Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA3: Managing the Internal Audit Function: Policies, Coordination, and Reliance
Transcript
- Marcus: Emma, let's start with a scenario I think every auditor dreads. An internal audit team spends weeks on a fraud review, only to find out the compliance team was doing almost the exact same thing. Emma: It's such a costly mistake. Wasted hours, frustrated business leaders getting duplicate requests… it’s the perfect example of why managing the internal audit function effectively is so critical. It’s not just about doing good audits; it’s about running a smart, efficient operation. Marcus: And that’s what we’re covering today—the framework for that smart operation. Specifically, two key standards for any Chief Audit Executive, or CAE. Emma: Exactly. We're looking at GIAS 2040, which is all about Policies and Procedures, and GIAS 2050, which covers Coordination and Reliance. These are the blueprints for building a function that adds value instead of just adding to the noise. Marcus: Let's start with that first one, Standard 2040. The source material calls the policies and procedures manual a 'blueprint for consistency.' What does that mean in practice? Emma: It means that every auditor on the team, whether they're a 20-year veteran or fresh out of school, has a clear guide for how to perform their work. It's the CAE's primary tool for ensuring every engagement is handled with the same level of quality and professionalism. Marcus: So what actually goes into a manual like this? I'm picturing a huge binder on a shelf. What's inside? Emma: Well, it starts at the highest level. The first part is usually about Governance and Authority. It spells out the purpose, authority, and responsibility of the internal audit function itself, and it always ties back to the board-approved Internal Audit Charter. Marcus: Okay, so it establishes *why* we have the right to do our work. But what about the *how*? The day-to-day of an audit? Emma: That’s the next major section: Engagement Management. This part details the methodology for the entire audit lifecycle. It covers how we plan an audit, how we perform the work and gather evidence, how work is supervised, and finally, how we communicate the results. Marcus: And I assume that includes specific rules for the evidence we collect? Emma: It does. A good manual has a whole section on Work Programs and Documentation. It specifies the format for our work programs, the review and approval process, and—critically—the standards for our working papers. How to create them, how to keep them secure, and how long to retain them. Marcus: Which leads right into reporting. There must be rules for that, too. Emma: Definitely. The manual defines the protocols for everything related to Reporting and Communication. How to write and issue our final reports, how we communicate with management and the board, and what the process is for escalating really significant issues. Marcus: So we've covered the function's authority, how we do the work, and how we report it. What else is in there? Emma: Two big people-focused areas. One is the Quality Assurance and Improvement Program, or QAIP. The manual describes how we'll monitor our own work to ensure we're maintaining high standards. Marcus: So, how we audit ourselves, essentially. Emma: In a way, yes. And the final piece is People Management. This covers everything from recruiting and training new staff to continuing professional development and performance evaluations. It’s all about making sure the team has and maintains the skills it needs to do the job well. Marcus: That’s incredibly comprehensive. It sounds like the manual really is the operational brain of the audit function. Emma: It is. And it has a direct impact on audit quality. Let's take that Axiom Manufacturing scenario. You have a new auditor assigned to review a new cloud-based payroll system. They're not familiar with the company's IT environment. Where do they even start? Marcus: Without a guide, I'd probably just start by scheduling a meeting with the payroll manager and asking a bunch of questions. Emma: Which is exactly the tempting-but-wrong approach. That would likely miss huge risks. Instead, the auditor follows procedure and consults the audit manual. Marcus: And what do they find in the manual? Emma: They find two specific directives. First, that all IT system implementation audits must use the COSO Internal Control Framework as their criteria. Second, they find a mandate to complete a specific data privacy and security checklist because the system handles personal information. Marcus: So right away, the auditor has a clear, standardized starting point. The policy didn't just give them a task, it gave them a professional framework and pointed them directly at the biggest risks. Emma: Precisely. The CAE's policy directly enabled a high-quality audit plan from day one and prevented major gaps in coverage. That's Standard 2040 in action. Marcus: Okay, that makes perfect sense for ensuring consistency *within* the internal audit team. But what about avoiding that first problem we talked about—crashing into the work of other teams? Emma: That's the perfect transition to GIAS Standard 2050. This standard directs the CAE to work with other assurance and consulting providers. Think external auditors, regulators, but also internal groups like Compliance or Risk Management. Marcus: And the goal here is to get proper coverage and, more importantly, not duplicate everyone's work. Emma: Exactly. The standard covers two related, but very distinct, activities: Coordination and Reliance. Marcus: Ah, and I bet the exam loves to test the difference between those two words. They sound similar. How are they different? Emma: Let's start with Coordination. Think of coordination as sharing information. The goal is simply to minimize duplication and get a broader view of risk across the organization. Marcus: So, what does that look like? Emma: It's about regular meetings, sharing risk assessments and audit plans, and getting access to each other's reports. You're trying to understand their scope and what they found. For instance, internal audit might review the Compliance team's testing schedule for anti-money laundering to make sure they're not planning the same tests at the same time. Marcus: Okay, so coordination is about communication and staying in our own lanes. The risk seems pretty low. Emma: It is. The risk of you forming a wrong conclusion based on coordination is low because you're still doing your own work. Now, Reliance is a different story. Marcus: It sounds more serious. Emma: It is. Reliance is about actively *using* another provider's work as part of your own audit evidence, specifically to reduce the amount of testing you have to do yourself. Marcus: So instead of just knowing what they did, you're actually incorporating their work product into your own conclusion. Emma: Exactly. For example, using a cybersecurity firm's penetration test report as your primary evidence that a key application control is effective. Because you're using their work to support your opinion, the risk is much higher. You remain ultimately responsible for your own conclusions. Marcus: Which means the process must be much more rigorous than just scheduling a meeting. Emma: Far more. To place reliance, you have to perform a formal, documented assessment of the other provider. It’s not optional. Marcus: A formal assessment. What exactly are we assessing? Emma: GIAS specifies a three-part test. You have to assess the other provider's competence, their objectivity, and their use of due professional care. Marcus: Let's break that down. What are we looking for when we assess 'competence'? Emma: You’re asking: do they have the knowledge, skills, and experience to do this work? You'd look at their professional certifications, like a CPA or CISA. You’d review their industry experience, their reputation in the market, and their own internal quality control processes. Marcus: Makes sense. You want to know they're qualified. What about the second part, 'objectivity'? Emma: Here you're asking: are they independent and free from bias? For an internal group, like a compliance function, you'd look at their reporting structure. Do they report to an executive who also runs the area they are reviewing? That could be a conflict. For an external firm, you’d review their engagement letter and check for other services they provide that could impair their independence. Marcus: So, competence is about skill, objectivity is about independence. What's the third test, 'due professional care'? Emma: This is where you look at the quality of their actual work. Did they follow a systematic, disciplined process? You need to review their planning documents, their work programs, and the evidence they gathered. Is it sufficient? Is it high-quality? Does it logically support their conclusions? Was the work properly supervised? Marcus: So you're essentially auditing the auditors before you can rely on their work. Emma: That is the perfect way to put it. You have to be confident in their work because you are putting your own function's name and reputation on the line by using it. Marcus: This distinction is so important for the exam. Under pressure, coordination and reliance could easily blur together. Do you have a memory aid to keep them straight? Emma: I do. Think of it like a university group project. Marcus: Okay, I'm listening. Emma: Coordination is Communicating with your project partners. It's the meeting where you decide who is doing which chapter to make sure you don't duplicate the research. "I'll do Chapter 1, you do Chapter 2." It's efficient planning. Marcus: Simple enough. So what's reliance in this analogy? Emma: Reliance is Reusing your partner's finished chapter directly in your final report. Before you copy and paste their section into the paper, you'd better be sure their work is good, because your final grade depends on it. You have to check their sources and review their logic. That's the assessment of competence, objectivity, and due professional care. Marcus: That's a great way to remember it. Coordination is communicating, Reliance is reusing. Now, how do we apply this to an exam question? Emma: There’s a four-step process. First, identify the core activity. Is the question about internal audit's own processes? That's a 2040 policies issue. Is it about interacting with another group? That's a 2050 coordination or reliance issue. Marcus: Step one: internal process or external interaction. Got it. Emma: Step two, if it's an interaction, distinguish the objective. Is the goal just to share plans and avoid overlap? The answer will be about coordination. But if the goal is to use their work as evidence to reduce your own testing, it's about reliance. Marcus: Step three would then logically be about that formal assessment. Emma: Exactly. If the question is about reliance, the correct answer will almost always involve evaluating the other provider. Look for the options that mention assessing competence, objectivity, or due professional care. Marcus: And the final step? Emma: Remember ultimate responsibility. Internal audit can *use* another's work, but we can never *delegate* our conclusion. So, you can immediately eliminate any answer choice that suggests the CAE is no longer responsible for the final opinion. Marcus: That’s a powerful framework. So, to summarize: Standard 2040 and the policies manual are about building internal consistency. Standard 2050 is about external efficiency, and it requires us to know the critical difference between low-risk coordination and high-risk reliance. Emma: You've got it. And getting comfortable with these standards really comes from practice, working through scenarios until that distinction between coordination and reliance becomes second nature. Marcus: For that kind of practice, VoraPrep is a full exam-prep app. It has lessons, thousands of practice questions, and even an AI tutor all in one place. You can get started and try it for free at Vora Prep dot com. Emma: Mastering these two standards isn't just about passing the exam. It's about understanding how to manage a truly effective and respected internal audit function. Marcus: Excellent point, Emma. Thanks for breaking this down so clearly. And for all of you studying, keep up the great work. We’ll see you next time.