Selecting the Information-Gathering Method for an Objective (CIA Part 2)
Overview
In CIA Part 2 (Practice of Internal Auditing), the domain Information Gathering, Analysis and Evaluation tests whether you can choose the right way to collect information for a specific engagement objective. The IIA Global Internal Audit Standards (formerly Standard 2310, now under Domain V, Standard 14.1 Gathering Information for Analyses and Evaluation) require internal auditors to identify information that is relevant, reliable, sufficient, and useful to achieve the engagement objectives. Choosing the method is therefore a judgment call: which technique best produces that quality of evidence at a reasonable cost?
Why It Is Important
1. Evidence quality drives conclusions. Findings and opinions are only as strong as the evidence behind them. The wrong method (for example, an interview when you need proof that a control operated) leaves conclusions unsupported.
2. Efficiency. Some methods, such as confirmations and re-performance, are costly. Matching the method to the objective avoids over-auditing low-risk areas and under-auditing high-risk ones.
3. Professional standards. Auditors must exercise due professional care, which includes considering the extent of work and the relative complexity, materiality, and significance of matters.
4. Exam weight. This is a frequently tested application skill. Questions give a scenario and objective, then ask for the best, most persuasive, or most appropriate procedure.
What It Is
It is the process of linking an engagement objective (what you want to know) to an information-gathering technique (how you will find out). The main techniques are:
1. Inquiry and interviews: asking management or staff questions, orally or in writing. Useful for understanding processes, identifying risks, and gathering leads. It is the weakest evidence on its own and must be corroborated.
2. Questionnaires and surveys: structured questions sent to many people. Efficient for broad coverage, such as control self-assessment, culture, or customer satisfaction. Responses are subjective, and design matters: avoid leading or ambiguous questions.
3. Observation: watching a process or activity as it happens, such as an inventory count or cash handling. Good for testing whether a control is performed. It is limited to the moment observed, and people may behave differently when watched (the Hawthorne effect).
4. Inspection or examination of documents (vouching and tracing):
- Vouching: from the recorded entry back to the source documents. It tests existence/occurrence and detects overstatement.
- Tracing: from the source documents forward to the records. It tests completeness and detects understatement.
5. Physical examination: inspecting tangible assets. It is strong evidence of existence but not of ownership or valuation.
6. Confirmation: written verification from an independent third party, such as banks, customers, or vendors. It is highly reliable for existence and balances.
- Positive confirmations: the recipient always replies. They are more reliable.
- Negative confirmations: the recipient replies only if they disagree. Use them for many small, low-risk balances.
7. Recalculation and re-performance: the auditor independently redoes a calculation or control, such as depreciation or a bank reconciliation. It is very persuasive for accuracy and control operation.
8. Analytical procedures: comparing data with expectations through ratios, trends, regressions, and benchmarks. Useful in planning to identify risk areas, as substantive tests of reasonableness, and in overall review. They highlight anomalies but do not prove them.
9. Data analytics and CAATs: generalized audit software, data mining, and testing of whole populations. Ideal for large volumes, duplicate payments, gaps in sequences, and fraud indicators.
10. Process mapping and flowcharting: documenting process flow to understand it and to identify control gaps, segregation-of-duties issues, and bottlenecks.
11. Benchmarking: comparing performance or practices with peers or best practice. Typical for operational, efficiency, and effectiveness objectives.
12. Sampling: statistical or non-statistical selection when testing the whole population is impractical. Use attribute sampling for control deviation rates, and variables or monetary-unit sampling for amounts.
How It Works: A Step-by-Step Approach
Step 1: Clarify the objective. Is it about compliance, the operating effectiveness of a control, the accuracy of balances, existence of assets, completeness of records, efficiency, or fraud detection?
Step 2: Identify the assertion or attribute being tested.
- Existence/occurrence: vouch, physically examine, confirm.
- Completeness: trace from source documents, check numerical sequences, perform analytics.
- Accuracy/valuation: recalculate, compare with market or independent prices.
- Rights/ownership: inspect titles, contracts, and invoices.
- Control design: inquiry, walkthroughs, flowcharts.
- Control operation: observation, re-performance, inspection of evidence of performance.
- Efficiency/effectiveness: benchmarking, analytics, process mapping.
- Opinions and perceptions: surveys and interviews.
Step 3: Consider the reliability hierarchy.
- External evidence is better than internal evidence.
- Evidence the auditor obtains directly (observation, re-performance, physical examination) is better than indirect evidence.
- Documentary evidence is better than oral evidence.
- Original documents are better than copies.
- Evidence from systems with strong internal controls is better than evidence from weak control environments.
- Corroborated evidence is better than a single source.
Step 4: Weigh cost, timing, and practicality. Consider the volume of data, the availability of systems access, the time available, and the risk level. High risk justifies more persuasive, more costly methods.
Step 5: Combine methods where needed. A walkthrough typically combines inquiry, observation, and inspection. Inquiry alone is never sufficient to conclude that a control operates effectively.
Step 6: Document the method, the source, and the results in the workpapers.
Common Pairings Seen on the Exam
- Determine whether recorded sales actually occurred: vouch from sales journal entries to shipping documents.
- Determine whether all shipments were billed: trace from shipping documents to sales invoices.
- Verify that inventory exists: observe the physical count or physically examine items.
- Verify receivables: send positive confirmations to customers.
- Determine whether a control was performed throughout the year: inspect evidence of performance (signatures, logs) across a sample, or re-perform.
- Assess whether employees understand the ethics policy: surveys or interviews.
- Identify duplicate payments across millions of transactions: data analytics or CAATs.
- Identify unusual fluctuations during planning: analytical procedures.
- Understand a new process: interviews, walkthroughs, and flowcharting.
- Evaluate the efficiency of a department: benchmarking and analytical review.
- Verify cash on hand: surprise count (observation and physical examination).
- Confirm a bank balance: bank confirmation sent and received directly by the auditor.
Exam Tips: Answering Questions on Selecting the Information-Gathering Method for an Objective
1. Read the objective first and underline the key verb. Words like exist, all, complete, accurate, authorized, efficient, and understand point directly to the method.
2. Apply direction logic. Records to source documents is vouching, which tests existence. Source documents to records is tracing, which tests completeness. This is one of the most heavily tested distinctions.
3. Eliminate inquiry-only answers when the question asks for the most persuasive evidence or evidence that a control operated. Inquiry is appropriate for understanding, not for proving.
4. Prefer external and auditor-generated evidence when asked for the most reliable option. Confirmation and re-performance usually beat internal documents and management statements.
5. Remember the limits of each method. Physical examination does not prove ownership or valuation. Observation applies only to the moment observed. Analytical procedures identify issues but do not resolve them.
6. Watch for population size clues. Large volumes, entire populations, or patterns usually call for data analytics or CAATs.
7. Distinguish design from operation. Design is tested through walkthroughs, inquiry, and flowcharts. Operating effectiveness is tested through inspection, observation, and re-performance over a period.
8. Match the sampling type to the objective. Use attribute sampling for rates of control deviations. Use variables or monetary-unit sampling for dollar misstatements. Use discovery sampling when even one occurrence matters, as with fraud.
9. Choose surveys for broad, perception-based objectives involving culture, satisfaction, or awareness. Choose interviews for in-depth, exploratory understanding.
10. Beware of answers that are true but irrelevant. A procedure may be valid audit work yet not address the stated objective. Always ask yourself whether the option answers this specific objective.
11. Consider independence of the source. If the person responsible for a process provides the evidence, it is less reliable than evidence from an independent party.
12. When two answers seem right, pick the one that is more direct, more objective, and closer to the assertion. For example, counting inventory beats reviewing the inventory report.
Quick Example
An internal auditor wants to determine whether all purchase orders issued were recorded in the purchases journal. Which procedure is best?
a) Select entries from the purchases journal and vouch them to purchase orders.
b) Select purchase orders and trace them to the purchases journal.
c) Interview the purchasing manager.
d) Perform a ratio analysis of purchases.
Answer: b. The key word is all, which signals completeness. Testing completeness requires starting from the source documents and tracing forward to the records. Option a tests existence, c is weak oral evidence, and d only signals anomalies.
Key Takeaway
Start with the objective, identify the assertion or attribute it targets, then pick the method that gives the most relevant and reliable evidence at a reasonable cost. Combine methods where one alone is insufficient. On the exam, the best answer directly addresses the stated objective with the most persuasive evidence available.
