Certified Internal Auditor (CIA) Part 3 - New Syllabus

Study how to create annual and strategic internal audit plans from a three-year risk assessment to cover significant organizational risks, using a risk-based approach to define yearly work and resources.

Learn to report internal audits to senior management and the board, covering purpose, authority, responsibility, performance, ethics, conformance, and a mandatory self-assessment of risk control effectiveness and risk responses.

Coordinate with internal and external assurance providers to minimize duplication, share information, and broaden independent assurance across the three lines of defense.

Use assurance maps to visually link risks, risk owners, and departments to controls and audit coverage. Assess residual risk ratings and internal and external assurance across significant risks.

See how a long-term strategic plan guides the annual internal audit plan by aligning audit objectives with business objectives and ensuring comprehensive risk coverage.

Develop a risk-based internal audit plan from an annual risk assessment, grounded in the audit universe, with mandatory consultations with senior management and the board and approved consulting engagements.

Examine how audit approaches evolve with risk management maturity, shifting from control- and process-based methods to risk-based and enterprise risk management auditing, including reliance on internal assurance and hybrid approach.

Explore the balanced scorecard for internal audit, framing key performance indicators (KPIs) across financial, customer, processes, and learning and growth to measure budget, satisfaction, cost savings, and impact of recommendations.

Establish internal audit KPIs by defining what would make internal audit effective, identifying stakeholders, and monitoring and reporting effectiveness and efficiency to senior management and the board.

Communicate engagement results and monitor the implementation status of internal audit recommendations. Explain the acceptance of risk and conduct a confirmation meeting to verify the audit report with stakeholders.

Learn to communicate interim progress and recommendations with accuracy, objectivity, clarity, conciseness, completeness, and timeliness, and connect findings to root causes and risk remediation.

Master smart recommendations by making them specific, measurable, achievable, relevant, and time-based, and learn to design lean audit reports with purpose, scope, findings, recommendations, action plans, deadlines, and ownership.

Internal auditors escalate risk findings across management levels to the board, where acceptance of risk and risk appetite determine whether actions mitigate the risk or the risk is tolerated.

Monitor progress by assessing engagement outcomes and following up on internal audit recommendations to verify risk mitigation with evidence.

Explore how organizations plan their strategy, measure performance, and structure to achieve objectives, and examine the role of data analytics in internal auditing for stakeholder value.

Strategic objectives define long-term outcomes that increase stakeholder value, guided by board and management through strategic planning and multiyear plans; vision and mission statements clarify direction and purpose.

Learn how productivity rises by improving quality or quantity with the same resources, or by reducing resources, through balancing effectiveness, economy, and efficiency in internal audits.

Explore organizational behavior, the study of how people interact in groups and in an organization's culture, and see how individuals' behavior shapes workplace dynamics for internal auditors.

Apply Herzberg's motivation-hygiene theory to separate hygiene factors from motivators in the workplace. Identify how policy, supervision, work conditions, and salary prevent dissatisfaction, while growth and recognition boost satisfaction.

Explore McGregor's Theory X and Theory Y to compare management approaches, where X assumes dislike of work and close supervision, and Y assumes intrinsic motivation and participative management.

Explore Skinner's reinforcement theory and how behavior changes through positive reinforcement, negative reinforcement, extinction, and punishment. Learn practical examples of rewarding or removing consequences to shape behavior.

Reinforce an organization's culture by aligning ethics with education, providing resources, removing barriers like bonuses, and cultivating a participative culture with strong tone at the top.

Design jobs to boost overall performance and employee well-being by applying enlargement, rotation, and enrichment—providing more interesting tasks, greater variety, and growth opportunities.

Explore management control techniques along an autocratic to participative spectrum, including coercing, controlling information, assigning responsibilities, establishing accountability, measuring performance, and delegating authority and empowering teams.

Explore the five bases of power from French and Raven, including legitimate, coercive, expert, referent, and reward power, with examples from rank, threats, expertise, admiration, and rewards.

Build a risk inventory for the sales process within a CIA Part 3 audit, detailing governance, targets, marketing practices, data protection, and invoicing controls.

Evaluate procurement risk by examining policies, confidentiality controls, authorization practices, and tender processes to prevent noncompetitive bids, fraud, and conflicts of interest.

Clarify the project management lifecycle as planning and organizing resources to move a task toward completion, including tendering an offer as a project, and differentiate it from ongoing activities.

Master the theory of constraints, identify bottlenecks that limit output, and increase capacity at the constraint while balancing cost, quality, time, and scope as new constraints emerge.

Explore PERT and CPM using fast tracking and crashing to shorten project duration, with practical audit reporting examples and resource optimization within network analysis.

Identify core contract elements, including mutual agreement, consideration, and competent parties. Explain the mutual right to remedy breach, lawful subject matter, and the role of implied terms.

Identify and verify contract elements in external relationships, including proposals, offers comparison, timelines, payment terms, IP protection, termination, audit rights, cost sharing, compliance, performance metrics, and project reporting.

Discover common contract pricing forms, from fixed price agreements to cost reimbursement, price per unit, and joint venture contracts, with real-world examples like travel costs and shared expenses.

Identify the firm fixed price contract as the pricing form used when adequate competition exists, enabling identification of performance uncertainties and reasonable cost estimates with a price agreed upfront.

Examine data governance as processes, roles, policies, standards, and metrics that ensure efficient use of information to meet objectives, and define information security governance as the system directing information security.

Diagnostic data analytics interprets past performance to determine what happened and why, using trend analysis, data mining, and noting that correlation is not causation to identify root causes.

Explore prescriptive data analytics, building on descriptive, diagnostic, and predictive analytics to recommend actions, assess options, and quantify impacts on future opportunities and risks.

Determine objectives of the data analytics program and what value data should provide. Obtain, cleanse, and normalize data to reduce errors, then analyze and present results with graphs and visualizations.

Protect information by mitigating risks and preventing unauthorized or inappropriate access, while applying physical and information security controls and addressing data protection, privacy, and emerging cyber risks.

explore information technology general controls that apply to all systems, including governance, operations, backups and testing, change controls, and security, with emphasis on BCP, disaster recovery, and ISO 27001 governance.

A data center physical security audit recommends biometric authentication for workers and supplementary iris recognition. Avoid replacing the current system, and note password verification is not biometric.

Identify physical design considerations for data centers, such as uninterruptible power supply, surge protection, location, environment, and backup and emergency systems.

Explore identity access management by provisioning, terminating access, and enforcing segregation of duties. Remove obsolete rights, apply IAM administration and auditing, and enforce strong passwords to deter brute force attacks.

Learn how passwords should be fresh, unique, and not shared, and explore two factor authentication as a stronger defense using a password plus a biometric control such as a thumbprint.

Explore various information security controls, including encryption, firewalls, intrusion detection, antivirus software, biometric authentication, user behavior analytics, honeypots, data loss prevention, machine learning threat detection, and cloud security.

Explore encryption, which converts data into an unreadable coded form to prevent unauthorized access, and its link to logical access controls and confidential codes for privileged accounts.

Examine data privacy and protection, defining personal identifying information and data subject rights under GDPR, and explain how data use, access, and deletion must be controlled and acknowledged.

An internal auditor reviews the BYOD policy to assess the adequacy of security protections and patch updates as the primary control objective in a GDPR-influenced environment.

This lecture clarifies internal auditor's data privacy role, highlighting assurance that privacy laws are communicated to responsible parties, while surveys, training, and privacy test script validation procedures remain implementation tasks.

Define cybersecurity as protecting information through prevention, detection, and response to attacks, and examine malware as software that damages, disrupts, or gains unauthorized access, with Stuxnet as a notable example.

Explore the ecosystem of cybersecurity threats, from viruses and worms to ransomware and trojans. Learn how social engineering, phishing, insider threats, and data diddling enable attackers to compromise systems.

Identify phishing as a social engineering cyber threat that deceives recipients via email to reveal sensitive data, such as passwords or financial information, by impersonating a trusted source.

Apply elimination to see that viruses and worms spread by themselves, while Trojans, a type of Trojan horse, use social engineering to appear harmless.

Explain how malicious programs replicate themselves, distinguishing viruses from worms that replicate without external action, and describe Trojan horse and backdoor as other threats.

Enforce the principle of least privilege for application access, monitor privileged accounts with access management software, and implement robust patch, update, and antivirus controls.

Apply technical infrastructure controls and establish baseline performance for systems, networks, and resources. Monitor unusual traffic, implement change controls, ensure tested backup and recovery, and inventory assets to identify vulnerabilities.

Verify third party information security through SLA monitoring, SOC reports, insurance clauses, explicit security arrangements, and ensure prompt response and remediation with ongoing risk monitoring and service level monitoring.

Enforce password control procedures to block unauthorized access from store terminals and deter insider threats that could trigger fictitious orders, protecting distribution patterns.

Explore the layers model of IT management, external connections, and technical infrastructure, and how these layers support business applications, with governance, staffing, policies and procedures, and disaster recovery planning.

Compare key systems development methods, including waterfall, spiral, rapid development, and agile, highlighting phased versus iterative approaches, risk management, testing, and continuous improvement.

The waterfall method enforces sign-offs at the end of each stage, improving control and reducing wasted resources, but its inflexibility can extend deadlines.

Explore diverse application testing methods across alpha, pilot, beta, and user acceptance phases, and assess load, throughput, regression, security, sociability, and system testing.

Explore software testing concepts including beta testing, throughput testing, load testing, and systems testing, and validate interfaces with all systems to detect inner communication bugs.

Explore the client-server model, where servers provide processing power and storage to multiple devices, and learn how networks, VPNs, intranets, gateways, routers, firewalls, and mainframes enable secure, scalable infrastructure.

Explore how business continuity and disaster recovery planning ensure an organization sustains products and services after a disruption, with disaster recovery focusing on it and incident response.

Highlight how a thorough recovery plan enhances business continuity and disaster recovery planning to resume operations quickly after contingencies and interruptions.

Explore data backup and recovery controls, including daily, weekly, and monthly retention using sun, son, father, and grandfather backups; offsite and cloud backups; change-based updates; and recovery testing.

Explore the concepts and principles of financial and management accounting, including budgeting, transfer pricing, costing systems, and internal versus external reporting for strategic financial decision making.

Practice dual-entry accounting by determining whether entries increase or decrease assets, liabilities, capital, dividends, retained earnings, revenues, and expenses using a chart.

Compare cash-basis and accrual-basis accounting by showing revenue recognized when cash is received versus when earned, and apply the matching principle to two-year contracts with annual cutoffs.

Explore the installment sales method for revenue recognition, where revenue is recognized at delivery up to cost of goods sold, and the remaining profit is recognized when cash is collected.

Explore the cost recovery method for revenue recognition when collection is uncertain after delivery. Revenue is recognized only after cash collections exceed the cost of goods or services sold.

Learn how the activity method depreciation estimates expense by units produced, using the proportion of actual units to total expected units, illustrated with a $10,000 machine.

Explore lessor lease methods, including operating, direct financing, leveraged, and sales type leases, and how IFRS standards emphasize substance over form when the asset title does not transfer.

Explore debt and leverage ratios, including operating leverage and fixed versus variable costs, and examine how financial leverage, debt ratio, debt-to-equity ratio, and CVP analysis affect revenue, return, and risk.

Explore liquidity ratios, including the current ratio and quick ratio, comparing current assets (cash, inventory, marketable securities, accounts receivable) to current liabilities (accounts payable and other short-term obligations).

Understand net working capital by calculating current assets minus current liabilities, assuming accounts receivable are paid on time, accounts payable not delayed, and marketable securities change.

Explore profitability ratios by analyzing gross profit margin, operating profit margin, and net profit margin, highlighting how the cost of goods sold, taxes, and interest affect net earnings.

Analyze how return on assets (ROA) measures a firm's ability to convert assets into net income using the average total assets across two periods.

Analyze the price to earnings ratio, defined as stock price divided by earnings per share, and explain how a high or low pe ratio signals growth expectations or potential overvaluation.

Analyze accounts receivable turnover, DSO, and accounts payable turnover (DPO). Explore inventory turnover and fixed asset turnover, and explain the cash conversion cycle DIO + DSO − DPO.

Examine capital structure and budgeting through the master budget, detailing operating budgets for ongoing operations, capital budgets for large projects, and financial budgets linking uses and sources of funds.

Determine the payback period by tracking cumulative cash flows without discounting, showing repayment occurs in the fourth month of the fourth year.

Identify responsibility centers as units within an organization, cost centers that control costs, profit or revenue centers that boost revenues while managing costs, and investment centers that oversee capital budgeting.

Explore cost accounting concepts through a shoe workshop example, defining cost objects and cost drivers, and distinguishing direct and indirect costs like leather, workshop, and staff expenses.

Explore cost accumulation and allocation systems, comparing actual, normal, and standard costing, and distinguish job costing for unique projects from process costing for mass production, including overhead allocation.