Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA2: Crafting the Engagement Blueprint: Objectives, Scope, and Criteria
Transcript
- Marcus: Welcome back to VoraPrep Audio Office Hours. I’m Marcus. Ava: And I’m Ava. Today we’re talking about the blueprint for every single audit engagement: the objectives, scope, and criteria. Marcus: Right, the planning phase. I think some people see this as just administrative work before the "real" audit begins. Why is getting this blueprint right so critical? Ava: Because a flawed blueprint guarantees a failed audit. Imagine spending months on a cybersecurity audit. Then the head of security says, "This is irrelevant. You audited the wrong systems." Marcus: Ouch. All that work, completely wasted. It damages your credibility. Ava: Exactly. You provide no assurance, and you've wasted valuable resources. The engagement plan isn't just paperwork. It's the foundation. It makes the entire audit relevant and impactful. It all starts with the objectives. Marcus: Okay, objectives. The source material says they state what the engagement is "intended to achieve." So, it’s the ‘why’ of the audit? Ava: Precisely. It’s the strategic purpose. And it's not just a nice-to-have. Under GIAS, establishing objectives for every engagement is mandatory. They have to flow directly from the risk assessment you did when building the overall audit plan. Marcus: The material mentions making them SMART. I think everyone has heard that acronym, but let’s break it down in an audit context. What does a "Specific" objective actually look like? Ava: A weak objective is "Review payroll." It's too vague. A specific one is, "To verify that all new hires added to the payroll system in Q3 were properly authorized." Now you know exactly what you're looking for. Marcus: Got it. That’s a clear target. What about "Measurable"? How do you measure an audit objective? Ava: It means you can reach a definitive conclusion. An objective like "improve efficiency" is just a wish. A measurable one is, "To identify process redundancies that, if eliminated, could reduce payroll processing time by 10%." Now you have a benchmark. You either find them or you don't. Marcus: Okay, that makes sense. 'A' is for 'Achievable'. This one seems straightforward—don't bite off more than you can chew. Ava: It is. But it’s a critical reality check. Can you really audit global operations in two weeks with one junior auditor? Your objectives have to align with your resources, time, and your team's expertise. Marcus: And 'R' for 'Relevant'—how does that connect back to what you said earlier? Ava: An objective is relevant if it addresses a significant risk the organization is facing. It has to tie back to strategic goals or a known control weakness. This keeps the audit from being an academic exercise and makes it valuable to management. Marcus: Last one: 'T' for 'Time-bound'. Ava: This sets the temporal boundaries. It defines the period you're looking at. For example, "...for the fiscal year ended December 31." It puts a clear frame around the review period. Marcus: So a good objective tells you exactly what you’re trying to prove, for what period, and why it matters. That leads us to Scope. The 'what, where, and when'. Ava: Yes. If the objective is the 'why,' the scope defines the boundaries. I like the analogy of the frame of a photograph. The scope determines exactly what's in the picture. Marcus: And just as importantly, what's not in the picture. Ava: That's the key. A well-defined scope prevents scope creep, where the engagement just keeps expanding uncontrollably. You need to define the specific processes, like procurement-to-payment. The IT systems, like SAP. The physical locations, like the Dallas manufacturing plant. And the time period, like transactions from January 1 to June 30. Marcus: And you mentioned documenting what’s out of scope. Why spend time on that? Ava: Because it manages stakeholder expectations. If you’re auditing expense reports from the new automated system, you should explicitly state that manual expense reports are out of scope. That way, no one comes back later and asks why you didn't look at them. It’s about creating clarity for everyone involved. Marcus: Okay, so we have the Objective, the why, and the Scope, the what, where, when. The third piece is Criteria. What is that? Ava: The criteria are the 'what should be.' They are the benchmarks or standards you use to evaluate what you find. Without criteria, an audit finding is just your opinion. With criteria, it's a fact-based conclusion. Marcus: So it's the rulebook you're auditing against. Ava: Exactly. And it’s a GIAS requirement to establish them. The best practice is to agree on the criteria with management before you start testing. This prevents arguments later about whether your finding is valid. Marcus: Where do we find these criteria? Is it just the company's internal policies? Ava: That's one source, but there's a hierarchy of authority. The most authoritative source is laws and regulations, like SOX or GDPR. Next are contracts and legal agreements. Then come internal policies and procedures. Finally, you can use industry best practices or frameworks like koh-so or ISO. Marcus: Let's tie all three together. The source material has a great example with an expense report audit. Can you walk us through it? Ava: Of course. For an expense report audit, the Objective—the 'why'—could be: To determine if employee expense reimbursements for Q4 comply with company policy and are accurately recorded. Marcus: Clear. And the Scope—the 'what, where, when'? Ava: The Scope would be: All expense reports submitted by the Sales department from the New York office between October 1 and December 31. Marcus: Very specific boundaries. So the Criteria—the 'what should be'—would be...? Ava: The corporate Travel and Expense Policy, version 3.2, dated January 15. That is the specific standard for 'good.' Marcus: Objective, Scope, Criteria. That clarifies how they work together. Now, the source brings up a tricky distinction: constraints versus scope limitations. They sound similar. Ava: They do, but they're critically different. A constraint is a practical limitation. Think of your budget, your deadline, or the availability of key staff. These are normal business realities you plan around. Marcus: So what’s a scope limitation? Ava: A scope limitation is a restriction placed on the audit that stops you from meeting your objectives. The classic example is management denying you access to necessary records or personnel. This isn't just a constraint. GIAS sees it as an impairment to your independence. Marcus: An impairment to independence. That sounds serious. So if management tells me I can't see certain records, what's the right move? Ava: You don't just accept it. The Chief Audit Executive, the CAE, must first discuss the issue with senior management to try and resolve it. If that doesn't work, the CAE is required to communicate the limitation to the board. It’s a formal escalation process. Marcus: Let's apply this with the worked example. An auditor is planning an audit of a new automated expense reporting system. Management is worried about non-compliance with the new T and E policy. Ava: Right. First, we need a SMART objective. A good one would be: "To assess whether controls within the new automated expense system are designed effectively to ensure all expense submissions for Q1 comply with the T and E policy, version 4.0." Marcus: That’s specific, measurable, and relevant. Now, the scope. Ava: The scope needs to be sufficient to meet that objective. Something like: "The audit will cover all expense reports submitted through the new system from January 1 to March 31. We'll focus on system-enforced controls like approval workflows and per diem limits. Manual reports are excluded." Marcus: And the criteria we’d use to judge the system? Ava: Here, there would be a few. First, the company's own 'Travel and Expense Policy,' version 4.0. Second, the system design documents that say what the controls are supposed to do. And third, you could reference a broad framework like the koh-so principles for control activities. Marcus: What's a common mistake someone might make here? Ava: Defining the objective too broadly. A tempting but wrong approach is to say the objective is "To review the new expense reporting system." That's a task, not an objective. It's not focused on the specific risk management is worried about—non-compliance with the new policy. Marcus: And an unfocused audit doesn’t provide the right assurance. Okay, this is a lot to remember. Is there a good memory aid for this? Ava: There is. You can plan with OSCAR. O-S-C-A-R. Marcus: Let me guess. 'O' is for Objective, 'S' for Scope, 'C' for Criteria. Ava: You got it. The last two, A-R, stand for Available Resources. This helps you remember to factor in your constraints—people, time, and budget—during planning. Marcus: OSCAR. Objective, Scope, Criteria, Available Resources. I like that. Now, another common pitfall mentioned is confusing criteria with procedures. Ava: This is a huge one. The criterion is the rule. The procedure is the action you take to test against the rule. Marcus: Give me an example. Ava: The criterion, or the rule, is: "All IT system access changes must be approved by the data owner." The procedure, or the action, is: "Select a sample of 25 access change requests and inspect them for evidence of data owner approval." One is the standard, the other is the test. Marcus: Mixing those up would make your audit findings really weak. You always have to compare what you found—the condition—to the criterion. Ava: That's the formula for a solid finding. Marcus: Okay, let's focus on what's critical for exam day. What is the one thing we absolutely need to remember about this topic? Ava: On the exam, be on high alert for any scenario where management restricts access or limits the audit's scope. The question will test your knowledge of the proper GIAS response. Marcus: And the correct response is almost never to just accept it and move on. Ava: Correct. The best answer will always involve escalation. The CAE discusses the impairment with senior management. If it's unresolved, they communicate it to the board or audit committee. It’s about upholding the independence of the internal audit function. Marcus: Fantastic. That's a clear action plan. Getting these fundamentals right is the entire game. Ava: VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.