IIA Updated IIA-CIA-Part2 Exam Questions and Answers by seb

According to IIA guidance, there is no specific frequency mandated for conducting organization-wide risk assessments. Instead, the internal audit activity should perform risk assessments as necessary to reflect significant changes in the organization's business environment, risk profile, and operations. This flexibility allows the internal audit activity to remain responsive and relevant in a dynamic risk landscape.

IIA References:

IIA Standard 2010: Planning requires the CAE to establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals. The frequency and timing of risk assessments should be adapted to the organization’s changing conditions.

The IIA Practice Guide on Risk Assessment in Audit Planning emphasizes that risk assessments should be updated as needed, particularly when there are significant changes in the organization or external environment.

During the planning phase of a new engagement, an engagement supervisor is responsible for ensuring that the engagement is designed effectively to meet its objectives. One of the critical tasks involves approving the engagement work program. The work program outlines the detailed steps and procedures that the audit team will follow during the engagement. By approving this program, the supervisor ensures that it is comprehensive, aligned with the engagement objectives, and capable of addressing identified risks and controls effectively. This step is essential to ensure that the engagement is conducted systematically and covers all necessary areas.

References:

The Institute of Internal Auditors (IIA) Standard 2200: Engagement Planning

IIA Practice Advisory 2200-1: Engagement Planning Considerations

To determine whether company vehicles are being used for personal purposes, the auditor needs location and route data of the vehicles in addition to the initial data extracted. This additional information would allow the auditor to track the specific routes and destinations of the vehicles, making it possible to identify patterns of use that do not align with business purposes, especially during weekends. The location and route data can help in pinpointing any non-business-related usage of the vehicles, providing evidence of personal use.

References:

IIA Practice Guide: "Auditing Operational Activities"

COSO Internal Control – Integrated Framework

The role of the CAE includes ensuring that all significant risks, including those related to health and safety, are properly managed. Even though the chief health and safety officer reports directly to the CEO, the CAE should still coordinate with and review the work of this officer to understand and evaluate the management of health and safety risks. This helps ensure a comprehensive risk management approach within the organization and supports the overall assurance framework. It is not appropriate for the CAE to have no role (Option A), report directly to the regulator (Option C), or hire an external specialist annually without internal coordination (Option D).References:

IIA Standard 2010: Planning.

IIA Practice Guide on Coordinating Risk Management and Assurance.