CIA® Certified Internal Auditor Part 3: Business Knowledge for Internal Auditing

* Before starting the course. You will complete a self-assessment through the IIA’s Certification Candidate Management System (CCMS). Based on the results, the different sections of this program may be covered briefly or in greater depth.

Domain 1: Internal Audit Operations

• Strategic management of internal audit operations
  • Master the planning, organization, direction, and monitoring of internal audit activities, including the management of external service providers, balancing assurance and consulting engagements, and adapting methodologies.
     
• Effective management of internal audit resources
  • Develop expertise in managing financial resources (budgeting), human resources (recruitment, roles, training, performance, retention), and IT resources (necessary technologies), as well as applying behavioral and management techniques to optimize the audit function.
     
• Strategic alignment of internal auditing
  • Acquire the ability to align internal audit strategy with stakeholder expectations by supporting corporate strategy and risk management, defining the internal audit mission and vision, and ensuring resource planning consistency.
     
• Strategic communication with senior management and the board
  • Develop advanced relationship-building and communication skills, both formal and informal, with senior management and the board regarding the audit plan, independence and risk concerns, overall GRC effectiveness, quality assessment results, and performance indicators.

Domain 2: The Internal Audit Plan

• Identifying audit opportunities
  • Master the identification of potential engagement sources, including defining the audit universe and its key elements, applying thematic requirements, reviewing requests from management and the board, identifying applicable laws and regulations, recognizing market trends and emerging technologies, and understanding audit cycle requirements.
     
• Developing a risk-based audit plan
  • Gain expertise in risk assessment and prioritization processes, aligning the audit plan with organizational strategy and stakeholder expectations, and adapting the plan to changing circumstances.
     
• Coordinating with other assurance providers
  • Recognize the importance of coordination with internal and external assurance providers, identify methods to coordinate coverage, and establish evaluation criteria to rely on their work.

Domain 3: Quality of the Internal Audit Function

• Implementing a Quality Assurance and Improvement Program (QAIP)
  • Master the required elements of a QAIP, understand its purpose and the CAE’s responsibility for communicating it to the board, compare internal and external assessments, recognize evaluator qualifications, and describe the key elements of ongoing monitoring and self-assessments.
     
• Managing nonconformance with standards
  • Identify appropriate disclosure of nonconformance with global standards, including what information to report and the steps for communicating to management and the board.
     
• Establishing key performance indicators (KPIs)
  • Recognize practical methods for developing KPIs and dashboards for internal auditing, understand their objectives and key elements, and analyze qualitative and quantitative performance measures of the audit function.

Domain 4: Engagement Results and Follow-up

• Communicating engagement results effectively
  • Recognize the characteristics of effective communication (accurate, objective, clear, concise, constructive, complete, and timely) and apply them, identify effective communication methods, and recognize the key elements of audit reports.
     
• Developing recommendations and action plans
  • Determine when to develop recommendations, request action plans, or collaborate with management; recognize the protocol in case of disagreement; understand the purpose of recommendations (including cost-benefit considerations); and evaluate the adequacy of action plans.
     
• Engagement closure, communication, and reporting process
  • Describe the objectives and stakeholders of closing communications; recognize the CAE’s responsibility for disseminating the final report to stakeholders (management, board, risk management, external auditors, regulators, public); and outline the protocol for addressing resolved findings and significant errors/omissions.
     
• Assessing residual engagement risk
  • Master methodologies for evaluating the adequacy and effectiveness of controls to determine residual risk, understand the purpose of aggregating and prioritizing results, and apply rating scales.
     
• Communicating risk acceptance
  • Describe the process for communicating management’s acceptance of risk (when the level of risk may be unacceptable to the organization), including determining what constitutes unacceptable risk, identifying the stakeholders involved, and outlining the sequence of steps.
     
• Monitoring and confirming the implementation of action plans
  • Recognize internal audit’s responsibility to monitor management’s actions and distinguish the key steps of monitoring and confirmation.
     
• Escalation process in case of inadequate implementation
  • Describe the escalation process if management fails to implement an action plan adequately, including the stakeholders involved and the sequence of steps.