CIA P2 Engagement Planning: practice questions with answers

Question 1

Internal audit at Halvorsen Logistics is planning an assurance engagement over fleet maintenance. The auditors have read the maintenance policy but have not yet assessed risks. Which planning step is the most appropriate next action to understand how the process is intended to operate?

1. A Select a statistical sample of 60 work orders and test each one for supervisory approval before identifying risks.
2. B Walk one work order from request to closure with the maintenance supervisor and compare it with the policy.
3. C Send a control self-assessment survey to all mechanics and use their answers to conclude on control effectiveness.
4. D Compare total maintenance cost with an industry average and report any variance to management as a finding.

Show the answer

Answer: B. During planning, internal auditors must develop an understanding of the activity under review (Global Internal Audit Standards, Standard 13.2). A walkthrough of one transaction, set against the documented procedures, shows how the process is meant to work and where the key risks and controls sit. Testing samples, drawing conclusions from surveys and reporting findings all come later, once the work program has been built on that understanding.

Question 2

While building a risk and control matrix for treasury payments at Larkspur Energy, an auditor finds a significant risk (payments released to new beneficiaries without independent verification) for which no control seems to exist. How should this affect the work program?

1. A Remove the risk from scope, because there is no control in place for the auditors to test.
2. B Design an operating effectiveness test of the beneficiary verification control using a sample of 25 payments.
3. C Keep it in scope and plan work to confirm the gap, find any compensating controls and size the exposure.
4. D Assume that a compensating control exists elsewhere and record the risk as adequately mitigated.

Show the answer

Answer: C. A risk and control matrix links each significant risk to the controls meant to address it. A significant risk with no matching control points to a possible design deficiency. The work program should include steps to confirm that no control exists, check for any compensating controls (for example bank callback procedures), and possibly analyse payments to new beneficiaries to estimate the exposure.

Question 3

The objective of an engagement at Treloar Pharmacies is to determine whether inventory records are accurate in both quantity and value at each of its 35 branches. The proposed criterion is: "Quantities counted at each branch agree with the perpetual records within 1% of items counted." What is the main shortcoming of this criterion?

1. A Its 1% tolerance is not allowed, because criteria must require exact agreement with records.
2. B It is not measurable, because the counts are carried out by branch staff and not by auditors.
3. C It does not address the value part of the objective, such as costing and expiry write-downs.
4. D It should be stated in dollars only, because quantity differences cannot be tested by audit.

Show the answer

Answer: C. Criteria must be relevant to, and sufficient for, the engagement objective. Treloar's objective has two parts: accurate quantities and accurate values. The proposed criterion deals only with quantities. Inventory can be counted correctly yet carried at the wrong value, for example through wrong unit costs or failure to write down expired or damaged medicines. The auditors should add criteria for value (such as costing in line with the accounting policy and write-down of expired stock) so that both parts of the objective can be evaluated. A stated tolerance such as 1% is acceptable and makes the criterion more specific.

Question 4

Which statement best describes a key planning difference between assurance engagements and advisory engagements performed by an internal audit function?

1. A In assurance engagements, the process owner sets the objectives and scope, and internal audit carries them out.
2. B Advisory engagements do not require internal auditors to exercise due professional care.
3. C Advisory engagements require no communication of results to the requesting stakeholder.
4. D In advisory engagements, the nature and scope are generally agreed with the requesting stakeholder.

Show the answer

Answer: D. Assurance engagements give an objective assessment to stakeholders such as the board and senior management, and internal audit determines their nature and scope. Advisory services are performed at the request of a stakeholder, with their nature and scope agreed with that stakeholder. In both, the Standards on objectivity, due professional care and appropriate communication still apply.

Question 5

An audit manager at Kynance Logistics estimates the duration of the data analytics activity using three-point (PERT) estimation: optimistic 3 days, most likely 5 days and pessimistic 13 days. What is the expected duration?

1. A 5.0 days
2. B 6.0 days
3. C 7.0 days
4. D 8.0 days

Show the answer

Answer: B. PERT (three-point) estimation weights the most likely estimate four times:

Expected duration = (optimistic + 4 x most likely + pessimistic) / 6 = (3 + 4 x 5 + 13) / 6 = (3 + 20 + 13) / 6 = 36 / 6 = 6.0 days

The standard deviation is (13 - 3) / 6 = 1.7 days, which indicates the uncertainty in the estimate. Using the expected duration rather than the most likely one builds a realistic allowance for delays, such as late data delivery, into the engagement schedule.

Question 6

Management of Garrick Shipping gives internal audit its own risk register for the logistics function, which rates every risk as "low". Internal audit is planning an engagement on logistics. How should the auditors use the register?

1. A Use it only at the reporting stage to decide which rating to give the overall engagement conclusion.
2. B Disregard it completely, because internal audit must not use any information that management has prepared.
3. C Treat it as one input to the risk assessment, but evaluate the risks independently and with professional skepticism.
4. D Adopt it as the engagement risk assessment, because management is responsible for identifying and assessing its own risks.

Show the answer

Answer: C. Under Standard 13.2, internal auditors gather information about the activity under review, including the risk assessment that supports it. Management's register shows how management sees its risks and controls, which is valuable. However, a register that rates every risk as low should prompt professional skepticism (Standard 4.3): the auditors should compare it with their own understanding, incidents, data and external information, and reach an independent view of which risks are significant.