Planning for Key Risks and Controls
5 minutes
5 Questions
In the Certified Internal Auditor (CIA) Challenge Exam, planning for key risks and controls is a core part of Engagement Planning. The Challenge Exam is a condensed exam for qualified professional accountants. This topic covers how internal auditors focus an engagement on the risks that matter most and on the controls meant to manage them. Under the IIA's Global Internal Audit Standards (Standard 13, Engagement Planning, which replaces former Standards 2200 to 2240), auditors must understand the activity under review before setting objectives and scope. The process begins with gathering information about the area's objectives, strategies, processes, performance measures, and governance. This often includes reviewing prior audit reports, interviewing management, analyzing data, and conducting walkthroughs. Next, auditors perform an engagement-level risk assessment. They identify significant risks that could prevent the area from achieving its objectives, including strategic, operational, financial, compliance, fraud, and IT risks. Each risk is evaluated for inherent likelihood and impact. Auditors then consider management's risk responses and the residual risk compared with the organization's risk appetite. Auditors then identify and document key controls, meaning the preventive, detective, directive, and corrective controls that most directly reduce significant risks. Tools such as risk and control matrices, process maps, and flowcharts help link each risk to its mitigating controls. They also reveal gaps or redundancies in control design. This analysis drives the engagement objectives, scope, and evaluation criteria. Criteria may come from internal policies, laws, contracts, or frameworks such as COSO or COBIT. Fraud risk must be explicitly considered, and auditors should be alert to significant exposures. Finally, the results shape resource allocation and the engagement work program. The work program specifies the procedures to test control design adequacy and operating effectiveness. Exam questions often test the correct sequence of these steps: understand the area, assess risks, identify controls, then design tests. They also test the idea that a risk-based focus improves efficiency by concentrating effort on high-risk, high-impact areas rather than testing everything equally.
Planning for Key Risks and Controls: A Complete CIA Challenge Exam Guide to Engagement Planning
Introduction
Planning for key risks and controls is the core of internal audit engagement planning. It tested in the CIA Challenge Exam under the Engagement Planning domain and links directly to the IIA Global Internal Audit Standards. These Standards require internal auditors to understand the activity under review, assess the risks relevant to it, and evaluate the adequacy and effectiveness of the controls that manage those risks. This guide explains why this concept matters, what it involves, how it works step by step, and how to answer exam questions on it with confidence.
Why Planning for Key Risks and Controls Is Important
1. Focus on what matters most: Internal audit resources are limited. A risk-based engagement plan directs time and effort to the areas with the greatest potential to stop the organization from achieving its objectives.
2. Compliance with the Standards: The IIA Standards require auditors to conduct a risk assessment of the activity under review. They also require auditors to consider significant risks, the means management uses to keep risk at an acceptable level, and the governance, risk management, and control processes in place.
3. Value to stakeholders: Senior management and the board expect assurance on the risks that could seriously harm the organization. An audit that only checks low-risk, routine items adds little value.
4. Efficiency and effectiveness: Knowing the key controls in advance lets the auditor design targeted tests. This avoids testing every control and avoids missing critical ones.
5. Basis for objectives and scope: Engagement objectives must reflect the results of the risk assessment. Without this step, the objectives and scope would be arbitrary.
6. Fraud and significant exposure awareness: Auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing engagement objectives.
What Planning for Key Risks and Controls Is
It is the part of engagement planning in which the internal auditor:
- Gains an understanding of the area under review, including its objectives, strategies, processes, and the context in which it operates.
- Identifies the risks that could prevent those objectives from being achieved.
- Assesses those risks by impact (significance) and likelihood.
- Identifies the controls management relies on to mitigate the significant risks. These are the key controls.
- Uses this analysis to set engagement objectives, scope, criteria, and the work program.
Key terms
- Inherent risk: The risk that exists before management takes any action, meaning before controls are considered.
- Residual risk: The risk that remains after management's response and controls.
- Key control: A control that, if it failed, would expose the organization to a significant risk that no other control would detect or prevent in time. Key controls are the primary focus of testing.
- Secondary (or compensating) control: A control that supports or partially substitutes for a key control.
- Preventive, detective, and corrective controls: Preventive controls stop errors or irregularities before they happen. Detective controls identify them after they occur. Corrective controls fix problems once they are found.
- Directive controls: Controls that encourage desirable outcomes, such as policies and training.
- Risk appetite and tolerance: The level of risk the organization is willing to accept in pursuit of its objectives.
- Control design adequacy vs. operating effectiveness: Adequacy asks whether the control is designed properly to mitigate the risk. Operating effectiveness asks whether it works as intended over time.
How It Works: The Step-by-Step Process
Step 1: Understand the activity under review
The auditor gathers background information to understand the area being audited. Typical sources include:
- Prior audit reports and working papers
- Organizational charts and process maps
- Policies and procedures
- Strategic plans and key performance indicators
- Regulatory requirements
- Interviews with management
- The results of management's own risk assessments
- Results of the internal audit annual risk-based plan
The auditor clarifies the objectives of the activity, because risks are always defined relative to objectives.
Step 2: Identify risks
The auditor asks, "What could go wrong that would prevent this activity from achieving its objectives?" Useful techniques include:
- Brainstorming and workshops
- Process walkthroughs and flowcharting
- Control self-assessment results
- Review of incident and loss data
- Analytical procedures
- Risk frameworks such as COSO ERM or ISO 31000
- Considering fraud risk factors (the fraud triangle: pressure, opportunity, rationalization)
Step 3: Assess risks
Each risk is evaluated for its impact and likelihood, often using a heat map or risk matrix. The auditor also considers:
- Velocity (how fast the risk could materialize)
- Changes in the environment, such as new systems, reorganizations, or new regulations
- Complexity of transactions
- Results of prior audits
The auditor first considers inherent risk to see which risks are significant. Controls are then considered to evaluate residual risk.
Step 4: Identify key controls
For each significant risk, the auditor identifies the controls management relies on. Key controls are usually those that:
- Directly address a significant risk
- Cover multiple risks or assertions
- Have no compensating control backing them up
- Are preventive, or are high-level management review controls
Examples include segregation of duties, authorization limits, reconciliations, system access controls, and management reviews of exceptions.
Step 5: Evaluate control design (preliminary)
During planning, the auditor performs a preliminary assessment of whether the controls are adequately designed. Walkthroughs and documentation such as narratives, flowcharts, and risk and control matrices (RCMs) are commonly used. If a key control is poorly designed, testing its operating effectiveness may be pointless. The design gap itself may become a finding.
Step 6: Develop engagement objectives, scope, and criteria
The engagement objectives reflect the significant risks identified. The scope must be sufficient to achieve the objectives and covers the relevant systems, records, personnel, and physical properties. The auditor also identifies appropriate criteria, such as policies, laws, benchmarks, or best practices, to evaluate the controls. If management's criteria are inadequate, the auditor works with management to develop suitable criteria.
Step 7: Build the work program
The work program sets out the procedures to identify, analyze, evaluate, and document information. Procedures are linked to the key controls and risks, usually through a risk and control matrix. Higher-risk areas receive more extensive testing, larger samples, and more experienced staff.
Step 8: Allocate resources and obtain approval
The auditor determines the staffing, skills, and budget needed. The plan is approved by the chief audit executive or a designee before fieldwork, and any significant changes are approved promptly.
Common Tools Used in Planning
- Risk and Control Matrix (RCM): Links objectives, risks, controls, and test procedures.
- Heat maps: Visualize impact versus likelihood.
- Flowcharts and narratives: Document processes and control points.
- Internal control questionnaires: Gather information efficiently about the control environment.
- Analytical review: Identifies unusual trends that may indicate risk.
- Data analytics: Help identify anomalies and high-risk populations.
Relationship to Frameworks
- COSO Internal Control Integrated Framework: Has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Planning considers all five, not only control activities.
- COSO ERM: Connects risk to strategy and performance.
- Three Lines Model: Internal audit may consider the work of first-line and second-line functions, such as risk management or compliance, when assessing risks and controls. It may also rely on that work where appropriate.
Worked Example
An auditor is planning an audit of accounts payable. The objective of the area is to pay only valid, authorized invoices accurately and on time.
- Risks: Payments to fictitious vendors (fraud), duplicate payments, unauthorized payments, and late payments causing penalties.
- Assessment: Fictitious vendors carry high impact and medium likelihood, so this is a significant risk. Late payments carry low impact.
- Key controls: Segregation between vendor master file maintenance and payment processing, three-way match (purchase order, receiving report, invoice), system duplicate-invoice checks, and approval limits.
- Plan: Test the vendor master file change controls and the three-way match in depth. Use data analytics to detect duplicates and vendors sharing addresses with employees. Late payments receive limited testing.
Exam Tips: Answering Questions on Planning for Key Risks and Controls
1. Remember the correct sequence. Many questions test the order of steps. Use this sequence: understand the area and its objectives, identify risks, assess risks, identify controls, evaluate control design, set objectives and scope, develop the work program, then test operating effectiveness during fieldwork. If an answer choice tests controls before risks are identified, it is usually wrong.
2. Objectives come first. Risk is defined relative to objectives. When asked what the auditor should do first, look for answers about understanding the activity's objectives or gaining background knowledge.
3. Focus on significant risks and key controls. The IIA favors a risk-based approach. Answers suggesting the auditor tests all controls equally, or tests areas that are easiest to audit, are typically incorrect.
4. Distinguish inherent and residual risk. Inherent risk is assessed before controls. Residual risk is what remains after controls. A question asking which risk determines the need for controls points to inherent risk. A question about what management must accept points to residual risk relative to risk appetite.
5. Know the control types. Be ready to classify controls:
- A reconciliation is detective.
- Authorization before payment is preventive.
- Training and policies are directive.
- Backup restoration is corrective.
The IIA generally views preventive controls as more desirable for high-risk areas.
6. Design before operation. If a control is not adequately designed, there is no point testing its operating effectiveness. In a question about a poorly designed key control, the best answer is often to report the design deficiency or look for compensating controls. Further operating tests are usually not the best choice.
7. Consider fraud during planning. The Standards require consideration of the probability of significant errors, fraud, and noncompliance when setting objectives. Answers that ignore fraud risk in a high-risk area are likely incorrect. However, internal auditors are not expected to have the expertise of a fraud investigator.
8. Criteria matter. If a question describes management lacking adequate criteria, the correct response is that the auditor should identify suitable criteria through discussion with management or the board. The auditor should not proceed without criteria or simply accept inadequate ones.
9. Use the work of others wisely. Auditors may rely on management's risk assessments or second-line functions. Before relying on that work, they must evaluate its objectivity and competence. Blind reliance is a wrong answer.
10. Watch for 'best', 'most', and 'first' wording. CIA questions often have several plausible answers. Choose the one that is most risk-focused, most aligned with the Standards, and most appropriate at the planning stage. Fieldwork activities such as detailed substantive testing are not planning activities.
11. Link changes to risk. New systems, mergers, new management, regulatory changes, and rapid growth all increase risk. When a scenario mentions these, expect the correct answer to highlight increased risk and the need for more audit attention.
12. Scope must be sufficient. If a question asks about scope, remember that it must cover relevant systems, records, personnel, and properties, including those under third-party control. Scope limitations should be communicated.
13. Approval and documentation. The work program must be documented and approved before work begins. Changes must be approved promptly. Answers implying informal or undocumented plans are usually wrong.
14. Eliminate extreme answers. Options using words like always, never, all controls, or guarantee are often incorrect. Internal controls provide reasonable, not absolute, assurance.
15. Think like the CAE. When in doubt, choose the option that best protects the organization's objectives, uses resources efficiently, and aligns with stakeholder expectations.
Sample Exam Question
During planning of an engagement on inventory management, what should the internal auditor do first?
A. Test the operating effectiveness of the cycle count controls.
B. Select a statistical sample of inventory items for observation.
C. Obtain an understanding of the inventory function's objectives and processes.
D. Issue a preliminary report on control weaknesses.
Answer: C. Understanding objectives and processes is the foundation for identifying and assessing risks. Options A and B are fieldwork activities. Option D is premature.
Summary
Planning for key risks and controls ensures that an engagement is focused, efficient, and valuable. The process follows a clear path: understand the objectives, identify and assess risks, identify key controls, evaluate their design, set objectives, scope, and criteria, and build a risk-linked work program. In the exam, follow the logical sequence, favor risk-based answers, distinguish planning from fieldwork, and always connect risks back to objectives.
Planning for key risks and controls is the core of internal audit engagement planning. It tested in the CIA Challenge Exam under the Engagement Planning domain and links directly to the IIA Global Internal Audit Standards. These Standards require internal auditors to understand the activity under review, assess the risks relevant to it, and evaluate the adequacy and effectiveness of the controls that manage those risks. This guide explains why this concept matters, what it involves, how it works step by step, and how to answer exam questions on it with confidence.
Why Planning for Key Risks and Controls Is Important
1. Focus on what matters most: Internal audit resources are limited. A risk-based engagement plan directs time and effort to the areas with the greatest potential to stop the organization from achieving its objectives.
2. Compliance with the Standards: The IIA Standards require auditors to conduct a risk assessment of the activity under review. They also require auditors to consider significant risks, the means management uses to keep risk at an acceptable level, and the governance, risk management, and control processes in place.
3. Value to stakeholders: Senior management and the board expect assurance on the risks that could seriously harm the organization. An audit that only checks low-risk, routine items adds little value.
4. Efficiency and effectiveness: Knowing the key controls in advance lets the auditor design targeted tests. This avoids testing every control and avoids missing critical ones.
5. Basis for objectives and scope: Engagement objectives must reflect the results of the risk assessment. Without this step, the objectives and scope would be arbitrary.
6. Fraud and significant exposure awareness: Auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing engagement objectives.
What Planning for Key Risks and Controls Is
It is the part of engagement planning in which the internal auditor:
- Gains an understanding of the area under review, including its objectives, strategies, processes, and the context in which it operates.
- Identifies the risks that could prevent those objectives from being achieved.
- Assesses those risks by impact (significance) and likelihood.
- Identifies the controls management relies on to mitigate the significant risks. These are the key controls.
- Uses this analysis to set engagement objectives, scope, criteria, and the work program.
Key terms
- Inherent risk: The risk that exists before management takes any action, meaning before controls are considered.
- Residual risk: The risk that remains after management's response and controls.
- Key control: A control that, if it failed, would expose the organization to a significant risk that no other control would detect or prevent in time. Key controls are the primary focus of testing.
- Secondary (or compensating) control: A control that supports or partially substitutes for a key control.
- Preventive, detective, and corrective controls: Preventive controls stop errors or irregularities before they happen. Detective controls identify them after they occur. Corrective controls fix problems once they are found.
- Directive controls: Controls that encourage desirable outcomes, such as policies and training.
- Risk appetite and tolerance: The level of risk the organization is willing to accept in pursuit of its objectives.
- Control design adequacy vs. operating effectiveness: Adequacy asks whether the control is designed properly to mitigate the risk. Operating effectiveness asks whether it works as intended over time.
How It Works: The Step-by-Step Process
Step 1: Understand the activity under review
The auditor gathers background information to understand the area being audited. Typical sources include:
- Prior audit reports and working papers
- Organizational charts and process maps
- Policies and procedures
- Strategic plans and key performance indicators
- Regulatory requirements
- Interviews with management
- The results of management's own risk assessments
- Results of the internal audit annual risk-based plan
The auditor clarifies the objectives of the activity, because risks are always defined relative to objectives.
Step 2: Identify risks
The auditor asks, "What could go wrong that would prevent this activity from achieving its objectives?" Useful techniques include:
- Brainstorming and workshops
- Process walkthroughs and flowcharting
- Control self-assessment results
- Review of incident and loss data
- Analytical procedures
- Risk frameworks such as COSO ERM or ISO 31000
- Considering fraud risk factors (the fraud triangle: pressure, opportunity, rationalization)
Step 3: Assess risks
Each risk is evaluated for its impact and likelihood, often using a heat map or risk matrix. The auditor also considers:
- Velocity (how fast the risk could materialize)
- Changes in the environment, such as new systems, reorganizations, or new regulations
- Complexity of transactions
- Results of prior audits
The auditor first considers inherent risk to see which risks are significant. Controls are then considered to evaluate residual risk.
Step 4: Identify key controls
For each significant risk, the auditor identifies the controls management relies on. Key controls are usually those that:
- Directly address a significant risk
- Cover multiple risks or assertions
- Have no compensating control backing them up
- Are preventive, or are high-level management review controls
Examples include segregation of duties, authorization limits, reconciliations, system access controls, and management reviews of exceptions.
Step 5: Evaluate control design (preliminary)
During planning, the auditor performs a preliminary assessment of whether the controls are adequately designed. Walkthroughs and documentation such as narratives, flowcharts, and risk and control matrices (RCMs) are commonly used. If a key control is poorly designed, testing its operating effectiveness may be pointless. The design gap itself may become a finding.
Step 6: Develop engagement objectives, scope, and criteria
The engagement objectives reflect the significant risks identified. The scope must be sufficient to achieve the objectives and covers the relevant systems, records, personnel, and physical properties. The auditor also identifies appropriate criteria, such as policies, laws, benchmarks, or best practices, to evaluate the controls. If management's criteria are inadequate, the auditor works with management to develop suitable criteria.
Step 7: Build the work program
The work program sets out the procedures to identify, analyze, evaluate, and document information. Procedures are linked to the key controls and risks, usually through a risk and control matrix. Higher-risk areas receive more extensive testing, larger samples, and more experienced staff.
Step 8: Allocate resources and obtain approval
The auditor determines the staffing, skills, and budget needed. The plan is approved by the chief audit executive or a designee before fieldwork, and any significant changes are approved promptly.
Common Tools Used in Planning
- Risk and Control Matrix (RCM): Links objectives, risks, controls, and test procedures.
- Heat maps: Visualize impact versus likelihood.
- Flowcharts and narratives: Document processes and control points.
- Internal control questionnaires: Gather information efficiently about the control environment.
- Analytical review: Identifies unusual trends that may indicate risk.
- Data analytics: Help identify anomalies and high-risk populations.
Relationship to Frameworks
- COSO Internal Control Integrated Framework: Has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Planning considers all five, not only control activities.
- COSO ERM: Connects risk to strategy and performance.
- Three Lines Model: Internal audit may consider the work of first-line and second-line functions, such as risk management or compliance, when assessing risks and controls. It may also rely on that work where appropriate.
Worked Example
An auditor is planning an audit of accounts payable. The objective of the area is to pay only valid, authorized invoices accurately and on time.
- Risks: Payments to fictitious vendors (fraud), duplicate payments, unauthorized payments, and late payments causing penalties.
- Assessment: Fictitious vendors carry high impact and medium likelihood, so this is a significant risk. Late payments carry low impact.
- Key controls: Segregation between vendor master file maintenance and payment processing, three-way match (purchase order, receiving report, invoice), system duplicate-invoice checks, and approval limits.
- Plan: Test the vendor master file change controls and the three-way match in depth. Use data analytics to detect duplicates and vendors sharing addresses with employees. Late payments receive limited testing.
Exam Tips: Answering Questions on Planning for Key Risks and Controls
1. Remember the correct sequence. Many questions test the order of steps. Use this sequence: understand the area and its objectives, identify risks, assess risks, identify controls, evaluate control design, set objectives and scope, develop the work program, then test operating effectiveness during fieldwork. If an answer choice tests controls before risks are identified, it is usually wrong.
2. Objectives come first. Risk is defined relative to objectives. When asked what the auditor should do first, look for answers about understanding the activity's objectives or gaining background knowledge.
3. Focus on significant risks and key controls. The IIA favors a risk-based approach. Answers suggesting the auditor tests all controls equally, or tests areas that are easiest to audit, are typically incorrect.
4. Distinguish inherent and residual risk. Inherent risk is assessed before controls. Residual risk is what remains after controls. A question asking which risk determines the need for controls points to inherent risk. A question about what management must accept points to residual risk relative to risk appetite.
5. Know the control types. Be ready to classify controls:
- A reconciliation is detective.
- Authorization before payment is preventive.
- Training and policies are directive.
- Backup restoration is corrective.
The IIA generally views preventive controls as more desirable for high-risk areas.
6. Design before operation. If a control is not adequately designed, there is no point testing its operating effectiveness. In a question about a poorly designed key control, the best answer is often to report the design deficiency or look for compensating controls. Further operating tests are usually not the best choice.
7. Consider fraud during planning. The Standards require consideration of the probability of significant errors, fraud, and noncompliance when setting objectives. Answers that ignore fraud risk in a high-risk area are likely incorrect. However, internal auditors are not expected to have the expertise of a fraud investigator.
8. Criteria matter. If a question describes management lacking adequate criteria, the correct response is that the auditor should identify suitable criteria through discussion with management or the board. The auditor should not proceed without criteria or simply accept inadequate ones.
9. Use the work of others wisely. Auditors may rely on management's risk assessments or second-line functions. Before relying on that work, they must evaluate its objectivity and competence. Blind reliance is a wrong answer.
10. Watch for 'best', 'most', and 'first' wording. CIA questions often have several plausible answers. Choose the one that is most risk-focused, most aligned with the Standards, and most appropriate at the planning stage. Fieldwork activities such as detailed substantive testing are not planning activities.
11. Link changes to risk. New systems, mergers, new management, regulatory changes, and rapid growth all increase risk. When a scenario mentions these, expect the correct answer to highlight increased risk and the need for more audit attention.
12. Scope must be sufficient. If a question asks about scope, remember that it must cover relevant systems, records, personnel, and properties, including those under third-party control. Scope limitations should be communicated.
13. Approval and documentation. The work program must be documented and approved before work begins. Changes must be approved promptly. Answers implying informal or undocumented plans are usually wrong.
14. Eliminate extreme answers. Options using words like always, never, all controls, or guarantee are often incorrect. Internal controls provide reasonable, not absolute, assurance.
15. Think like the CAE. When in doubt, choose the option that best protects the organization's objectives, uses resources efficiently, and aligns with stakeholder expectations.
Sample Exam Question
During planning of an engagement on inventory management, what should the internal auditor do first?
A. Test the operating effectiveness of the cycle count controls.
B. Select a statistical sample of inventory items for observation.
C. Obtain an understanding of the inventory function's objectives and processes.
D. Issue a preliminary report on control weaknesses.
Answer: C. Understanding objectives and processes is the foundation for identifying and assessing risks. Options A and B are fieldwork activities. Option D is premature.
Summary
Planning for key risks and controls ensures that an engagement is focused, efficient, and valuable. The process follows a clear path: understand the objectives, identify and assess risks, identify key controls, evaluate their design, set objectives, scope, and criteria, and build a risk-linked work program. In the exam, follow the logical sequence, favor risk-based answers, distinguish planning from fieldwork, and always connect risks back to objectives.
Test mode:
CIA Challenge - Planning for Key Risks and Controls Example Questions
Test your knowledge of Planning for Key Risks and Controls
Question 1
An internal auditor is evaluating the disbursements cycle of an organization. During the review, the auditor discovers multiple payments directed to a recently established supplier. These invoices are consistently priced just under the mandatory secondary authorization limit, display strictly sequential invoice numbers, and provide only a post office box for contact details. Based on these specific anomalies, which fraudulent activity do these combined indicators most strongly suggest is occurring?
Question 2
An organization's fraud awareness program aims to help staff spot early warning signs. A trainer wants to explain why lifestyle changes among employees matter to fraud detection. Which explanation best captures the significance of an employee suddenly displaying wealth that exceeds their known income?
Question 3
An auditor is planning tests for a procurement cycle where a manager holds authority to add vendors and approve invoices. Recent data shows several new vendors sharing a mailing address with an employee, and invoice amounts that stay just beneath the manager's approval threshold. Given limited audit hours, which testing approach yields the most persuasive evidence about a possible disbursement scheme?
Unlock Premium Access
Certified Internal Auditor Challenge Exam
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2865 Superior-grade Certified Internal Auditor Challenge Exam practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CIA Challenge: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Planning for Key Risks and Controls questions
107 questions (total)