Sources of Potential Engagements and the Audit Universe

5 minutes 5 Questions

In the CIA Challenge Exam, under Internal Audit Operations and the Audit Plan, the audit universe and the sources of potential engagements are the starting point for building a risk-based internal audit plan, as required by IIA Standards. The audit universe is the complete inventory of auditable entities, or areas of the organization that internal audit could review. These include business units, departments, processes, functions, programs, information systems, subsidiaries, locations, projects, contracts, and key risks. It is usually organized by the organization's structure, its processes, or its risk categories. It should be comprehensive, linked to organizational objectives, and updated regularly to reflect reorganizations, acquisitions, new products, new technologies, and emerging risks. Sources of potential engagements are the inputs the chief audit executive (CAE) uses to identify and prioritize audit work. Key sources include: (1) the organization's strategic plans, objectives, and enterprise risk management results; (2) internal audit's own documented risk assessment, performed at least annually; (3) requests and concerns from the board, audit committee, and senior management; (4) legal and regulatory requirements that mandate certain reviews; (5) results of prior audits, outstanding issues, and follow-up needs; (6) significant changes such as mergers, system implementations, new markets, or restructurings; (7) emerging risks, including cybersecurity, fraud, ESG, and third-party risks; (8) input from external auditors, regulators, and other assurance providers, coordinated to avoid duplication; (9) hotline reports, fraud allegations, and whistleblower information; and (10) cyclical or rotational coverage of high-risk areas and consulting requests. The CAE ranks the audit universe by risk, considering impact, likelihood, control environment, time since last audit, and management concerns. The highest-priority engagements are matched to available resources. The plan is communicated to senior management and approved by the board, and it remains flexible so it can be revised as risks change.

Sources of Potential Engagements and the Audit Universe: A Complete CIA Challenge Exam Guide

Introduction
The audit universe is the starting point for every risk-based internal audit plan. Before the Chief Audit Executive (CAE) can decide what to audit, the internal audit activity must first know what could be audited. This guide covers why the audit universe matters, what it is, where potential engagements come from, how the universe becomes a plan, and how to answer CIA Challenge Exam questions on the topic.

Why It Is Important
1. It is the foundation of risk-based planning.
  • The IIA's Global Internal Audit Standards require the CAE to create an internal audit plan that supports the organization's objectives.
  • That plan must rest on a documented assessment of the organization's strategies, objectives and risks, done at least annually.
  • You cannot assess risk across the organization without first defining the full population of auditable areas.
2. It ensures coverage and reduces blind spots.
  • A complete universe helps make sure that significant risks are not overlooked.
  • Typical blind spots include new business lines, third-party arrangements, IT systems and emerging risks.
3. It supports assurance to the board.
  • The board and senior management rely on internal audit to give reasonable coverage of key risks.
  • A well-defined universe lets the CAE show what is covered, what is not, and why.
  • It also supports discussions about resource limits and residual risk.
4. It enables coordination and reliance.
  • Mapping the universe shows where other assurance providers already give coverage.
  • Examples include external auditors, compliance, risk management, quality assurance and the second line.
  • This reduces duplication and supports the combined assurance model.
5. It is heavily tested.
  • The CIA Challenge Exam often tests whether candidates know where engagements come from.
  • It also tests how the universe is built and maintained, and how it links to risk assessment and the audit plan.

What It Is
The audit universe is the complete inventory of all auditable entities, or units, within an organization. It represents every area on which internal audit could potentially perform an assurance or advisory engagement.

Ways to define an auditable unit
Auditable units can be defined in several ways. Most organizations use a hybrid approach.
  • Organizational units: departments, divisions, subsidiaries, business units, geographic locations.
  • Business processes: procure-to-pay, order-to-cash, payroll, treasury, inventory management, financial close.
  • Functions and programs: HR, marketing, R&D, sustainability or ESG programs, grants.
  • Information systems and IT: ERP systems, cybersecurity, data privacy, cloud services, IT general controls.
  • Projects and initiatives: system implementations, mergers and acquisitions, capital projects, transformation programs.
  • Risks or compliance obligations: regulatory requirements, fraud risk, anti-bribery, environmental compliance.
  • External relationships: key vendors, outsourced service providers, joint ventures, contracts.
Key characteristics of a good audit universe
  • Complete: covers all significant activities, including those that are outsourced.
  • Linked to objectives and risks: each unit connects to strategic objectives and key risks.
  • Appropriately sized: each unit is small enough to audit in a reasonable engagement, but not so fragmented that it cannot be managed.
  • Dynamic: updated regularly as the organization changes.
  • Documented: kept as a formal record, often in audit management software.

Sources of Potential Engagements
Potential engagements come from many sources. The CAE gathers input from these sources to identify and rank engagements.

1. Organizational strategy and objectives
  • Strategic plans, business plans and budgets.
  • Key performance indicators (KPIs) and major initiatives.
  • Engagements should align with what matters most to the organization.
2. Enterprise risk management (ERM) outputs
  • Risk registers, risk assessments and risk appetite statements.
  • Heat maps produced by management or the risk function.
  • Internal audit may use these, but should form its own independent view of risk.
3. Board and audit committee input
  • Specific concerns, requests and areas of interest raised by those charged with governance.
4. Senior management input
  • Interviews, surveys and workshops with executives and operational managers.
  • These surface concerns, changes and emerging risks.
  • Management requests often lead to advisory engagements.
5. Regulatory and legal requirements
  • Mandatory audits required by law, regulators, contracts or industry rules.
  • Examples include SOX/ICFR testing support, banking regulations, grant compliance and data protection laws.
6. Prior audit results
  • Previous engagement findings and unresolved or repeat issues.
  • Follow-up needs and areas with a history of weak control.
7. Changes in the organization
  • New products, markets, systems, reorganizations or acquisitions.
  • Leadership changes, rapid growth or downsizing.
  • Change is a major driver of risk.
8. Emerging and external risks
  • Economic conditions, technology disruption (such as AI) and cyber threats.
  • Geopolitical events, climate and ESG expectations, and industry trends.
9. Fraud and hotline information
  • Whistleblower reports, investigations and fraud risk assessments.
10. Other assurance providers
  • External auditors' management letters and compliance reviews.
  • Second-line monitoring reports, quality reviews and regulator examinations.
11. Data analytics and continuous monitoring
  • Anomalies, trends and red flags found through analytics can trigger engagements.
12. Cyclical or rotational coverage
  • Some areas, even lower-risk ones, may be audited on a set cycle to ensure periodic coverage.
  • The modern approach puts risk first and uses cycles only as a secondary input.
13. Internal audit's own knowledge
  • Auditors' observations during other engagements.
  • Industry benchmarking, professional guidance and peer networks.

How It Works
Step 1: Understand the organization
  • Review the strategy, organizational structure, business model, governance framework and regulatory environment.
Step 2: Define and build the audit universe
  • Identify all auditable units using one or more of the approaches above.
  • Use organization charts, process maps, the chart of accounts, system inventories, contract registers and risk registers.
  • Consult management and the board.
Step 3: Link units to objectives and risks
  • Map each unit to the strategic objectives it supports and the risks it faces.
  • This creates the bridge between the universe and the risk assessment.
Step 4: Perform a risk assessment of the universe
Rate each unit on risk factors such as:
  • Financial materiality.
  • Complexity.
  • Regulatory exposure.
  • Quality of the control environment.
  • Degree of change.
  • Results of prior audits.
  • Management concern.
  • Fraud susceptibility.
  • Reputational impact.
  • Time since the last audit.
Factors are often weighted and scored to produce a relative risk ranking. Both inherent and residual risk may be considered.

Step 5: Consider coverage by other assurance providers
  • Identify where reliance on other providers is appropriate.
  • This allows internal audit resources to be directed elsewhere.
Step 6: Prioritize and select engagements
  • Choose engagements based on risk ranking, mandatory requirements and board or management requests.
  • Also weigh strategic importance and available resources.
  • Higher-risk units are audited more often or in more depth.
Step 7: Develop the internal audit plan
  • Document the selected engagements, their timing and the resource needs.
  • Communicate the plan to senior management and the board for review and approval.
  • Highlight the impact of any resource limits.
Step 8: Maintain and update
  • Review the universe and risk assessment at least annually.
  • Update them whenever significant changes occur.
  • Many organizations now use rolling or dynamic plans, such as quarterly updates, to keep pace with fast-changing risks.
Illustrative example
A retail company's audit universe might include:
  • Store operations by region.
  • E-commerce platform.
  • Inventory and supply chain.
  • Payroll.
  • Vendor management.
  • Cybersecurity.
  • Data privacy.
  • Treasury.
  • Tax.
  • A new loyalty program.
  • A planned acquisition.
The risk assessment ranks these units as follows:
  • Highest risk: cybersecurity and the acquisition, because of high impact, rapid change and board concern.
  • Moderate risk: payroll, because of stable processes, good prior results and second-line monitoring.
The plan therefore prioritizes a cybersecurity assurance engagement and an advisory engagement on acquisition integration. Payroll is scheduled on a longer cycle.

Relationship to Key IIA Concepts
  • Risk-based planning: the universe feeds the risk assessment, which drives the plan.
  • Independence and objectivity: the CAE considers management input but makes independent judgments on what to audit. Management's risk assessment should not be accepted uncritically.
  • Board communication: the board approves the plan and should understand significant areas excluded from coverage.
  • Coordination and reliance: the universe helps map combined assurance and avoid gaps and overlaps.
  • Assurance vs. advisory: both engagement types can come from the universe. Advisory requests are accepted based on their potential to improve risk management, add value and improve operations.

Exam Tips: Answering Questions on Sources of Potential Engagements and the Audit Universe
1. Know the sequence.
  • The usual order is: understand the organization's strategy and objectives, define the audit universe, assess risks, prioritize, develop the plan, obtain board approval, then update regularly.
  • Questions often ask what the CAE should do first. The answer is usually to understand strategy and objectives or to identify the audit universe, before any risk scoring or scheduling.
2. Risk drives selection.
  • When asked how engagements should be prioritized, choose the answer based on risk assessment.
  • Avoid answers based mainly on fixed cycles, auditor preference, ease of audit or simply what was done last year.
3. Watch for completeness traps.
  • The universe should include outsourced processes, IT, new initiatives and third parties.
  • An answer that limits the universe to financial areas or in-house departments is usually wrong.
4. Management input is an input, not a mandate.
  • Management's risk assessments and requests are valid sources, but internal audit must apply independent judgment.
  • Be careful with answers saying the CAE should simply adopt management's risk register or let management choose engagements.
5. The board approves; the CAE develops.
  • The CAE develops the risk-based plan.
  • Senior management reviews it.
  • The board approves it.
6. Change is a red flag for risk.
  • Scenarios involving new systems, acquisitions, rapid growth, new regulations or leadership turnover usually point to higher risk.
  • These should lead to a higher priority or an update to the universe or plan.
7. Updating frequency.
  • The universe and risk assessment should be reviewed at least annually.
  • They should also be updated whenever significant changes occur.
  • Answers suggesting the plan is fixed for multiple years without review are typically incorrect.
8. Mandatory engagements are non-negotiable inputs.
  • Engagements required by law, regulation or contract must appear in the plan regardless of internal risk scoring.
9. Leverage other assurance providers.
  • If a question mentions coverage by external auditors or the second line, the best answer often involves coordinating and possibly relying on their work.
  • Reliance requires first evaluating their competence, objectivity and due professional care.
10. Advisory requests.
  • When management requests an advisory engagement, the CAE should consider its potential to add value and improve governance, risk management and control processes.
  • The CAE should also consider its effect on resources and independence.
  • Significant additions should be communicated to the board.
11. Resource limitations.
  • If resources cannot cover high-risk areas, the CAE should tell senior management and the board about the impact of the limitation.
  • Quietly reducing scope or ignoring the areas is not acceptable.
12. Eliminate extreme answers.
  • Answers using words like 'only', 'always audit every unit annually' or 'never consider management input' are often wrong.
  • Look for balanced, risk-based, objective-aligned answers.
13. Read the role carefully.
  • Identify whether the question is about the CAE, an internal auditor, management or the board.
  • Many wrong options assign a responsibility to the wrong party.
14. Pick the 'best' answer.
  • Several options may be partly correct.
  • Choose the one most aligned with the IIA Standards: risk-based, linked to strategy, independent, comprehensive and communicated to the board.

Quick Practice Scenarios
Scenario 1: A CAE is preparing next year's plan, and the organization recently outsourced its IT infrastructure. What should the CAE do?
Best answer: Include the outsourced IT services and the vendor management process in the audit universe and assess their risk. Outsourcing does not transfer accountability for risk.

Scenario 2: The CFO asks internal audit to drop a planned fraud risk review and replace it with a cost-saving advisory project. What should the CAE do?
Best answer: Evaluate both based on risk and value, use independent judgment, and communicate any significant changes to the plan to senior management and the board for approval.

Scenario 3: Which is the MOST appropriate basis for selecting engagements?
Best answer: A documented risk assessment of the audit universe, aligned with organizational objectives and updated at least annually.

Key Takeaways
  • The audit universe is the complete inventory of auditable units. It is the foundation of risk-based planning.
  • Sources of potential engagements include strategy, ERM, the board, management, regulations, prior audits, organizational change, emerging risks, fraud reports, other assurance providers, analytics and auditor knowledge.
  • The universe is risk-assessed, prioritized and turned into a plan approved by the board.
  • The universe must be complete, dynamic and reviewed at least annually.
  • On the exam, favor answers that are risk-based, independent, comprehensive, linked to objectives and communicated to the board.
Test mode:
Start practice test

CIA Challenge - Sources of Potential Engagements and the Audit Universe Example Questions

Test your knowledge of Sources of Potential Engagements and the Audit Universe

Question 1

An organization completed the sale of one of its business units last quarter. It no longer owns, operates or provides services to that unit. While updating the audit universe, how should the chief audit executive treat the entry for the sold unit?

Correct Answer: Remove the sold unit's entry and record the change in universe documentation.

The audit universe should reflect only the auditable entities the organization currently owns, operates or controls. Because the unit has been sold, its entry should be removed, and the change should be documented to keep the universe accurate and traceable.
Retaining it with a low risk rating misrepresents the universe, since the unit is not merely low risk; it is no longer in scope at all. Waiting for a cyclical audit is pointless because the organization has no authority or access to audit a divested unit. Merging it into corporate support functions distorts the scope and risk profile of those remaining functions.
Key concept: maintaining a current, documented audit universe that reflects organizational changes.

Question 2

Senior management has a staffing shortage. It asks the chief audit executive to assign an internal auditor to approve vendor master file changes for three months, until a new purchasing supervisor is hired. Senior management calls this a priority request for the current audit plan. How should the chief audit executive respond?

Correct Answer: Decline operating the control and offer an advisory engagement on designing interim approval procedures

Approving vendor master file changes is a management control function, so performing it would impair internal audit's objectivity. The chief audit executive should decline to operate the control and instead offer advisory services to help management design interim approval procedures.
Calling it an advisory engagement does not change the fact that auditors would be performing management's operational duties, and using auditors new to purchasing adds a competence problem. Disclosing the arrangement to the audit committee afterward does not cure the impairment. Audit committee approval cannot authorize internal audit to run controls, and a later assurance review would mean auditors reviewing their own work.
Key concept: preserving objectivity by not assuming management responsibilities or operating controls.

Question 3

A chief audit executive is designing a three-year internal audit plan. A regulator requires the treasury function to be audited every two years. The board also wants each lower-risk unit reviewed at least once every five years. Which plan design best builds these audit cycle requirements into the risk-based internal audit plan?

Correct Answer: Schedule the mandated and board-set rotations as fixed engagements, then allocate remaining capacity by assessed risk

Regulatory mandates and board-required rotation cycles are fixed constraints, so the CAE should schedule them first and then allocate remaining audit resources based on assessed risk. This keeps the plan compliant while still risk-based.
Ranking units by risk score alone ignores the regulator's two-year treasury requirement. A uniform two-year rotation over-audits lower-risk units and wastes capacity the board did not require. Treating the cycles as advisory targets that can be deferred risks regulatory noncompliance and overrides board direction.
Key concept: incorporating mandatory and stakeholder-required audit cycles into risk-based internal audit planning.

More Sources of Potential Engagements and the Audit Universe questions
74 questions (total)
Start 74 question test

Other Internal Audit Operations and Audit Plan concepts

Aligning Internal Audit Strategy with Stakeholder ExpectationsCAE Relationships and Communication with Senior Management and the BoardCoordinating with and Relying on Other Assurance ProvidersDeveloping a Risk-Based Audit PlanManaging Financial, Human and IT ResourcesPlanning, Organizing, Directing and Monitoring Internal Audit Operations
All Internal Audit Operations and Audit Plan questions · CIA Challenge practice test