C.I.A.
Gleim · Global Internal Audit Standards 2024
0
day streak
Practice
Library
📋 Section A (SU1–4) = 35% · Section B (SU5) = 20% · Section C (SU6–8) = 30% · Section D (SU9–10) = 15%
On your phone, open this page in Safari or Chrome, then use Share → Add to Home Screen. It opens full screen, like the French app, and your ratings stay on the device.
📋 CIA Part 1 breakdown: Section A (SU1–4) = 35% · Section B (SU5) = 20% · Section C (SU6–8) = 30%
Tap a unit to expand its subunits. Tap any subunit to jump directly to its flashcards.
Tap a unit to expand its subunits. Tap any subunit to jump directly to its flashcards.
Your style: Real-world analogies + simple answer first, then technical depth.
Tap any subunit card to jump to its flashcards. Each card gives the plain-English answer, then the exact Standards language, then an analogy. Rate yourself after each flip — Progress tracks what needs more work.
Use Standards Map to see all Principles and Standards organized by domain. Use Cheat Sheet for fast review before an exam session.
Tap any subunit card to jump to its flashcards. Each card gives the plain-English answer, then the exact Standards language, then an analogy. Rate yourself after each flip — Progress tracks what needs more work.
Use Standards Map to see all Principles and Standards organized by domain. Use Cheat Sheet for fast review before an exam session.
SU 1.1 · Purpose
Loading…
Tap to reveal answer
Simple answer first
–
–
–
CIA Part 1 · Study Unit 1 Standards
SU 1.1 — Purpose of Internal Auditing
Principle 6 Authorized by the Board · Standard 6.1 Internal Audit Mandate
Principle 6 — Authorized by the Board
Board establishes, approves, and supports the IA mandate
6.1
Internal Audit Mandate — CAE must give board and senior management information to establish the mandate. If law prescribes it, charter must include legal requirements. CAE must also coordinate with other assurance providers and regularly assess whether mandate needs updating.
Mandate triggers a review when: notable change in Standards · significant acquisition or reorganization · change in board/senior management · change in strategies/objectives/risk profile · new law or regulation. CAE should formally consider changes at least annually.
SU 1.2 — Internal Audit Charter
Standard 6.2 Internal Audit Charter
Standard 6.2 — Internal Audit Charter
The four minimum elements + additional considerations
Four Minimum Charter Elements (Std 6.2):
1
Purpose of Internal Auditing
2
Adherence to the Global Internal Audit Standards
3
Internal audit mandate — scope, services, board's responsibilities and expectations about management support
4
Organizational position and reporting relationships
Additional topics per Gleim: Safeguards for objectivity/independence · Unrestricted access · Communication protocols (nature/timing with board and senior management) · Audit process expectations · Quality assurance expectations · Approvals
SU 1.3 — Impairment of Independence
Principle 7 Positioned Independently · Standard 7.1 Organizational Independence
Principle 7 — Positioned Independently
Board establishes and protects independence and qualifications
7.1
Organizational Independence — CAE must confirm independence to board at least annually. 12-month rule: if CAE has temporary nonaudit roles, an independent third party must oversee assurance in those areas during and for 12 months after.
7.2
CAE Qualifications — CAE must help board understand qualifications needed. Must maintain and enhance competencies required by the board.
Gleim exam tip: Impairment examples to know: CAE lacks direct board communication · Management limits scope approved by board · Management restricts data/personnel access · Management pressures auditors to change findings · Budget cuts preventing IA from meeting responsibilities · IA provides assurance on area where CAE has significant influence · IA provides assurance on activity managed by a senior exec to whom CAE reports administratively
SU 1.4 — Role in Risk Management
Principle 9 Plan Strategically · Standard 9.1 · Three Lines Model
Standard 9.1 — Understanding GRC
Four key risk areas the CAE must understand
Four Key Risk Areas (Std 9.1):
1
Reliability and integrity of financial and operational information
2
Effectiveness and efficiency of operations and programs
3
Safeguarding of assets
4
Compliance with laws or regulations
Three Lines Model — 6 Principles
IIA framework for governance, risk management, and assurance
P1
Governance — Structures for accountability (governing body), managerial actions, and assurance by competent/objective/independent IA.
P2
Governing body roles — Ensure structures exist; align objectives with stakeholders; give management resources; establish and oversee IA.
P3
1st & 2nd Line — 1st: provision of products/services; directly manages risk. 2nd: expertise, support, monitoring, and challenge on risk-related matters (compliance, sustainability, ERM, IT, quality).
P4
3rd Line roles — IA provides assurance and advice on governance, risk, and compliance; reports on objective achievement and continuous improvement.
P5
3rd Line independence — Achieved through: (1) accountability to the governing body; (2) unfettered access to people, resources, and data; (3) freedom from bias and interference.
P6
Creating and protecting value — Alignment through communication, cooperation, and collaboration creates value. Ensures reliability, coherence, and transparency of risk-based decisions.
SU 1.1 — Purpose of Internal Auditing
Key definitions & concepts
IA definition
An independent, objective assurance and advisory service designed to add value and improve an organization's operations. Helps achieve objectives through a systematic, disciplined approach to evaluate and improve governance, risk management, and control processes.
Purpose stmt.
Internal auditing strengthens the organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight.Remember the four deliverables: Assurance · Advice · Insight · Foresight
IA enhances
Achievement of objectives · Governance/risk/control processes · Decision-making and oversight · Reputation and credibility with stakeholders · Ability to serve the public interest
Most effective when
Done by skilled professionals conforming to the Standards · Independently positioned with direct accountability to the board · Free from undue influence and committed to objective assessments
Std 6.1 Mandate
CAE must give board and senior management the information to establish the mandate. Must document/reference it in the board-approved charter. Mandate = authority, role, and responsibilities. CAE formally considers whether mandate needs updating at least annually.Mandate triggers: notable Standards change · significant acquisition/reorganization · change in board/senior management · strategy/risk/environment change · new law/regulation
Dual reporting
CAE reports: (1) Functionally to the board — enables independence, unrestricted access. (2) Administratively to senior management (ideally CEO) — enables access and authority day-to-day. Leading practice: report administratively to CEO or equivalent.
SU 1.2 — Internal Audit Charter
Std 6.2 Charter requirements
Charter def.
A formal document stating the purpose, authority, responsibility, and position of IA within the organization. Approved by the governing body/audit committee, often with management's agreement.
4 min. elements
(1) Purpose of Internal Auditing · (2) Adherence to the Global Internal Audit Standards · (3) Mandate including scope/services and board's responsibilities/expectations about management support · (4) Organizational position and reporting relationships
Additional topics
Safeguards for objectivity/independence · Unrestricted access (data, records, personnel, physical properties) · Communications (nature and timing with board/senior management) · Audit process (communications with management, resolving disagreements) · Quality assurance expectations · Approvals
Audit committee charter
Separate formal document defining the audit committee's purpose, authority, composition, and responsibilities. Outlines how the committee assists the board in overseeing financial reporting, internal controls, compliance, and external/internal audit. CAE maintains alignment between both charters.
Board must
Discuss additional topics with CAE and senior management · Endorse (approve) the charter · Review charter when changes affect the organization (new CAE, risk changes, new advisory services approved)
CAE role
Develops and maintains the charter · Discusses proposed charter with board and senior management to confirm it reflects their understanding · Shares final version at a board meeting for discussion and approval · Decides with board how often to review the charter
SU 1.3 — Impairment of Independence
Principle 7 · Standard 7.1 · Gleim exam-tested examples
Independence def.
Freedom from conditions that impair the function's ability to perform responsibilities without bias. Requires: CAE reports directly to board · CAE is qualified · CAE is positioned to discharge services without interference.
Std 7.1
CAE must confirm organizational independence to the board at least annually. Must also communicate: (1) instances where independence may have been impaired and (2) actions/safeguards that addressed impairments.
12-month rule
If CAE takes on temporary nonaudit responsibilities, an independent third party must oversee assurance in those areas during the assignment AND for the subsequent 12 months. CAE should also discuss with board whether 12 months is appropriate in context.
Impairment examples (Gleim)
① CAE lacks direct board communication ② Management limits scope approved by board ③ Management restricts access to data/records/personnel ④ Management pressures auditors to suppress or change findings ⑤ Budget cuts leave IA unable to meet responsibilities ⑥ IA performs assurance where CAE has significant influence ⑦ IA provides assurance on activity managed by senior exec to whom CAE reports administratively
Nonaudit role examples
New regulation requires immediate risk management development · CAE most qualified to adapt risk management to new segment · Organization too small/limited to afford separate compliance function. When these occur, CAE identifies safeguards depending on whether roles are permanent or temporary.
Interference examples
Failing to provide timely information · Restricting access to information, personnel, or physical properties · Unduly limiting resources (budget reduction)
SU 1.4 — Role in Risk Management
Principle 9 · Std 9.1 · Three Lines Model
Risk def.
The positive or negative effect of uncertainty on objectives.
Risk mgmt def.
A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization's objectives.
Std 9.1
CAE must understand how the organization identifies and manages: (1) reliability/integrity of financial and operational information · (2) effectiveness/efficiency of operations · (3) safeguarding of assets · (4) compliance with laws/regulations.Sources: board/senior management discussions, minutes/presentations, IA workpapers, other assurance provider reports
Three Lines: 1st
Management and staff directly responsible for delivering products/services and managing risk. Day-to-day operations. Also includes support functions (HR). Directly responsible for risk management.
Three Lines: 2nd
Functions providing expertise, support, monitoring, and challenge on risk-related matters. Not independent of management. Examples: risk management, compliance, legal, quality, sustainability, IT security, ERM.
Three Lines: 3rd
Internal audit. Provides independent and objective assurance and advice on adequacy and effectiveness of governance, risk management, and compliance for all matters related to achievement of objectives. Reports to the governing body.
3L Model P5
IA independence achieved through: (1) accountability to the governing body · (2) unfettered access to people, resources, and data · (3) freedom from bias and interference.
Risk appetite
The types and amount of risk that an organization is willing to accept in pursuit of its strategies and objectives. CAE must assess whether risk appetite has been defined and whether a risk management framework has been implemented.
SU 3.1 — Operational Auditing
Engagement types & efficiency measures
Op. audit def.
An audit that assesses the efficiency and effectiveness of an organization's operations — not just financial accuracy.
Process engagement
Follows a process across organizational lines, service units, or geographies. Emphasis on cooperation between units. Typical areas: purchasing/receiving, distribution, safety, budgeting, marketing, asset management. Challenging due to broad scope and conflicting unit objectives.
Program-results
Obtains information on costs, outputs, benefits, and effects of a funded, non-routine activity (e.g., expansion, new IT system). Measures accomplishment and success. Key challenge: quantifying effectiveness when benefits are not financial. Clear objectives and standards must be defined at the outset.
4 efficiency measures
① Productivity ratio — output relative to input · ② Productivity index — production potential · ③ Resource usage rate — resource use relative to available resources · ④ Operating ratio — operational efficiency of the organization
SU 3.2 — Compliance Auditing
Compliance program design, monitoring & enforcement
Compliance def.
Adherence to policies, procedures, laws, regulations, contracts, and other requirements. IA evaluates risk exposures and control effectiveness in governance, operations, and information systems.
Program objectives
(1) Prevent unintended employee violations · (2) Detect illegal acts · (3) Discourage intentional violations. Also: prove insurance claims, determine D&O liability, create corporate identity, decide appropriateness of punitive damages.
Program elements
Written code of conduct · Org chart identifying compliance personnel · Financial incentives that do not reward misconduct · For international orgs: global program reflecting local conditions and laws
Responsibility
High-level personnel with substantial control must own compliance. Chief compliance officer reports directly to CEO. Senior management must be involved. Personnel need adequate access to senior management.
Communication
Standards communicated via interactive formats and multiple media. New employees get orientation training. Agents receive a tailored presentation. Employees certify annually that they have read and complied with the code of conduct.
Hotlines
Best approach: monitored by an attorney (protects attorney-client privilege). Employees may prefer in-house representative + nonretaliation policy, but anonymity may be compromised. Ombudsperson: reports to CCO or board, keeps informants secret, guides informants, follows up on retaliation.
Discipline
Must be consistent, fair, and case-specific. Managers who knew of misconduct and did not report it must also be disciplined. Document everything. After detection, prevent recurrence — may require self-reporting to government and replacing compliance personnel.
SU 3.3 — Financial Audits
Accounting cycles, key risks & fraud
IA vs. external
External auditors: full financial statement audit. IA: reviews specific accounting cycles and internal controls — identifies weaknesses before the external audit, strengthening overall reliability.
Management assertions
Direct or indirect claims about measurement, presentation, and disclosure in financial statements. IA tests assertions to determine whether controls are working as designed.
6 key risks
① Overstating revenues (premature recognition) · ② Understating liabilities (failure to accrue payables) · ③ Understating expenses (capitalizing instead of expensing) · ④ Overstating assets (inventory overstatement) · ⑤ Inappropriate accounting estimates · ⑥ Not incorporating new accounting standards
6 accounting cycles
① Order to cash (sales/receivables/receipts) · ② Purchase to pay (purchases/payables/disbursements) · ③ Production/conversion (inventory, costs) · ④ Financial capital & payment (debt, equity, dividends) · ⑤ Hire to pay (payroll) · ⑥ Record to report (journal entries, consolidation, disclosure)
Fraud vs. error
Error = unintentional. Fraud = intentional. Two types of fraud: (1) Fraudulent financial reporting — misstatements/omissions to deceive users. (2) Misappropriation of assets — theft or embezzlement. Only errors with material effect must be reported. Management fraud harder to detect than employee fraud.
SU 3.4 — Management Reporting
Report types, goals & IA evaluation
Definition
Internal reports managers and executives use to make decisions and monitor progress. Confidential and for internal use only. Not based on GAAP/IFRS. No external deadlines unless management-imposed.
Report goals
Measure and monitor KPIs · Understand project status · Establish benchmarks · Improve stakeholder communication · Create action plans · Monitor performance
Report types
Financial and cash · Project · Personnel · Compliance · Variance analysis · Status and forecasts · Systems · Internal audit
Effective reports
Clear and frequent · Induce prompt action · Provide critical information to decision-makers · Identify problems or opportunities · Contain information relevant to decision-making
IA evaluation
Assesses effectiveness, accuracy, whether reports met objectives, and whether reports are relevant to identified stakeholders. Part of IA's broader role in supporting informed decision-making.
SU 3.5 — Organizational Culture Audit
Culture vs. conduct, risk factors, tone at top & engagement
Culture def.
The shared set of values, beliefs, norms, and behaviors of an organization. Culture = invisible belief systems. Conduct = tangible manifestation of culture through actions and decisions.
Why it matters
Strong culture → engaged employees, higher retention, better productivity, lower risk. Poor culture → root cause of serious challenges, can undermine internal controls and cause financial harm.
Culture risk factors
Unreasonable expectations · No incentives supporting core values · Employees lack risk knowledge · Inflexible hierarchy · Misunderstood controls · Senior management arrogance · Lack of accountability at top · Unenforced codes of conduct · Suppressed employee voice · Disregard for laws
Tone at the top
Leadership shapes culture. Senior leaders and the board must consistently communicate and model desired values. If leadership does not shape culture, it develops by default — often in ways harmful to the organization.
3 audit approaches
(1) Integrate culture assessment with other assurance engagements · (2) Target audit to key processes related to culture · (3) Top-down approach filtering through all layers of the organization
Culture indicators
Employee turnover · Exit interview data · Grievances · Ethics hotline data · Absences. High turnover and absence rates are red flags.
Info sources
Focus group interviews · Individual interviews · Observation of meetings · Surveys. Data analytics can process survey and interview data to identify positive/negative aspects. Confidentiality is imperative.
Document review
Value statements · Strategic plan and KPIs · Risk appetite statements · Org charts · Leadership communication style · Risk escalation protocols · Board/committee minutes · Incentive/compensation policies · Recruitment and retention processes
SU 4.1 — Overview of Advisory Services
Advisory types, assurance interrelationship & charter authorization
Advisory def.
Specialized consultations provided by internal auditors to help stakeholders improve operations — without offering formal assurance or assuming management responsibilities. Nature and scope agreed upon with management of the reviewed activity.
6 advisory types
① Formal — planned, subject to written agreement · ② Informal — routine (standing committees, ad-hoc meetings, limited-life projects, routine info exchange) · ③ Special — M&A team, system conversion · ④ Emergency — disaster recovery team, unusual deadlines · ⑤ Educational — impart specialized IA knowledge to staff · ⑥ Facilitative — use IA expertise to help management assess issues and solutions
Advisory vs. assurance
Assurance = objective evaluation → formal opinion for a third party. Advisory = consultative guidance → recommendations only, no formal opinion, no management role assumed. Many engagements require both. A blended engagement combines elements of each.
Key limit
Auditors must NOT agree to conduct an advisory engagement to circumvent requirements that apply to an assurance engagement. IA is not a management decision-making function — management decides whether to implement recommendations.
Charter role
The board empowers IA to perform advisory services through the charter — if no conflicts of interest or impairment of board obligations exist. The charter documents the organization's approach to blended engagements.
5 assurance areas
Even in advisory work, the CAE must communicate information relevant to: (1) operational efficiency, (2) reliability of reporting, (3) compliance with laws and regulations, (4) safeguarding of assets, (5) ethical culture.
SU 4.2 — Internal Auditor Responsibilities
Independence, objectivity, cooling-off, due care & communication
Board approval
CAE must ensure the board understands and approves advisory services before engagement. Charter is amended to include advisory responsibilities. Clear policies and procedures are developed.
1-year cooling-off
Independence and objectivity MAY be impaired if assurance services are provided within 1 year after a formal advisory engagement. Mitigants: assign different auditors, establish independent supervision, define separate accountability, disclose the presumed impairment.
Conflict disclosure
If impairments of independence or objectivity exist — before or during the advisory engagement — disclosure must be made IMMEDIATELY to management. If CAE has temporary non-audit responsibilities, an independent third party provides assurance for those areas for at least 12 months afterward.
Due care — 7 factors
① Needs of management (nature, timing, communication) · ② Motivations of those requesting the service · ③ Extent of work needed · ④ Skills and resources required · ⑤ Effect on approved audit plan · ⑥ Potential effects on future assignments · ⑦ Potential organizational benefits
3-phase process
Same three phases as assurance: (1) Plan — objectives/scope approval, understand environment/risks/controls, formulate approach, allocate resources · (2) Perform — collect, document, evaluate, compose findings · (3) Communicate — confirm format with management, validate advice, interim communications, final deliverable, monitor/follow up
Scope ownership
Advisory: objectives and scope set JOINTLY by IA and management. Assurance: set primarily by IA. If IA believes additional objectives are needed beyond what management requested, IA may persuade management to include them OR document the gap and address it in a separate assurance engagement.
Reporting
Reporting requirements determined by those requesting the service. Detailed reports or specific results do NOT need to be communicated — but appropriate descriptions of engagement types and significant recommendations ARE communicated. In final communication: assurance engagements communicate findings/conclusions on effectiveness; advisory engagements do NOT.
SU 4.3 — Benchmarking
5 phases, 5 types & IA's role
Definition
Comparing performance with entities known for best practices using reference metrics (financial ratios, days, percentages, grades). Enables comparison of any process expressible in metrics.
5 phases
① Select & prioritize — identify key processes tied to critical success factors and customer needs · ② Organize teams — equitable labor division, cross-functional expertise, project management skills · ③ Research best-in-class — databases, questionnaires, benchmarking partners (most difficult phase) · ④ Data analysis — identify performance gaps, understand root causes, prioritize activities · ⑤ Implementation — leadership most critical; justify recommendations, manage approved changes
5 benchmark types
① Internal — compares functions within the org (risk: strong internal performers may still lag external peers) · ② External/competitive — compares with competitors or industry peers (challenge: competitors won't share data; use third-party data providers) · ③ Process/functional — studies similar processes across entities · ④ Performance — assesses outcomes of processes (e.g., sales growth) · ⑤ Strategic — reviews business approaches to enhance strategic planning
IA's role
Acts as facilitator OR adviser in identifying, evaluating, and implementing benchmarks. Benchmarking is also an opportunity for advisory engagements.
Team qualities
Knowledge of the benchmarked function · Respected organizational standing · Communication skills · Teaming skills · Motivation to innovate · Project management skills
SU 4.4 — Other Advisory Services
Due diligence, process mapping, reengineering, system reviews
Risk & controls training
IA helps employees understand risks and controls in their work. Two key channels: (1) CSA — participants assess risks and determine controls in their own units; (2) Ethical culture support — IA serves as ethics counselor and ethics expert; ethical culture is the most important soft control.
Due diligence
IA verifies the business justification for a major transaction (merger, JV, divestiture) alongside external auditors, tax experts, and attorneys. Advisory if IA provides counsel/advice/facilitation only. Assurance if IA provides an independent assessment. Reviews: operations, IT controls, cultural compatibility, financials, legal compliance, and integration plans.
Reengineering vs. TQM
Reengineering = radical redesign — eliminate unnecessary tasks, automate, optimize remaining; focuses on outcomes not tasks; for the MOST important processes; not continuous improvement or downsizing. TQM = continuous improvement — quality as a basic org function; cumulative effects hard to duplicate. Both reduce traditional controls and emphasize automated, self-correcting controls.
IA reengineering limit
IA must NOT become directly involved in implementing the reengineering process — this would impair independence and objectivity. IA's role: verify senior management support, recommend candidates for consideration, develop audit plans for the new system.
Process mapping
Simple flowcharting to depict a business process. IA prepares maps to identify potential control gaps and streamline processes, verifies accuracy of maps against actual operations, and clearly indicates identified controls to assess their effectiveness.
System dev. reviews
IA examines processes and controls throughout the entire system development life cycle to ensure controls and audit trails are built in from the start. Key control matters: user needs clearly recorded; design follows predetermined plan; each part tested; change management validated; outsourced development contracts include same controls as internal development.
SU 5.1 — Integrity · Principle 1
Honesty, professional courage, ethical expectations & discreditable acts
Integrity def.
Adherence to ethical principles, including honesty and the courage to act based on relevant facts. The foundation of all other ethics principles — essential to instilling trust and earning respect.
Std 1.1 — Honesty
Internal auditors must be truthful, accurate, clear, open, and respectful in all professional relationships. Must disclose all material facts that could affect informed decision-making. Professional courage = communicating truthfully and taking appropriate action even in difficult situations.
CAE environment duty
The CAE must maintain a work environment in which auditors are supported when presenting legitimate, evidence-based results — even if unfavorable. CAE obtains feedback from stakeholders about auditors' honesty and courage as part of performance reviews.
Std 1.2 — Ethics expectations
IA must understand, respect, meet, and contribute to the organization's legitimate and ethical expectations. Must promote an ethics-based culture. If senior management violates ethical expectations → CAE reports to the board. If the board chair violates → CAE reports to the entire board.
Discreditable acts
Bullying/harassment/discrimination · Lying or misrepresenting qualifications · Issuing false reports or allowing others to · Overlooking illegal activities the org tolerates · Soliciting/disclosing confidential info without authorization · Performing services with undeclared objectivity impairment · Claiming Standards conformance without support · Not accepting responsibility for mistakes
Std 1.3 — Legal behavior
Refrain from unlawful actions or actions that could tarnish the organization's or profession's reputation. Know relevant laws and regulations. If legal/regulatory violations are identified → report to authorities able to act, per applicable laws, regs, and policies.
SU 5.2 — Objectivity · Principle 2
Individual objectivity, safeguards, conflicts of interest & impairment disclosure
Objectivity def.
An unbiased mental attitude that allows internal auditors to make professional judgments, fulfill responsibilities, and achieve the Purpose of Internal Auditing without compromise. Requires fair consideration of all relevant factors without favoritism or subordination of judgment.
3 bias types
① Self-review bias — lack of critical perspective on one's own work · ② Familiarity bias — assumptions based on past experience that compromise professional skepticism · ③ Prejudice/unconscious bias — misinterpretation of information based on culture, ethnicity, gender, ideology, race, or other characteristics
12-month rule
If an auditor performs assurance for an activity for which they were responsible in the previous 12 months, objectivity IS IMPAIRED. IA must not assess specific activities for which they were previously responsible. Mitigants: different auditors, independent supervision, separate accountability, disclose presumed impairment.
Conflict of interest
A situation, activity, or relationship that may influence — or appear to influence — an auditor's ability to make objective professional judgments. Conflicts may create the appearance of impropriety even without actual improper acts. Examples: competing with the org's interests, undue financial gain, nepotism, favoritism.
Compensation impairments
CAE must reduce impairments from performance evaluation and compensation design. Examples of impairments: basing evaluations primarily on management surveys · measuring performance by number of findings, revenue growth, or cost savings · allowing management to give indirect compensation (gifts).
Safeguards
Rotation of internal auditors and outsourcing mitigate familiarity and self-review biases. For each engagement, auditors must be independent of the activity under review. Workpaper review by supervisors ensures findings are adequately supported.
Std 2.3 — Disclosure
Impairments must be disclosed PROMPTLY to appropriate parties. Auditor → discloses to CAE. CAE → discusses with management AND board/senior management. If impairment arises after engagement completes, CAE discusses with affected parties and determines resolution. If CAE's own objectivity is impaired → disclose to the board.
Mitigation options
① Reassign auditors · ② Reschedule to get appropriate personnel · ③ Change focus or extent of task · ④ Hire an external party to carry out or oversee the task
Nonimpairments
Recommending standards of control for systems = NOT an impairment. Reviewing procedures BEFORE they are implemented = NOT an impairment. BUT: designing, installing, or drafting procedures for information systems = IMPAIRS objectivity. Direct involvement in reengineering = IMPAIRS independence and objectivity.
SU 5.3 — Competency · Principle 3
Skills, professional development & CPE requirements
Std 3.1 — Competency
Internal auditors must have or acquire the skills necessary to carry out duties effectively. Must only provide services for which they already have or can develop the required skills. CAE must determine the team has — or must acquire — skills outlined in the charter.
Key skill areas
Communication and teamwork · Governance, risk management, and control knowledge · Business operations (finance, IT) · Identifying common risks (fraud) · Data collection and analysis tools · Economic, environmental, legal, political, and social risk awareness · Relevant laws, regulations, and practices · Emerging trends · Supervision and leadership · Critical thinking and change management
CPE requirements
Practicing CIAs: 40 hours CPE per year (including ≥2 hours ethics). Non-practicing CIAs: 20 hours CPE per year (including ≥2 hours ethics). Failing to meet CPE requirements may jeopardize permission to use credentials.
CPD methods
Self-study · On-the-job training · Special assignments (rotational programs) · Mentorship · Supervisory feedback · Education · Courses and conferences · Subscriptions to news services and webinars
CAE's dev. duties
Assess staff skills as ongoing process · Know auditors' competencies for assignments/training/recruiting · Participate in performance reviews · Encourage intellectual curiosity · Consider reliance on other providers' specialty competencies · Contract with external providers if needed · Implement quality assurance and improvement program. Training budget must be included.
SU 5.4 — Due Professional Care · Principle 4
Standards conformance, 8 DPC factors & professional skepticism
DPC def.
Planning and conducting audit work with the care, sound judgment, and critical thinking typical of a skilled professional. Adherence to the Global Internal Audit Standards. Employing professional skepticism. IA is not expected to be perfect, but must exercise appropriate professional care.
Std 4.1 — Conformance
Methods must be clearly defined and documented in accordance with the Standards. If laws/regs prevent applying certain Standards, comply with all others and explain limitations. If noncompliance occurs → CAE must record and share: the noncompliance, alternative steps taken, results of those actions, and reasoning.
8 DPC factors (Std 4.2)
① Org goals and strategies · ② Needs of those receiving IA services · ③ How well governance, risk management, and controls function · ④ Costs vs. potential benefits of IA services · ⑤ Amount and duration of work needed · ⑥ Importance and complexity of risks · ⑦ Likelihood of errors, fraud, noncompliance · ⑧ Use of suitable methods, tools, and technology
Professional skepticism
A questioning mindset applied during both planning and execution. Requires: curious mindset · evaluating trustworthiness of information · speaking clearly when expressing concerns · seeking more proof for incomplete, inconsistent, or potentially misleading information. Based on facts, information, and logic — not trust or belief.
More stringent rule
If the Standards and requirements of other authoritative bodies are inconsistent, internal auditors may be required — or may choose — to conform with the more stringent requirements.
SU 5.5 — Confidentiality · Principle 5
Use of information, protection obligations & retention/disposal
Std 5.1 — Use
Internal auditors must adhere to policies, procedures, laws, and regulations when processing information. Must NOT use information for personal benefit or in ways that harm the org's lawful and ethical goals. Misuse includes: using, selling, or sharing confidential financial, strategic, or operational details; using info for stock trades or competing products.
Std 5.2 — Protection
Must not share confidential information with anyone not authorized to receive it — unless required by law or professional obligation. Must also guard against accidental disclosure. CAE must confirm team and support staff follow all protection standards. CAE should regularly evaluate whether current access controls are functioning properly.
Protection measures
① Encrypt data · ② Use password protection · ③ Restrict email distribution · ④ Limit social media usage · ⑤ Control physical access to sensitive areas. When access is no longer required: cancel digital permissions and dispose of printed materials per set procedures. Do NOT use shared drives or standard emails — insufficient security.
Records management
Manage storage, keeping, and disposal of audit records · Share records with internal/external parties per policies · Deal with, access, or distribute confidential info only as long as necessary. CAE should consult legal counsel on legal privilege, attorney-client privilege, and retention requirements.
Info life cycle
Policies guide IA from the moment information is accessed through collection, transfer, storage, and disposal. Following data retention policies ensures sensitive information is not retained longer than necessary — minimizing exposure risks.
SU 6.1 — Governance Principles
IIA definition, mechanisms, components, board duties & risk owners
IIA definition
Governance = "the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward achievement of its objectives." A set of relationships among management, the board, shareholders, and other stakeholders.
10 stakeholder types
① Board · ② Management · ③ Employees · ④ Customers · ⑤ Vendors · ⑥ Shareholders · ⑦ Regulators · ⑧ Financial institutions · ⑨ External auditors · ⑩ The public
Mechanisms
Internal: corporate charters/bylaws, board of directors, internal audit function. External: laws, regulations, government regulators. Governance, risk management, and control are interrelated — not independent.
2 major components
① Strategic direction — determines business model, overall objectives, approach to risk taking (risk appetite), and limits of organizational conduct. ② Oversight — the component most relevant to IA; includes risk management activities (senior management + risk owners) and internal/external assurance activities.
Board composition
Majority should be outside directors. Directors need years of experience in the industry or corporate governance. Must be willing to challenge management. Complacent directors increase chances of adverse consequences. When multiple governing groups exist, "the board" = the group that grants IA its authority.
Board duties
Selection/removal of officers · Capital structure decisions · Adding/amending/repealing bylaws · Fundamental changes (mergers, acquisitions) · Declaring dividends · Setting management compensation (compensation committee) · Coordinating audit activities (audit committee) · Evaluating and managing risk (risk committee)
Risk committee role
① Identifies key risks · ② Connects them with risk management processes · ③ Delegates to risk owners · ④ Considers whether risk tolerances are consistent with risk appetite. Note: some functions (like delegating) may resemble management tasks, but the risk committee's overall role is oversight.
Senior management
Performs day-to-day governance. Determines where specific risks are managed, who will be risk owners, and how risks will be managed. Establishes reporting requirements for risk owners. Periodically reevaluates governance expectations and tolerance levels with the board.
Risk owner duties
① Evaluate adequacy of risk management design and the org's ability to carry it out · ② Determine whether activities are operating as designed · ③ Establish monitoring activities · ④ Ensure information reported to senior management and the board is accurate, timely, and available
SU 6.2 — Organizational Culture
Mission/vision/values, control environment, ethical culture & IA assessment role
Culture def.
The attitudes, behaviors, and understanding about risk (positive and negative) that influence decisions of management and personnel and reflect mission, vision, and core values. Mission = core purpose. Vision = aspirations for what the org intends to achieve. Core values = essential beliefs about acceptable/unacceptable behavior.
Culture → control environment
Risk-aggressive culture → lesser regard for internal control → auditors more likely to UNDERESTIMATE engagement risks. Risk-averse culture → higher regard for internal control → auditors more likely to OVERESTIMATE engagement risks. Senior management is primarily responsible for establishing and maintaining organizational culture.
Ethical culture
A key component of organizational culture and crucial to effective governance. Each person should be an ethics advocate. Codes of conduct and vision statements state: (1) the org's values and objectives, (2) behavior expected, and (3) strategies for maintaining legal, ethical, and societal responsibilities.
Board vs. mgmt ethics
Board = oversees the organization's ethical climate. Senior management = has ultimate responsibility for promoting and setting the example of ethical behavior (tone at the top) and for establishing/maintaining sound ethics-related objectives and programs.
Chief ethics officer risk
IA may serve as chief ethics officer, member of an ethics council, or assessor of the ethical climate. BUT: the role of chief ethics officer MAY CONFLICT with the independence attribute of the internal audit function — because IA performs internal assurance services, organizational independence is necessary.
IA ethical climate assessment
IA periodically assesses effectiveness of: formal code of conduct · demonstrations of ethical attitudes by influential leaders · explicit strategies to support ethical culture · confidential reporting of alleged misconduct · employee declarations of ethical requirements · delegation of counsel/investigation/reporting responsibilities · learning opportunities · personnel practices · employee surveys · processes that undermine ethical culture · reference and background checks
SU 6.3 — Roles of Internal Auditors in Governance
Standard 9.1, IA governance roles & maturity levels
Std 9.1 — 7 factors
CAE must understand how the org: ① Establishes strategic objectives and makes strategic/operational decisions · ② Oversees risk management and control · ③ Promotes an ethical culture · ④ Delivers effective performance management and accountability · ⑤ Structures its management and operating functions · ⑥ Communicates risk and control information throughout the org · ⑦ Coordinates activities among the board, internal/external assurance providers, and management
CAE info sources
Discussions with board and senior management · Reviews of board/management minutes and presentations · IA engagement communications and workpapers · Assessments and reports from other assurance and advisory service providers
IA governance roles
Obtain board approval of IA charter · Communicate engagement plan · Report significant audit issues · Report KPIs to board · Discuss significant risk areas · Support org-wide risk assessment · Review IA positioning in risk management framework · Monitor compliance with code of conduct · Report on effectiveness of control framework · Assess ethical climate · Follow up on regulatory/external audit responses · Assess performance measurement system · Support fraud awareness culture
Maturity levels
Less mature system: IA emphasizes compliance with policies, procedures, and laws; addresses basic org risks. More mature system: IA emphasizes optimizing structure and practices. As IA becomes more sophisticated, it transitions from compliance-only auditing → adding value by suggesting how to optimize operations.
Governance dynamics
Governance experts view it as a dynamic process, not a fixed system. Rules differ by org type (public company, non-profit, government, private, etc.). Shaped by: org size/complexity/stage · stakeholder makeup · legal and cultural context. CAE works with board and senior management to define governance for audit purposes.
SU 7.1 — Risk Management Processes
Standard 9.1, 5-Step Risk Cycle, Three Lines Model & Roles
Risk Mgmt (Standard 9.1)
Series of activities for recognizing, evaluating, managing & regulating possible situations/events — helps entity attain its goals; Risk = severity × probability × effects on goals
CAE Must Understand
How org identifies/manages: (1) reliability/integrity of financial & operational information, (2) effectiveness/efficiency of operations, (3) safeguarding of assets, (4) compliance with laws/regulations
Step 1 — Context
Identify significant contexts: laws & regulations, capital projects, business processes, technology, organizations, market risk (interest rates, FX)
Step 2 — Risk Identification
Performed at every level (entity, division, BU). Use SWOT, workshops, scenario analysis. Both past events AND future possibilities. Risk inventory = all identified risks.
Step 3 — Assessment
Formal or informal; qualitative (interviews, surveys, benchmarking) or quantitative (decision trees, Monte Carlo). Assess: significance, likelihood, and means of managing. Risk map: plots impact × likelihood.
Step 4 — Risk Response (5 Types)
Acceptance (within appetite, self-insurance) · Avoidance (remove risk) · Pursuit/Exploitation (accept MORE risk for performance) · Reduction/Mitigation (lower severity) · Sharing/Transfer (insurance, hedging, outsourcing)
Step 5 — Risk Monitoring
Continuous 4-part loop: Track identified risks → Evaluate current risk response plans → Monitor residual risks → Identify new risks. IA is MORE OBJECTIVE than line managers (who designed the strategies)
Board / Mgmt / IA Roles
Board = oversight (processes in place, adequate, effective); Management = ensures functioning day-to-day; IA = alerts to new risks, provides recommendations, evaluates processes, reviews risk assessments, performs own assessments, assures management, monitors corrective actions
Three Lines Model
Line 1 = Management (directly responsible for products/services & risk); Line 2 = Management specialists (expertise, support, monitoring, challenge — compliance, IT, ERM); Line 3 = Internal Audit (independent/objective assurance & advice on ALL matters → reports to GOVERNING BODY)
SU 7.2 — COSO ERM Overview
COSO ERM Definition, Key Concepts, Risk Hierarchy & Roles
COSO ERM Definition
"The culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value." — ERM is based on premise that every org exists to provide VALUE
ERM Benefits
Increases range of opportunities · Identifies/manages risk entity-wide · Increases positive outcomes · Reduces performance variability · Improves resource deployment · Enhances organizational resilience
Culture (ERM)
Attitudes, behaviors & understanding about risk — reflects mission, vision, core values. Shaped by internal factors (autonomy, standards, rewards) & external (legal, stakeholder). NOT static — changes over time.
Risk Profile vs. Portfolio View
Risk profile = composite view of risks for a SPECIFIC strategy/objective; Portfolio view = entity-WIDE composite view of all risks and their effects on entity performance (most integrated)
Risk Capacity ⊃ Tolerance ⊃ Appetite
Capacity = MAX risk org CAN assume; Appetite = risk WILLING to accept (board approves, mgmt communicates); Tolerance = acceptable RANGE of deviation from expected performance. Appetite rarely set above capacity.
Inherent vs. Residual Risk
Inherent = risk ABSENT management actions; Residual = risk AFTER management actions. Target residual risk = preferred level after actions; Actual residual risk ≤ Target residual risk. Control risk = risk controls fail to manage controllable risk.
CEO Role in ERM
ULTIMATE responsibility for ERM and achievement of strategy and business objectives. Board may delegate oversight to audit committee (often required by regulators), risk committee, or executive compensation committee. Risk officer = centralized coordinating point.
SU 7.3 — COSO ERM: 5 Components & 20 Principles
5 Components, 20 Principles, Risk Severity & Limitations
5 Components (20 Principles)
① Governance & Culture [5] · ② Strategy & Objective Setting [4] · ③ Performance [5] · ④ Review & Revision [3] · ⑤ Information, Communication & Reporting [3]. Components 1 & 5 = "supporting aspects"; 2, 3, 4 = "common processes"
Governance & Culture (5)
Board exercises risk oversight · Establishes operating structures · Defines desired culture · Demonstrates commitment to core values · Attracts/develops/retains capable individuals
Strategy & Objective Setting (4)
Analyzes business context · Defines risk appetite · Evaluates alternative strategies · Formulates business objectives
Performance (5)
Identifies Risk · Assesses Severity of Risk · Prioritizes Risk · Implements Risk Responses · Develops Portfolio View. Severity = Impact + Likelihood + Time horizon
Review & Revision (3)
Assesses Substantial Change · Reviews Risk & Performance · Pursues Improvement in ERM
Info, Comm. & Reporting (3)
Leverages Information & Technology · Communicates Risk Information · Reports on Risk, Culture, and Performance
5 Risk Responses (COSO)
1=Acceptance (within appetite, self-insurance) · 2=Avoidance (remove risk, e.g. sell pipeline) · 3=Pursuit (accept more risk for performance) · 4=Reduction/Mitigation (lower severity, e.g. info security) · 5=Sharing/Transfer (insurance, hedging, joint ventures, outsourcing, contracts)
4 Portfolio Risk Views
Minimal=Risk view · Limited=Risk category view · Partial=Risk profile view (linked to objectives) · Full=Portfolio view (entity-wide, responsibility cascades)
ERM Limitations (5)
Faulty human judgment · Cost-benefit considerations · Simple errors/mistakes · Collusion · Management OVERRIDE of ERM practices → ERM provides REASONABLE (not absolute) assurance
SU 7.4 — ISO 31000 Risk Management Framework
ISO 31000 Principles, Framework, Process & Assurance
ISO 31000 vs. COSO ERM
ISO 31000 = broad, principles-based, globally flexible, applicable to any sector, emphasizes adaptability; COSO ERM = detailed, prescriptive, structured, ties risk directly to strategic objectives. Many orgs use BOTH.
ISO 31000: 8 Principles
Integrated · Structured & Comprehensive · Customized · Inclusive · Dynamic · Best Available Information · Human & Cultural Factors · Continual Improvement — all centered on VALUE CREATION & PROTECTION
ISO Framework (LDIE+I)
Leadership & Commitment (center) → Integration → Design → Implementation → Evaluation → Improvement (continuous cycle). Board & senior mgmt demonstrate leadership by implementing components, adopting policy, committing resources, assigning accountability.
ISO Process
Scope/Context/Criteria → Risk Assessment [Identification → Analysis → Evaluation] → Risk Treatment → Recording & Reporting. Surrounded by: Communication & Consultation (left) + Monitoring & Review (right). Monitoring occurs in ALL phases.
Risk Treatment (ISO)
Repetitive: select treatment (accept/avoid/reduce/share/pursue) → implement → assess effectiveness → determine if residual risk acceptable → adopt another treatment if unacceptable
ISO 31000 Roles
Board = overall oversight, ensuring risk mgmt system effective; Management = sets RISK ATTITUDE (approach to assess/pursue/retain/turn away from risk), identifies & manages risks; IA = assurance on ENTIRE risk management SYSTEM
3 ISO Assurance Approaches
1=Key principles (are principles followed?); 2=Process element (elements in practice?); 3=Maturity model (where on maturity curve? progressing? adding value? meeting org needs?)
Study Unit 8 · Controls: Types
SU 8.1 · Overview of Control
Control (IIA) — Any action by management, board, or other parties to manage risk & increase likelihood objectives are achieved.
Control Environment — Board/management attitude & actions re: control importance; shaped by integrity, structure, philosophy, HR policies, competence.
Risk & Control Matrix — Links objectives → risks → controls; used by CAE to plan and evaluate the audit universe.
Inherent Limitations — Controls provide reasonable (not absolute) assurance due to: faulty human judgment, management override, collusion, cost > benefit.
Segregation of Duties — No single person controls a transaction from inception to completion; prevents fraud by requiring collaboration.
Audit Trail — Record tracing accounting data back to source; may exist only in computer-readable form in automated systems.
Automated vs. Manual — Automated = uniform, consistent, concentrated functions; Manual = better for large/unusual transactions requiring judgment.
Internal Auditor Role — Provide independent assurance on effectiveness & efficiency of controls; understand risk appetite, risk culture, and control frameworks used.
SU 8.2 · Types of Controls
Primary Controls (PDCD) — Preventive (deter before), Detective (alert after), Corrective (fix after), Directive (encourage desirable).
Secondary Controls — Compensating/mitigative (when SoD absent or primary ineffective); Complementary (work together to reach acceptable risk). Neither alone is sufficient.
IT General Controls — Apply to ALL systems: data center ops, software acquisition/change, access security, application system development. Umbrella over everything.
Application Controls — Specific to each app; include input, processing, and output controls.
Batch Input Controls — Financial totals (monetary), record counts (volume), hash totals (no meaning — e.g., sum of invoice #s).
Online Input Controls — Preformatting, field/format checks, validity checks, limit/range checks, check digits, sequence checks, zero balance checks.
Hash Total ≠ Financial Total — Hash total has no financial meaning (e.g., sum of vendor IDs). Financial total summarizes monetary amounts.
Entity-Level — Governance (board level: code of conduct, IT policies) + Management oversight (business-unit supervisory approvals).
Process-Level — Achieve process objectives (physical inventory counts, revenue center reports).
Transaction-Level — Achieve transaction objectives (application controls, exception reports, segregation of duties).
Time-Based — Feedback (past: learn from completed activities), Concurrent (present: adjust ongoing processes), Feedforward (future: anticipate & prevent problems).
Financial vs. Operating — Financial = proper authorization, recordkeeping, compliance with laws; Operating = production & support activities based on management principles.
People-Based vs. System-Based — People-based requires human intervention (bank recs, checklists); System-based executes automatically (auto PO blocks above threshold).
Concurrency Controls — Manage simultaneous database access by 2+ users; prevent data corruption from conflicting updates.
Control Matrix — Maps multiple risks to multiple controls; controls may address more than one risk, and one risk may require more than one control.
Study Unit 9 · Controls: Application
SU 9.1 · Accounting Cycles & Associated Controls
ARC = Segregation of Duties — Authorization, Recordkeeping, Custody. No single employee should control all three for any transaction.
5 Accounting Cycles: (1) Sales-Receivables, (2) Cash Receipts, (3) Purchases-Payables, (4) Cash Disbursements, (5) Payroll.
Sales Cycle 3-Way Match — Packing slip + Bill of lading + Sales order must reconcile before invoice is generated. Credit check before approval.
Cash Receipts — Two employees open mail; "For Deposit Only" stamp; remittance listing compared to deposit slip; lockbox alternative routes payments directly to bank.
Purchases-Payables — Blind PO to Receiving (no quantities) forces independent count. 3-way match: Req + PO + Receiving Report before payment.
Cash Disbursements — Tickler file by due date. "Paid" stamp prevents duplicates. Large checks need 2 signatures.
Payroll Cycle Departments: HR (rates/deductions) → Timekeeping (clock cards, job time tickets) → Cost Accounting → Payroll (register) → AP (voucher) → Cash Disbursements (imprest payroll account) → GL → Bank (distributes checks).
Imprest Payroll Account — Funded for exact payroll; zeroes out after checks clear. Limits exposure to one pay period.
SU 9.2 · Management Controls
6 Elements of Management Controls: Organization, Policies, Procedures, Personnel, Accounting, Budgeting, Reporting.
Tone at the Top — CEO sets ethical climate. Organizations reflect the control consciousness of leadership.
Board Committees (size matters): Audit, Compensation, Finance, Risk. Members need industry knowledge & willingness to question management.
Organization as Control — Divide responsibilities; authority must match responsibility; simple structures preferred; organization charts document the chain.
Policies — Written, approved, conforming to law, periodically reviewed. In strong cultures, formal written policies may be less necessary.
Procedures — Methods for conforming with policies. One employee's work should automatically be reviewed by another. Keep simple; avoid stifling judgment in nonmechanical work.
Personnel — Background checks; training; rotation of duties (e.g., purchasing agents rotated to prevent vendor favoritism). Supervision is the best single control over individuals.
Budget — Statement of expected results in numerical terms. Preparers should participate in setting it. Integrates subsidiary plans. Timely variance reports preferred over delayed precision.
Reporting — Timely, accurate, meaningful, economical. Only report on what the unit is responsible for. Report exceptions when quantitative measurement is not possible.
SU 9.3 · Control Frameworks
COSO Definition — Internal control is a process effected by the board, management, and personnel to provide reasonable (not absolute) assurance regarding Operations, Reporting, and Compliance objectives.
COSO 5 Components — CRIME: Control activities, Risk assessment, Information & communication, Monitoring, Control Environment (foundation).
Control Environment = Foundation. If weak, no other component can compensate. It has a pervasive effect on the entire system.
COSO Objectives: Operations (mission, safeguard assets), Reporting (reliable info), Compliance (laws & regs). Reporting & Compliance provide stronger assurance than Operations (external factors affect Operations).
Risk Assessment — Identify & analyze risks to objectives; consider changes (internal/external) that could impair controls. Clear objectives are a precondition.
Monitoring — Evaluates whether all 5 components are present and functioning. Uses criteria from regulators, standard-setters, or management/board. Deficiencies addressed appropriately.
COBIT 2019 — Best-known IT governance framework. Internationally accepted. Addresses how IT aligns with business objectives across the whole organization.
COBIT 6 Governance System Principles: (1) Stakeholder value, (2) Holistic approach, (3) Dynamic (responds to design factor changes), (4) Distinct from management, (5) Tailored to org needs, (6) Encompasses all IT.
COBIT 3 Framework Principles: (1) Conceptual model, (2) Open & flexible, (3) Aligned with major standards/regulations/best practices.
Other Frameworks: ISO 31000 (broad risk principles, multiple sectors); specific regulatory/legal frameworks may also be required by regulators.
SU 10 · Fraud Risks
SU 10.1 · Fraud – Risks and Types
Fraud Triangle: Pressure/Motive + Opportunity + Rationalization. Opportunity is the element organizations can MOST influence.
IIA Fraud Definition: Intentional act of deceit, concealment, dishonesty, misappropriation, forgery, or violation of trust to secure unjust personal or business advantage. Three elements: intent, commission, accomplishment.
Asset Misappropriation (Defalcation): Most common fraud type. Includes embezzlement (recorded assets stolen), skimming (cash stolen BEFORE recording), lapping (cycling A/R shortage), payment fraud, expense fraud, payroll fraud (ghost employees).
Skimming vs. Lapping: Skimming = off-books (no record); Lapping = on-books (covers theft by cycling customer payments). Both are cash/A/R fraud.
Executive Fraud (Financial Statement Misrepresentation): Benefits the organization. Methods: channel stuffing, fictitious sales, premature revenue recognition. Contrast: low-level fraud benefits the individual.
Corruption: Bribery/kickbacks, conflict of interest, diversion of business opportunities, related-party fraud, tax evasion, check kiting.
Social Engineering: Phishing (fake emails/sites), Spear phishing (targeted), Vishing (voice/phone), Smishing (SMS), Quishing (QR codes).
Red Flags: Document (altered records, two sets of books), Lifestyle (unexplained wealth), Behavioral (refuses vacation/promotion, defensiveness). Red flags ≠ proof of fraud — they signal opportunity.
Internal Auditor Roles (IIA Standard 4.2): Due professional care; evaluate adequacy of fraud controls; raise awareness; recommend investigations. NOT primarily responsible for preventing fraud — that is management.
SU 10.2 · Fraud – Controls
Fraud Management Program (6 Components): Ethics policy → Fraud awareness training → Fraud risk assessment → Ongoing reviews → Prevention & detection → Investigation procedures.
Management Override: Management circumvents controls for illegitimate purposes. MOST DIFFICULT to detect. Mitigated by: anonymous whistleblower hotlines, strong ethical culture, effective board/audit committee oversight.
Preventive Controls: Safeguarding assets, computer access controls, lockbox, background checks, supervision, authority levels, segregation of duties (ARC).
Detective Controls: Whistleblower hotlines, exit interviews, employee surveys, data analytics, monitoring.
Key Rule: Management (NOT internal audit) has PRIMARY responsibility for preventing fraud. Internal auditors are the Third Line — assurance providers, not first responders.
SU 10.3 · Fraud – Investigation
Forensic Auditing: Accounting/audit knowledge applied in civil/criminal legal matters. Investigation determines: whether fraud occurred, loss exposure, who was involved, how it occurred.
Reporting Chain: Normal findings → senior management. If senior management is implicated → CAE reports DIRECTLY to audit committee, bypassing management.
Fraud Interview vs. Normal Interview: Normal = gather facts. Fraud interview = already have evidence; seeking confirmation/confession. Rules: Never directly accuse; two persons present; accused interviewed after most evidence gathered; do NOT let accused return to work area after interview.
Evidence & Chain of Custody: All evidence logged chronologically. Chain of custody must be maintained. Types: financial records, IT access logs, correspondence, phone records, public records, websites.
Fraud Testing Methods:
• Benford's First-Digit Law: Digits 1-5 appear ~78% of the time naturally. Overrepresentation of 6-9 suggests manipulation.
• Discovery Sampling: Find at least one occurrence of a rare event (specific fraud type) if it exists above a threshold rate.
• CAAT / Data Mining / Data Analytics: Computerized tools to find anomalies (duplicate invoices, unusual patterns).
• Inference Testing: Statistical significance — sample → population.
• Ground Truth Testing: Real-world facts, evidence, direct observation — more reliable than inference testing.
• Pressure Testing: Assess high-pressure environments (lawsuits, staffing shortages, aggressive goals) that increase fraud risk.
Fraud Reporting (CAE responsibility): Formal report includes: time frames, observations, conclusions, resolution, corrective action. Addressed to legal counsel for attorney-client privilege. Significant fraud → timely report to senior management AND board.
Opinion Limits: Internal auditor may express opinion on fraud-related CONTROLS — but it is INAPPROPRIATE to express an opinion on the culpability of a fraud suspect.
Tap a unit to expand · tap a subunit to see terms · tap a term to read its definition
Your study stats
0
Mastered
0
Review
44
Not seen
Card-by-card mastery
Everything that isn’t on the bottom bar