Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA2: World-Class Engagement Planning: A Risk-Based Approach Under GIAS 2024
Transcript
- Marcus: Welcome back to VoraPrep Audio's Office Hours. I'm Marcus. Ava: And I'm Ava. Today, we're talking about engagement planning. This is the foundation of every successful audit. Marcus: And it can be the source of a lot of headaches if you get it wrong. If you don't plan correctly, you could perform a perfect audit on the wrong risk. Ava: Exactly. Success isn't just about correct testing. It's about auditing the right things in the right way. Marcus: And that all starts with a risk-based engagement plan. Is this just a best practice? Ava: It's a requirement. It's mandated by the Global Internal Audit Standards. The key standard here is 13.1. That standard requires a documented plan for each engagement. Marcus: Okay, so what does that standard require us to document in the plan? Ava: The standard lists four core components. First, the engagement's objectives. Marcus: Which answers the question, "What are we trying to achieve with this audit?" Ava: Precisely. It’s the high-level goal. The second component is the scope. Marcus: The scope defines the boundaries. It answers, "What's in and what's out of this review?" Ava: Correct. Objectives are the 'what,' and scope is the 'where.' The other two components are more practical. Marcus: Let me guess: how long it will take and who will do the work? Ava: You got it. The plan must include the timing and the resource allocations. Marcus: Okay, so the plan covers the 'what' and 'where'—that's objectives and scope. It also needs the 'when' and 'who'—the timing and resources. And this all has to happen before any testing begins. Ava: That's right. To build that plan, you first have to understand the area you're auditing. You can't just walk in and start testing. Marcus: So you need to do some initial information gathering first. Ava: Yes, you have to understand the landscape. Think of it like a doctor's first consultation. A good doctor asks questions and reviews your history before ordering an expensive test. Marcus: They gather context first. So what does that look like for an auditor? Ava: It means talking to the people who run the process day-to-day. It means reviewing documentation, like process maps or org charts, to see how things are supposed to work. Marcus: And then comparing that to how things actually work? Ava: Exactly. The goal isn't to find errors yet. The goal is to understand the process, the systems, and most importantly, the potential risks. Marcus: So all of that initial work—the conversations, the document review—it all flows into defining the engagement's objectives and scope. Ava: Correct. Once you have that context, you can set a clear objective and a specific scope. For example, the objective might be to evaluate controls in the procure-to-pay cycle. Marcus: And the scope would define the boundaries for that objective. Ava: Yes. The scope defines the specific processes, locations, or time periods the audit will cover. Being specific is crucial. Marcus: So once we have our objectives and scope, what's next? This is where the risk assessment comes in, right? Ava: Yes, and this is the absolute core of risk-based planning. We perform an engagement-level risk assessment. But this is where a lot of auditors make a common mistake. Marcus: What's the mistake? Ava: They only assess inherent risk. They ask, "What could go wrong?" But a proper plan must focus on residual risk. Marcus: Residual risk. That's the risk that's left over after management's controls are considered, right? Ava: Exactly. We have to understand the controls management already has in place. Then we assess the risk that those controls might fail, or that there are gaps. That's the risk we're actually auditing. Marcus: And for each of those residual risks, we have to evaluate it. Ava: We do. We assess its potential impact and its likelihood of occurring. A risk with a high impact and high likelihood demands more of your audit attention. It needs much more focus than one with a low impact and low likelihood. Marcus: This assessment directly tells you where you need to spend your time and effort. Ava: It has to. If you identify a high residual risk of unauthorized payments, your audit must include specific tests for that. You can't ignore it. That risk assessment becomes the blueprint for the final step in planning: developing the engagement work program. Marcus: The work program is the detailed game plan. Ava: It's the 'how, when, and who' of the audit. It translates the objectives, scope, and risk assessment into a concrete set of steps for the team. The program lists the specific audit procedures. And it links each one back to a risk you identified. Marcus: So there are no "just because" steps. Every test has a purpose. Ava: Every single one. The work program also details who is responsible for performing each specific test. Marcus: This process seems really clear. Let's walk through that Procure-to-Pay example to see it in action. Ava: Great idea. The scenario is this: The Chief Audit Executive has tasked a team with auditing the procure-to-pay process. This is happening right after the implementation of a new ERP system. Marcus: So, first, the team needs to gather information. What do they do and what do they find? Ava: They interview the Accounts Payable manager and review process maps. They discover the migration may have weakened controls over vendor master file changes. They also find that user access rights are not yet fully configured. Marcus: That sounds like a potential risk. How does that finding shape their objectives and scope? Ava: It helps them form a very specific objective. Their goal is to determine if controls over the vendor master file, invoice processing, and purchase order approval are effective. Marcus: And the scope? Ava: The scope is defined as all vendor payments processed through the new ERP system from January 1st to June 30th of the current year. Marcus: Very specific. Now for the crucial part: the risk assessment. What did they identify as the biggest risks within that scope? Ava: They identified the risk of adding a fraudulent vendor to the master file. They rated this as having a High potential impact, even if the likelihood was only moderate. Marcus: What else? Ava: They also noted a risk of duplicate payments. This had a lower impact per event, but it had a High likelihood of occurring due to system limitations in the new ERP.. Marcus: So based on that prioritization, how did they build the work program? Ava: They allocated their resources to match the risk. For the highest priority risk—fraudulent vendors—they planned detailed testing. This included selecting a sample of new vendors and verifying their existence independently. Marcus: And for the duplicate payment risk? Ava: They planned to use data analytics to scan one hundred percent of the payment file for potential duplicates. This is an efficient way to address a high-likelihood risk. They spent the most time and effort on the areas that could cause the most damage. Marcus: That is the essence of risk-based auditing. Now, I can see a point of confusion here. We do a risk assessment to build the annual audit plan. And we also do a risk assessment to plan a specific engagement. Are they the same thing? Ava: That's a fantastic question, and a common pitfall. They are very different. The annual audit plan risk assessment is a macro-level view. It looks at the entire organization. Its purpose is to decide what to audit over the next year. Marcus: So it helps you pick which projects to do from a list of hundreds of possibilities. Ava: Exactly. The engagement-level risk assessment is micro. It's a detailed look at the specific process we're already reviewing. Its purpose is to decide how to audit it and where to focus our testing. Marcus: Macro versus micro. What to audit versus how to audit. That's a really clear distinction. Any final tips for exam day? Ava: Yes. When you get a scenario question about planning, always focus on the 'Why'. Why is this audit being performed? What is the fundamental business risk it's trying to address? Marcus: So don't just get lost in the details of the audit steps. Ava: Right. Understanding the 'Why' helps you identify the most critical objective. This is the key to cutting through distractor answer choices. Those choices might describe a valid audit step, but for the wrong reason. Marcus: This has been incredibly useful. So, to summarize, effective engagement planning is a systematic, risk-based process. It's not optional; it's mandated by the standards. Ava: You start by gathering information to understand the landscape. Then you use that knowledge to define clear objectives, a tight scope, and the timing and resources. Marcus: That plan then drives your engagement-level risk assessment. This, in turn, dictates the procedures in your work program, ensuring you focus on what matters most. Ava: You've got it. It’s the process that turns a broad mandate into a focused, actionable audit project that truly adds value. Marcus: VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.