CIA - Part 1 Flashcards
CH 1.1: Internal Audit Charter
- Defines the IA Activity’s purpose, authority, responsibility.
- Must be adopted and it should contain a grant of sufficient authority.
- Final approval resides with the Board.
CH 1.1: Assurance Service
- Involves IA’s objective assessment of evidence to provide opinions of conclusion regarding an entity, operation, function process, system or, other subject matters.
- Objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization.
CH 1.1: Consulting Service
- Are advisory in nature and are generally performed at a specific request of an engagement client.
- Activities intended to add value and improve an org’s governance, risk management, & control processes without the internal auditor assuming managements responsibility.
- Providing counsel, advice, facilitation, and training.
CH 1.1: International Professional Framework (IPPF)
Defines the mission of IA as follows:
- To enhance and protect the organizational value by providing risk-basked and objective assurance, advice, and insight.
- Facilitating the achievement of the mission in the IPPF.
- Contains mandatory & recommended guidance.
CH 1.1: Recommended Guidance
Describe practices for effective implementation of core principles, the definition of internal auditing, the code of ethics , and the standards.
- 2 recommended elements (1) Implementation and (2) Supplemental.
CH 1.1: Attribute Standards
Number in 1000s, governs the responsibilities, attitudes, and actions of the organization’s internal audit activity and the people who serve as internal auditors.
CH 1.1: Performance standards
Number of 2000s govern the nature of the internal auditing and provide quality criteria for evaluation the internal audit function performance.
CH 1.1: Standards
A) Guide Adherence
B) Provide a framework for performing and promoting a broad range of value added internal auditing services
C) Establish the basis for evaluation of internal audit performance
D) Foster improved organizational processes and operations
CH 1.1: Definition of Internal Auditing
Is an independent objective assurance and consulting activity designed to add value and improve an organizations operations.
It helps an organization accomplish its objectives by bringing a systematic, disciplined, approach to evaluate and improve the effectiveness of risk management, control, ad governance processes.
CH 1.1: Mandatory Guidance
Adherence to the mandatory guidance is essential for the professional practice of internal auditing.
Consist of 4 elements (1) Core Principles, (2) Definition of Internal Auditing, (3) Code of Ethics, and the (4) Standards
CH 1.2: Code of Ethics
Reasons for Codes of Ethical Conduct: The primary purpose of a code of ethical conduct for a professional organization is to promote an ethical culture among professionals who serve others.
Additional functions of a code of ethical conduct for a professional organization include
Communicating acceptable values to all members,
Establishing objective standards against which individuals can measure their own performance, and
Communicating the organization’s values to outsiders
CH 1.2: Code of Ethics Components
(1) Integrity - A refusal to compromise professional values for personal gain. Another facet of integrity is performance of professional duties in accordance with relevant laws.
(2) Objectivity - A commitment to providing stakeholders with unbiased information. Another facet of objectivity is a commitment to independence from conflicts of economic or professional interest.
(3) Confidentiality - A refusal to use organizational information for private gain.
(4) Competency - A commitment to acquiring and maintaining an appropriate level of knowledge and skill.
CH 1.8: Board
- Is the highest-level governing body (e.g., a board of directors, a supervisory board, or a board of governors or trustees) charged with the responsibility to direct and/or oversee the organization’s activities and hold senior management accountable.
- Although governance arrangements vary among jurisdictions and sectors, typically the board includes members who are not part of management.
- If a board does not exist, the word “board” in the Standards refers to a group or person charged with governance of the organization.
- Furthermore, “board” in the Standards may refer to a committee or another body to which the governing body has delegated certain functions (e.g., an audit committee).
Chapter 1: Internal Auditing is..
Independent, objective, assurance/consulting, designed to add value, improve an org’s operations, help and org accomplish objectives, evaluate and improve effectiveness of governance, risk management, and control processes.
Chapter 1: Generally, Internal Auditors…
- Review, Assess, and Provide Assurance
- They DO NOT: Design, Secure, Implement, Management, or Take responsibility for controls
Chapter 1: IA Charter
The IA charter does NOT specify the resources needed or available for the IA Activity.
The Charter is: Prepared = CAE Approved = Management Accepted = Board Communicated = Engagement Client
CH 2.1: Dual Reporting
Separates functional reporting and administrative reporting.
Organizational independence is effectively achieved when the CAE reports functionally to the BOARD and administratively to SR. MGMT (aka CAE).
CH. 2.1: Independence
An Org attribute of the internal audit activity as a whole.
CH 2.2: Objectivity
An unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their product and that no quality compromises are made.
IA must have an impartial, unbiased attitude and avoid any conflict of interest.
CH 2.1: Independence vs. Objectivity
IA Activity MUST be independent and internal auditors MUST be objective in performing work.
CH 2.3: Scope Limitation
A restriction placed on the IA Activity that precludes the activity from accomplishing its objectives and plan.
CH 2.4: Proficiency
- Internal Auditor must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities.
- The IA Activity collectively must possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities.
- Includes knowledge sufficient to evaluate fraud risk and IT risks and controls.
CH 2.6: Due Professional Care
IA must apply the care and skills expected of a reasonably prudent and competent internal auditor. Does not imply infallibility (it is never wrong/fails).
- Conformance with code of ethics and org’s code
- Proper application of IPPF
CH 2.7: Deming Cycle
4 Steps
(1) Plan - establish standards and expectations for operating a process to meet goals
(2) Do - Executes the process and collects data for further analyses
(3) Check - Compares actuals to expectations
(4) Act - Provides feedback by identifying and implementing improvements to the process
CH 2.8: Quality Assurance Improvement Program (QAIP)
- Designed to enable an evaluation of the Internal Auditing Activity’s conformance with the Standards and the evaluation of whether internal auditors apply the Code of Ethics.
- The program also assesses the efficiency and effectiveness of the internal audit activity and identifies opportunities for improvement.
- CAE should encourage board oversight.
- Ongoing measurement and analysis of performance metrics
CH 2.8: QAIP Components
5 Components
- Internal Assessment
- External Assessment
- Communication of QAIP Results
- Proper use of a conformance Statement
- Disclosure of non conformance
CH 2.8: Internal Assessment
- Ongoing monitoring of the performance of IA Activity
- Periodic self assessment/assessments by others within the organization
- Provides an effective structure for the IA Activity to continuously assess its conformance with the Standards and whether IA apply the Code of Ethics.
Ch 2.8: External Assessment
- Must be conducted once every 5 years
- Provide independent/objective evaluation of the IA Activity’s conformance with the Standards and Code of Ethics
(A) Full External Assessment - level of conformance/ efficiency and effectiveness, and meet expectations
(B) Self Assessment (SAIV) - with independent external validation - self assessment/onsite validation/limited attention to other areas
Chapter 2: Independence Achieved
Largely through the organization placement of the IA Activity, including the CAE’s reporting lines, as well as the direct interaction of the CAE with the board and sr. management through dual reporting.
Chapter 2: Manage IA Objectivity
To manage IA objectivity effectively, many CAEs have a internal audit policy manual or handbook that describes expectations and requirements.
Chapter 2: IA Gift Accepting
Whenever IA is offered a gift (other than minor value promotional items), the required course of action is to report the issue to the CAE or audit management.
Chapter 2: IA Audit Areas - NO
An IA must NOT be involved in auditing areas where he/she was responsible for previous year or if the auditor has been promoted (i.e., will be transferred to the operating department under audit). If involved, adequate reporting and disclosure MUST be made.
CH 3.1: Governance
The combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives.
Corporate governance can be influences by internal or external mechanisms.
CH 3.1: Internal/External Mechanisms
Internal - Corporate charters, by laws, board of directors, and internal audit function.
External - Laws, regulations, and the government regulators who enforce them.
CH 3.1: Board
As the highest level governing body (i.e., a board of directors, a supervisory board, or a board of governors of trustees) charged with the responsibility to direct and/or oversee the organization’s activities and hold sr. management accountable.
A group or person charged with governance of the organization.
CH 3.1: Board Duties
The board has the following duties:
- Selection and removal of officers
- Decisions about capital structure (mix of debt and equity, consideration to be received for shares, etc.)
- Adding, amending, or repealing bylaws (unless this authority is reserved to the shareholders)
Initiation of fundamental changes (mergers, acquisitions, etc.)
- Decisions to declare and distribute dividends
- Setting of management compensation (sometimes performed by a subcommittee called the compensation committee)
- Coordinating audit activities (most often performed by a subcommittee called the audit committee)
- Evaluating and managing risk (sometimes performed by a subcommittee called the risk committee)
CH 3.1: Stakeholders
Persons or entities who are affected by the activities of the entity. Among others, these include shareholders, employees, suppliers, customers, neighbors of the entity’s facilities, and government regulators.
CH 3.1: Governance Principles
Governance does not exist independently of risk management and control. Rather, governance, risk management, and control (collectively referred to as GRC) are interrelated.
(1) Effective governance considers risk when setting strategy, and risk management relies on effective governance (e.g., tone at the top, risk appetite and tolerance, risk culture, and the oversight of risk management).
(2) Effective governance relies on controls to manage risks and on communication of their effectiveness to the board.
CH 3.1: Governance Process & Roles
Governance has two major components: strategic direction and oversight.
1) Strategic direction determines
a. The business model,
b. Overall objectives,
c. The approach to risk taking (including the risk appetite), and
d. The limits of organizational conduct.
2) Oversight is the governance component with which internal auditing is most concerned. It is also the component to which risk management and control activities are most likely to be applied. The elements of oversight are
Risk management activities performed by senior
a. management and risk owners and
b. Internal and external assurance activities.
CH 3.1: Risk Committee
May be created that (1) Identifies key risks, (2) Connects them to risk management processes, (3) Delegates them to risk owners, and (4) Considers whether tolerance levels delegated to risk owners are consistent with the organization’s risk appetite.
CH 3.1: Management
Performs day-to-day governance functions. Senior management carries out board directives (within specified tolerances for unacceptable outcomes) to achieve objectives.
CH 3.1: Risk Owners
Are responsible for:
- Evaluating the adequacy of the design of risk management activities and the organization’s ability to carry them out as designed;
- Determining whether risk management activities are operating as designed;
- Establishing monitoring activities; and
- Ensuring that information to be reported to senior management and the board is accurate, timely, and available.
CH 3.1: Culture
Consists of the attitudes, behaviors, and understanding about risk, both positive and negative, that influence the decisions of management and personnel and reflect the mission, vision, and core values of the organization.
CH 3.2: Effective Governance
The design and practice of effective governance vary with:
- Size, complexity, and life cycle maturity
- Its Stakeholders structure
- Legal and Cultural Requirements
CH 3.2: IA Governance Responsibility
The internal audit activity’s ultimate responsibility is to evaluate and improve governance
CH 3.3: CSR
CSR refers to (a) social responsibility, (b) sustainable development, and (c) corporate citizenship.
CH 3.3: CSR Strategies
(1) Reaction - The organization denies responsibility and tries to maintain the status quo.
(2) Defense - The organization uses legal action or public relations efforts to avoid additional responsibilities.
(3) Accommodation - The organization assumes additional responsibilities only when pressured.
(4) Proaction - The organization takes the initiative in implementing a CSR program that serves as an example for the industry.
CH 4.1: Risk & Risk Management
Risk - is the possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood (The IIA Glossary).
Risk management - is a process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives (The IIA Glossary)
