CIA Part 2 — Engagement Planning and Performance flashcards

10 of 67 cards free to study here · 3 topics · the whole deck is built into Willys

Risk-based audit planning, engagement risk assessment, objectives, scope and criteria, work programs, evidence quality, statistical and nonstatistical sampling, analytical procedures, audit software techniques, workpapers and supervision.

Get the app All IIA Certified Internal Auditor (CIA), Parts 1–3 decks

Learn deck · part of IIA Certified Internal Auditor (CIA), Parts 1–3 · written against: IIA CIA exam syllabus effective 2025, aligned with the Global Internal Audit Standards (2024). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list

What does the CAE need to understand before building a risk-based internal audit plan?

The organization's strategy and objectives and its governance, risk management and control processes, informed by input from the board and senior management. The plan then targets the risks that matter most to those objectives.
Managing the Internal Audit Function › Risk-Based Internal Audit Plan
What is an audit universe?

The full inventory of auditable units: the processes, entities, functions, systems and risks the internal audit function could cover. Risk assessment then ranks them to decide what goes into the plan.
Managing the Internal Audit Function › Risk-Based Internal Audit Plan
How often must the documented risk assessment behind the internal audit plan be performed under the 2024 Standards?

At least annually, and it should be revisited whenever significant changes in the organization or its risks occur.
Managing the Internal Audit Function › Risk-Based Internal Audit Plan
Why is the internal audit plan expected to be dynamic rather than fixed for the year?

Because risks change. The CAE reviews and revises the plan as the business, risks, systems and controls change, and communicates significant changes to the board and senior management.
Managing the Internal Audit Function › Risk-Based Internal Audit Plan
What should auditors understand about the activity under review before setting engagement objectives?

Its objectives and strategies, the significant risks to them, the controls that address those risks, applicable criteria, and the results of earlier engagements.
Engagement Planning › Engagement Risk Assessment
What is a risk and control matrix used for in engagement planning?

To map each objective to its risks, the controls that address them, and the test planned for each control. It shows gaps where a significant risk has no control and focuses testing on key controls.
Engagement Planning › Engagement Risk Assessment
Why do auditors perform a walkthrough during engagement planning?

To follow a transaction from start to finish through the process, confirming their understanding and identifying where key controls operate, and whether they are designed sensibly.
Engagement Planning › Engagement Risk Assessment
Which qualities should engagement information have to support findings and conclusions?

It should be sufficient, reliable and relevant.

Watch out: the 2017 Standards also listed useful, meaning it helps the organization meet its goals.
Performing the Engagement › Evidence
When is engagement information sufficient?

When it is enough that a prudent, informed and competent person could repeat the work and reach the same conclusions as the auditor.

Watch out: the 2017 Standards described sufficient information as factual, adequate and convincing.
Performing the Engagement › Evidence
When is engagement information relevant?

When it supports the findings and recommendations and is consistent with the engagement objectives and scope.
Performing the Engagement › Evidence

Unlock the whole deck

You are studying a free 10-card sample. All 67 cards of CIA Part 2 — Engagement Planning and Performance, the other 8 IIA Certified Internal Auditor (CIA), Parts 1–3 decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More IIA Certified Internal Auditor (CIA), Parts 1–3 decks

Foundations, Ethics and Governance Governance, Risk, Control and Quality Practice Questions, Part 1 Communicating Results and Monitoring Practice Questions, Part 2 Business Acumen and Risk Information Security, IT and Financial Management Practice Questions, Part 3

← All IIA Certified Internal Auditor (CIA), Parts 1–3 decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

IIA CIA exam syllabus (2025) and Global Internal Audit Standards (2024) — topic outline only; no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Not financial, tax or legal advice. These cards prepare you for an exam; rules and figures change, so check current standards before relying on any of it.

CIA® and Certified Internal Auditor® are registered trademarks of The Institute of Internal Auditors, Inc. (The IIA), which is not affiliated with and does not endorse this product.

Use of these pages is covered by our Terms of Use.