmental developed by lenders to prevent liabilities for properties Due Diligence in their loan portfolios. If undetected environmental Audits? pollution were to be passed on through the sale, the new property owner might be held responsible for contamination caused or left behind by the previous owners. Therefore, environmental audits have now become standard requirements for all loans and investments in real property.
The liability assessment consists of preliminary
activities, a site visit, review of records (including prior uses of the land), a regulatory review, a geological and hydrogeological review, and a report. If the liability assessment indicates possible contamination, confirmation sampling is conducted. For any confirmed contamination, the next step is to characterize and assess the nature and extent of the contamination. It is possible that, as a result of the audit’s findings, the potential liability connected with the land acquisition might be greater than the land’s market value. 41. What is a A physical security audit ensures that an organization’s Physical Security physical facilities are properly secured and that the Audit? environment is safe for management and staff. The audit includes perimeter security, proximity security, and physical security of the premises. 42. What is a Perimeter security auditing requires a review of the Perimeter property boundaries and a boundary risk assessment, Security including documenting risks on a site map. Risks can Auditing? include rail lines, roads, unsecured access points, improperly lighted areas, power lines, phone lines, and other service access points. All cameras and surveillance equipment should be documented. All guard stations should be identified and assessed as manned or unmanned and noted for the presence (or absence) of barriers, telephone access, emergency panic buttons, and camera surveillance. The auditor should attempt to gain unauthorized access by bypassing the guard station or through “social engineering” (for example, attempting to pass through
From the Desk of Muhammad Zain – Founder of Zain Academy Page 19 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
security without credentials). Lighting should be
sufficient to deter intruders. 43. What is a Proximity security auditing determines how Proximity vulnerable company buildings are by being near certain Security items or buildings. For example, a proximity security Auditing? audit might assess how thoroughly vehicles are inspected for weapons or other hazardous materials, the procedures to ensure that visitors have legitimate business in the facility, how well entrances are protected, and whether there is camera surveillance. 44. What is a Privacy Privacy concerns exist in all aspects of an organization, Audit from its paper-based records to its internal databases Engagements? to its policies of data collection on its website. Internal auditors need to make certain that personal information is protected from unauthorized access, both from inside and outside the organization. Furthermore, policies should be in place, in line with all applicable laws, to specify the appropriate instances where disclosure can be made with or without the individual’s consent.
Privacy vulnerabilities pose a number of challenges
and pitfalls for companies and their customers. For companies, disclosing or losing control of private information could lead to lawsuits, penalties, fines, and (of particular importance) negative publicity. For individuals, unauthorized disclosure of private information could be embarrassing, inconvenient, and cause financial loss (such as damaged credit ratings). Therefore, organizations should spend considerable resources avoiding these vulnerabilities.
During the process of evaluating the privacy
framework, the internal auditor should be aware of the following issues:
• Compliance with governmental statutory and
regulatory mandates. • Documenting compliance with governmental statutory and regulatory mandates. • The organization’s existing policies and procedures. • Protection of personal information. • Cost versus benefits of additional security measures
From the Desk of Muhammad Zain – Founder of Zain Academy Page 20 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• Ethical imperative of maintaining the confidentiality of
private information. 45. What is Financial A financial audit tests the reliability and integrity of Audit reported financial information and determines the Engagement? degree to which the company’s assets are properly safeguarded.
Internal auditors may perform financial audits in areas
that are not heavily tested as part of the external audit, or they may look at the efficiency of resource allocation instead of merely accounting for resource usage. Internal and external auditors should coordinate their efforts to optimize audit coverage and minimize duplicated efforts.
Financial audits are often performed or arranged in
connection with a transaction cycle. The main transaction cycles in business are: • Revenue and receivables (cash collections) • Purchasing and payables • Inventory and warehousing • Financial capital and payment • Personnel and payroll 46. What is an Audit Audit risk is calculated by multiplying the chances of Risk? each of these three events happening. Each event has an associated risk, and these three associated risks in aggregate make up the complete audit risk. The three associated risks are:
1) Inherent risk (the risk that there is an error in the
first place): This risk occurs naturally in a given element of the financial statements or the function being audited. That is, certain assertions are by their nature susceptible to producing or creating material misstatements (assuming that there are no controls in place). For example, pensions and financial instruments have a high level of inherent risk because pension calculations and financial instruments are, by their nature, extremely complex. In other words, the internal auditor cannot reduce the inherent riskiness of pensions or financial instruments. Cash, on the other hand, has low inherent risk.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 21 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
2) Control risk (the risk that the internal controls will
fail to detect the error): No matter how well designed and operated, internal controls can provide only a reasonable assurance that they will prevent and detect every mistake, because internal controls may fail due to human error, collusion, or management override. Control risk, therefore, refers to the chance that internal controls will fail to detect an error. “High control risk” means that controls are inadequate or faulty. “Low control risk” means that controls are adequate and functional.
3) Detection risk (the risk that the auditor will fail to
detect the error): Auditing is the process of reviewing policies and procedures to determine their fitness and effectiveness. However, no matter how thoroughly audits are conducted, there is always the risk that a misstatement or error in the financial statements will not be found because auditors do not test every transaction. Therefore, the presence of even one untested transaction means that there is a risk that a material misstatement will go undetected. “Low detection risk” means that there is a low chance that the auditor will fail to detect an error (meaning that auditor has done a great deal of work and testing). “High detection risk” means that there is a high risk that the auditor will not detect an error (which would be the case if the auditor did not perform a great number of tests).
The formula for calculating audit risk is:
Audit Risk = Inherent Risk * Control Risk * Detection
Risk
Inherent risk cannot be influenced because these are
risks that are part of the item being tested. Control risk cannot be influenced in the current period because the audit covers events that have occurred in the past; in other words, controls were already either functioning or not functioning at the time of the transactions.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 22 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
Detection risk is the only one of the three risks that
the auditor can directly influence. To determine the level of acceptable detection risk, the auditor should begin by assessing inherent and control risk, then solve for detection risk using the audit risk formula. Once detection risk is calculated, then the auditor will be able to determine the nature, extent, and timing of the tests that need to be performed. 47. What is the If control risk is reduced, detection risk can be relationship increased without changing the overall level of audit between Control risk. The opposite is also true: an increased control risk Risk and means that the detection risk threshold may be lowered Detection Risk? while still maintaining the same overall level of audit risk. In other words, control risk and detection risk are inversely related. 48. What are the “Assertions” are the claims that management makes Financial when it presents financial information, and the auditor Statement determines if the assertions are correct. Therefore, Assertions? most of the work in a financial audit is spent on evaluating and forming an opinion about management assertions. There are five assertions:
1) Completeness. Financial statements contain all
required information, and no material financial information has been omitted. 2) Rights and Obligations. Everything that is reported as an asset represents something that the company has rights over, and everything reported as a liability represents a real obligation. 3) Valuation or Allocation. Items reported in the financial statements are valued at the correct amount, and income statement items have been allocated to the proper period. 4) Existence or Occurrence. All balance-sheet items exist, and all income-statement items occurred during relevant period. 5) Statement of Presentation and Disclosure. The formal organization and classification of accounts on the financial statements and disclosures in the accounts, footnotes, and accounting policies conform to generally accepted accounting principles.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 23 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
49. What is an An environmental audit is a systematic, documented,
Environmental periodic, and objective evaluation of how well an entity, Audit? its management, and its equipment are performing with regards to safeguarding the environment through facilitating management control of environmental practices and assessing compliance with entity policies and external regulation. 50. What are the The IIA Research Foundation has identified seven types types of of environmental audits: Environmental Audits? 1) Compliance. These are site-specific reviews of the company’s past, current, and planned practices. The greater the risk from noncompliance with environmental laws to the company, the greater the scope and depth of the audit. 2) Environmental Management Systems. These audits make certain that the company can manage any future environmental risk that might result from changing legislation. 3) Transactional. This is a review of a property prior to its purchase or sale to identify any associated environmental risks. 4) Treatment, Storage, and Disposal Facility. This audit follows the documentation of hazardous materials from their creation (or appearance) to their destruction or disposal (that is, the oversight must cover these materials from “cradle to grave”). 5) Pollution Prevention. These audits review the process of eliminating or minimizing the pollution a company generates at its source rather than controlling pollution after it has been created. 6) Environmental Liability Accrual. This process establishes the moment that an environmental liability needs to be accrued on the balance sheet and a corresponding expense entered on the income statement. This procedure is particularly difficult because the precise moment that it should be done is not always clear and the value of these liabilities is subject to interpretation. 7) Product Audit. This is a review of the production process to determine whether pollutant restrictions are being met.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 24 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
51. What are the risk The risk exposures that should be evaluated are: exposures that should be • The comprehensiveness of organizational reporting evaluated in structures. Environmental • The likelihood of environmental harm, fines, and Audits? penalties. • Environment-related expenditures mandated by governmental agencies. • The history of injuries and/or deaths related to environmental issues. • The loss of customers, negative publicity, and damage to public image and reputation due to an environment- related accident. 52. Define The IIA glossary defines consulting services as advisory Consulting and related client service activities, the nature, and Services? scope of which are agreed with the client and which are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility. Examples include counsel, advice, facilitation, and training.
The nature of consulting services must be defined in the
internal audit charter. 53. When should Consulting services may be conducted as either part of consulting the internal auditor’s normal or routine activity or as a services be special request made by management. Each provided? organization must first consider the type of consulting activities to conduct and then determine the specific procedures to develop for each type of activity. 54. What is the Internal auditors may provide consulting services Independence relating to operations for which they had previous and Objectivity responsibilities. requirement in Consulting If internal auditors have potential impairments to Engagements? independence or objectivity relating to proposed consulting services, the disclosure must be made to the engagement client prior to accepting the engagement.
While internal auditors can provide consulting services
relating to operations for which they have had previous responsibilities, the auditor should still act in an independent and objective manner. To assess the
From the Desk of Muhammad Zain – Founder of Zain Academy Page 25 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
impact that a previous position may have on objectivity,
the auditor should consider:
• The appropriate requirements and standards of the
profession. • Expectations of stakeholders, directors, the audit committee, and legislative bodies. • Any allowances or restrictions that are in the charter. If the charter prohibits this type of work but management insists anyway, this conflict needs to be brought to the attention of the audit committee for a final resolution. • Disclosures that may be required by standards. • Subsequent audit work, including its scope and coverage. 55. What is the Due The chief audit executive must decline the consulting Professional Care engagement or obtain competent advice and assistance requirement in of the internal auditors lack the knowledge, skills, or Consulting other competencies needed to perform all or part of the Engagements? engagement.
Internal auditors must exercise due professional care
during a consulting engagement by considering the:
• Needs and expectations of clients, including the
nature, timing, and communication of engagement results; • Relative complexity and extent of work needed to achieve the engagement’s objectives; and • Cost of the consulting engagement in relation to potential benefits. 56. What is the Communication of the progress and results of requirement of consulting engagements will vary in form and content communicating depending upon the nature of the engagement and the the results of needs of the client. Consulting Engagements? The chief audit executive is responsible for communicating the final results of consulting engagements to clients.
During consulting engagements, governance, risk
management, and control issues may be identified. Whenever these issues are significant to the
From the Desk of Muhammad Zain – Founder of Zain Academy Page 26 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
organization, they must be communicated to senior
management and the board. 57. Why should Internal auditors should participate in internal control Internal Auditors training for the following reasons: participate in Internal Control • To communicate and embed a control awareness Training? within the organization’s operations. The more employees know about the functions of internal controls; the more likely control weaknesses will be identified and corrected in a timely manner. • To decrease fraud. The training should make employees aware of what constitutes fraud and what they need to do if they suspect fraud is occurring. • To motivate employees to report control deficiencies and weaknesses. • To provide staff support for the organization’s Control Self-Assessment (CSA) program. It is possible that the internal auditing staff could be involved in a CSA program by conducting training programs. 58. What are the • Financial benchmarks use monetary values to make Financial and comparisons, such as profitability, cost of production Non-Financial per unit, and so forth. Benchmarks? • Nonfinancial benchmarks make comparisons using non-numerical factors, such as the percentage of on- time deliveries or percentage of satisfied customers. 59. What are Internal • With internal benchmarks, a company compares its and External performance against its own internal divisions, Benchmarks? processes, functions, or departments. • With external benchmarks, a company makes an external comparison, most commonly against a competitor. 60. What is • A functional benchmark is a comparison with Functional, organizations that operate within the same Competitive and technological area. Generic • A competitive benchmark is a comparison with the Benchmark? best of a company’s competitors. • A generic benchmark compares processes that are virtually the same, regardless of the industry or production line. This type of benchmarking is not as helpful as a comparison of processes that are exactly the same.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 27 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
61. What are the • Effective benchmarks make apples-to-apples
limitations of comparisons. Companies must make sure that the Benchmarking? sources from which they collect benchmarking data are reliable, accurate, and appropriate. Incorrect data leads to comparison errors, causing the company to waste time reconciling useless data.
• Improper benchmarking may cause the company to
lose focus on employee and customer wellbeing. Companies that use benchmarking data to produce rapid performance improvements risk causing employee burnout, errors, and low morale. Similarly, a company might anger customers and suppliers if their needs are being ignored for the sake of a benchmark objective.
• Regardless of the quality of benchmarking
information, the lack of a proper implementation plan will undermine the usefulness of benchmarking. The participation of management and employees is a critical component to the success of benchmarking. 62. What is Due Due Diligence Consulting engagements focus on a Diligence company’s internal operations such as: Consulting? • Controls. • Corporate governance. • Risk assessment and risk management processes. Due diligence consulting engagement may also assess how the company’s operations would contribute to or detract from the company’s mission and the achievement of its goals and objectives. 63. What should be For any systems development project there are three the Internal Audit basic approaches that internal auditors can take: involvement in 1) Traditional audit approach. Internal auditors monitor System how the project is progressing and report back to Development management and the board. project? 2) Consulting approach. Internal auditors advise the systems development team on an as-needed basis regarding controls and risk management. 3) Embedded approach. The internal auditor is integrated within the systems development team, functioning as a control and risk management expert.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 28 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
64. What does Section 404 of Sarbanes-Oxley (SOX) requires
Section 404 of companies to include in their annual reports these two the SOX require? items: • A statement of management’s responsibility for establishing and maintaining adequate internal controls over financial reporting. • An assessment of the effectiveness of those internal controls. 65. What must To comply with Section 404, management must management do establish a formal, internal control testing program to to comply with determine the extent to which the design and the requirements operation of activities in the internal control process of Section 404? is sufficient to prevent, or detect and correct, significant misstatements. 66. What is the focus The internal-control evaluation should focus on of Internal establishing controls that adequately prevent or Control detect material misstatements in financial statements Evaluation? in a timely manner. 67. Who is The chief audit executive should share information, responsible for coordinate activities, and consider relying upon the coordinating work of other internal and external assurance and Internal Audit consulting service providers to ensure proper coverage Efforts with other and minimize duplication of efforts. assurance providers? 68. Why is the Coordination between external and internal auditors is coordination important for the following two reasons: between Internal and External 1) Internal auditing continues to become increasingly Auditors professionalized, with more internal auditors being important? full-time internal auditors or former external auditors. As a result, the scope and quality of internal auditing have increased.
2) The cost of the external audit has risen, and
therefore companies are looking for ways to reduce expenses in this area. Having a strong, objective, and competent internal auditor means that the work of the external auditor can be better streamlined and thus less costly. 69. What are the two Before the external auditor relies on the internal things that must auditor’s work, however, he or she needs to assess the be considered by internal auditor’s competence and objectivity.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 29 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
External Auditors before relying on • Competence is the measure of an IAA’s skills and Internal Auditors? abilities to perform acceptable work.
• Objectivity measures the IAA’s capacity to work
without any influence from management or others in the organization. 70. Can Internal The CAE can provide copies of the internal audit Auditors’ working working papers to the external auditor and to others papers be shared within the organization. However, the external auditor with the External should not give the internal audit working papers to Auditors? anyone without the permission of the internal auditor. 71. Can Internal The decision to rely on the work of other assurance Auditors’ rely on providers can be made for a variety of reasons, including the work of other to address areas that fall outside of the competence of assurance the internal audit activity, to gain knowledge transfer providers? from other assurance providers, or to efficiently enhance coverage of risk beyond the internal audit plan. 72. What is Assurance Mapping is the grouping of all of the Assurance assurance providers together and then using the Mapping? company’s risk management process to identify the “key” risks that need to be assessed.
This process allows the company to identify and assess
gaps in the risk management process and gives primary stakeholders the reassurance that risks are being managed and reported and that regulatory and legal obligations are being met.
Assurance Map may include the following:
1. The identity of the assurance providers 2. Risk 3. Level of assurance 4. Urgency or importance of the issue 5. Action to be taken 73. What is the The chief audit executive must communicate the requirement of internal audit activity’s plan and resource requirements, Standard 2020 - including significant interim changes, to senior Communication management and the board for review and approval. and Approval? The chief audit executive must also communicate the impact of resource limitations.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 30 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
74. What is the The chief audit executive must report periodically to requirement of senior management and the board on the internal audit Standard 2060? activity’s purpose, authority, responsibility, and performance relative to its plan and on its conformance with the Code of Ethics and the Standards. Reporting must also include significant risk and control issues, including fraud risks, governance issues, and other matters that require the attention of senior management and/or the board. 75. What is the KPIs of the internal audit activity provides a platform purpose of KPIs to discuss issues relative to the internal audit activity on Internal Audit and potentially gain board support in making necessary Activity? changes. Establishment of KPIs should be done in a group that includes senior management, as well as the board, and there should be a consensus that the KPIs chosen are meaningful and appropriate.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 31 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
SECTION B – PLANNING THE ENGAGEMENT (WEIGHTAGE 20%)
S.No Questions Answers
1. What is the Internal auditors must develop and document a plan for requirement of each engagement, including the engagement’s Standard 2200 - objectives, scope, timing, and resource allocation. The Engagement plan must consider the organization’s strategies, Planning? objectives, and risks relevant to the engagement. 2. What is needed The following are needed for planning an engagement: for planning an engagement? • The objectives of the audit. • The scope or extent of the audit. • The resources required to achieve the objectives (for example, financial resources and staffing). • The work program. 3. What are the An effective work program should: characteristics of effective work • State the objectives of the engagement. program? • Document the procedures that the internal auditor will use to collect, analyze, interpret, and document information during the engagement. • Identify the technical elements, risks, transactions, and processes that will be examined. • State the nature and extent of required testing. • Be prepared prior to the commencement of engagement work but, with the approval of the CAE, can be modified during the course of the engagement. 4. What may be the The topics of these meetings might cover: agenda of meeting between • The objectives and scope of work of the planned CAE and engagement. management • The timing of the work. team whose area • The internal auditors who will be performing the work. of responsibility • The communication process throughout the is being audited? engagement, including the methods, time frames, and individuals who will be responsible. • Business conditions and operations of the activity being reviewed, including recent changes in management or major systems. • Any concerns or requests from management. • Any concerns from the internal auditor.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 32 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• A description of the final reporting process and the
follow-up that will be conducted. 5. What does the In planning the engagement, internal auditors must Standard 2201 – consider: Planning Considerations • The strategies and objectives of the activity that is say? being reviewed and the means by which the activity controls its performance. • The significant risks to the activity’s objectives, resources, and operations and the means by which the potential impact of risk is kept to an acceptable level. • The adequacy and effectiveness of the activity’s risk management and control systems compared to a relevant control framework or model. • The opportunities for making significant improvements to the activity’s risk management and control processes. 6. What are the Objectives must be established for each engagement. requirements of Standard 2210 – – Internal auditors must conduct a preliminary Engagement assessment of the risks relevant to the activity under Objectives? review. Engagement objectives must reflect the results of this assessment. – Internal auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing engagement objectives. – Adequate criteria are needed to evaluate governance, risk management, and controls. Internal auditors must ascertain the extent to which management and/or the board has established adequate criteria to determine whether objectives and goals have been accomplished. If adequate, internal auditors must use such criteria in their evaluation. If inadequate, internal auditors must identify appropriate evaluation criteria through discussion with management and/or the board. 7. What are the The established scope must be sufficient to satisfy the requirements of objectives of the engagement. Standard 2220 – – The scope of the engagement must include Engagement consideration of relevant systems, records, personnel, Scope? and physical properties, including those under the control of third parties.
– If significant consulting opportunities arise during an
assurance engagement, a specific written understanding
From the Desk of Muhammad Zain – Founder of Zain Academy Page 33 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
as to the objectives, scope, respective responsibilities,
and other expectations should be reached and the results of the consulting engagement communicated in accordance with consulting standards. – In performing consulting engagements, internal auditors must ensure that the scope of the engagement is sufficient to address the agreed-upon objectives. If internal auditors develop reservations about the scope during the engagement, these reservations must be discussed with the client to determine whether to continue with the engagement. – During consulting engagements, internal auditors must address controls consistent with the engagement’s objectives and be alert to significant control issues. 8. What are the Internal auditors must develop and document work requirements of programs that achieve the engagement objectives. Standard 2240 – – Work programs must include the procedures for Engagement identifying, analyzing, evaluating, and documenting Work Program? information during the engagement. The work program must be approved prior to its implementation, and any adjustments approved promptly. – Work programs for consulting engagements may vary in form and content depending upon the nature of the engagement. 9. What the The engagement work program contains the list of Engagement necessary procedures, and it also serves as a supervisory Work Program tool to make sure that all of the required and expected contains? procedures are performed. It is important that the work program is prepared and completed before to the start of the engagement (and usually after the preliminary survey) because it is the essential roadmap for completing the audit.
The audit program should include:
• Information about the objectives of the area that is
being audited. • A description of the controls that are currently in place. • A description of controls that should be in place. 10. What are the All audit evidence must be able to stand the tests of characteristics sufficiency, reliability, competency, and relevance.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 34 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
of Audit Evidence? 11. What is the Sufficiency of the evidence is determined through the Sufficiency of auditor’s professional judgment. One method to Evidence? determine the appropriate level of evidence is to look at the effectiveness of the client’s internal controls and risks. More evidence is needed to determine sufficiency when:
• Internal controls are not functioning effectively.
• Inherent risk is high. • Materiality is high. 12. What is the Evidence must be reliable, meaning that the auditor can Reliability of believe and trust the evidence. The most reliable Evidence? evidence is any information that is obtained directly by the auditor, most often through firsthand observation. However, there is a great deal of information that cannot be obtained directly and, as a result, the auditor will need to rely on other resources. 13. What is the For information to be considered relevant, it must relate Relevant specifically to the item being audited. Irrelevant Evidence? information can be distracting, distort results, and waste resources. However, an auditor should not automatically disregard or ignore information that on its surface might appear to be irrelevant. 14. What is Useful Useful evidence is information that helps the Evidence? organization meet its goals. Locating and identifying useful information is one of the main goals of the internal audit activity. 15. What are the two There are two main types of auditing evidence: sources of Evidence? 1) Underlying accounting data is primary information that comes from the accounting system, including original documents, journals, ledgers, supporting information, and the output from the accounting systems. This type of evidence by itself is not sufficient, and it will always need to be verified with corroborative evidence. 2) Corroborative evidence is secondary information that supports the primary data. It is generally evidence that is obtained from outside the accounting system, and that can be verified with a third
From the Desk of Muhammad Zain – Founder of Zain Academy Page 35 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
party, such as an invoice, a check, contracts, or similar
types of documents. 16. What are the There are four types of evidence: four types of Evidence? 1) Testimonial evidence. Evidence obtained through direct, first-person interviews. 2) Documentary evidence. Evidence in document form. 3) Physical evidence. Evidence-based on physical objects (for example, does the asset exist). 4) Analytical evidence. Evidence that comes from comparing, computing, or otherwise analyzing data. All evidence must be confirmed, corroborated, or otherwise substantiated. 17. What are the There are six categories of procedures: selected Engagement 1) Observing. Observing is a visual examination of a Procedures? specific item or event by the auditor. It may involve observing a specific document or the application of an internal control procedure. All observations should be described and documented.
2) Questioning. Questioning is usually the best way to
determine what a person thinks or feels about a particular subject, and so the auditor may conduct an in- person interview or send out a questionnaire.
In-person interviews are the most common approach,
but there are potential pitfalls.
Interviews require the auditor to create effective
questions, develop appropriate follow-up questions (often in immediate response to answers given in an interview), and interpret answers with insight and intelligence. Any information obtained through questioning should be confirmed, if possible, either by other individuals or by other evidence.
3) Analyzing. Analyzing means drawing conclusions
based on a careful survey of the evidence. In general, analysis involves comparing related items, noting trends in information, and looking at differences between actual and expected results. Effective auditors will be trained in many different methods of obtaining and
From the Desk of Muhammad Zain – Founder of Zain Academy Page 36 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
analyzing evidence to make the strongest, most
intelligent judgments possible.
4) Verifying. Verifying is the process of checking one
source of information against another. Corroborating evidence is information that supports the facts or assertions found in another piece of evidence. A single piece of evidence may not be sufficient to support a conclusion, but two or more forms of corroborating evidence can support the conclusion that a fact has been verified.
5) Investigating. Investigating is searching for evidence
or facts that are not easily or readily available. When dealing with large volumes of information, the auditor may have to carefully sift through piles of documents, examine electronic records, or conduct extensive research to find a specific piece of information. In some instances, information may have been deliberately hidden, obscured, or destroyed, especially in cases of suspected wrongdoing. In those situations, the auditor will need to employ more aggressive investigative techniques to uncover what has happened. (The search for wrongdoing is called a probe.)
6) Evaluating. In evaluating, the auditor collects all
available information, organizes it, and develops a reasoned, documented supported conclusion. In preparing an evaluation, the auditor must rely on a great degree of professional judgment, because there will always be areas where suppositions and inferences must be made.
In the case of internal auditing, evaluations are made in
respect to financial balances, internal control procedures (whether they are functioning properly and are sufficient), and risk assessment.
The process of evaluation will include a number of
different considerations: • The number of deviations. • The size of the deviations. • The reasons why the deviations occurred.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 37 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• The area in which the deviations occurred.
• Whether the deviations will likely occur again. 18. What is the Inductive reasoning begins with a specific item and then difference draws general, broad conclusions about it. For example, between an auditor samples receivables in order to conclude that Inductive and accounts receivable exist as recorded. Deductive Reasoning? Deductive reasoning begins with a general statement and then draws specific conclusions based on that generality. For example, an auditor performs analytical procedures in order to estimate the accuracy of a particular account balance. 19. What is Tracing? In tracing, the auditor starts with a piece of information from a source document and follows it through the accounting records until it reaches the final ledger. This test for completeness makes sure that every event or transaction is appropriately recorded. 20. What is Vouching is the opposite of tracing. The auditor starts Vouching? with an amount in a ledger and searches for the documentation that supports it. This is a test for existence or occurrence, and it makes certain that every event or transaction that has been recorded in the records has occurred. 21. What does the The chief audit executive must ensure that internal audit Standard 2030 – resources are appropriate, sufficient, and effectively Resource deployed to achieve the approved plan. Management say? Appropriate refers to the mix of knowledge, skills, and other competencies needed to perform the plan.
Sufficient refers to the quantity of resources needed to
accomplish the plan. Resources are effectively deployed when they are used in a way that optimizes the achievement of the approved plan. 22. What does the Internal auditors must determine appropriate and Standard 2230 - sufficient resources to achieve engagement objectives Engagement based on an evaluation of the nature and complexity of Resource each engagement, time constraints, and available Allocation say? resources.
Appropriate refers to the mix of knowledge, skills, and
other competencies needed to perform the engagement.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 38 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
Sufficient refers to the quantity of resources needed to
accomplish the engagement with due professional care. 23. What are the Internal auditors consider the following when factors that need determining the appropriateness and sufficiency of to be considered resources: while allocating Engagement • The number and experience level of the internal audit Resources? staff. • Knowledge, skills, and other competencies of the internal audit staff when selecting internal auditors for the engagement. • Availability of external resources where additional knowledge and competencies are required. • Training needs of internal auditors as each engagement assignment serves as a basis for meeting the internal audit activity’s developmental needs.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 39 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
SECTION C – CONDUCTING INTERNAL AUDIT ENGAGEMENTS
(WEIGHTAGE 40%)
S.No Questions Answers
1. What is a The preliminary survey (also called an “on-site survey”) is Preliminary the first step in the audit process. This survey gives the Survey? internal auditor an opportunity to start collecting, and become familiar with, the preliminary information about the activity to be reviewed without getting into details. 2. What are the The preliminary survey should accomplish several objectives of objectives, allowing the internal auditor to: the Preliminary Survey? 1) Become familiar with the client’s • Objective and goals. • Organizational structure and key staff. • Operations, facilities, key customers, and suppliers. • Risk management, control, and governance systems. • Information systems. 2) Concentrate the audit work on significant matters. 3) Identify low-risk areas and then reduce the audit time spent on them. 4) Create a cooperative tone for the engagement. 3. What are the The auditor should: factors that Internal • Read all relevant background information, including Auditor should recent financial results and operational results. consider to • Prepare the questionnaires based on this information maximize the and assessment of the risks within the area in question. benefits of a • Know where or from whom to obtain additional preliminary information, and make appropriate appointments. survey? • Document the information received in this process. Flowcharting and narratives are two of the more common methods. • Understand the objectives and goals of each part of the operation. • Identify the risks implicit in the areas under review. 4. What purpose The review of prior audit reports is valuable because of it: does the review of prior audit 1) Allows the auditor to become familiar with the audit reports serve? subject.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 40 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
2) Shows how other auditors approached the assignment.
3) Helps the auditor decide the scope of the current audit. 4) Identifies problem areas. 5) Identifies areas that may need additional evaluation. 6) Reveals whether or not the action was taken on past recommendations. 5. What are the There are four types of interviews for the various stages of types of the information-gathering process: Interviewing for Information 1) Preliminary. This interview establishes a relationship gathering with interviewees, helps them feel comfortable with the process? auditor, and sets the groundwork for the importance of the process. 2) Fact-gathering. During this interview, facts are collected about a specific situation. 3) Follow-up. The auditor gathers additional information to clarify issues that were raised in previous interviews. 4) Exit. The auditor conducts final checks to verify the accuracy of the information. 6. How can the The auditor can decrease the anxiety commonly auditor associated with the interview process by: decrease anxiety with • Explaining how the engagement may be helpful to the the interview individual. process? • Emphasizing that everyone is on the same team and working toward the same goals. • Demonstrating an understanding of the individual and the situation. • Listening sympathetically and resisting the impulse to criticize immediately or nitpick. 7. When should Surprise interviews should be conducted only in the case surprise of fraud interviews or any other circumstance in which it interviews be is critical that the interviewee does not have time to done? prepare. 8. Can Interviews Under certain circumstances, interviews may sometimes be recorded? be recorded. However, audio or video recordings should be made only if it absolutely necessary and only with the agreement and permission of the interviewee. The auditor should keep in mind that the presence of a recording device has the potential to make people uncomfortable, hesitant, and more closed with their answers.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 41 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
9. Define Audit Audit sampling is defined as, the application of audit
Sampling? procedures to less than 100 percent of items within a class of transactions or account balance such that all sampling units have a chance of selection. The population is defined as, the entire set of data from which a sample is selected and about which the internal auditor wishes to draw conclusions. 10. Define Sampling risk is defined as the risk that the internal Sampling Risk? auditor’s conclusion based on a sample may be different from the conclusion if the entire population was subjected to the same audit procedure. 11. What is the Internal auditors must base conclusions and engagement requirement of results on appropriate analyses and evaluations. the Standard 2320 – Analysis and Evaluation? 12. Define Sufficient, in that the information is factual, adequate, and Sufficient, convincing so that a prudent, informed person would Reliable, reach the same conclusions as the auditor. Relevant and Useful Reliable, in that the information is the best attainable Information? information through the use of appropriate engagement techniques.
Relevant, in that the information supports engagement
observations and recommendations and is consistent with the objectives for the engagement.
Useful, in that the information helps provide assurance
that the organization will meet its goals. 13. What is Statistical sampling (e.g., random and systematic) Statistical involves the use of techniques from which mathematically Sampling? constructed conclusions regarding the population can be drawn.
Statistical sampling allows the auditor to draw
conclusions supported by arithmetic confidence levels (e.g., odds of an erroneous conclusion) regarding a population of data output. It is critical that the sample of transactions selected is representative of a population. Without ensuring that the sample represents the
From the Desk of Muhammad Zain – Founder of Zain Academy Page 42 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
population, the ability to draw conclusions based on the
review of the sample is limited, if not erroneous. The internal auditor should validate the completeness of the population to ensure that the sample is selected from an appropriate data set. 14. What is Non- Non-Statistical sampling is an approach used by the Statistical auditor who wants to use his or her own experience and Sampling? knowledge to determine the sample size. Non Statistical sampling (e.g., judgmental) may not be based objectively and, thus, results of a sample may not be mathematically supportable when extrapolated over the population. That is, the sample may be subject to bias and not representative of the population. The purpose of the test, efficiency, business characteristics, inherent risks, and impacts of the outputs are common considerations the auditor will use to guide the sampling approach. Non- Statistical sampling may be used when results are needed quickly and needed to confirm a condition rather than being needed to project the mathematical accuracy of the conclusions. 15. What are the Statistical sampling requires the following: prerequisites of Statistical 1) Training the auditors in the necessary methods. Sampling? 2) Designing the samples to meet the statistical requirements. 3) Selecting the items to be tested. 16. What is Attributes sampling tests for the existence of a specific Attribute characteristic. In many situations, attribute sampling is Sampling (Test used to test compliance with a specific procedure or of Controls)? control. 17. What is Variables sampling is used when the auditor is testing for Variable the amount of a certain item. Sampling (Substantive Testing)? 18. What is Sampling risk is defined as the risk that the internal Sampling Risk? auditor’s conclusion based on a sample may be different from the conclusion if the entire population was subjected to the same audit procedure. 19. What are the There are two types of sampling risk: two types of Sampling Risk? • Incorrect acceptance — the risk that the attribute or assertion tested is assessed as unlikely when,
From the Desk of Muhammad Zain – Founder of Zain Academy Page 43 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
in fact, it is likely.
• Incorrect rejection — the risk that the attribute or
assertion tested is assessed as likely when, in fact, it is not likely. 20. Define Tolerable errors are the maximum numbers of errors that Tolerable the auditor is willing to accept and still reach a conclusion Error? that the underlying assertion is correct. This is not always the auditor’s decision and may be determined by the nature of the business, consultation with management or best practices. In some cases, an error of one will not be tolerable. 21. What are the Expected errors are errors that the auditor expects in the Expected population based on prior audit results, changes in Errors? processes, and evidence/conclusions from other sources. 22. Explain the In attribute sampling, the risk of incorrect acceptance is Risk of the risk that the auditor will test the sample and determine Incorrect that the control is working when in fact the control is not Acceptance? working.
In variables sampling, the risk of incorrect acceptance is
the risk that the auditor will test a sample and determine that the balance is correct when in fact it is not. 23. Explain the In attribute sampling, the risk of incorrect rejection is Risk of the risk that the auditor will test the sample and determine Incorrect that the control is not working when in reality the control Rejection? is working.
In variables sampling, the risk of incorrect rejection is
the risk that the auditor will test a sample and determine that the balance is not correct when the balance is actually correct. 24. On what Some considerations for the sample size are: factors the Sample Size • Audit objectives. The auditor needs to ensure that the depends? population and the sample of the population will help achieve the objective.
• Nature of the population. The auditor must be aware of
both the size and variability of the population. The larger the population, the larger the sample needs to be.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 44 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• Sampling and selection methods. It is important that the
methods that are used help achieve the objectives.
• Level of sampling risk the auditor is willing to accept.
The amount of risk the auditor is willing to accept and the size of the sample are inversely proportional. That is, the lower the acceptable risk of error, the larger the sample size will need to be.
Tolerable Deviation Rate in the Population. This figure
reflects the number of deviations that can be found within the sample and still conclude that it is correct. The lower the acceptable number, the larger the sample needs to be.
• Expected error in the population. The larger the
expected error in the population, the larger the sample size needs to be. 25. What are the • Judgmental (Haphazard) Sampling. With this method, methods for the auditor uses professional judgment to determine the selecting the size of the sample and then selects the items to be tested sample? without any bias or particular reason for excluding or including an item. This method can be used only in non- statistical sampling.
• Random Number Sampling. With this method, the
auditor uses a random number generator to select the items to be tested. Random number sampling uses tables of digits that have been scientifically randomized. This method is done without bias, and each item has an equal chance of being selected. If random number sampling is done with replacement, the auditor puts each selected item back into the population, meaning that the same item may be selected multiple times. This method requires a larger sample size, and so most auditors prefer to do random number sampling without replacement.
• Stratified Sampling. With this method, the auditor
breaks the population into different levels based on the size of the items within the population. Within each of these strata, the auditor determines a separate testing method. The primary goal of stratified sampling is to reduce the effect of variances within the population by
From the Desk of Muhammad Zain – Founder of Zain Academy Page 45 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
making more populations of similar items. As a result, this
method is most useful when the items within the population are diversified (that is, very different from each other).
• Systematic Sampling. With this method, the auditor
selects a starting point within the population and then determines an interval. For example, if the auditor determines that the interval is every fifteenth item, he or she begins at the designated starting point and then selects every fifteenth item for testing.
• Block Sampling. With this method, the auditor chooses
a block or group of items within the population. Block sampling makes it easier to locate individual items to include in the sample. Furthermore, it is best used to test the application of a new control or a control over time. 26. What is Stratification is the process of segregating a population Stratification? into homogenous subpopulations explicitly defined so that each sampling unit can belong to only one subpopulation depending on the criteria used for stratification. 27. What are the Auditors use attribute sampling to test internal controls. main methods The main methods of attribute sampling are: of Attribute Sampling? 1) Acceptance Sampling. This is a quality control tool that classifies an item as either acceptable or unacceptable. For example, a document is either properly authorized (acceptable) or not (unacceptable).
2) Sequential Sampling. This is used when the sample
follows a number of steps or includes a number of requirements, any of which would lead to a deviation if one of the steps or requirements is not correct. For example, a document has been properly authorized and also sent to the proper recipient.
3) Discovery Sampling. Discovery sampling tests for
fraud, and thus it is an investigative technique. The auditor looks for any single deviation on the assumption that there are no mistakes in the population. To this end, the auditor determines the size that the sample needs to be in order to achieve a certain level of confidence that the error rate is sufficiently low.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 46 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
4) Stop-or-Go Sampling. This method is used to reduce
the sample size by testing only enough items to prove that the rate of deviation is less than the acceptable rate of error. If an initial sample does not support the estimation of the population, then the sample size is enlarged until the auditor has proven that the sample deviation is less than the tolerable deviation. This sampling technique minimizes the sample size whenever a low rate of noncompliance is expected. 28. What should Whenever the auditor selects and tests a sample, there is the auditor do the chance that the sample will contain errors. If an error if an error is is confirmed, the auditor should perform additional discovered in a testing to determine: sample? • Is the error isolated, or connected to other errors? • Are many small immaterial errors combing to create a material error? • Is there a control weakness that could allow other errors? • Is the population as a whole correct, or not? 29. What are the There are three methods of variables sampling: methods of Variable 1) Mean-per-Unit Sampling. The auditor tests a sample of Sampling? items, obtains the audited value of these tested items (verified by the audit) and calculates an average amount per item. This average amount per item is then multiplied by the number of items in the population. The auditor does not need to know the book value (or recorded value) of the sample items.
2) Difference Estimation. The auditor finds the average
difference between the book value (or recorded value) and the audited amount of the items in the sample (verified by the audit) and then multiplies this average error by the number of items in the population. Finally, the auditor determines if the account is reasonably stated.
3) Ratio Method. The auditor determines a ratio between
the book amounts (or recorded value) of the sample and the audited amounts of the sample (verified by audit) and then apply this ratio to the population as a whole. This
From the Desk of Muhammad Zain – Founder of Zain Academy Page 47 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
method is most effective when the book and audited
values are similar. 30. What is Probability-Proportional-to-Size Sampling, also called Probability dollar-unit sampling or monetary-unit sampling, is a form Proportional of variables sampling where the auditor uses the dollars to size within the population instead of the number of invoices or Sampling some other identifier of each account or invoice. This type (PPS)? of sampling is often used with very diverse values or amounts because this method automatically stratifies the population. In the case of PPS being used to test accounts receivable, the population would be made up of the number.
PPS has two unique characteristics that are important to
consider in determining whether or not it should be used:
1) PPS automatically stratifies the population because the
largest items will have the most likelihood of being selected and the smallest items the least chance. Therefore, it is a useful method when working with a diverse population.
2) PPS is more effective in the detection of
overstatements rather than understatements because the smaller the item is, the less likely it is to be tested. Furthermore, a zero-balance item (or an item that has not been recorded) has no chance of being selected for testing. For this reason, PPS is a better test for assets than for liabilities because assets are more likely to be overstated. 31. What are 1) Generalized Audit Software (GAS) Computerized 2) Utility Software Assisted Audit 3) Application Software for Tracing and Mapping Techniques 4) Expert Systems Software (CAAT)? 32. What is Data Data mining is the process of looking for patterns or other Mining and useful information, usually from an enterprise-wide Extraction? database or a data warehouse.
Extraction refers both to extracting data and extracting
patterns or knowledge from the data to produce useful business information.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 48 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
33. What is an An embedded audit module is a process built within a
Embedded regular production program that conducts special Audit Module? auditing tasks. It is easier to develop embedded audit modules when a program is developed rather than adding it later. During the course of regular data processing, the embedded module selects and records specific data for later analysis and evaluation by an auditor. Embedded Audit Modules also allow continuous monitoring. 34. What is Automated working papers are computer-based audit Automated papers that make the audit documentation much easier Working than using written, manually-prepared work papers Papers? because the auditors will enter the results of their testing directly into the computer. By entering directly into the automated work papers, all of the work papers are automatically cross-referenced, adjusted, and balanced by the computer as new information is entered. 35. What are the The advantages of automated working papers are: advantages of Automated • A reduction in the risk of clerical and math errors. Working • Neater and more organized working papers that are easy Papers? to review. • Easier adjustments to the work papers. • Standard work paper forms do not need to be created and prepared for each engagement. • The working papers can be easily accessed from multiple locations, making the review process much more efficient. 36. What is an Extended records refer to the technique of modifying a Extended program to tag specific transactions and then saving all of Record the processing steps in an “extended record,” which technique? permits an audit trail to be reconstructed from one file for those transactions. 37. What is a The snapshot technique “takes a picture” of a transaction Snapshot as it is processed. Program code is added to the technique? application, instructing it to save the contents of selected memory areas. A snapshot is used commonly as a debugging technique. As an audit tool, snapshots can be used only for transactions that exceed predetermined limits. 38. What is Mapping uses special software to monitor the execution Mapping? of a program by counting the number of times each program statement in the program is executed. Originally, mapping was a technique for program design and testing, but auditors began using it to determine if program
From the Desk of Muhammad Zain – Founder of Zain Academy Page 49 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
statements were being executed. Mapping, therefore,
makes sure that the program that is running matches the code that was written and has not been changed. It can also locate “dead” code that is not being used and can flag code that might be used for fraudulent purposes. 39. What is In tagging and tracing, certain transactions are identified Tagging and when they are input (tagged) and then followed through Tracing? the computer system until they are output (traced). This process enables the auditor to confirm that all of the procedures were applied to a specific transaction. Tracing provides a detailed audit trail of all the instructions executed by a program. A single trace can produce thousands of output records, so the auditor must take care to limit the number of transactions that are tagged. Tracing might verify that internal controls in an application are being executed as the program is processing data (either live data or test data). A trace may also reveal sections of unexecuted program code, which can indicate incorrect or unauthorized modifications made to the program. 40. What is The auditor receives a verified copy of the processing Controlled program that the auditee is using and then runs the Reprocessing? information or transactions through the verified program. The results of this test are compared to the actual results. 41. What are the There are three main methods that the internal auditor methods to test can use to test that the computer system properly the computer processes data: system? • Test data approach • Integrated test facility (ITF) • Parallel simulation 42. What is Test The objective of the test data approach is to verify the Data processing accuracy of programs and any programming Approach? changes. Test data is information prepared by an auditor that contains both valid (correct) and invalid (incorrect) data, whether real or fictitious. Next, the input is processed manually to determine the correct output. Then the auditor tests the data processing on a client’s computer that is under the auditor’s direct control. After processing the test data electronically, the auditor compares the manually processed results with the electronically-processed results to determine accuracy.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 50 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
43. What is an An Integrated Test Facility (ITF) is used to audit large
Integrated computer systems that employ real-time processing. An Test Facility? ITF uses test data and fictitious test entities that are processed concurrently with real transactions. Therefore, the main difference between the test data approach and an ITF is that the test data in an ITF is processed alongside real data. By utilizing an ITF, the auditor can be sure that the test data is being processed by the same system as the “live” data. Only the auditor knows which entries are fictitious. Careful planning is required to make sure that ITF data does not become mixed in with the real data. Therefore, fictitious transactions have to be excluded from the normal outputs of the system. This exclusion may be done manually or by modifying the application programs. Either way, the fictitious transactions must be identified by special codes so they can be segregated from the real data. There are costs involved in developing an ITF; however, after the initial expenditures, ongoing operating costs are low because there is no special processing required and thus no interruption of normal computer activity. 44. What is Parallel simulation uses real data (rather than test data) Parallel and processes it through test or audit programs. The Simulation? output from the parallel simulation is then compared with the output from the real processing. Parallel simulation is expensive and time-consuming, and thus it is usually limited to sections of an audit that are of major concern and are important enough to require an audit of all transactions.
Because parallel simulation is done with test programs, it
can be done on a computer other than the one used for the real processing. However, the auditor should make sure that the live system used for processing is the one that is used all the time, and not one that has been swapped in for the audit (perhaps because the normal system is committing fraud or bypassing controls). 45. What are the Internal auditors must identify sufficient, reliable, requirements relevant, and useful information to achieve the of Standard engagement’s objectives. 2310 – Identifying Information?
From the Desk of Muhammad Zain – Founder of Zain Academy Page 51 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
46. What are some Some process mapping methods are flowcharts, data flow of the process diagrams, and narratives. mapping methods? 47. Define Flowcharts are diagrams that create a visual Flowchart? representation of processes or events, usually through text boxes and arrows representing chains of command or orders of events. Flowcharts are effective in detailing a company’s internal controls or any other related process. They also enable the auditor to identify areas where internal controls are required. 48. What is a A systems or horizontal flowchart. This type of flowchart Systems or shows the different departments or functions involved in Horizontal a process and clearly outlines the segregation of duties. Flowchart? Furthermore, it documents both manual and computer processes as well as the input, output, and processing steps.
A horizontal flowchart identifies specific control points in
the system. A control point is a point in a process where an error or irregularity is likely to occur, thereby creating a need for control. 49. What is a A program or vertical flowchart. This type of flowchart Program or depicts the specific steps in the process and how they are Vertical executed. It does not usually show the system Flowchart? components as clearly as a horizontal flowchart. This type of flowchart is not commonly used, having been replaced by other more effective techniques. 50. What is a Data A data flow diagram is a graphical notation of the path and Flow Diagram? transformation of data as it moves through an information system (as compared to flowcharts, which focus on control flow). The five basic elements shown in a data flow diagram are:
1) Data Sources. Where the information comes from.
2) Data Destinations. Where the information goes. 3) Data Flows. How the data gets there. 4) Transformation Processes. What happens to the data. 5) Data Storage. How the data is stored long-term. 51. What are With the narrative approach, controls and their Narratives? descriptions are written out.
Advantages of the narrative approach:
From the Desk of Muhammad Zain – Founder of Zain Academy Page 52 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
1) It can be tailored-made for each process.
2) It requires a detailed analysis and thus forces the reviewer to understand the structure of the function.
Disadvantages of the narrative approach:
1) The narrative may be time-consuming to create. 2) The narrative may become long and cumbersome to read. 3) Weaknesses in the system are not always obvious. 4) The reviewer may overlook important portions of internal control. 52. What are Spaghetti diagrams create a dynamic visual representation Spaghetti of physical items moving through a system using colored Maps? lines and direction arrows to represent the way that various sites interconnect. An analyst can use a spaghetti diagram to analyze a given process to identify inefficient pathways and to suggest improvements. 53. What are the Analytical procedures are useful in identifying: uses of Analytical • Unexpected differences. Procedures? • The absence of differences when they are expected. • Potential errors. • Potential fraud or illegal acts. • Other unusual or nonrecurring transactions or events. 54. What are the Internal auditors may use analytical procedures to factors that generate evidence during the audit engagement. Internal When determining the extent of analytical procedures, Auditors the internal auditor considers the: consider while using the • The significance of the area being audited. Analytical • Assessment of risk management in the area being Procedures? audited. • Adequacy of the internal control system. • Availability and reliability of financial and nonfinancial information. • The precision with which the results of analytical audit procedures can be predicted. • Availability and comparability of information regarding the industry in which the organization operates. • The extent to which other procedures provide evidence. 55. What purpose Engagement working papers generally: does the
From the Desk of Muhammad Zain – Founder of Zain Academy Page 53 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
Engagement • Aid in the planning, performance, and review of
Working engagements. Papers serve? • Provide the principal support for engagement results. • Document whether engagement objectives were achieved. • Support the accuracy and completeness of the work performed. • Provide a basis for the internal audit activity’s quality assurance and improvement program. • Facilitate third-party reviews. 56. What are the The working papers should include documentation of the contents of following parts of the engagement: Working Papers? • Planning. • The examination and evaluation of the internal control system. • The procedures performed, the evidence obtained, and the conclusions reached. • The review process. • Communications from the engagement client. • Any necessary follow up. 57. What risks Electronic working papers present specific security- does the related issues: Electronic Working • Data Protection. Electronically-stored information is Papers pose? always at risk of being irretrievably lost. Therefore, the company needs procedures for the regular and consistent backup of electronic data. These backups should be stored in an offsite location, and proper security needs to be maintained over both the backups and the original data source.
• Data Access. Because electronic information can be
accessed through internal networks and the Internet, the company needs to have sufficient identification checks and passwords to restrict access.
• Changing Data. It is important that only authorized
people have the ability to change files. Accordingly, there must be different levels of access, usually controlled by passwords. Some people will have read-only access, while others will be able to change data. Generally, only the
From the Desk of Muhammad Zain – Founder of Zain Academy Page 54 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
person who created a file should have the ability to make
changes to it. 58. What are the There are two main types of files in which working papers types of are stored. Working Paper Files? 1) The current file contains all documents related to the current year’s engagement. 2) The permanent file contains documents relevant to multiple engagements across several years. 59. What are the Items that are commonly kept in the permanent file are: items that are kept in the • Communications and reports from previous Permanent engagements. Working Paper • Results of reviews done after the engagement is File? completed. • Chart of accounts. • Updated organizational charts. • Long-term contracts. • Debt agreements. • Share documentation. • Historical financial information. • Management reports. • Corporate charter and other corporate documents. • Significant correspondence related to the engagement.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 55 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
SECTION D – COMMUNICATING RESULTS AND MANAGING
PROGRESS (WEIGHTAGE 20%)
S.No Questions Answers
1. What are the Internal auditors must communicate the results of requirements of engagements. Topics of discussion may include: Standard 2400 – Communicating • Planned engagement objectives and scope of work. Results? • The resources and timing of engagement work. • Key factors affecting business conditions and operations of the areas being reviewed, including recent changes in internal and external environment. • Concerns or requests from management. 2. What are the The Final Report must contain the purpose, scope, contents of the and results of the engagement. Also, where Final Report? appropriate, the report should contain the internal auditor’s overall opinion.
The final communication may also include
improvements that have been made or implemented by the auditee since the last engagement. 3. What are the Communications must include the engagement’s requirements of objectives, scope, and results. Standard 2410 – Criteria for Final communication of engagement results must Communicating? include applicable conclusions, as well as applicable recommendations and/or action plans. Where appropriate, the internal auditors’ opinion should be provided. An opinion must take into account the expectations of senior management, the board, and other stakeholders and must be supported by sufficient, reliable, relevant, and useful information.
Opinions at the engagement level may be ratings,
conclusions, or other descriptions of the results. Such an engagement may be in relation to controls around a specific process, risk, or business unit. The
From the Desk of Muhammad Zain – Founder of Zain Academy Page 56 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
formulation of such opinions requires consideration
of the engagement results and their significance. 4. What is the Purpose Statements describe the engagement objective of objectives and may inform the reader why the Purpose engagement was conducted and what it was Statements? expected to achieve. 5. What is the Scope Statements identify the audited activities and objective of Scope may include supportive information such as time Statements? period reviewed and related activities not reviewed to delineate the boundaries of the engagement. They may describe the nature and extent of engagement work performed. 6. What is included in Results include observations, conclusions, opinions, Result Statements? recommendations, and action plans. Any scope limitations should also be reported. 7. When the scope A “scope limitation” occurs when the auditor is limitation arises? unable to perform all of the required procedures. 8. Can the Internal The internal auditor may communicate engagement Auditor client accomplishments, in terms of communicate the improvements since the last engagement or the engagement client establishment of a well-controlled operation. This accomplishments? information may be necessary to present the existing conditions fairly and to provide perspective and balance to the engagement final communications. 9. What is the Communications must be accurate, objective, clear, requirement of the concise, constructive, complete, and timely. Standard 2420 – Quality of Accurate communications are free from errors and Communication? distortions and are faithful to the underlying facts. Objective communications are fair, impartial, and unbiased and are the result of a fair-minded and a balanced assessment of all relevant facts and circumstances. Clear communications are easily understood and logical, avoiding unnecessary technical language and providing all significant and relevant information. Concise communications are to the point and avoid unnecessary elaboration, superfluous detail, redundancy, and wordiness.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 57 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
Constructive communications are helpful to the
engagement client and the organization and lead to improvements where needed. Complete communications lack nothing that is essential to the target audience and includes all significant and relevant information and observations to support recommendations and conclusions. Timely communications are opportune and expedient, depending on the significance of the issue, allowing management to take appropriate corrective action. 10. What is the The person reviewing the reports should focus on responsibility of the readability, correctness, and appropriateness. person reviewing • Readability refers to the clarity of the writing. the reports before • Correctness refers to accurate grammar and its release? punctuation. • Appropriateness refers to the tactfulness and objectivity of the report and the correct balance given to major and minor observations. 11. What is the If a final communication contains a significant error requirement of the or omission, the chief audit executive must Standard 2421 – communicate corrected information to all parties Errors and who received the original communication. Omissions? 12. What purpose do Interim reports are communications that are issued the Interim before the final report. They may be written or oral Reports serve? and are used to communicate the following:
• Information that requires immediate action.
• A change in the scope of the engagement. • The status of the project (if it is a long-term plan).
An interim report does not eliminate the need for a
final report. 13. What are the there are advantages to oral communication: advantages of Oral Communication? • Timeliness. • Opportunities for immediate feedback. • Clients are able to respond in real-time. • Improved relationships (due to face-to-face interaction).
From the Desk of Muhammad Zain – Founder of Zain Academy Page 58 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
• Incorrect information or misunderstandings can
be immediately addressed. 14. What is the One drawback of a strictly spoken engagement is disadvantage of that, in the absence of notetaking or recording, Oral there is no permanent record of the conversation, Communication? which might lead to later discrepancies and disagreements. 15. What are the Recommendations are based on the internal Recommendations? auditor’s observations and conclusions. They call for action to correct existing conditions or improve operations and may suggest approaches to correcting or enhancing performance as a guide for management in achieving desired results. Recommendations can be general or specific. 16. What is the The chief audit executive must communicate results requirement of to the appropriate party. Standard 2440 – Disseminating The chief audit executive is responsible for Results? reviewing and approving the final engagement communication before issuance and for deciding to whom and how it will be disseminated. When the chief audit executive delegates these duties, he or she retains overall responsibility. 17. Who is responsible The chief audit executive is responsible for for Disseminating communicating the final results to parties who can Results in case of ensure that the results are given due consideration. Assurance Engagements? 18. Who is responsible The chief audit executive is responsible for for Disseminating communicating the final results of consulting Results in case of engagements to clients. Consulting Engagements? During consulting engagements, governance, risk management, and control issues may be identified. Whenever these issues are significant to the organization, they must be communicated to senior management and the board. 19. What are the There are 2 objectives of the Exit Conference: objectives of the Exit Conference? • The client confirms that they understand the report. It is possible that the client may not have seen the full report before the exit conference, but its general tone and findings should not come as a
From the Desk of Muhammad Zain – Founder of Zain Academy Page 59 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
surprise. The internal auditor should keep the client
updated throughout the engagement. • Action plans should be developed if the engagement identified any problems.
The exit conference is a presentation of findings and
a confirmation that everything in the report is factually correct. It is not a negotiation between the internal auditor and the client about the contents of the report. 20. To whom the CAE The CAE should distribute the final engagement should distribute communications to those members of the the final organization who will give the results all due engagement? consideration. This distribution list will usually include the manager in charge of the audited function as well as any other managers or individuals who are in a position to enact the recommended changes.
In cases where senior management is guilty of
wrongdoing, the report needs to go directly to the board. 21. What are the The CAE must: factors that must be considered by • Assess the potential risk to the organization. CAE while • Consult with senior management and/or legal distributing reports counsel as appropriate. outside the • Control dissemination by restricting the use of the organization? results. 22. What does the When the CAE believes that senior management has Standard 2600 – accepted a level of residual risk that is unacceptable Resolution of the to the organization, the CAE must discuss the matter Senior with senior management. If the decision regarding Management’s residual risk is not resolved, the CAE must report the Acceptance of matter to the board for resolution. Risks say? The identification of risk accepted by management may be observed through an assurance or consulting engagement, monitoring progress on actions taken by management as a result of prior engagements, or other means. It is not the responsibility of the chief audit executive to resolve the risk.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 60 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
23. What is the The chief audit executive must establish and requirement of maintain a system to monitor the disposition of Standard 2500 – results communicated to management. Monitoring Progress? In Assurance Engagement, the chief audit executive must establish a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action.
In Consulting Engagement, the internal audit
activity must monitor the disposition of results of consulting engagements to the extent agreed upon with the client. 24. What are the To effectively monitor the disposition of results, the procedures chief audit executive (CAE) establishes procedures implemented by the to include: CAE to monitor progress? • The time frame within which management’s response to the engagement observations and recommendations are required. • Evaluation of management’s response. • Verification of the response (if appropriate). • Performance of a follow-up engagement (if appropriate). • A communications process that escalates unsatisfactory responses/actions, including the assumption of risk, to the appropriate levels of senior management or the board. 25. What is a Follow- Follow-up is a process by which internal auditors up process? evaluate the adequacy, effectiveness, and timeliness of actions taken by management on reported observations and recommendations, including those made by external auditors and others. This process also includes determining whether senior management and/or the board have assumed the risk of not taking corrective action on reported observations. 26. On what factors The chief audit executive (CAE) determines the does the nature, nature, timing, and extent of follow-up, considering timing, and extent the following factors: of follow-up
From the Desk of Muhammad Zain – Founder of Zain Academy Page 61 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
procedures • Significance of the reported observation or
depend? recommendation. • Degree of effort and cost needed to correct the reported condition. • Impact that may result should the corrective action fail. • Complexity of the corrective action. • Time period involved.
The appropriate follow-up for a consulting
engagement must be discussed and agreed with the client. The extent of the monitoring effort depends on various factors, including management’s explicit interest in the engagement and the internal auditor’s assessment of the project’s risks or value to the organization. 27. What are the Clients might overlook recommendations because: reasons that client overlook the • More resources were needed for implementation recommendations than were expected or were available. proposed by • The expected costs of implementation may have Internal Auditors? increased. • The expected benefits of implementation may have decreased. • The client determined that the implementation would not have worked. • The client has misperceptions about the costs and/or benefits of the recommendations.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 62 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
BOOKS WRITTEN BY MUHAMMAD ZAIN
Other books written by him in chronological order can be found on the following link:
1. Certified Management Accountant (CMA) – Part 1 – 2019
From the Desk of Muhammad Zain – Founder of Zain Academy Page 63 of 64
CIA PART 2 – PRACTICE OF INTERNAL AUDITING – 2019
QUOTES THAT WILL CHANGE YOUR LIFE
I have always have been fascinated by some of the quotes which I would like to share:
1. Excellence, Creativity, and Passion are key ingredients to become a Star.
2. Get up and Hustle. Chase your dreams. Turn your dreams into reality by showing up every day. 3. Have Confidence. You can do it. You have the capacity and potential to reach the top. Just believe in your abilities and chase your dream. Dream is what seen by an open eye, not with the closed one. 4. Dreams don’t work unless you do. 5. What we learn becomes a part of who we are. 6. The right way to start your day is to focus on end goal. 7. Sometimes the bad things that happen in our lives put us directly on the path to the best things that will ever happen to us. 8. A creative man is motivated by the desire to achieve, not by the desire to beat others. 9. Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover. 10. It does not matter how slow you go. So long as you don’t stop. 11. It is never too late to begin. 12. If it scares you, it might be a good thing to try. 13. There is only you and your camera. The limitations in your photography are in yourself, for what we see is what we are. 14. Creativity is Intelligence having fun. 15. All progress takes place out of comfort zone, so when are you starting. 16. Everything you have ever wanted is on the other side of fear. 17. The will to win, the desire to succeed, the urge to reach your full potential – these are the keys that will unlock the door to personal excellence. 18. The reason most people never reach their goals is that they don’t define them, or ever seriously consider them as believable or achievable. Winners can tell you where they are going, what they plan to do along the way, and who will be sharing the adventure with them. 19. When everything seems to be going against you, remember that the airplane takes off against the wind, not with it. 20. Unexpected kindness is the most powerful, least costly and most underrated agent of human change. 21. Sometimes courage is the quiet voice at the end of the day saying I will try again tomorrow. 22. Sometimes you win, sometimes you learn. 23. Do something today that your future self will thank you for. 24. The past has no power over the present moment. So forget about your failures and start a new day. 25. Most of the important things in the world have been accomplished by people who have kept on trying when there seemed to be no help at all.
From the Desk of Muhammad Zain – Founder of Zain Academy Page 64 of 64
