Free IAP Exam Flashcards

Domain I of the Global Internal Audit Standards says internal auditing strengthens the organization's ability to create, protect, and sustain value by giving the board and management independent, risk-based, and objective assurance, advice, insight, and foresight. 'Enhance and protect organizational value' is the retired pre-2024 Mission wording.

Domain I lists three conditions: the work is performed by competent professionals in conformance with the Standards, the function is independently positioned with direct accountability to the board, and internal auditors are free from undue influence and committed to objective assessments. Finishing audits on schedule is not one of them.

The mandate is internal audit's authority, role, and responsibilities, which may be granted by the board and/or laws and regulations. The chief audit executive (CAE) must give the board and senior management the information needed to establish it, and must document or reference it in the board-approved charter.

The CAE must develop and maintain a charter that specifies, at a minimum, the Purpose of Internal Auditing, a commitment to adhere to the Standards, the mandate (scope and types of services, plus board expectations for management's support), and the function's organizational position and reporting relationships. The CAE discusses the draft with the board and senior management.

The board - not senior management or the CAE alone - holds final approval authority over the internal audit charter, which anchors the function's independence from the activities it reviews.

Engagements where internal audit independently and objectively evaluates evidence to form a conclusion or opinion on a process, system, or activity, such as a control or compliance assessment.

Services where internal auditors give advice to stakeholders without providing assurance or taking on management responsibilities - for example process mapping, training, or system design input. The nature and scope are agreed with the relevant stakeholders rather than set by internal audit alone. Also called consulting services.

The Standards' glossary says internal auditors may provide limited or reasonable assurance depending on the nature, timing, and extent of procedures performed. Reasonable assurance rests on more extensive work and supports higher confidence; limited assurance rests on narrower procedures and supports a more modest conclusion.

Internal audit selects assurance when an independent opinion is needed on a process or risk area, and advisory when management instead needs counsel, training, or facilitation without an independent conclusion.

Risk-and-control assessments, third-party or contract compliance audits, IT security and privacy audits, and operational, financial, regulatory, and organizational-culture audits are all forms of assurance work.

Providing risk-and-control training, supporting system design and development, performing due-diligence reviews, and benchmarking are advisory activities where internal audit counsels rather than concludes.

Freedom from conditions that threaten internal audit's ability to carry out its responsibilities impartially. It depends on the function's reporting structure and freedom from management interference in scope, work, and reporting - not on physical separation.

Under Standard 7.1 Organizational Independence, the chief audit executive needs a direct reporting relationship with the board (often through the audit committee). Administrative reporting for matters such as budget or HR may run through senior management without impairing independence.

A functional reporting line to management instead of the board is a classic independence impairment, because it lets the reviewed party influence internal audit's scope, resources, or findings.

The board is responsible for safeguarding internal audit's independence, and the CAE must communicate to the board whenever an actual or perceived independence impairment arises.

Restricted access to records or personnel, and budget cuts that limit what internal audit can cover, are independence impairments because they let management constrain the function's work.

The IIA's 2020 update of the 'Three Lines of Defense.' The governing body provides oversight; management holds first line roles (delivering products and services and managing risk) and second line roles (expertise, support, monitoring, and challenge on risk matters); internal audit is the third line, giving independent and objective assurance and advice.

If internal auditors take on first- or second-line duties (such as designing a control they will later audit), independence is threatened. Safeguards include disclosure to the board and using different staff for the assurance work.

The first principle of Domain II (Ethics and Professionalism), the part of the Global Internal Audit Standards that replaced the separate Code of Ethics. Standard 1.1 requires honesty and professional courage - for example, reporting an uncomfortable finding rather than softening it to avoid conflict. Standards 1.2 and 1.3 cover the organization's ethical expectations and legal and ethical behavior.

An objectivity threat that occurs when an internal auditor evaluates work, a process, or a control that they previously designed or performed, making an unbiased assessment difficult.

An objectivity threat arising from a close or long-standing relationship with the people or area being audited, which can make an auditor less willing to report unfavorable findings.

Options include reassigning the affected auditor to a different engagement or outsourcing performance or supervision of the work to someone without the conflict; the impairment must also be disclosed to the appropriate party.

Standard 2.2 Safeguarding Objectivity bars internal auditors from accepting any tangible or intangible item - a gift, reward, or favor - that may impair or be presumed to impair objectivity. The test includes appearance: no actual influence has to be shown.

Beyond technical audit skills, internal auditors need written and verbal communication, critical thinking, research, persuasion and negotiation, and relationship-building skills to deliver effective engagements.

Internal auditors must recognize when their knowledge or skills need updating and pursue relevant training or education - a continuous obligation, not a one-time credentialing step.

Applying the level of skill and judgment expected of a reasonably prudent, competent internal auditor, including weighing an engagement's cost against its potential benefit and considering the likelihood of significant error, fraud, or noncompliance.

Maintaining a questioning mind and critically assessing the reliability of evidence and explanations, rather than accepting information at face value during an engagement.

Principle 5 Maintain Confidentiality has two standards: 5.1 Use of Information and 5.2 Protection of Information. Internal auditors respect the ownership and privacy of what they gather, use it only for legitimate professional purposes, and apply appropriate safeguards against misuse or disclosure.

The Standards' glossary defines governance as the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the organization's activities toward achieving its objectives. Senior management, internal audit, and other assurance providers each support that board-led system.

The most widely used internal control framework. It has five components - control environment, risk assessment, control activities, information and communication, and monitoring activities - supported by 17 principles, and three objective categories: operations, reporting, and compliance. Using a framework gives auditors consistent criteria for evaluating controls.

The shared values and behaviors that shape how employees act. A culture that discourages raising concerns can weaken the control environment even when written policies look strong on paper.

Engagement risk is the exposure identified within a specific audit's scope, such as a process failing to prevent duplicate payments. Engagement controls are the specific activities designed to address that exposure.

How an organization makes decisions - centralized versus decentralized, for example - shapes its governance, risk management, and control processes, so internal audit must understand that process before assessing controls.

Beyond following Domain II (Ethics and Professionalism) of the Standards themselves, internal audit helps identify the ethical, legal, and compliance requirements that apply to the organization and evaluates how well the organization's own ethical framework is functioning.

Strategic, operational, financial, compliance, reputational, and environmental/sustainability/social-responsibility risk are the fundamental risk types internal audit must be able to differentiate.

Inherent risk is the exposure that exists before any controls are applied. Residual risk is what remains after controls have been designed and are operating - the gap between them shows how much a control mitigates.

Risk appetite is the broad amount of risk an organization is willing to pursue in support of its objectives. Risk tolerance is the acceptable variation around a specific objective or metric within that appetite.

The repeating process of identifying, assessing, responding to, and monitoring risks, so an organization's risk picture and its responses stay current as conditions change.

An organization can accept, avoid, reduce (mitigate), or share/transfer an identified risk; COSO's 2017 ERM framework also lists 'pursue' for risk taken on deliberately to improve performance. Internal audit evaluates whether the chosen response fits the risk's significance and the risk appetite.

A structured, organization-wide approach that replaces ad hoc, siloed risk handling with a consistent way to identify, assess, and respond to risk. Common examples are COSO's Enterprise Risk Management - Integrating with Strategy and Performance (2017; five components, 20 principles) and ISO 31000.

Controls exist to provide reasonable assurance that an organization achieves its objectives - safeguarding assets, ensuring reliable information, and supporting compliance - not to eliminate risk entirely.

Preventive controls stop an undesired event before it happens (such as segregation of duties). Detective controls identify an event after it occurs (such as a reconciliation). Corrective controls fix the effects once detected.

A control can be well designed on paper yet fail in practice. Evaluating internal controls means checking both whether the control is designed to address the risk and whether it is actually operating as intended.

Motivation (a pressure or incentive, such as financial strain or unrealistic targets), opportunity (weak or overridden controls that let the act go undetected), and rationalization (the self-justification). The IAP syllabus says 'motivation'; Cressey's original model and ACFE materials say 'pressure' for the same element.

Internal auditors assess which processes carry significant fraud exposure while planning an engagement, so testing can be directed toward the areas most susceptible to fraud rather than spread evenly.

Warning indicators at both the organizational level (such as management overriding controls) and the process level (such as unexplained reconciling items) that suggest fraud risk requires closer attention.

Leadership's demonstrated commitment to ethical behavior and control consciousness. A weak tone at the top raises fraud risk because employees take cues from how leaders actually behave, not just from written policy.

Dividing custody of assets, record-keeping, and authorization among different people so that no single individual can both commit and conceal a fraudulent act alone.

Whistleblower hotlines, account reconciliations, and supervisory reviews are controls designed to surface fraud that has already occurred, complementing preventive measures like authorization limits.

The role is not fixed: depending on the charter, mandate, and the organization's fraud policy, internal audit may lead an investigation, support it, or stay out of it. Internal auditors coordinate with fraud investigators, review their risk assessments, prior investigations, investigation trends, and whistleblower complaints, and need the right competencies for any interviewing or fraud testing they perform.