3.3 Scenario Practice for Ethics and Professionalism
Key Takeaways
- When objectivity is impaired in fact or appearance, the details must be disclosed PROMPTLY to the appropriate parties (Standard 2.3).
- An auditor discloses impairments to the CAE or supervisor; if the CAE's own objectivity is impaired, the CAE discloses to the board.
- Self-review bias, familiarity bias, and unconscious bias are the three biases the Standards name explicitly.
- A former operational manager moved into audit must wait 12 months before providing assurance over that activity.
- Disclosing a potential impairment before accepting an advisory engagement is required when prior responsibilities are involved.
A repeatable method for objectivity scenarios
Most Section B scenario questions are objectivity threats in disguise. Work them in four moves:
- Name the threat. Is it a gift, a personal relationship, a financial interest, prior operational responsibility, self-review, or scope/management pressure?
- Match the standard. Gifts and conflicts → 2.2; disclosure → 2.3; structural/reporting → 7.1.
- Identify who acts. The auditor discloses to the CAE or supervisor; the CAE escalates to senior management and/or the board; if the CAE's own objectivity is impaired, the CAE discloses to the board.
- Pick the required action, not the convenient one. Disclosure and reassignment beat "just be careful" or "proceed and note it."
The three named biases
The Standards explicitly name three biases auditors must manage:
| Bias | What it does |
|---|---|
| Self-review bias | Lack of critical perspective when reviewing your own prior work, so you overlook your own mistakes |
| Familiarity bias | Assuming things based on past experience, which erodes professional skepticism |
| Prejudice / unconscious bias | Misjudging information based on predisposed ideas about people or groups |
When a stem describes an auditor who "designed the control last year" or "used to manage this department," the cue is self-review bias and the 12-month rule under Standard 2.2.
Worked scenarios
Scenario A — the offered gift. A vendor frequently audited by the team offers the lead auditor tickets to a sporting event. Action: decline. Standard 2.2 prohibits accepting any item that may be presumed to impair objectivity; the appearance alone is disqualifying. If the auditor already has a relationship that creates the appearance of a conflict, that is disclosed to the CAE.
Scenario B — prior operational responsibility. An auditor was, until eight months ago, the manager of accounts payable and is now assigned to provide assurance over accounts payable. Action: the auditor must refrain — objectivity is presumed impaired because the responsibility ended within the previous 12 months. The CAE reassigns the engagement or supervises it with an independent party.
Scenario C — the inherited stock. An auditor owns a small, inherited block of stock in a company that is a major customer of the department under review, and had forgotten about it. Action: this is a financial conflict of interest. On realizing it, the auditor discloses to the CAE; the CAE decides whether to reassign. Forgetting is not a defense — Standard 2.2 covers conflicts "in fact or appearance."
Scenario D — the CAE's gifts. A senior auditor learns the CAE has accepted gifts from a frequently audited vendor and the CAE dismisses the concern. Action: because the CAE's own objectivity is in question, the matter is escalated beyond the CAE — to the audit committee / board, which is the body the CAE reports to functionally under Standards 2.3 and 7.1.
Scenario E — advisory work on a former area. An auditor is asked to provide advisory (consulting) services on a process they were previously responsible for. Action: they must disclose the potential impairment to the party requesting the service before accepting the engagement (advisory engagements allow disclosure-and-proceed where assurance would not).
Reading the cue under pressure
The wrong answer in these items usually sounds responsible but skips the required step. Train yourself to reject:
- "Continue the engagement and stay objective." — This ignores the mandatory disclosure in Standard 2.3.
- "Resign / report externally first." — Premature; the Standards route disclosure internally (CAE → senior management → board) before any external action.
- "Accept the gift but document it." — Documentation does not cure a presumed impairment; the gift is prohibited.
- "Audit your own former area; you know it best." — Knowing it best is exactly the self-review problem the 12-month rule prevents.
A reliable tie-breaker between two plausible answers: the more transparent, more disclosed, more independently-supervised option is almost always correct. The Standards consistently prefer transparency and independent oversight over an auditor's private assurance that they can remain unbiased. When a scenario names the CAE as the conflicted party, push the escalation up to the board — that is the structural safeguard the framework builds in precisely for CAE-level conflicts.
Scenarios involving the CAE's own roles
A second family of scenarios targets the CAE's organizational position rather than an individual engagement. These test Standard 7.1 Organizational Independence.
** A new regulation requires the company to build a compliance control framework quickly, and the board asks the CAE to design and own it. Issue: the CAE would now hold operational responsibility for an area internal audit may later audit — a clear impairment to independence in fact or appearance. Required handling: the CAE must discuss the proposed role, its nature, and any safeguards with the board, and document them in the audit charter. If that area becomes subject to internal auditing, an alternative process for assurance (for example, an external provider reporting to the board) must be used.
If the non-audit role is temporary, assurance over it should come from an independent third party during the assignment, and the CAE must plan to transition the role back to management.
Scenario G — management limits scope. Management refuses to give the team access to a system or tries to pressure the team to soften a finding. Issue: this is an independence impairment by interference, not an objectivity problem. Required handling: the CAE escalates; unresolved interference is communicated to the board, because the function's freedom to set scope and report results is the heart of independence.
Scenario H — annual confirmation. Even with no specific incident, the CAE must confirm the function's organizational independence to the board at least annually, including any incidents where independence may have been impaired and the safeguards applied. Treat "the CAE never told the board anything about independence this year" as a nonconformance cue.
An internal auditor realizes mid-engagement that they own inherited stock in a company that is a major customer of the department being audited. What is the most appropriate action?
A senior auditor learns the chief audit executive (CAE) has been accepting gifts from a frequently audited vendor; when raised, the CAE dismisses the concern. What is the most appropriate next step?