Table Of ContentWILEY CIA EXAM REVIEW
Internal Audit Activity’s Role
in Governance, Risk, and Control
VOLUME 1
S. Rao Vallabhaneni
• Outlines • Concepts • Tools and Techniques • Standards
JOHN WILEY & SONS, INC.
WILEY CIA EXAM REVIEW
Internal Audit Activity’s Role in
Governance, Risk, and Control
VOLUME 1
WILEY CIA EXAM REVIEW
Internal Audit Activity’s Role
in Governance, Risk, and Control
VOLUME 1
S. Rao Vallabhaneni
• Outlines • Concepts • Tools and Techniques • Standards
JOHN WILEY & SONS, INC.
This book is printed on acid-free paper.
Copyright © 2009 by S. Rao Vallabhaneni. All rights reserved.
Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Published simultaneously in Canada.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopy-
ing, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior
written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Cen ter, Inc., 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400, fax 978-646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be
addressed to the Permissions De partment, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201-748-6011, fax 201-748-6008, or online at
http://www.wiley.com/go/permission.
A portion of this material has been used with permission from The Institute of Internal Auditors, Inc. (IIA), 247 Maitland Avenue, Altamonte Springs, Florida
32701-4201.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in pre paring this book, they make no representations or
warranties with respect to the accuracy or completeness of the contents of this book and specifi cally disclaim any implied warranties of merchantability or fi tness
for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained
herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for
any loss of profi t or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.
For general information on our other products and services, or technical support, please contact our Customer Care Department within the United States at
800-762-2974, outside the United States at 317-572-3993 or fax 317-572-4002.
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more
information about Wiley products, visit our Web site at www.wiley.com.
ISBN 10: 0470277068 (Volume 1)
ISBN 13: 9780470277065
ISBN: 978-0-470-27710-2 (Set)
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1
Contents
Preface ...........................................................................................................................
vii
About the Author .............................................................................................................
ix
Chapter 1
Comply with the IIA’s Attribute Standards (15–25%) ...........................
1
Chapter 2
Establish a Risk-Based Plan to Determine
the Priorities of the Internal Audit Activity (15–25%) ........................... 28
Chapter 3
Understand the Internal Audit Activity’s Role
in Organizational Governance (10–20%) .............................................. 41
Chapter 4
Perform Other Internal Audit Roles and Responsibilities (0–10%) .... 68
Chapter 5
Governance, Risk, and Control Knowledge Elements (15–25%) ........ 72
Chapter 6
Plan Engagements (15–25%) ................................................................. 115
Appendix
Sarbanes-Oxley Act of 2002 ................................................................... 131
Index
......................................................................................................................... 134
Preface
The Wiley CIA Exam Review Focus Notes are developed for each of the four parts of the Certifi ed Internal
Auditor (CIA) exam sponsored by the Institute of Internal Auditors (IIA). The purpose of the Focus Notes is to
digest and assimilate the vast amounts of knowledge, skills, and abilities (KSAs) tested on the CIA exam in a
clear, concise, easy - to - read, and - use format anywhere and any time to achieve success in the exam.
Each of the Focus Notes book topics is organized in the same way as the Wiley CIA Exam Review book
topics, that is, one Focus Notes book for each of the four - volume review books. This clear linkage makes the
exam study time more effi cient and long - lasting, and provides the ability to recall important concepts, tools, and
techniques, and the IIA Standards tested on the CIA exams. The Focus Notes are written in an outline format.
However, they can be used with any study materials that you have determined works best for you to prepare for
the CIA Exam. The Focus Notes provide a quick and easy refresher to the material that you are studying.
The Focus Notes books will be especially useful to auditors who are traveling on an audit assignment, as well as
others who are not traveling, due to their small and compact size, giving portability. The simplifi ed outlines included
in this material will help you learn the essential KSAs as well as help you retain them for years to come.
The Focus Notes book can also be used as a desk reference on a post - exam basis, similar to a dictionary.
With no bias intended and for the sake of simplicity, the pronoun “ he ” has been used throughout the book rather
than “ he/she ” or “ she. ” Good luck on the exam!
S. Rao Vallabhaneni
September 2008
About the Author
S. Rao Vallabhaneni is an educator, author, publisher, and practitioner in the business management fi eld with
more than 30 years of management and teaching experience in internal auditing, accounting, manufacturing,
fi nance, and information technology consulting in the public and private sectors and the academia. The 2004
Joseph Wasserman Memorial Award recipient, he is the author of more than 50 books, including monographs,
audit guides, exam study guides, and articles. He has 24 professional certifi cations in management, account-
ing, auditing, fi nance, information technology, manufacturing, supply chain, quality, and human resources. He
is the author of Wiley CIA Exam Review Books and CD Software. His CIA Exam Review books were trans-
lated into Chinese and his CISA Exam Review book was translated into Japanese. His recent book, entitled
Corporate Management, Governance, and Ethics Best Practices, was published by John Wiley & Sons, Inc.
(January 2008).
1
MANAGING AN INTERNAL AUDIT FUNCTION
The internal audit director needs to comply with the IIA ’ s Attribute Standards, which say that the chief audit
executive (CAE) is responsible for properly managing the department so that: (1) audit work fulfi lls the general
purposes and responsibilities approved by senior management and accepted by the board, (2) resources of
the internal auditing (IA) department are effi ciently and effectively employed, and (3) audit work conforms to
the Standards.
Focus on: Comply with the IIA ’ s Attribute Standards (15 – 25%)
1
Focus on: Comply with the IIA ’ s Attribute Standards (15 – 25%)
2
1
Internal Audit Charter
Basic policy statement under which the internal auditing (IA) department operates.
Establishes the IA department ’ s position in the organization ’ s hierarchy.
IA department operates independently of all other departments in the organization.
Describes the organizational status that the director of internal auditing should report to the chief executive
offi cer (CEO) but have access to the board of directors. A dual reporting relationship exists here: reporting
administratively to the president or CEO, and reporting functionally to the audit committee of the board of
directors.
Describes the purpose, authority, and responsibility of the IA department.
•
•
•
•
•
