Certified Internal Auditor (CIA) Part 2 - New Syllabus

Plan internal audit engagements aligned with the annual plan, secure resources, and execute an audit program from risk assessment through fieldwork, including design and operating effectiveness tests.

Learn how engagement objectives and scope frame internal audits under the new IIA standards. Identify risk-based planning, materiality, and tests that cover governance, risk, and internal controls.

Assess the expenditure cycle to ensure that all goods paid for are received and charged to the correct account, emphasizing safeguarding of assets and cash.

Assess how the scope of engagements and coverage of significant risks shape engagement reports. Exercise due professional care by reporting material findings within the defined scope and objectives.

Identify generally accepted criteria for assurance engagements, note that management objectives are unsuitable, and judge criteria against control framework, acts, regulations, and industry best practice.

Explore the workflow of an engagement from the annual internal audit plan through planning, preparation, field work, and report drafting, covering risk assessment, data collection, and controls design.

The lecture explains how internal auditors identify and cover significant risks through detailed risk assessments, risk inventories, and control evaluations, guided by due professional care and the code of ethics.

Explore engagement work programs and the risk control matrix to design audits that identify objectives, assess inherent risk, document controls, test operating effectiveness, and report findings.

Under the 2025 standards, the chief audit executive must ensure internal audit resources are sufficient, appropriate, and used effectively; the board of directors and management must engage to resolve gaps.

Learn IT general controls across IT strategy, operations, security, and change management, including separation of duties and Cobit 5 alignment of IT with business risk.

Explore information gathering techniques for internal audits, including walkthroughs, observation, and interviews to assess risks. Benchmark against ISO standards and use process mapping and gap analysis to identify improvements.

Explain how to perform a walk through to identify root causes of control failures, assess training gaps, consider deliberate omissions, and propose improvements such as training, escalation, or control redesign.

Determine the operating effectiveness of internal controls by applying tests of controls, focusing on safeguarding assets, and evaluating background tests and inventory controls.

Explore interview approaches for internal audit, including structured, behavioral, and situational interviews, and master skills like active listening, note-taking, open questions, and handling nonverbal behaviors.

Explore process maps and benchmarking to compare current, ideal, and actual workflows, identify risks and inefficiencies, and apply internal, competitive, industrial, and best in class benchmarks for auditing.

Explore risk control matrices as a focused audit program that links objectives to risks, assesses controls and operating effectiveness, and documents risk-based thinking for team accountability.

Identify objectives before risks and build a risk control matrix using the Kozo framework; assess inherent risks, design controls, test operating effectiveness, and report findings.

Compare statistical and non-statistical sampling methods to infer population risk from samples, using risk-based selection like gifts and unusual expenses.

Explore attribute sampling, ratio estimation, stratified random sampling, and cluster sampling to determine how well a sample represents a population. Avoid biases from non-homogeneous data and convenient but unrepresentative selections.

Use generalized audit software to read the total loan file, age by last payment, and stratify samples by current or non current to test collateralization and aging.

Explore normal distribution and its measures—mean, median, mode, and variance with standard deviation—through practical audit scenarios like arrival times, auction prices, and outliers.

Explore how increasing confidence level from 95% to 98% or expanding the range of error impacts sample size, population size, and alpha risk across stocks.

Explore statistical process control concepts, including upper and lower control limits and natural variation, and apply trend analysis to uncover unreasonable relationships in cost data.

Assess insufficient evidence when 5% of employees are from minority groups and none were hired last year. Recognize that without data on where minorities work, you cannot conclude a problem.

Explore analytical tests for internal audits, including numerical analysis, regression analysis, data mining, and continuous monitoring, using Bedford's law and trend analysis to detect anomalies.

Explore continuous auditing with automated tests and exception reports, and embedded audit modules that flag transactions by criteria, enabling real-time insights from a data repository and specialized apps.

Identify analytical tests within continuous auditing and embedded audit modules, using accounts payable schedules, vendor invoices, creditor confirmations, and trend analysis of prior year balances.

Discover how persuasiveness hinges on sufficient, reliable, and relevant information that is factual, replicable, and credible, supporting audit observations and objectives.

Explain direct evidence and its certainty, compare primary and secondary evidence, and show how corroborative, analytical, and testimonial evidence support audit findings.

Evaluate audit evidence types and identify the most persuasive sources, from real estate deeds to vendor invoices, and explain the forensic information systems auditor as an expert witness.

Define ratios as a division, interpret kpis, and assess operational and liquidity performance using inventory turnover, days of sales outstanding, current ratio, and quick ratio.

Analyze debt and profitability ratios, including debt ratio, debt-to-equity, times interest earned, and fixed payment coverage, and apply Pareto analysis to prioritize internal audit recommendations.

Identify supervision points from engagement planning, audit engagement letters, risk assessment, to final audit report, ensuring standards and scope are met.

Explore performance appraisals within an internal audit context, emphasizing post engagement evaluations to combat recency bias and produce a balanced annual appraisal.

Explore practical supervision best practices for internal audit teams, assigning clear areas, delegating planning, objectives, testing, and oversight while developing staff.

Reviewing working papers ensures high-quality documentation by linking risks, objectives, and tests, guiding audit quality reviews, sign-off checks, and finalizing the internal audit file.

Identify appropriate evidence of supervisory review for engagement working papers, including supervisor initials on each paper, an engagement review checklist, and a memorandum detailing nature, extent, and results.

Explore the main types of internal audit engagements, including assurance, consulting, control self assessments, and fraud examinations, with emphasis on independence, audit committee approvals, and planning.

Identify common engagements, such as external business relationships, quality audits, due diligence, security and privacy audits, and compliance and environmental audits, with a focus on real-world examples.

Explore due diligence in merger and acquisition engagements, identifying the least valid reason for a merger, such as stock prices rising, and examine diversification, cost reduction, and cross-border acquisition dynamics.

Audit external business relationships by evaluating formal and informal contracts, unilateral and bilateral clauses, express or implied agreements, and risks like non-compliance, intellectual property threats, conflicts of interest, and disruptions.

Identify and assess external business relationships, and implement controls through RFPs, supplier master files, audits, and SLAs to monitor service levels and protect IP.

Explore contract basics, including mutual agreement, consideration, competent parties, and power of attorney, plus remedies and proper subject matter for lawful objectives.

Evaluate contract controls in external relationships by reviewing requests for proposals, supplier capabilities, ethical standards, delivery timelines, IP protection, payment terms, and KPIs.

Explore the costs of quality, detailing prevention, appraisal, internal and external failure costs. Emphasizes early prevention and higher quality inputs to avoid defects, transportation damage, returns, and reputational damage.

Define due diligence in mergers and acquisitions, detailing pre acquisition and post acquisition stages, buyer and seller perspectives, price assessment, and how internal auditors adjust offers or cancel deals.

Explore how security audits protect assets and information integrity by assessing data storage risks, backups, labeling, and access controls, including ISO 27001 classifications and disaster-ready replication.

Audit data protection policies across GDPR, the Australia Privacy Act, and Japan PIPA. Assess consent, collection, use, retention, access, disclosure, security, and data quality.

Explore operational audits by evaluating the effectiveness, efficiency, and economy of organizational processes, and use benchmarking against other operations or past performance to identify issues.

Focus on internal controls to ensure accurate financial reporting, while external auditors verify statements align with generally accepted accounting principles and present a true and fair view.

an auditor highlights segregating duties in accounts payable by preventing vendor master file maintenance from entering invoices, using a future-focused, risk-based approach to correct the deficiency via access control updates.

Explore the internal control environment and its base role, examining board and management attitude and actions, code of ethics, risk assessment, and hiring practices to strengthen monitoring and control activities.

Explore how assignment of authority and responsibility, human resource policies and practices, commitment to competence, and organizational structure shape the internal control environment and risk monitoring.

Define a compliance framework with internal and external components to identify and remedy breaches, promoting ethical conduct through policies, training, and clear escalation channels, including whistleblowing.

Explore compliance audit checks in a medical supplies company by reviewing safety training logs, anti-money laundering training verification, forklift driver certifications, and the appropriateness of testing debit accounts against receipts.

Assess environmental compliance through internal audits that cover health and safety, carbon reporting, waste reduction, environmental management systems, and due diligence on land and hazardous substances.

Explore the systems development life cycle, from planning and requirements analysis to design, testing, and implementation, emphasizing user feedback, ongoing improvement, and internal audit controls.

Examine the systems development life cycle through assurance engagements, reviewing criteria for enterprise management platform implementation and clarifying what internal auditors can monitor, review, or develop.

Educate the board and senior management on governance and risk management. Review risk frameworks, laws, regulations, and standards to provide governance assurance, and facilitate workshops identifying emerging risks.

Plan internal audit engagements by defining objectives, scope, and criteria, outlining risk-based procedures and working papers, and considering staffing under standards 2210.

Distinguish extent from nature in internal audit engagements. Explore how materiality, geographic and department limits, and planning shape tests of controls, substantive procedures, and analytical methods in engagements.

Explore engagement objectives, including safeguarding assets, profitability through revenue and costs, service delivery, and reliability of reporting, while assessing risks, fraud, and compliance under planning standards.

Identify and document significant risks in the planning phase using a risk assessment, heat map, and process flow charts to map risks and controls.

Define engagement work programs as the tests, risks, and objectives guiding internal audit engagements, and learn how they support planning, assurance, and resource allocation for the audit.

Develop a risk-based internal audit plan and manage engagements across strategic and operational perspectives, aligning policies, ethics governance, and reporting to the board and management.

Learn how internal audit policies and procedures, aligned with the IIA standards, enable a quality assurance program through the internal audit charter, strategic and annual plans, and the audit manual.

Establish independence and define the internal audit charter's scope, mission, and reporting lines, with unfettered access and direct contact rights to the audit committee, board, shareholders, and regulator.

Examine annual and strategic internal audit plans built on a three-year risk assessment, guiding risk-based audits and resourcing for CIA Part 2.

Define your internal audit manual by detailing organisation, planning procedures, risk assessment methods, sampling, engagement procedures, and supervision. Emphasize quality assurance, self-assessment, KPIs, and clear sign-off processes to evaluate performance.

Learn how internal audits report to senior management and the board, covering purpose, authority, responsibility, performance, ethics, standards conformance, and assessing significant risk, control effectiveness, and risk responses.

Make internal audit add value by fulfilling the charter, adhering to standards and ethics, and applying a risk-based approach to governance, risk management, and internal controls.

The chief audit executive implements directive, detective, and corrective controls guided by policies, templates, mentoring, and CPD to ensure proper risk assessment and strong internal audit activity.

Translate a strategic risk assessment into a three-year, risk-based internal audit plan by prioritizing processes, incorporating management and audit committee feedback, and aligning resources for annual engagement planning.

Align the annual internal audit plan with the organization's strategic plan by ensuring audit objectives support business objectives and comprehensive risk coverage.

Create a risk-based internal audit plan from a documented annual risk assessment and an audit universe, with management and board consultation and consulting engagements added and approved.

Explore how audit approaches evolve with risk management maturity, shifting from control-based and process-based methods to risk-based auditing aligned to organizational maturity.

Coordinate with assurance providers to minimize duplication and improve coverage by sharing plans, data, and findings with external auditors. Clarify reporting lines and independence to ensure board oversight of assurance.

Coordinate with regulatory examiners to provide evidence of adequacy through internal audit working papers and reports, while avoiding bias, refraining from influencing laws or scope, and ensuring ethical disclosure.

Map and evaluate assurance across organizational risks by plotting risks against departments and risk owners, rating inherent and residual risk with color scales, and integrating internal and external audit coverage.

Communicate significant risk exposures and residual risks to the board and senior management, evaluate internal controls and risk management, and report internal audit plans and KPIs with governance insights.

Explore how the balanced scorecard structures internal audit KPIs across financial, customer, processes, and learning and growth, covering budget, cost savings, independence, and ethics.

Define what would make internal audit effective, identify stakeholders, and develop KPIs on effectiveness and efficiency to communicate results to senior management and the board.

Establish internal audit KPIs by focusing on outcomes and long-term goals, not only short-term financial targets, and start by understanding goals and objectives to define audit effectiveness.

Learn to communicate engagement results, acceptance of risk, and monitor implementation status of audit recommendations via a confirmation process emphasizing preliminary and quality communication, interim reporting, and final audit report.

Confirm audit findings and recommendations with the audit client across multiple levels, from junior accountant to CFO, to corroborate information and finalize the report with agreed action plans.

Learn to craft accurate, objective, clear, and concise audit communications, avoiding acronyms, incorporating mitigating circumstances, and delivering complete, timely, constructive reports.

Communicate interim progress during the audit, flagging scope changes and high-impact issues that require immediate attention, and include closed-during-audit items with date updates in the final report.

Describe the risk and implications of audit findings, identify root causes, and propose remedies that address underlying issues. Recommend realistic action plans with owners and monitoring to mitigate risk.

Identify and apply smart criteria for recommendations—specific, measurable, achievable, relevant, time-based—and structure lean audit reports with purpose, scope, findings, recommendations, action plans, deadlines, and owners.

Explore internal audit opinions, including engagement and overall opinions, and discuss maturity matrices for risk management and internal controls, highlighting the difference between positive, negative, and qualified assurances.

Learn how internal audit opinions rely on documenting observations and seeking management agreement on operating performance criteria, with recommendations that enable engagement and practical corrective actions.

Understand the acceptance of risk in internal audit, including escalation from middle to senior management and to the board. Learn how the board sets risk appetite and approves mitigation actions.

Learn to monitor progress, assess engagement outcomes, and establish a robust follow-up on the implementation status of internal audit recommendations, including evidence, management reporting, and audit committee oversight.

Assess why senior management accepts risk after an internal control weakness, and establish a follow-up monitoring process to ensure corrective actions and inform the board.

Congratulations on finishing the CIA part 2 - new syllabus course. Celebrate this milestone in your professional journey.