1

CIA CHALLENGE – STUDY UNIT 8

Internal Audit Operations
Rapid Review

1. Introduction to Internal Auditing

a. The internal audit activity must evaluate and contribute to the improvement of
governance, risk management, and control processes using a systematic, disciplined,
and risk-based approach.
b. The internal audit activity provides assurance services and consulting services.
1) Assurance service – “An objective examination of evidence for the purpose of
providing an independent assessment on governance, risk management, and
control processes for the organization.”
2) Consulting services – “Advisory and related client service activities, the nature and
scope of which are agreed with the client, are intended to add value and improve
an organization’s governance, risk management, and control processes without the
internal auditor assuming management responsibility.”
2. Internal Audit Administrative Activities
a. The chief audit executive (CAE) must establish policies and procedures to guide the
internal audit activity.
3. Stakeholder Relationships
a. For internal auditors to be effective, they must build and maintain strong constructive
relationships with managers and other stakeholders within the organization.
b. The most important function of the audit committee is to promote the independence of
the internal and external auditors by protecting them from management’s influence.
4. Internal Audit Resource Requirements
a. The CAE must ensure that internal audit resources are appropriate, sufficient, and
effectively deployed to achieve the approved plan.
b. Resources may include employees, service providers, financial support, and IT-based
audit methods.
c. The competencies of the internal audit staff should be appropriate for the planned
activities.
d. When an external service provider serves as the internal audit activity, the provider must
make the organization aware that the organization has the responsibility for maintaining
an effective internal audit activity.
5. Coordination
a. According to The Three Lines Model, there are six principles, which include governance,
governing body roles, management roles (first and second line), third line roles, third line
independence, and creating and protecting value.
b. The CAE should share information, coordinate activities, and consider relying upon the
work of other internal and external assurance and consulting service providers to ensure
proper coverage and minimize duplication of efforts.
c. Oversight of the work of external auditors, including coordination with the internal audit
activity, is the responsibility of the board.
d. Coordination of internal and external audit work is the responsibility of the CAE.
Copyright © 2023 Gleim Publications, Inc. All rights reserved. Duplication prohibited. Reward for information exposing violators. Contact copyright@gleim.com.