IIA Updated IIA-CIA-Part2 Exam Questions and Answers by kylo

According to the IIA’s Implementation Guide for Standard 2340 - Engagement Supervision1, one of the activities that the chief audit executive or the designated engagement supervisor should perform is to review and approve the engagement work program before the commencement of fieldwork. The engagement work program should be based on the engagement objectives, scope, and approach, and should reflect the risks and controls identified during the planning phase. The engagement work program should also be discussed with the engagement team to ensure that they understand the tasks and procedures to be performed, and to address any questions or concerns. The engagement supervisor should document the approval of the work program and any subsequent changes in the workpapers.

If an internal auditor identifies that some employees have inappropriate access to a key system in the early stage of an audit, the best course of action is to issue an interim audit report so that management can implement action plans. This approach ensures that the identified issue is formally communicated to management promptly, allowing them to take immediate corrective action to mitigate the risk. It also documents the auditor's findings and recommendations, providing a clear audit trail and supporting accountability. Obtaining verbal assurance or creating a ticket might address the issue temporarily but lacks the formal documentation and follow-up mechanisms inherent in an interim audit report.

References:

IIA Standard 2440: "Disseminating Results"

IIA Practice Advisory 2440-1: "Communicating Interim Engagement Results"

When there is a deadlock between the internal auditor and management over a significant issue such as access controls, escalating the issue to senior management is the most effective strategy. This approach ensures that the disagreement is addressed at a higher organizational level, where a decision can be made that aligns with the organization's risk tolerance and priorities. References: = IIA Standard 2600 - Resolution of Senior Management's Acceptance of Risks.

When identifying audit resource requirements, the chief audit executive (CAE) should consider approaching an external service provider to conduct internal audits in areas where the organization lacks the necessary skills (2). This ensures that audits are conducted by individuals with the appropriate expertise. Additionally, communicating to senior management a summary report on the status and adequacy of audit resources (4) keeps them informed about the internal audit activity's capacity and any resource constraints. Considering employees from other operational areas as audit resources (1) could compromise objectivity and independence, while suggesting deferral of audits (3) is generally not advisable as it might leave significant risks unaddressed. References: IIA Standard 2030 – Resource Management, IIA Practice Advisory 2030-1