Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA3: Structuring the Internal Audit Function: Policies, Procedures, and the Audit Manual
Transcript
- Marcus: Welcome back to VoraPrep Audio Office Hours. I’m Marcus. Ava: And I’m Ava. Today we’re talking about the backbone of any high-performing internal audit function. We're covering its policies and procedures. Marcus: And why this isn't just administrative paperwork. The source material opens with a great example. It describes two auditors at the same company getting wildly different results on similar audits. Management is confused, and credibility is shot. That feels very real. Ava: It’s the core problem. Without a consistent, documented methodology, you don't really have an audit function. You just have a collection of individual auditors doing their own thing. That inconsistency undermines trust and creates risk. Marcus: So whose job is it to prevent that chaos? Ava: The responsibility falls directly on the Chief Audit Executive, the CAE. This isn't just a suggestion. It's a mandate under the Global Internal Audit Standards, or GIAS. Marcus: Okay, so this is a conformance issue. Where in the Standards does it say that? Ava: It's in GIAS. Domain Four, which covers Managing the Internal Audit Function. Specifically, you'll find it in Standard 10.1. This standard operationalizes Guiding Principle 10 on managing resources. And the language is explicit. The CAE must establish policies and procedures to guide the function. Marcus: Must establish. That’s clear. The source material then breaks down three key terms: policies, procedures, and the audit manual. They sound related, but how are they distinct? Ava: It’s a classic source of confusion. The best way to think about it is with an analogy. Imagine the audit manual is the master cookbook for a professional kitchen. Marcus: Okay, I like that. A master cookbook. So what are policies in this kitchen? Ava: Policies are the high-level rules. They are the 'what' and the 'why'. In our cookbook, the policy might be 'All ingredients must be fresh' or 'Maintain kitchen hygiene.' For an audit function, policies are statements about independence, objectivity, or the scope of our work. Marcus: Got it. The fundamental principles. So if the policy is the rule, what's a procedure? Ava: The procedure is the 'how.' It's the detailed, step-by-step recipe. If the policy is 'Maintain kitchen hygiene,' the procedure tells you exactly how to sanitize your workstation. In auditing, it’s the specific steps for conducting a risk assessment, or the exact protocol for issuing a report. Marcus: And the audit manual is simply the cookbook itself? The place where you find all of this? Ava: Precisely. The audit manual is the central repository—the 'where.' It holds everything. The audit charter, the Code of Ethics, all the policies, all the procedures, and even standardized templates. It's the single source of truth that ensures everyone is, literally, on the same page. Marcus: So these aren't documents you write once and then stick on a shelf. They have to stay current. How does a new policy or procedure get created? Ava: It’s a continuous lifecycle, and the CAE is responsible for it. It starts with identifying a need. Marcus: What would trigger that? Ava: It could be a change in the GIAS. Or a new organizational risk, like a major cybersecurity threat. It could even be a finding from your own internal quality assurance program—the QAIP.—that uncovers an inconsistency. Marcus: So you've identified the need. What’s the next concrete step? Ava: Drafting. First, the high-level policy is written—the 'what' and 'why.' Then, the detailed procedures that explain 'how' to implement that policy are developed. Marcus: Who has the final say? Does it go to a committee? Ava: Now, audit management and stakeholders might review the drafts. But the ultimate responsibility for approving and issuing them rests with the CAE. Marcus: And once it’s approved, do you just send out an email and hope everyone reads it? Ava: That's a common mistake. The next crucial step is formal communication and training. You have to ensure the entire team understands the new guidance and knows how to apply it correctly. A training session is often essential. Marcus: And I assume it doesn't end there. Ava: It doesn't. The final step is periodic review. The CAE has to make sure everything in the manual is reviewed regularly, usually annually. This ensures it’s still relevant and effective. If updates are needed, the whole cycle begins again. Marcus: Let's make this tangible. The source material has a great scenario about creating a remote audit policy. Can you walk us through how that would work in practice? Ava: Absolutely. Let's use the scenario of Innovatech Solutions. The CAE notices most of the company is now remote. And the audit manual has no guidance on conducting audits virtually. Marcus: So first, the CAE has to identify the need. Ava: Exactly. The QAIP has already flagged inconsistencies in how teams are gathering evidence remotely. That's the trigger. The CAE determines a formal policy is necessary to ensure quality and security. Marcus: So what does the draft policy look like? Is it super detailed? Ava: No, the policy is high-level. It might say something like, "All remote audit activities must be conducted using company-approved secure platforms." It would also state that, "electronic evidence must meet the same standards as evidence gathered onsite." It just sets the principle. Marcus: And the procedure provides the 'how-to' instructions. Ava: Right. The corresponding procedure would get specific. It would list the required actions. For example: use encrypted video conferencing for sensitive interviews. Obtain direct read-only system access. Use secure file-sharing portals instead of email. And document any limitations in the workpapers. Marcus: Then it goes through review, the CAE approves it, and it's communicated to the team with training. Ava: Precisely. And by doing this, the CAE has created a consistent, enforceable standard. A standard that conforms with GIAS and addresses a new organizational risk. Marcus: What's the tempting-but-wrong answer in a scenario like this? What would be the incorrect approach for the CAE.? Ava: The classic wrong answer is the informal fix. The CAE just sends out an email memo with some 'best practices' for remote auditing. Marcus: Why is that wrong? It seems faster. Ava: It's faster, but it fails the test of a formal, established methodology. An email isn't an enforceable standard. It doesn't get formally incorporated into the manual. So you'll end up with the same inconsistencies the QAIP flagged in the first place. It’s a failure to properly manage the function. Marcus: That makes sense. This feels like a classic scenario-based exam question. How should we break those down? Ava: There’s a four-step framework that works very well. First, identify the core problem in the question. Is it a lack of guidance? An inconsistency? A failure to follow standards? Marcus: Okay, diagnose the root cause. What's step two? Ava: Determine the appropriate level of response. Does this problem require a high-level rule, which is a policy? Or does it need detailed instructions, which is a procedure? Or maybe a full update to the audit manual? Marcus: So you're matching the solution to the problem. What’s third? Ava: Pinpoint the CAE's responsibility. Remember, GIAS. Domain Four puts the CAE in charge of this. The correct answer will almost always involve the CAE taking ownership. Marcus: And the last step? Ava: Eliminate the incorrect options. Look for distractors. These often involve delegating the CAE's strategic responsibility to a junior auditor. Or proposing a tactical fix for a strategic problem. Or ignoring the need for formal, documented guidance. Marcus: You mentioned a tactical fix. The source material flags a specific point of confusion here. Ava: Yes, the most common pitfall is confusing the audit manual with an engagement work program. Marcus: What’s the key difference to remember for the exam? Ava: A work program contains the procedures for one specific audit. The audit manual contains the policies and procedures that govern all audits. A work program is temporary and tactical. The audit manual is permanent and strategic. Fixing one work program doesn't fix the underlying systemic issue. Marcus: That’s a critical distinction. Now, the audit manual contains a lot of components. Is there an easy way to remember its core contents? Ava: There is. You can use the mnemonic C-ME MAP. That’s C… M… E… M… A… P. Marcus: C-ME MAP. Let's walk through it. What's the C? Ava: C is for the internal audit Charter. Marcus: M and E? Ava: M is for Methodology. That's how you handle risk assessment, planning, and execution. E is for Ethics, meaning the IIA. Code of Ethics. Marcus: Okay, C-ME... what about the second MAP part? Ava: M is for Management of the function itself. A is for Assurance and Advisory processes. And the final P is for Performance. This covers the QAIP and continuous improvement. Marcus: C-ME MAP. Charter, Methodology, Ethics, Management, Assurance and Advisory, and Performance. That’s a great memory aid. This kind of detailed breakdown is exactly what you need to feel confident on exam day. Marcus: Okay, Ava, before we sign off, can you summarize the absolute key takeaways on this topic? Ava: Of course. First, the CAE is required by GIAS. Domain Four, Standard 10.1, to establish and maintain policies and procedures for the internal audit function. Marcus: Second? Ava: Remember the difference. Policies are the high-level 'what,' and procedures are the step-by-step 'how.' Marcus: And the audit manual? Ava: The audit manual is the central repository for everything. It holds the charter, policies, and procedures that ensure consistency and quality. Marcus: And finally? Ava: This is a dynamic process. The CAE must continuously review and update these documents to keep the function current and in conformance with the Standards. On the exam, always focus on the CAE’s strategic role in owning this process. Marcus: Excellent. Clear, concise, and directly tied to the standards. Thanks, Ava. Ava: My pleasure. Keep up the great work, everyone. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.