Capital and Investments in Engagement Planning (CIA Part 2)
Capital and Investments in Engagement Planning: A Complete Guide for CIA Part 2
This guide covers why capital and investment activities matter to internal auditors, what the topic includes, how planning works in practice, and how to answer exam questions on it.
1. Why It Is Important
Capital expenditures (CapEx) and investments are among the largest, longest-lasting and least reversible commitments an organization makes. Typical examples include:
• A new manufacturing plant
• An ERP system implementation
• An acquisition
• A portfolio of marketable securities
Such decisions can commit resources for decades. Poor decisions or weak controls can destroy shareholder value, distort financial statements and expose the organization to fraud.
For internal auditors, these areas matter for several reasons:
• Materiality: Capital projects and investment balances are often material to the balance sheet and to future cash flows.
• Strategic alignment: Capital allocation is how strategy becomes action. Auditors provide assurance that spending supports organizational objectives.
• Fraud and misuse risk: Large contracts, construction projects and vendor relationships create opportunities for kickbacks, inflated invoices, change-order abuse and bid rigging.
• Accounting complexity: Several judgments are open to manipulation, for example to inflate profits:
- Capitalizing versus expensing costs
- Classifying investments as held-to-maturity, available-for-sale or trading (or at amortized cost or fair value)
- Impairment testing
• Governance expectations: Boards and audit committees expect assurance that capital budgeting processes are disciplined, transparent and properly authorized.
The IIA Global Internal Audit Standards (and the earlier IPPF Standards 2200 series on engagement planning) require auditors to consider the activity's objectives, significant risks, the adequacy of governance and controls, and opportunities for improvement. Capital and investment activities are a common area where these planning requirements are tested in CIA Part 2.
2. What It Is
In CIA Part 2, under Engagement Planning, this topic means planning audit engagements over the organization's capital and investment cycle. The main components are:
a) Capital budgeting and expenditure process
• Identifying and proposing capital projects
• Financial evaluation of proposals
• Authorization and approval hierarchy (for example, board approval above set thresholds)
• Project execution, procurement and contract management
• Monitoring of budget versus actual, change orders and cost overruns
• Project close-out and capitalization into fixed assets
• Post-completion audits (post-implementation reviews) that compare actual results with projected benefits
Common evaluation techniques include:
• Net present value (NPV)
• Internal rate of return (IRR)
• Payback period
• Discounted payback
• Accounting rate of return (ARR)
• Profitability index
b) Fixed asset management
• Asset register accuracy, tagging and physical verification
• Depreciation methods and useful lives
• Impairment reviews
• Disposals, retirements and transfers
• Safeguarding and insurance
c) Investment and treasury activities
• Investment policy and authorized instruments
• Classification and valuation of securities
• Custody and safekeeping
• Segregation of duties between front office (trading), middle office (risk) and back office (settlement and accounting)
• Limits, hedging and derivatives
• Reconciliations with custodians and brokers
d) Mergers, acquisitions and strategic investments
• Due diligence
• Valuation assumptions
• Post-acquisition integration
• Goodwill impairment
3. How It Works: Planning the Engagement
Planning follows the standard engagement planning steps, tailored to capital and investment risks.
Step 1: Understand the activity under review
• Review the capital budgeting policy, approval thresholds, investment policy and treasury charter.
• Read board and committee minutes, strategic plans and prior audit reports.
• Interview the CFO, treasurer, project managers and the asset accounting team.
• Use flowcharts or narratives to document the process from project proposal to capitalization.
Step 2: Establish engagement objectives
Example objectives:
• Determine whether capital projects are approved according to policy and aligned with strategy.
• Assess whether financial evaluations use reasonable assumptions and appropriate discount rates.
• Evaluate whether project costs are properly controlled, recorded and capitalized.
• Determine whether investments comply with the approved investment policy and are properly valued and safeguarded.
Step 3: Perform the risk assessment
Key risks to consider:
• Projects not aligned with strategy, or approved without proper authority
• Overly optimistic cash-flow forecasts, or inappropriate discount rates (for example, ignoring project-specific risk)
• Splitting a project into smaller requests to avoid higher approval levels
• Cost overruns, unauthorized change orders and contractor fraud
• Incorrect capitalization of operating expenses, or failure to record impairment
• Ghost assets in the register, or unrecorded disposals
• Unauthorized trading, excessive risk-taking or breaches of investment limits
• Inadequate segregation of duties in treasury
• Misclassification or mispricing of securities
Step 4: Determine scope
• Decide which projects to include, for example all projects above a threshold or a risk-based sample.
• Set the time period, locations and systems (fixed asset subledger, treasury management system).
• Decide whether to cover ongoing projects (real-time or concurrent auditing) or only completed ones.
• Note any reliance on external experts, such as valuation specialists or construction cost consultants.
Step 5: Identify and evaluate controls
Key controls include:
• Formal capital request forms with business case and financial analysis
• Tiered approval matrix
• Competitive bidding
• Project budget monitoring
• Change-order approval
• Independent review of capitalization entries
• Periodic physical counts of assets
• Investment limits
• Independent price verification
• Custodian reconciliations
• Dual authorization for fund transfers
Step 6: Allocate resources and develop the work program
• Assign staff with the right skills: financial analysis, construction auditing, treasury or derivatives knowledge, IT.
• Consider using CAATs and data analytics, for example to find duplicate vendor payments or invoices just below approval limits.
• Write the work program, which sets out the procedures for each objective.
Typical audit procedures:
• Recompute NPV or IRR, and test whether key assumptions are reasonable.
• Trace approved projects to board minutes.
• Vouch capitalized costs to invoices and contracts.
• Physically inspect assets.
• Confirm investment holdings directly with custodians.
• Compare actual project results to the original proposal (post-completion review).
• Test change orders for proper authorization.
Key financial concepts auditors should know
• NPV: Present value of future cash inflows minus the initial investment. Accept the project if NPV is greater than zero. NPV is generally the preferred method because it accounts for the time value of money and measures absolute value creation.
• IRR: The discount rate at which NPV equals zero. Accept the project if IRR exceeds the cost of capital (hurdle rate). Weaknesses: multiple IRRs can occur with non-conventional cash flows, and IRR can conflict with NPV when ranking mutually exclusive projects.
• Payback period: Time to recover the initial investment. It is simple and gives a sense of liquidity risk, but it ignores the time value of money (unless discounted) and ignores cash flows after the payback point.
• ARR: Based on accounting profit rather than cash flow, and ignores the time value of money.
• Profitability index: PV of inflows divided by the initial investment. Useful for capital rationing.
• Relevant cash flows: Include incremental cash flows, opportunity costs, changes in working capital and tax effects of depreciation (the depreciation tax shield). Exclude sunk costs and financing costs, because financing is captured in the discount rate.
• Weighted average cost of capital (WACC): The typical hurdle rate. It should be adjusted upward for projects riskier than the firm's average.
4. How to Answer Exam Questions
CIA Part 2 questions on this topic are usually scenario-based. They ask you to identify one of the following:
• The most appropriate engagement objective
• The most significant risk
• The best audit procedure for a given objective
• The most effective control
• The correct interpretation of a capital budgeting method
Approach:
1. Identify what stage of planning is being tested. Is the question about objectives, scope, risk assessment, resource allocation or the work program? Planning questions typically want a planning-level answer. Do not pick a fieldwork action when the question asks what to do first.
2. Identify the risk being described. For example: authorization, valuation, existence, completeness, fraud or strategic misalignment.
3. Match the procedure to the assertion.
• Existence: physically inspect, or trace from register to asset.
• Completeness: trace from asset to register, or from invoices to the capital ledger.
• Authorization: compare to the approval matrix and minutes.
• Valuation: recompute, use independent pricing, review impairment.
• Investments held by third parties: confirm directly with the custodian.
4. Prefer stronger evidence. Evidence is stronger when it is external, obtained directly by the auditor, documented, and produced under good internal control.
5. For capital budgeting questions, remember that NPV is theoretically superior. Watch for distractors that include sunk costs or financing costs in cash flows.
Exam Tips: Answering Questions on Capital and Investments in Engagement Planning
• Tip 1: When asked for the FIRST step in planning a capital expenditure audit, choose gaining an understanding of the process, policies and objectives. Testing transactions comes later.
• Tip 2: The post-completion audit compares actual costs and benefits with original projections. Its purposes are to:
- Improve future forecasting
- Deter overly optimistic proposals
- Identify projects that should be terminated
It is a frequently tested control.
• Tip 3: Splitting large projects into smaller requests to avoid approval thresholds is a classic red flag. Data analytics that search for amounts just below limits is the best detective procedure.
• Tip 4: Sunk costs are never relevant. Opportunity costs are always relevant. Depreciation matters only for its tax effect.
• Tip 5: If NPV and IRR conflict for mutually exclusive projects, choose the project with the higher NPV.
• Tip 6: For investments, segregation of duties is the key control. The people who authorize trades, the people who hold custody, and the people who record and reconcile must be separate.
• Tip 7: The best evidence that investments held by a custodian exist is direct written confirmation from the custodian, not client-prepared statements.
• Tip 8: For existence of fixed assets, sample from the register and physically inspect. For completeness, start from the physical asset or source documents and trace to the register. Direction matters.
• Tip 9: Consider the auditor's role and independence. Auditors may review and advise on capital project controls during design, but must not make management decisions such as approving projects.
• Tip 10: Watch for "most," "best" and "primary" in questions. Several answers may be true, so pick the one that most directly addresses the stated objective or risk.
• Tip 11: Raise the discount rate for higher-risk projects. Using a single company-wide WACC for every project can lead to accepting risky projects that destroy value. This is a commonly tested planning risk.
• Tip 12: Remember the resource element of planning. Complex derivatives, construction or valuation audits may require specialists. The CAE should obtain competent advice and assistance if the internal audit staff lacks the skills.
Summary
Capital and investment engagements require auditors to:
• Understand strategic intent and governance
• Assess risks around authorization, evaluation, execution, accounting and safeguarding
• Design a risk-based scope and work program, supported by appropriate expertise
In the exam, focus on:
• The sequence of planning activities
• Matching procedures to assertions and risks
• Recognizing fraud red flags
• Applying sound capital budgeting principles: NPV preference, relevant cash flows and risk-adjusted discount rates
