CIA Part 1, Unit 2: Assurance Services I
Free study notes for Section A: Foundations of Internal Auditing, which is 35% of the CIA Part 1 exam. Topics: What assurance covers, Control self-assessment (CSA), Third parties and contracts, Quality, Security and privacy, Performance audits.
Practice 168 free questionsOpen CIA Drill
What assurance covers
- Goal: Strengthen the organization's ability to create and maintain value.
- Three processes: Governance, risk management, and control.
- COSO components: Control environment, risk assessment, control activities, information and communication, monitoring.
- Engagement types: Compliance, operational, financial reporting, and IT assurance.
Control self-assessment (CSA)
- Purpose: Raise risk and control awareness by involving the people who run the processes.
- Three approaches: Workshop facilitation, survey, and self-certification.
- Workshop formats: Objective-, risk-, control-, and process-based.
- Auditor's role: Facilitate, train, and validate. Management owns the controls.
- Limit: Participants may lack risk skills, so risks can be missed.
Third parties and contracts
- EBR audit cycle: Understand the relationship, assess risks and controls, perform the audit, report, monitor progress.
- Management owns: Managing external relationship risks. Benefits must exceed risks.
- Contract types: Lump-sum (fixed price), cost-plus, and unit-price.
- SOC reports: SOC 1 for financial reporting, SOC 2 for controls, SOC 3 for general use.
- Right to audit: Check the contract allows it.
Quality
- TQM: Continuous pursuit of quality in every activity. Do it right the first time.
- Starts with: External customer requirements.
- Audit role: Assure quality structures exist and processes work as intended.
- ISO 9000: Guidance for a quality management system.
Security and privacy
- Board: Ultimately accountable for privacy risk.
- Audit role: Assess risks, monitor corrective action, evaluate controls. Do not build the program.
- Privacy: Personal information is collected, kept, and used only as intended and as the law allows.
Performance audits
- KPIs: Assurance on how well targets for key performance indicators are met.
- Balanced scorecard: Financial, customer, internal process, learning and growth.
- Advisory side: Help management choose the right metrics.
Test yourself on this unit
Reading is only half of studying. CIA Drill has 168 free exam-style questions for this unit, each with an explanation, and spaced review that brings missed questions back. You can also take timed mock tests that follow the real exam weighting.