Risk-Based Audit Planning and Engagements

The audit universe and organizationwide risk assessment, prioritizing engagements into a risk-based internal audit plan, managing engagements, and forming an overall assessment across engagements and providers.

5 minutes 5 Questions

Risk-Based Audit Planning and Engagements is a core competency within the Certification in Risk Management Assurance (CRMA), offered by The Institute of Internal Auditors (IIA). It refers to the practice of aligning internal audit activities with the organization's most significant risks, ensuring …

Concepts covered
Aggregating Results Across EngagementsEvaluating Management's Risk RemediationPrioritizing Engagements by RiskThe Audit UniverseMarket and Industry Trends as Sources of RiskUsing Other Providers' Work in an Overall AssessmentEngagement Work ProgramsDeveloping Staff Through EngagementsQuality Assurance in EngagementsRegulatory Change as a Source of RiskEngagement SupervisionForming an Overall Assessment of Risk ManagementUsing Management's Risk Assessment in PlanningAudit Plan Approval and Resource CommunicationOrganizationwide Risk Assessment for Audit PlanningManaging Engagement Resources and TimelinesEngagement Objectives and Scope for Risk EngagementsDeveloping the Risk-Based Internal Audit PlanUpdating the Audit Plan for Changing RisksManagement Requests in the Audit Plan
Test mode:
Start practice test

CRMA - Risk-Based Audit Planning and Engagements Example Questions

Test your knowledge of Risk-Based Audit Planning and Engagements

Question 1

Which statement best describes how relevant market and industry trends should inform an organizationwide risk assessment used for internal audit planning?

Correct Answer: They signal external shifts that can change the likelihood and impact of risks to objectives, prompting reassessment of audit priorities.

Market and industry trends are external factors that can raise or lower the likelihood and impact of risks to organizational objectives. They should therefore trigger a reassessment of risk rankings and audit priorities in a dynamic, risk-based plan.
Trends do not replace historical audit results. Prior findings remain one input among many when ranking auditable entities. Trends also do not establish risk appetite, which is set by the board and senior management, not by internal audit. Nor do they indicate residual risk, because external trends say nothing about the effectiveness of management's own responses or controls.
Key concept: using external environmental factors as inputs to a risk-based internal audit plan.

Question 2

During annual planning, the chief audit executive has capacity for one more engagement. The organizationwide risk assessment shows the following. Treasury operations carry the highest inherent risk, but internal audit recently evaluated the second line's monitoring of treasury and found it reliable. A new third-party onboarding process supports a strategic growth objective, has high residual risk, and shows no assurance coverage on the risk assurance map. Payroll is due under a three-year rotation. The chief financial officer has requested a travel expense review. Which allocation is MOST appropriate?

Correct Answer: Audit third-party onboarding, since its high residual exposure to a strategic objective has no current assurance coverage

Third-party onboarding is the right choice because it supports a strategic objective, carries high residual risk, and has no assurance coverage on the assurance map, so an engagement there closes the largest assurance gap.
Treasury already has reliable second-line monitoring that internal audit has evaluated, so it can rely on that assurance rather than duplicate it. Payroll's rotation is a calendar-driven schedule, not a risk-based priority. The CFO's travel expense request reflects one stakeholder's preference rather than the organizationwide risk assessment.
Key concept: risk-based audit planning that uses assurance mapping to direct limited resources toward high residual risk with no coverage.

Question 3

During fieldwork on a procurement engagement, an internal auditor finds a significant risk of vendor collusion. The approved engagement work program does not address this risk. The auditor believes added procedures are needed to meet the engagement objectives. Which action is MOST appropriate?

Correct Answer: Propose an amended work program covering the new risk and obtain the supervisor's approval before testing

IIA Standards require engagement work programs to be documented and approved before implementation, and any adjustments must be approved promptly. Proposing an amended program for the collusion risk and getting supervisory approval before testing satisfies this requirement while still meeting the engagement objectives.
Completing the original program and deferring the risk to next year leaves a known significant risk unaddressed, so the engagement objectives are not met. Testing now and seeking approval at close bypasses the requirement for prior approval. Business unit management cannot approve work programs, because that would impair internal audit independence.
Key concept: approval of engagement work program changes by the internal audit supervisor before implementation.

More Risk-Based Audit Planning and Engagements questions
377 questions (total)
Practice 100 questions
One session at a time, always new questions