Certified Internal Auditor (CIA) Part 1 - New Syllabus

This lecture explains independence and objectivity in internal auditing, detailing board-approved internal audit charter, reporting lines, freedom from interference, access to information, and safeguards against threats and conflicts of interest.

Examine external business relationships with suppliers, clients, and partners, and assess risks from noncompliance, IP threats, and conflicts of interest; cover contracts, SLAs, due diligence, and audits.

Understand the internal control environment as the base of the COSO pyramid. Examine management attitude, tone at the top, ethics, reporting lines, and training shaping controls and risk assessment.

Educate the board and senior management on governance and risk management, review laws and standards, and facilitate workshops to identify emerging risks for the internal audit plan.

Develop objectivity in internal auditing by upholding the code of ethics and avoiding conflicts of interest. Disclose all material facts to prevent distorted reporting and maintain independent, accurate work.

Internal auditors must perform only services they have the knowledge, skills, and experience for, under chief audit executive oversight, and continually improve through professional education to standards.

Coordinate governance actions, risk management, and control to manage risk and keep the organization on track to its objectives, containing risks within risk tolerance at the lowest cost.

COSO's control environment forms the foundation of the pyramid. It covers culture, tone at the top, and hiring practices that shape integrity, ethics, and overall risk management.

Examine how controls operate at the entity, process, and transaction levels, and how internal audits assess governance, journal entries, and financial statements to mitigate risks across the organization.

Examine how internal controls promote performance and profitability targets, support organizational goals, and increase likelihood—never guarantee—while aiding resource protection and reliable financial reporting.

Explore control self-assessment as a structured process where managers and teams assess risks, controls, and objectives, with internal audit providing varied involvement from verifier to facilitator.

Explore the audit risk model by defining inherent risk, control risk, and detection risk, and understand residual risk through practical examples from external and internal auditing.

Explore how the board defines risk appetite as the level of risk it will accept and how acceptable risk tolerates that risk, consciously or unconsciously, without further controls.

Identify objectives and risk events, assess likelihood and impact, and determine inherent and residual risk; apply risk responses such as hedging and map risks visually.

Show how inherent and residual risks shift from high to medium or low as controls mitigate likelihood and impact. Explain acceptance of unmitigated risk and the resulting risk response.

Explore the enterprise risk management model based on the coso cube, expanding risk assessment into event identification, evaluation, and responses, with emphasis on objective setting, control activities, communication, and monitoring.

Management uses risk controls to convert acceptable risk within the risk appetite, and joint ventures share risk to transform unacceptable risk into acceptable.

Internal audit can rely on ISO 31000–based risk maturity models and the CMI maturity model, using stages from initial to defined as a roadmap for risk management.

Explore psychological biases for assessing risk, including the Dunning–Kruger effect and prospect theory, and discuss how biases hinder precise, granular risk management for internal auditors.

Explore the enterprise risk management model, from the board setting risk appetite to management implementing controls. The risk officer coordinates practices across the organization, with internal audit reviewing their work.

Apply assurance mapping to visualize three lines of defense across risks, controls, and risk owners. Assess inherent and residual risk levels and audit coverage, including IT security risks and governance.

Discover how internal auditors identify, assess, and address fraud risks, integrate fraud indicators into the audit plan, and decide when to perform extra tests or pursue investigations.

The fraud triangle explains how opportunity, motive, and rationalization drive fraud; weak controls and unverified payments create opportunity, while financial pressure and entitlement fuel motive and rationalization.

Contrast interviews and interrogations in fraud cases, explaining distinct goals, settings, and questioning approaches used by internal auditors versus specialized fraud investigators.

forensic auditors gather admissible evidence and test fraud narratives, often requiring legal background or certifications, while internal auditors identify fraud indicators, red flags, and weak controls.

Explore how internal auditors assess governance, risk management, and effective controls, shaping the control environment through ethics, culture, and continuous improvement across projects such as construction sites.

Enhance governance through independent internal auditing that communicates risk and control information to the board, coordinates internal and external assurance, and adds value with risk-based advice.

Explore the core principles of internal auditing, including integrity, competence, objectivity, independence, and risk alignment, supported by the code of ethics and the internal audit charter.

Explore the Institute of Internal Auditors standards, including attribute and performance standards, and how governance, risk management, and internal controls guide internal audit activities.

Examine organizational independence and its effect on objectivity in the internal audit activity, including reporting lines, threats, and how independence supports adherence to standards and ethics.

Explore administrative reporting and the dotted line relationship with senior management to support operations, including payroll processing and internal communications via published policies, with clear limits on budgets.

The internal audit charter establishes independence, reporting lines, scope, and accountability, aligning with IIA standards and confirming the chief audit executive's duties, unfettered access, and annual board-approved oversight.

Explore internal audit staffing by aligning resources with a risk-based plan, ensuring sufficient, appropriate, and effectively used expertise, whether in-house, outsourced, subcontracted, or seconded, while upholding ethics.

Perform due professional care by conducting formal risk assessments to identify all significant risks, document findings, discuss with leadership, and deliver auditable results in internal audits.

Explore the CIA part one code of ethics, emphasizing integrity, objectivity, confidentiality, and competency, with guidance on honesty, diligence, responsibility, observing the law, and disclosures for conflict of interest.

Internal auditors protect confidentiality and prudently handle information, avoiding personal gain or illegal actions. They guide colleagues toward whistleblowing channels and explain that standards do not guarantee anonymity.