Internal Audit Glossary: 99 Key Terms for the CIA Exam

Short, plain-English definitions of the terms that appear most often in CIA Part 1.

Learn them as flashcards in CIA Drill, and see each idea explained in the study guide.

Acceptance: No action is taken to change the severity of a risk. Fits when the risk is within appetite. Same as self-insurance.
Activity under review: The subject of an engagement, such as an area, entity, operation, function, process, or system.
Advisory services: Advice given to stakeholders without providing assurance or taking on management responsibilities. Also called consulting services.
Application controls: Measures inside software applications, such as user authentication, that ensure data accuracy, integrity, and security.
Assurance: A statement meant to raise stakeholders’ confidence in governance, risk management, and control processes compared with established criteria.
Audit trail: A record that lets financial data be traced back to its source.
Avoidance: Action taken to remove the risk entirely, for example selling the pipeline to avoid sabotage risk.
Balanced scorecard: A performance tool that links critical success factors from strategy to financial and nonfinancial measures.
Batch processing: Transactions are accumulated and the database is updated in a single batch.
Benchmarking: Comparing performance with other entities known for best practices.
Board: The highest-level governing body, such as a board of directors, audit committee, or board of trustees.
Charter: A formal document giving the internal audit function’s mandate, position, reporting lines, scope, and services.
Chief audit executive (CAE): The leader responsible for managing the internal audit function and the quality of its services in line with the Standards.
Code of conduct: Addresses an organization’s values, objectives, and legal responsibility.
Compliance: Adherence to laws, regulations, contracts, policies, procedures, and other requirements.
Concurrency controls: Controls for when two or more users try to access or update a file or database at the same time.
Conduct: The tangible expression of culture through the actions, behaviors, and decisions of individuals.
Confidentiality: Using information only for professional purposes and protecting it from unauthorized access or disclosure.
Conflict of interest: A situation, activity, or relationship that may influence, or appear to influence, an auditor’s objective judgment.
Control: Any action by management, the board, or others to manage risk and raise the likelihood that objectives are achieved.
Control activities: Policies and procedures that support mitigating risks to achieving objectives.
Control environment: The tone set by senior management and the board on the importance of governance, internal control, and risk management.
Control framework: Guidelines that let organizations match their controls to identified risks and goals.
Control processes: Policies, procedures, and activities designed and operated to keep risks within the organization’s risk tolerance.
Control risk: The risk that controls fail to effectively manage controllable risk.
Control self-assessment (CSA): A process for evaluating operational risks and the effectiveness of control systems.
Core values: The organization’s essential beliefs about what is acceptable or unacceptable.
Corrective controls: Controls that correct the negative effects of unwanted events.
Criteria: Specifications of the desired state of the activity under review (evaluation criteria).
Culture: The invisible belief systems, values, norms, and preferences of individuals in an organization.
Detective controls: Controls that alert the proper people after an unwanted event.
Directive controls: Controls that cause or encourage a desirable event, such as policy manuals, training, and job descriptions.
Due professional care: Planning and performing services with the diligence, judgment, and skepticism of prudent and competent auditors.
Engagement: A specific audit assignment or project with multiple tasks to accomplish related objectives.
Engagement conclusion: The auditors’ professional judgment about findings viewed together, indicating satisfactory or unsatisfactory performance.
Engagement planning: Gathering information, assessing risks, setting objectives and scope, identifying criteria, and creating a work program.
Engagement work program: A document identifying the tasks, methodology, tools, and auditors needed to meet engagement objectives.
Entity-level controls: Controls designed to achieve organizational objectives and address entity-wide risks.
Environmental risk: Results when an organization fails to be a good steward of nature, such as emissions, waste, and climate vulnerability.
External service provider: A resource from outside the organization that supports internal audit services.
Familiarity bias: Making assumptions based on past experience that weaken professional skepticism.
Financial controls: Controls based on accounting principles: authorization, recordkeeping, safeguarding assets, and compliance.
Financial risk: Includes interest-rate, exchange-rate, commodity, credit, liquidity, and market risk.
Finding: A gap between the evaluation criteria and the condition of the activity under review.
Forensic auditing: Using accounting and auditing skills to investigate matters with civil or criminal legal implications.
Fraud: Any intentional act of deceit, concealment, misappropriation, forgery, or violation of trust to gain unjust or illegal advantage.
Fraud investigation: Gathering enough information to decide whether fraud occurred, the loss exposure, who was involved, and how.
Fraud reporting: Oral or written, interim or final communications to management or the board on the status and results of investigations.
Fraudulent financial reporting: Intentional misstatements or omissions to deceive users, such as altering records or misapplying principles.
General IT controls: Wide-ranging policies that maintain the integrity, security, and availability of IT systems.
Governance: The processes and structures the board uses to inform, direct, manage, and monitor activities toward objectives.
Hazard risk: An insurable risk such as natural disasters, sabotage, or loss of senior officers.
Impact: The result or effect of an event, which can be positive or negative.
Independence: Freedom from conditions that may impair the internal audit function’s ability to act without bias.
Inherent risk: The combination of internal and external risk factors that exists without any management action.
Integrity: Adherence to moral and ethical principles, including honesty and the courage to act on relevant facts.
Integrity controls: Controls that monitor data being processed and stored to keep them consistent and correct.
Internal audit mandate: The function’s authority, role, and responsibilities, granted by the board and/or laws and regulations.
Internal audit plan: A risk-based, dynamic document by the CAE listing engagements and services expected in a period.
Internal control (COSO): A process by the board, management, and others giving reasonable assurance on objectives for operations, reporting, and compliance.
Key performance indicator (KPI): A measure of an organization’s performance over time.
Likelihood: The possibility that a given event will occur.
Misappropriation of assets: Theft, embezzlement, or an action that causes payment for items not received.
Mission: The organization’s core purpose.
Monitoring: Evaluating whether the components of the control framework are present and functioning.
Objectivity: An unbiased mental attitude that lets auditors make professional judgments without compromise.
Online transaction processing (OLTP): Real-time processing that updates the database immediately when a transaction is entered.
Operational assurance: Reviewing a function or process to appraise efficiency, effectiveness, and achievement of objectives.
Operational risk: Risk of loss from inadequate or failed internal processes, people, and systems.
Organizational culture: The shared values, beliefs, norms, and behaviors of an organization.
Output controls: Controls ensuring processing results are complete, accurate, and properly distributed.
People-based controls: Controls that depend on human action, such as regular bank reconciliations.
Preventive controls: Controls that identify potential problems before they occur to prevent errors, fraud, or other risks.
Professional skepticism: Questioning and critically assessing the reliability of information.
Pursuit (exploitation): Accepting increased risk to improve performance without exceeding acceptable tolerance.
Quality assurance and improvement program (QAIP): A CAE program to ensure conformance with the Standards, performance objectives, and continuous improvement.
Reduction (mitigation): Reducing the severity of risk to fit the target residual risk profile and risk appetite.
Reengineering: Redesigning core systems to improve efficiency, effectiveness, and quality.
Reputational risk: Arises from conduct that may cause stakeholders to lose respect for the enterprise.
Residual risk: The portion of inherent risk that remains after management actions.
Risk: The positive or negative effect of uncertainty on objectives.
Risk appetite: The types and amount of risk an organization is willing to accept in pursuing its strategies and objectives.
Risk assessment: Identifying and analyzing risks relevant to objectives, usually in terms of impact and likelihood.
Risk capacity: The maximum amount of risk the organization can assume.
Risk management: A process to identify, assess, manage, and control potential events to give reasonable assurance on objectives.
Risk profile: A composite view of the types, severity, and interdependencies of risks tied to a strategy or objective.
Risk tolerance: Acceptable variations in performance related to achieving objectives.
Root cause: The core issue behind the difference between the criteria and the condition of an activity.
Segregation of duties: Spreading tasks among several people so no one controls a transaction from start to finish.
Senior management: The highest executive level, ultimately accountable to the board for executing strategy, including the CEO.
Sharing (transfer): Reducing risk by shifting part of it to another party, such as insurance, hedging, or outsourcing.
Stakeholder: A party with a direct or indirect interest in an organization’s activities and outcomes.
Strategic risk: Includes global economic, political, regulatory, reputation, leadership, and brand risks and changing customer needs.
Sustainability risk: A threat to the business’s long-term survival if it does not act within its social and economic environment.
System-based controls: Controls executed whenever needed with no human intervention.
Target residual risk: The risk the entity prefers to assume after management acts to alter its severity.
Total quality management (TQM): Continuous pursuit of quality in all activities: do it right first time, train and empower staff, teamwork, process improvement.
Vision: The organization’s aspirations for what it intends to achieve over time.
Workpapers: Documentation of the work done in planning and performing engagements that supports findings and conclusions.

Practice with flashcards