Section B. Information Gathering, Analysis, and Evaluation

Output of Standard 14.1: Gathering Information for Analyses and Evaluation

Completed Audit Procedures, Supporting Evidence

Output of Standard 14.2: Analyses and Potential Engagement Findings

Preliminary Findings, Workpaper Drafts with Criteria and Condition

Output of Standard 14.3: Evaluation of Engagement Findings

Finalized Root Cause, Risk Assessment, Rating of Findings

Output of Standard 14.4: Recommendations and Action Plans

Recommendations, Management Action Plans, Justification

Output of Standard 14.5: Engagement Conclusion

Overall Conclusion on GRC Effectiveness, Audit Ratings

Output of Standard 14.6: Engagement Documentation

Finalized Workpapers with Attributes of Observation, Cross-referenced to Report

GIAS Principle 14

Conduct Engagement Work

This principle outlines the execution phase of the internal audit engagement, where the planned procedures are carried out to gather sufficient, reliable, and relevant evidence to support conclusions.

Principle 14: Conduct Engagement Work

Before commencing fieldwork, internal auditors should revisit key outputs from the planning phase, which typically include:

• Engagement Objectives

• Evaluation Criteria

• Engagement Work Program

It is developed based on a preliminary risk assessment to guide the scope and focus of the engagement.

Engagement Objectives

These are standards, benchmarks, or expectations (e.g., policies, procedures, laws, regulations, or frameworks) used to assess the adequacy and effectiveness of governance, risk management, and control processes.

Evaluation Criteria

It is a detailed plan of tasks and audit procedures derived from the planning phase, used to identify, analyze, and document audit evidence.

Engagement Work Program

Attributes of Observation and Recommendation

CCR ERR

• Criteria - The benchmark or standard (e.g., policy, regulation, framework) used to evaluate performance

• Condition - The current state observed or documented during the audit

• Root Cause - The underlying reason for the deviation between condition and criteria

• Effect - The risk or consequence resulting from the identified issue

• Rating - Assessment of the severity or significance of the issue (e.g., high, medium, low)

• Recommendation - Suggested corrective action to address the root cause and mitigate risk

Standard 14.1: Gathering Information for Analyses and Evaluation Requirements.
To perform analyses and evaluations, internal auditors must gather information that is:

• Relevant

• Reliable

• Sufficient

This means consistent with engagement objectives, within the scope of the engagement, and contributes to the development of engagement results.

Relevant

It means factual and current. Internal auditors use professional skepticism to evaluate whether information is ___________.

Reliable

Reliability is strengthened when the information is:

• Obtained directly by an internal auditor

• From an independent source

• Corroborated

• Gather from a system with effective governance, risk management, and control processes.

It enables internal auditors to perform analyses and complete evaluations and can enable a prudent, informed, and competent person to repeat the engagement work program and reach the same conclusion as the internal auditor.

Sufficient

If relevant evidence cannot be obtained, internal auditors must determine whether to identify that as a finding (T/F)

True

Internal auditors begin gathering information—-including audit evidence—-during the execution phase. (T/F)

False (planning phase)

A thorough review of these will equip auditors to identify and collect relevant, reliable, sufficient, and useful information.

Objectives and Work Program

It outlines the specific procedures that auditors will perform and serves as a structured guide for executing the engagement.

Work Program

The extent and nature of testing depends on __________ of evidence obtained.

adequacy

In cases where testing does not yield sufficient evidence to support conclusions or recommendations, internal auditors must adjust the __________ and consider performing additional or alternative procedures.

testing strategy

According to Standard 14.2 Analyses and Potential Engagement Findings. Internal auditors must analyze relevant, reliable, and sufficient information to develop potential engagement finding. For advisory services, gathering evidence to develop findings may not be necessary, depending on the agreement with relevant stakeholders (T/F)

True

A difference between the criteria and condition is indicative of this, that must be noted and further evaluated.

Potential engagement finding

If additional analyses are required, the work program must be adjusted accordingly and approved by the _____________

Chief Audit Executive

According to the Requirement of Standard 14.3 Evaluation of Findings. Internal auditors must evaluate each potential engagement finding to determine its __________

significance

When evaluating potential engagement findings, internal auditors must collaborate with management to identify the ________, ________, and evaluate the __________ of the issue

root cause, potential effects, significance

Internal auditors are required to evaluate each potential engagement finding to determine its significance. This evaluation involves more than just identifying gap—-it includes understanding why _________, what _______ it has on the organization, and how it aligns with the organization’s _______ and _______.

the issue occurred, impact, risk appetite and tolerance

This is often performed in collaboration with the audit client to ensure accuracy, ownership, and practical insights into why a control or process failed. It is also one of the first and most critical steps in evaluation of findings.

Root Cause Analysis.

Standard 14.4 Recommendation and Action Plans Requirements:

Internal auditor must determine whether to develop recommendations, requiest action plans from management, or collaborate with management to agree on actions to:

• Resolve the differences between the established criteria and the existing condition.

• Mitigate identified risks to an acceptable level.

• Address the root cause of the finding.

• Enhance or improve the activity under review.

When developing recommendations, internal auditors must discuss the recommendations with the management of the activity under review (T/F)

True

If internal auditors and management disagree about the engagement recommendations and/or action plans, internal auditors must follow an ______________ to allow both parties to express their positions and rationale and to determine a resolution.

established methodology (Standard 9.3 Methodologies)

After the recommendation is developed, internal auditors request _________ from management.

formal action plan

This outlines how the auditee will address the finding, the timeline for implementation, and the responsible parties. It is important that this specifically targets the risks and root causes identified during the engagement.

Formal Action Plan

It summarizes the engagement results relative to the engagement objectives, and management objectives. It must summarize the internal auditors’ professional judgment about the overall significance of the aggregated engagement findings.

Engagement Conclusion

For assurance engagements, conclusions must include an evaluation of the effectiveness of governance, risk management, and control (GRC) processes in the area under review (T/F)

True

When appropriate, auditors should also acknowledge when these processes are functioning effectively and support the achievement of organization objectives (T/F)

True

Standard 14.6 Engagement Documentation Requirements

• Internal auditors must document information and evidence to support the engagement results. The analyses, evaluations, and supporting information relevant to an engagement must be documented such that an informed, prudent internal auditor, or similarly informed and competent person, could repeat the work and derive the same engagement results.

• Internal auditors and the engagement supervisor must review the engagement documentation for accuracy, relevance, and completeness. The chief audit executive must review and approve the engagement as well as policies and procedures of the internal audit function and the organization.

They serve as ultimately support the conclusions and content of the final audit report

Working papers

Standard 12.3

Oversee and Improve Engagement Performance.

They must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies.

Chief Audit Executive

They must provide internal auditors with guidance throughout the engagement, verify work programs are complete, and confirm engagement workpapers adequately support findings, conclusions, and recommendations.

CAE or Engagement Supervisor

To assure quality, they must verify whether engagements are performed in conformance with Standards and the internal audit function’s methodologies.

CAE

To develop competencies, they must provide internal auditors with feedback about their performance and opportunities for improvement.

CAE

Standard 12.3 Oversee and Improve Engagement Performance. Role of CAE:

• To provide guidance throughout the engagement

• To assure quality

• To develop competencies

Standard 12.3 Oversee and Improve Engagement Performance. The extent of supervision required depends on the:

• maturity of internal audit function

• proficiency and experience of internal auditors

• complexity of engagements

When the engagement is performed by other service providers, the engagement partner is responsible for the supervision of audit (T/F)

False

Supervisory responsibilities may be delegated, but the _____ retains ultimate responsibilities.

CAE

It entails confirming that audit activities conform to GIAS 2024 and internal audit methodologies.

Quality assurance