Part 2 covers managing the internal audit activity, planning and performing engagements, communicating results, and monitoring progress and risk acceptance. The most useful preparation approach is decision-based: for each topic, learn the named concepts (charter, risk-based plan, engagement objectives, sufficient and reliable evidence, the elements of a finding, report attributes, escalation of accepted risk), contrast the look-alike options, and practice narrating your choice in short scenarios. Finish with a finding-reconstruction exercise and a readiness rubric rather than raw practice-question counts.
Managing the Activity: Why the Charter and Risk-Based Plan Come First
Managing the internal audit activity means the chief audit executive maintains a charter, an approved risk-based plan, appropriate resources, and a quality program. Part 2 scenarios ask which management action conforms.
The charter is the mandate: it defines internal audit's purpose, authority, and responsibility and secures board approval, which is what protects independence. From that foundation, the chief audit executive builds an audit universe, assesses risk across it, and proposes an annual plan for board approval. The plan is not frozen; it is revisited as risks shift, and resource limitations are communicated to the board rather than absorbed silently.
Worked scenario A: a chief audit executive's approved plan lists the payroll function as a high-priority engagement because payroll systems were just replaced and control changes are untested. The operations director argues payroll should be audited first because it has not been reviewed in four years, and offers to fund a consultant instead. The weak choice is reordering the plan by elapsed time since the last audit; the stronger choice is to compare inherent risk, recent control changes, and potential impact against other plan items, document the rationale, and discuss any scope or resource trade-offs with the board. Scheduling by age alone discards the risk assessment the Standards require.
| Planning decision | Weak rationale | Stronger rationale |
|---|---|---|
| Choose next engagement | Area has not been audited for years | Risk assessment ranks exposure, control changes, and impact |
| Handle an unplanned request | Senior manager insists, so insert it | Assess risk, then revise and communicate the plan through board channels |
| Facing a resource shortfall | Quietly stretch fewer staff over the same plan | Reassess coverage and report implications to the board for approval |
| Conformance question raised | Treat it as a workflow preference | Trace the action to the charter and the Standards, then correct or document |
Engagement Planning: Setting Objectives Before Writing Procedures
Engagement planning means defining objectives, scope, timing, and resources, using a preliminary survey to identify risks and controls. The work program flows from that assessment, not from a generic checklist.
Keep the vocabulary distinct: the engagement objective states what the audit is to determine (for example, whether disbursement controls reasonably ensure payments are authorized and accurate); engagement procedures are the specific steps taken to get there (reconciling a sample of payments to approvals). Scope draws the boundaries of what is covered, and identified criteria, the policies or regulations the condition is judged against, are settled early so fieldwork has a benchmark.
Application to watch for: if planning or early fieldwork suggests fraud indicators, the appropriate response is to expand procedures or escalate, not to finish the original checklist. Practice distinguishing the defensible reaction to a suspected red flag from the tempting one, which is to stay narrowly inside the assigned scope. The boundary between objective, scope, and procedure is also a common source of look-alike options in scenario practice: two answers can sound equivalent until you ask which one answers the stated objective within the stated scope.
- Draft one sentence for an engagement objective in your own workplace area, then list three procedures that would support it.
- Write down the scope boundary: which locations, systems, and periods are in and out.
- Name the criteria document each procedure would test conditions against.
Fieldwork Evidence: Sufficiency, Reliability, Relevance in Tension
Information gathering is judged by whether evidence is sufficient, reliable, relevant, and useful. Interviews, sampling, analytics, and observation are only as good as the corroboration behind them.
These properties answer different questions. Sufficiency asks whether there is enough evidence to support the conclusion; reliability asks whether the source and method can be trusted (evidence obtained directly by the auditor, or from a controlled external source, is more reliable than hearsay); relevance asks whether it actually relates to the objective; usefulness asks whether it helps the organization in the long run. Oral statements can lead to evidence but rarely end an audit as evidence on their own.
Worked scenario B: during a warehouse review, a supervisor tells the auditor that cycle counts are performed weekly and reconciled. The tempting move is to write the control as operating effectively on that statement alone. The better decision is to corroborate: examine count records and reconciliation logs, observe a count, and reconcile a sample of variances to follow-up. Why it matters: a verbal confirmation tests the process as described, while corroborating records test it as operated, and the finding would change materially if the logs show gaps the supervisor did not mention.
Findings and Workpapers: Building Criteria, Condition, Cause, and Effect
Working papers must let an experienced reviewer reperform the work and reach the same conclusion. Findings compare the condition to criteria and explain cause and effect; conclusions answer the objective.
Documentation is not filing; it is the reasoning trail. Each working paper should state its purpose, source, and what was done, and support the conclusion drawn from it. Distinguish an observation (a fact noticed) from a conclusion (a judgment on whether the objective was met). If a working paper contains reconciliations, the conclusion should state what the reconciliations showed, with unexplained differences flagged and resolved or escalated rather than left blank.
Compare two phrasings of the same problem. Weak: 'approval controls are weak.' Stronger: 'Condition: 12 of 40 sampled disbursements lacked documented second-level approval. Criteria: the finance policy requires it. Cause: the workflow system permits payment release before approval routing completes. Effect: unauthorized or erroneous payments could be processed undetected.' The strong version is checkable, quantified, and traceable, and it feeds directly into a conclusion about whether the disbursement objective was achieved. Rebuilding findings from raw notes is a practical drill because it forces every element to be checkable rather than impressionistic.
Communicating Results: Report Attributes and Handling Disagreement
Final communications should be accurate, objective, clear, concise, constructive, complete, and timely, include the engagement opinion and management responses, and reflect resolved disagreements about findings.
Each attribute disciplines a different failure mode: accuracy ties statements to evidence; objectivity separates observation from opinion; clarity and conciseness keep the message usable; constructiveness frames improvement; completeness ensures scope, limitations, and criteria are stated; timeliness means issues reach decision-makers while action is still possible. Distribution follows the charter and the chief audit executive's direction, and interim communications are used when urgent issues cannot wait for the final report.
Worked scenario C: a division head disputes an unfavorable rating and asks the auditor to drop the paragraph on system access controls so the report 'reads better.' The weak choice is quietly removing the content to preserve the relationship. The better decision is to resolve the disagreement through discussion and, if it persists, document the auditor's position and the management position in the report, and escalate per the agreed process. Why it matters: the report's value to the board depends on it presenting supported findings; softening content without a documented resolution converts a communication into a concealment.
After the Report: Monitoring Action and Testing Risk Acceptance
Follow-up verifies whether corrective action was taken and is effective. When management decides to accept the risk of an uncorrected finding, the auditor assesses the acceptance and escalates significant residual risk.
Monitoring and follow-up are related but distinct. Monitoring can include tracking corrective actions, checking whether recommendations were implemented as intended, and reassessing the risk that prompted the engagement. Follow-up confirms outcomes: did the control change happen, does it operate, and did the exposure actually shrink? The chief audit executive reports the status of such actions to the board so accountability stays visible.
Worked scenario D: a finding shows unreconciled suspense account balances. Management signs a memo accepting the risk and asks internal audit to close the finding. The tempting move is to close it because acceptance was documented. The better decision is first to judge whether the acceptance is within management's authority and whether the residual risk is significant; if it is significant and the auditor believes acceptance is inappropriate, escalate to senior management or the board, and record the acceptance and the escalation in the report and workpapers. Why it matters: documenting acceptance transfers accountability to management only when governance actually knows what was accepted.
A Preparation Sequence, an Exercise, and Readiness Checks
Study each domain as a decision sequence, then practice explaining your choice. Suggested rhythm: concepts first, scenario narration second, mixed practice third, with a rubric instead of raw scores.
One adaptable sequence: spend your first block on the managing-the-activity concepts (charter, plan, quality) and the planning vocabulary; a second block on fieldwork evidence and documentation, drilling the elements of a finding until you can build one from raw notes; a third on reporting attributes and escalation; a fourth on monitoring and risk acceptance, where the distinctions are subtlest. Then move to mixed practice and, for every wrong answer, write one sentence naming the concept you confused, not just the letter you missed.
Practical exercise with expected observations: take any engagement you have documented (or draft notes for a fictional review of expense reimbursements) and reconstruct the finding with quantified condition, cited criteria, plausible cause, and traced effect. For administrative details of the certification itself, refer to the IIA's official CIA page rather than secondhand summaries. Use this self-check rubric, treating the milestones as learning signals rather than pass predictions.
If your reconstruction scores weakly on cause and effect, reread the documentation material and try a second finding from a different function before moving on.
- Condition is specific and quantified, not a general adjective.
- Criteria are named documents, policies, or standards the condition is measured against.
- Cause explains why the gap exists, not a restatement of the condition.
- Effect traces the consequence to an objective, and the conclusion answers the engagement objective.
- Readiness checks: you can narrate each planning decision's rationale, rebuild a four-element finding unaided, and state the escalation step for an accepted risk you believe is inappropriate.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.