Internal Audit Operations and Audit Plan

Running the internal audit function: methodologies, resources, strategy, chief audit executive communication, the audit universe, the risk-based audit plan and coordination with other assurance providers.

5 minutes 5 Questions

In the Certified Internal Auditor (CIA) Challenge Exam, which offers a condensed route to the CIA designation for eligible professionals, Internal Audit Operations and the Audit Plan fall under managing the internal audit function. Internal Audit Operations covers how the Chief Audit Executive (CAE…

Concepts covered
Planning, Organizing, Directing and Monitoring Internal Audit OperationsCoordinating with and Relying on Other Assurance ProvidersCAE Relationships and Communication with Senior Management and the BoardAligning Internal Audit Strategy with Stakeholder ExpectationsManaging Financial, Human and IT ResourcesDeveloping a Risk-Based Audit PlanSources of Potential Engagements and the Audit Universe
Test mode:
Start practice test

CIA Challenge - Internal Audit Operations and Audit Plan Example Questions

Test your knowledge of Internal Audit Operations and Audit Plan

Question 1

Which of the following is the best criterion for judging whether an internal audit function's methodologies, such as its policy manual and procedures, are adequate?

Correct Answer: They give systematic guidance scaled to the function's size and complexity and support conformance with professional standards

Under the IIA Standards, the chief audit executive must establish methodologies that provide systematic guidance appropriate to the internal audit function's size, structure, and complexity, and that support conformance with the Global Internal Audit Standards.
Scaling guidance to management's preferences and departmental policies undermines independence and replaces professional standards with operational rules. A fixed template copied from a peer organization ignores the function's own risks and needs, and prevents tailoring to individual engagements. Senior management approval is not the benchmark, and scripting every procedure removes the professional judgment auditors must exercise.
Key concept: adequate methodologies are scalable, systematic, and aligned with professional standards.

Question 2

Midway through the year, the audit committee asks the chief audit executive how it will know whether advisory requests are displacing the assurance coverage in the approved risk-based internal audit plan. Which practice would best give the audit committee this visibility on an ongoing basis?

Correct Answer: Track actual assurance and advisory hours against the approved plan and report variances to the board periodically

Tracking actual assurance and advisory hours against the approved plan, and reporting variances periodically, shows the board on an ongoing basis whether advisory work is consuming resources intended for planned assurance coverage.
A fixed cap with automatic declines is a control, not a source of visibility, and it may reject valuable work without the board's input. Senior management approval undermines independence and reports decisions rather than the impact on coverage. Annual engagement counts come too late and ignore differences in effort and risk coverage.
Key concept: monitoring internal audit plan performance and reporting resource variances and coverage impacts to the board.

Question 3

During an outsourced assurance engagement, the external provider's engagement lead informs the chief audit executive that management has asked to remove a high-risk process from the agreed engagement scope so a reporting deadline can be met. The provider is willing to make the change. What should the chief audit executive do?

Correct Answer: Evaluate the scope change personally and document the approval decision and its rationale

When assurance work is outsourced, the chief audit executive keeps responsibility for the engagement. The CAE must therefore personally evaluate any change to the agreed scope, especially removing a high-risk process, and document whether it is approved and why.
Letting the provider's engagement lead decide improperly hands accountability to the service provider. Accepting management's request undermines internal audit independence, because management cannot limit scope to suit its own deadlines. Going straight to the board skips the CAE's own evaluation. The board needs to be told only if the CAE concludes the scope limitation is unacceptable or significant.
Key concept: the CAE remains accountable for outsourced engagements and must approve and document scope changes.

More Internal Audit Operations and Audit Plan questions
426 questions (total)
Practice 100 questions
One session at a time, always new questions