High Yield Internal Audit

[SU1] What should internal audit accomplish?

Use a systematic, disciplined approach to improve governance, risk management, and control through objective assurance and advice.

[SU1] Define governance.

Board-implemented processes and structures that inform, direct, manage, and monitor activities toward organizational objectives.

[SU1] What does risk management involve?

Identifying, assessing, managing, and controlling potential events or situations to provide reasonable assurance of achieving objectives.

[SU1] Define a control.

An action by management, the board, or others that manages risk and increases the likelihood of achieving objectives.

[SU1] What does reasonable assurance mean?

Cost-effective risk reduction that lowers expected deviations to a tolerable level; it is not an absolute guarantee.

[SU1] Who operates business controls, and what does internal audit do?

Management owns and operates the business and its controls; internal audit evaluates them and provides assurance or advice.

[SU1] Distinguish assurance from advisory services. (List assurance definition and then advisory definition in numbered list)

1. Objectively evaluates an area and supports conclusions

2. Provides agreed guidance without taking on management responsibilities.

[SU1] Which resource categories must the CAE consider?

Financial, human, and technological resources, aligned with the plan, risk, coverage, qualifications, timing, and unexpected work.

[SU1] What staffing outcome must the CAE ensure?

Human resources are appropriate, sufficient, and effectively deployed to achieve the approved audit plan.

[SU1] What qualities should guide auditor selection?

Job-related qualifications and education; communication and analytical ability; attention to detail, curiosity, motivation, and potential contribution.

[SU1] How do structured and behavioral interviews differ?

Structured interviews use consistent job-related questions to reduce bias; behavioral interviews ask how candidates handled past situations.

[SU1] What makes feedback constructive?

It is specific and tied to work expectations and goals. Coaching, mentoring, training, and development build capability.

[SU1] What risks can come with external providers?

They may add specialist skill or flexibility but can introduce cost, quality, continuity, cybersecurity, liability, and ethical risks.

[SU1] Who retains responsibility when audit work is outsourced?

The CAE retains oversight and responsibility for the internal audit function.

[SU2] What does internal audit strategy establish?

The long-term plan for achieving the function's overall goals, including resource allocation to support annual goals.

[SU2] Distinguish mission from vision.

Mission = current purpose and what the function does; vision = the desired future state.

[SU2] What are strategic objectives designed to do?

Set measurable goals that help the function achieve its mission and vision.

[SU2] In SWOT, which factors are internal and which are external?

Strengths and weaknesses are internal; opportunities and threats are external.

[SU2] What does gap analysis compare?

The internal audit function's current state with its desired state.

[SU2] What kinds of changes may trigger a strategy review?

Changes in operations, structure, acquisitions, industry, governance/risk/control, laws, leadership, stakeholder expectations, standards, or quality results.

[SU2] How should internal audit respond when the organization changes?

Assess effects on objectives, risks, stakeholder expectations, and audit capability; then align strategy and resources.

[SU2] What should internal audit resource planning align?

The audit universe, risk levels, audit plan, coverage expectations, likely unexpected work, qualified staff, and technology.

[SU2] Who communicates internal audit resource needs, and who must ensure resources are adequate?

The CAE communicates needs and status to senior management and the board; they ultimately must ensure adequate resources.

[SU2] What are key audit committee responsibilities?

Support internal audit independence and oversee/review external-auditor matters, reports, disputes, and firm selection or fees where applicable.

[SU2] What should be assessed before relying on another assurance provider?

The provider's competence and objectivity; coordination should avoid duplicate work and reveal coverage gaps.

[SU3] What are the five steps of risk-based audit planning?

1. Establish the process. 2. Gather inputs. 3. Identify and assess risks. 4. Create the audit universe and draft plan. 5. Validate and obtain approval.

[SU3] Which inputs inform the audit plan?

Stakeholder insight, strategy, financial results/forecasts, prior findings, system documentation, operational intelligence, and relevant external information.

[SU3] How is risk significance commonly assessed?

By impact and likelihood; the methodology may also consider velocity or vulnerability.

[SU3] Which risks should a risk-based plan emphasize?

Unacceptable current risks needing action, controls the organization relies on most, large inherent/residual-risk gaps, and very high inherent risks.

[SU3] Define inherent risk.

Risk before existing controls or responses are considered.

[SU3] Define current risk.

Risk being managed within existing controls or control systems.

[SU3] Define residual risk.

Risk that remains after management puts controls or responses in place.

[SU3] What does a risk index represent?

A composite measure of likelihood and impact used to produce an overall risk assessment.

[SU3] What does a risk and control matrix (RCM) connect?

Objectives, risks, controls, and key information. One control may address several risks, and one risk may need several controls.

[SU3] What are common sources of potential engagements?

The charter/mandate, management risk assessments, independent validations, board/management requests, whistleblower reports, laws/regulations, and external-audit findings.

[SU3] Which roles make up the First Line?

Management and operational roles closest to delivering products or services; they are directly responsible for managing risk.

[SU3] What is the Second Line's role?

Provide risk-management expertise, support, monitoring, and challenge, such as through compliance or risk management.

[SU3] What is the Third Line's role?

Internal audit provides objective, independent assurance and advice on governance and risk management.

[SU3] What supports internal audit independence?

Accountability to the governing body, unrestricted access to people/resources/data, and freedom from bias or interference.

[SU3] When should an auditor avoid providing assurance over a recently managed area?

When the auditor held responsibility for that non-audit area during the previous 12 months, according to the supplied Gleim text.

[SU3] How must an applicable IIA Topical Requirement be used?

The supplied text says it must be used to assess the engagement.

[SU4] What does the QAIP evaluate?

The internal audit function's conformance, performance, efficiency/effectiveness, and opportunities for improvement.

[SU4] What are the four common QAIP components?

Conformance with Standards; achievement of performance objectives; compliance with relevant laws/regulations; improvement plans for deficiencies and opportunities.

[SU4] Distinguish ongoing monitoring from periodic self-assessment.

Ongoing monitoring is continuous day-to-day internal review; periodic self-assessment is a more comprehensive internal review.

[SU4] What is an external quality assessment (EQA)?

An independent external assessment performed by a qualified assessor or team.

[SU4] How often is an EQA required under the supplied Gleim guide?

At least once every five years.

[SU4] What does the board do in the EQA process?

Approves the assessment, receives the full results directly from the assessor, and approves action plans and timelines.

[SU4] What must be in place before internal audit claims compliance with the Standards?

A successfully functioning QAIP.

[SU4] What details must the CAE document and communicate when unable to conform with a Standard?

The nonconformance, alternative actions taken, their effects, and the rationale.

[SU4] When must nonconformance be disclosed to the board and senior management?

When it affects the overall scope or operation of the internal audit function; disclose the nonconformance and its impact.

[SU4] Distinguish quantitative from qualitative KPIs.

Quantitative measures are numerical/computable; qualitative measures capture deeper or nonquantifiable feedback, perceptions, and satisfaction.

[SU4] How does a performance objective differ from a KPI?

A performance objective is a specific goal; a KPI or scorecard metric measures progress and whether performance stays within tolerances.

[SU5] What are the four parts of an audit finding, in order?

Criteria → Condition → Cause → Effect.

[SU5] In a finding, what does Criteria describe?

What should be happening: the applicable requirement, policy, benchmark, or expectation.

[SU5] In a finding, what does Condition describe?

What is actually happening, as shown by audit evidence.

[SU5] In a finding, what does Cause describe?

Why the difference exists: the reason or root cause.

[SU5] In a finding, what does Effect describe?

The risk, exposure, or consequence resulting from the condition.

[SU5] What should a strong recommendation address?

The root cause, the gap between criteria and condition, identified risk, and/or opportunities to improve the activity.

[SU5] Distinguish an auditor recommendation from a management action plan.

A recommendation is the auditor's proposed action; a management action plan records the action management intends to take.

[SU5] What should be considered before finalizing recommendations or action plans?

Discuss them with authorized management; consider feasibility, cost-benefit, direct/indirect costs, and quantitative/qualitative benefits.

[SU5] Distinguish risk appetite from risk tolerance.

Appetite = types and amount of risk the organization is willing to accept; tolerance = acceptable variation in performance.

[SU5] What does risk attitude describe?

The organization's approach to assessing and potentially pursuing, retaining, taking, or avoiding risk.

[SU5] How do control design adequacy and operating effectiveness differ?

Design adequacy asks whether a control can address the risk; operating effectiveness asks whether it actually works as intended.

[SU5] What does control efficiency assess?

Whether the control avoids unnecessary effort, cost, and complexity while considering costs, benefits, and adverse effects.

[SU5] Who owns risk, and what is internal audit's role?

Management identifies and manages risk; the board oversees risk management; internal audit provides assurance about the risk-management system.

[SU5] What follow-up steps should internal audit perform?

Inquire about implementation progress, conduct risk-based follow-up assessments, and update the action-tracking system.

[SU5] What is the escalation sequence for unresolved action plans?

CAE → senior management → audit committee → board; unresolved matters may be reported to appropriate stakeholders under the methodology.

[SU6] What are the three purposes of engagement communication?

Inform stakeholders about findings, persuade them of the findings' validity and importance, and encourage change and improvement.

[SU6] What are the seven qualities of effective communication?

Accurate, objective, clear, concise, constructive, complete, and timely.

[SU6] When should interim communication be used?

When something should not wait for the final report, such as significant issues, scope changes, or progress on a long engagement.

[SU6] What belongs in final engagement communication?

Objectives, scope, recommendations/action plans if applicable, and conclusions. Assurance reports also include findings and significance, scope limitations, and a governance/risk/control conclusion.

[SU6] Who approves final engagement reports before issue?

The CAE.

[SU6] How must a significant final-report error or omission be corrected?

The CAE must promptly send corrected information to everyone who received the original communication.

[SU6] How should unacceptable risk acceptance be escalated?

Discuss it with senior management first; if unresolved, escalate to the board. The CAE does not own or resolve the risk.

[SU6] How should communication detail differ by audience?

Operating management generally needs detailed operational information; senior management generally needs appropriately generalized information about organization-wide significance.

[SU6] What makes evidence in a finding stronger?

Specific, neutral, verifiable evidence—for example, a numeric result rather than a vague claim.

[Exam rule] How should you approach an unfamiliar scenario question?

Identify the concept and responsible party, decide whether the question asks for a required or merely helpful action, then choose the option best supported by the rule.

[Exam rule] What should you do when an action-plan deadline is missed?

Confirm status and effectiveness, find out why action was not taken, and follow the established process based on significance and risk; do not close it automatically.

[Exam rule] What must you assess before relying on another assurance provider?

Competence and objectivity; consider reliance where appropriate, and check for gaps or duplicate work.

[Exam rule] Who manages risk and controls, and who independently evaluates them?

Management owns risk and controls; internal audit independently evaluates them and provides assurance/advice without taking on management