CIA P2 Engagement Supervision and Communication: practice questions with answers

Question 1

The chief audit executive of Hollin Bank is staffing two engagements: a routine branch cash audit led by a senior auditor with eight years' experience, and a first-time review of derivative valuation models performed by two newly hired staff. How should supervision differ between the engagements?

1. A Both engagements need the same level of supervision so that internal audit methodology is applied consistently
2. B The branch cash audit needs more supervision because cash is more susceptible to theft
3. C Neither engagement needs supervision if the workpapers are reviewed after the final report is issued
4. D The derivative review needs closer supervision, given the staff's inexperience and the subject's complexity

Show the answer

Answer: D. Supervision runs from planning to the final communication and includes guiding staff, monitoring progress and reviewing workpapers. The extent of supervision required depends on the proficiency and experience of the internal auditors and the complexity of the engagement. A complex, first-time area staffed by new auditors calls for closer direction, more frequent check-ins and more detailed review than a routine engagement led by an experienced senior.

Question 2

Midway through an engagement at Larkfield Logistics, the internal auditor finds that a former employee's system access was never removed and is still being used to approve fuel card top-ups. The final report is not due for five weeks. What should the auditor do?

1. A Hold the issue until the closing meeting so that all of the findings are presented together
2. B Promptly tell management with authority to act, and also include the issue in the final communication
3. C Remove the former employee's access personally to stop the misuse immediately
4. D Report the issue only to the board, because management may be involved in the misuse

Show the answer

Answer: B. Communication with management during an engagement allows significant issues to be addressed quickly. When the auditor finds a problem needing urgent action, such as active misuse of an unauthorized account, it should be communicated promptly to management with the authority to act, and also documented and reported in the final communication. Auditors should not take operational action themselves, as that would impair objectivity. If senior management is suspected of involvement, the CAE would consider escalating to the board.

Question 3

Management of Kilbride Energy has decided not to implement an action to fix a significant cybersecurity weakness reported by internal audit, citing cost. The chief audit executive concludes that the remaining risk exceeds the organization's risk appetite. What should the chief audit executive do?

1. A Discuss it with senior management and, if unresolved, communicate it to the board
2. B Accept management's decision, since management is responsible for managing risk
3. C Arrange for the internal audit team to implement the corrective action
4. D Report the weakness directly to the industry regulator responsible for energy companies

Show the answer

Answer: A. Under the Global Internal Audit Standards (Standard 11.5, Communicating the Acceptance of Risks), if the chief audit executive concludes that management has accepted a level of risk that exceeds the organization's risk appetite or tolerance, the CAE must discuss the matter with senior management. If the CAE determines it has not been resolved, the CAE must communicate the matter to the board.

Question 4

Two weeks into an engagement on grant payments at Garthby Council, a staff auditor tells the engagement supervisor that her brother-in-law has just been appointed as the grant payments manager. What should the supervisor do?

1. A Reassign her to work outside grant payments, review the work she has done so far, and document the matter
2. B Keep her on the work, because the appointment took place after the engagement had already been planned
3. C Remove her from the team and require every team member to repeat all of the work completed so far
4. D Keep her on the work, but ask the new manager to confirm in writing that he will not try to influence her

Show the answer

Answer: A. Supervisors assign work so that auditors are objective and competent for their tasks. When a potential impairment arises during the engagement, such as a close family relationship with the manager of the area under review, the supervisor should reassign the auditor to work where the impairment does not apply, review the work she has already performed to check for any effect, and document the action, informing the CAE as the methodology requires.

Question 5

During an external quality assessment of the internal audit function at Morrow Health, the assessors find that audit managers say they review all workpapers and discuss issues with their staff, but the engagement files contain no review sign-offs or review notes. What is the main concern?

1. A Audit managers should not discuss engagement issues orally with staff
2. B There is no evidence that supervision took place, so conformance cannot be demonstrated
3. C Oral review takes longer than written review, so the function is inefficient
4. D Supervision is required only for junior staff, so the managers' approach is unnecessary

Show the answer

Answer: B. Under the Global Internal Audit Standards (Standard 12.3), the chief audit executive must ensure engagements are properly supervised and that supervision is documented. Review sign-offs, review notes and their resolution show who reviewed what and when, and that issues were addressed. Without them, neither the quality assurance reviewers nor anyone else can verify that supervision took place.

Question 6

During an engagement at Wraxby Holdings, the internal auditor finds evidence that the chief financial officer, who sponsored the engagement and to whom the chief audit executive reports administratively, appears to have directed staff to post unsupported revenue journals at quarter-end. The auditor has told the CAE. To whom should the CAE communicate the matter?

1. A The CFO, as the sponsor of the engagement, so that he can explain the journals before the matter goes any further
2. B The board, through the audit committee chair, via the CAE's functional reporting line and without alerting the CFO
3. C The finance staff who posted the journals, to obtain their explanations before deciding whether escalation is needed
4. D The external auditor only, because a possible misstatement of revenue is a financial reporting matter for them

Show the answer

Answer: B. Escalation must reach someone with the authority and independence to act. When senior management may be involved in wrongdoing, the CAE communicates through the functional reporting line to the board (for example, the audit committee chair), following the organization's policies on investigations and taking advice from legal counsel as appropriate. Alerting the person who may be involved, or those working for him, risks loss of evidence and undermines any investigation.