Engagement Planning

Planning an engagement: objectives and scope, evaluation criteria, key risks and controls, the engagement approach, the detailed risk assessment, the work program and the resources needed.

5 minutes 5 Questions

In the Certified Internal Auditor (CIA) Challenge Exam, Engagement Planning is a core topic within the practice of internal auditing. It covers how auditors prepare for individual assurance or advisory engagements so that the work is focused, efficient and aligned with organizational risks. Under t…

Concepts covered
Engagement Resources and SkillsDetailed Engagement Risk AssessmentEngagement Procedures and Work ProgramPlanning for Key Risks and ControlsEngagement Evaluation CriteriaEngagement Objectives and ScopeChoosing the Engagement Approach
Test mode:
Start practice test

CIA Challenge - Engagement Planning Example Questions

Test your knowledge of Engagement Planning

Question 1

Which of the following is an example of a scope limitation that an internal auditor would identify and document during engagement planning?

Correct Answer: Management restricting the internal auditor's access to records, personnel, or physical properties

A scope limitation is a restriction imposed on the engagement, such as management denying or restricting access to records, personnel, or physical properties. It prevents the internal auditor from achieving engagement objectives and must be documented and communicated to the board and senior management.
Narrowing coverage to higher-risk subprocesses is a deliberate, risk-based scoping decision by the auditor, not an imposed restriction. A process owner requesting an added objective expands the scope rather than limiting it, and it is handled as a planning consideration. Relying on another assurance provider's work is a coordination and reliance decision that remains within the auditor's control.
Key concept: distinguishing externally imposed scope limitations from auditor-determined engagement scope.

Question 2

Management is drafting a new incident response plan that has not yet been approved or put into operation. It asks the internal audit function to give input on the draft's escalation, communication, and recovery steps. The chief audit executive accepts the request, and an internal auditor begins planning. How should the internal auditor frame the engagement objectives?

Correct Answer: As an advisory engagement providing insight and recommendations on the draft plan

Management requested input on a draft plan that is not yet approved or in operation, so the engagement is advisory: objectives should focus on giving insight and recommendations on the escalation, communication, and recovery steps.
Testing operating effectiveness is not possible because the plan has not been put into operation. Drafting and approving the final plan would mean assuming management responsibility, which impairs objectivity. Concluding whether the draft meets recovery time objectives is an assurance opinion, but management asked for input, not assurance, on a plan still being developed.
Key concept: distinguishing advisory from assurance engagement objectives and preserving objectivity by not taking on management responsibilities.

Question 3

An internal auditor's engagement objective is to conclude on the operating effectiveness of vendor master file change controls for the full fiscal year, January through December. The draft engagement work program tests a sample of changes made from January through August, with fieldwork scheduled to end in September. While evaluating the work program's adequacy, what should the engagement supervisor require?

Correct Answer: Add rollforward steps that test a sample of changes from the remaining months and confirm the control was unchanged

The objective covers January through December, so the work program must include rollforward procedures that test changes from the untested months and confirm the control did not change. Only then is there sufficient evidence to support a full-year conclusion on operating effectiveness.
A written representation from the process owner is weak, non-independent evidence and cannot replace testing. A larger sample from January through August still says nothing about September through December, because statistical results apply only to the population sampled. Prior-year results speak to a different period, and unchanged design does not show that the control operated effectively this year.
Key concept: engagement work program adequacy, with test coverage aligned to the full period of the engagement objective (rollforward testing).

More Engagement Planning questions
1334 questions (total)
Practice 100 questions
One session at a time, always new questions