GMSiSuccess – CIA PART 1: GIAS QUICK REVISION NOTES..CIA PART 1

GMSiSuccess – CIA PART 1: GIAS QUICK REVISION NOTES CIA PART 1

GMSiSuccess – CIA PART 1: GIAS QUICK REVISION NOTES

THE 5 DOMAINS (Sequence = WHY → BEHAVE → GOVERN → MANAGE → PERFORM)

Domain Focus Memory Key

I Purpose of Internal Auditing WHY we exist – add value

II Ethics and Professionalism HOW auditors BEHAVE

III Governing the IA Function WHO GOVERNS (Board + CAE)

IV Managing the IA Function HOW CAE MANAGES

V Performing IA Services HOW audits are PERFORMED

Industry Anchors:

· Domain I: Manufacturing firm – IA evaluates supply-chain risk controls to protect value

· Domain II: Pharma auditor refuses supplier gift during procurement audit

· Domain III: Bank Audit Committee approves mandate, ensures CAE access to Board

· Domain IV: Tech CAE decides: hire data analyst vs. outsource cybersecurity audit

· Domain V: Hospital auditor tests billing, issues report, tracks corrective actions

---

THE 15 PRINCIPLES (Domain II–V)

Domain II – Ethics (Principles 1–5)

· P1 Integrity – Report fraud even if senior management involved

· P2 Objectivity – Don't audit system you designed; disclose impairments

· P3 Competency – IT auditor acquires cybersecurity knowledge before complex audit

· P4 Due Professional Care – Verify evidence; don't blindly accept management explanations

· P5 Confidentiality – Don't disclose customer data to unauthorized employees

Domain III – Governance (Principles 6–8)

· P6 Authorized by Board – Board approves mandate/charter

· P7 Positioned Independently – CAE has direct functional access to Audit Committee

· P8 Overseen by Board – Committee reviews audit plans, resources, CAE effectiveness

Domain IV – Management (Principles 9–12)

· P9 Plan Strategically – Prioritize cyber and regulatory audits in a bank

· P10 Manage Resources – Recruit IT specialists or outsource technical audits

· P11 Communicate Effectively – Escalate critical safety weakness to Board; don't let management suppress

· P12 Enhance Quality – QAIP: ongoing monitoring + periodic self-assessments + EQA

Domain V – Performance (Principles 13–15)

· P13 Plan Engagements – Define objectives, scope, work program for hospital billing audit

· P14 Conduct Engagement Work – Test invoices, verify supporting documents

· P15 Communicate Results & Monitor Actions – Issue report; verify corrective actions implemented

---

CONFUSING TERMS – KNOW THE DIFFERENCE

Independence vs. Objectivity

Independence Objectivity

Organizational/structural Individual mental attitude

Position of IA function Unbiased professional judgment

Supported by Board Maintained by individual auditor

CAE has direct Audit Committee access Auditor refuses gifts from auditee

Trap: Structurally independent function ≠ auditor with objectivity (personal bias may exist)

Assurance vs. Advisory

Assurance Advisory

Independent assessment against criteria Advice and recommendations

Evaluates governance, risk, controls Helps improve processes

Auditor reaches conclusion Auditor advises; management decides

"Warehouse security controls are ineffective" "Consider improving warehouse layout"

Trap: Auditor must NOT assume management responsibility in advisory work

Essential Conditions

· Board + Senior Management MUST provide: mandate, access, resources, independence

· Example: Hospital IA denied patient billing records → CAE discusses with management → unresolved → escalate to Board

· Trap: Unrestricted access is essential (subject to law)

Combined Assurance

· Coordinate IA + External Audit + Compliance + Risk Management

· Avoid duplicate testing; identify gaps

· Trap: Coordination ≠ IA transfers accountability or judgment to others

---

TOP DEFINITIONS – EXAM CRITICAL

Risk Appetite vs. Risk Tolerance

Appetite Tolerance

Overall risk willing to accept Acceptable variation around appetite

Broad, strategic Specific, measurable

Bank: "moderate credit risk appetite" "Max 3% non-performing loan ratio"

Inherent vs. Residual Risk

· Inherent: Before controls (theft from unsecured construction site)

· Residual: After controls (some theft risk remains despite CCTV, fencing, patrols)

· Trap: Residual ≠ low or eliminated; may remain high

Criteria – Condition – Cause – Effect

Term Meaning University Example

Criteria What SHOULD be Fees reconciled monthly

Condition What IS Not reconciled for 3 months

Cause WHY ERP lacks automation; staff untrained

Effect SO WHAT Revenue misstated; fraud undetected

Memory: Criteria = should; Condition = is; Cause = why; Effect = so what

Trap: Don't confuse Cause with Condition

QAIP (Quality Assurance & Improvement Program)

· Internal: Ongoing monitoring + periodic self-assessments

· External (EQA): At least once every 5 years; qualified independent assessor; at least one team member holds active CIA

· Trap: QAIP = whole program; EQA = external component only

Mandate vs. Charter

· Mandate: Authority, role, responsibilities granted by Board/law

· Charter: Formal document defining purpose, authority, position, reporting, scope

· Correction: Charter NOT abolished; both concepts remain relevant

---

EXAM TRAPS – TERMINOLOGY & RULES

Old vs. New GIAS

Old New

2017 IPPF 2024 GIAS (effective Jan 9, 2025)

Mission of IA Purpose of Internal Auditing

Organizational independence Positioned Independently (P7)

Follow-up Communicate results + monitor actions (P15)

Remember: 5 Domains, 15 Principles, 52 Standards

MUST vs. SHOULD

· Must = Mandatory requirement

· Should = Recommended; follow unless justified

· May/Consider = Optional

· Trap: Implementation guidance recommendations ≠ mandatory requirements

Functional vs. Administrative Reporting

· Functional: CAE → Board/Audit Committee (independence, oversight)

· Administrative: CAE → CEO/CFO (payroll, facilities, routine admin)

· Board controls CAE appointment/removal

· Admin line must NOT interfere with audit scope, performance, communication

· Trap: Don't assume CFO is always appropriate admin line

---

WHO IS RESPONSIBLE?

Role Key Responsibilities

Board/Audit Committee Authorizes IA; approves charter; safeguards CAE independence; oversees function; ensures resources & access

CAE Manages IA function; develops strategy/plan; deploys resources; communicates with Board; maintains QAIP; monitors actions

Internal Auditors Plan engagements; gather evidence; identify findings; develop conclusions; communicate results; maintain objectivity & confidentiality

Exam Rule:

· "Who manages IA function?" → CAE

· "Who authorizes/oversees IA?" → Board

· "Who performs audit testing?" → Internal Auditors

---

10 MUST-KNOW SCENARIOS

1. Auditor's brother is Finance Manager in audited department → Objectivity: disclose conflict

2. CFO denies CAE access to records → Escalate to Board if unresolved

3. Management asks auditor to approve procurement policy → Advise only; don't assume management responsibility

4. Auditor accepts expensive gift from auditee → Integrity & Objectivity compromised

5. CAE plans audits without considering organizational risks → Failure to Plan Strategically

6. IA lacks IT expertise → CAE must address resource/competency gaps

7. High-risk recommendations not implemented → P15: Monitor action plans

8. EQA not conducted for 6 years → Nonconformance with 5-year requirement

9. Auditor accepts management explanation without verification → Failure of Due Professional Care & Skepticism

10. CAE reports to CFO who suppresses findings → Threat to independence; ineffective Board oversight

---

15 PRINCIPLES – ONE-WORD MEMORY TABLE

# Principle Key Word

1 Integrity Honesty

2 Objectivity Impartiality

3 Competency Knowledge

4 Due Professional Care Diligence

5 Confidentiality Secrecy

6 Authorized by Board Authority

7 Positioned Independently Independence

8 Overseen by Board Oversight

9 Plan Strategically Strategy

10 Manage Resources Resources

11 Communicate Effectively Communication

12 Enhance Quality QAIP

13 Plan Engagements Planning

14 Conduct Engagement Work Evidence

15 Communicate Results & Monitor Reporting/Follow-up

---

FINAL EXAM RULES (5 STEPS FOR MCQs)

1. Identify the Domain – Ethics? Governance? Management? Execution?

2. Identify the Responsible Person – Board? CAE? Management? Auditor?

3. Identify the Issue – Independence? Objectivity? Resources? Communication?

4. Select the BEST answer – More than one may seem correct; choose most appropriate per GIAS

5. Apply Professional Judgment – Consider authority, responsibility, risk, evidence, independence

---

SUCCESS MANTRA

Understand → Connect to Examples → Solve Scenarios → Analyze Mistakes → Improve

· Daily 30 minutes quality revision

· Attend lectures; revise notes; attempt mock tests

· Review performance reports; improve continuously

---

Faculty Note: Aligned with 2024 GIAS effective January 9, 2025. Examples are illustrative, not additional requirements.

Prof. Mahaley | GMSiSuccess | Goregaon West, Mumbai

Reference: The IIA – Global Internal Audit Standards