CIA IIA-CIA-Part1 Exam Dumps

When an internal auditor suspects fraudulent activity, such as erroneous payments to a fraudulent bank account, the appropriate course of action is to escalate the concern to the engagement supervisor (Option D). This step ensures that the issue is handled with the necessary urgency and oversight. According to the IIA Standards, particularly Standard 2060: Reporting to Senior Management and the Board, the CAE must communicate significant risk exposures and control issues, including fraud risks, to senior management and the board. Escalating the concern ensures the appropriate levels of the organization are aware and can take timely action.

IIA Standards, Standard 2060: Reporting to Senior Management and the Board

IIA Practice Guide: Internal Auditing and Fraud

The review requested by the manager of the payroll department, focusing solely on the processes related to the approval of time worked, is best classified as a Compliance Assurance Engagement. This type of engagement aims to ensure that specific processes comply with established policies, procedures, or regulations — in this case, those related to payroll approvals. The emphasis on adherence to established guidelines and rules characterizes this as a compliance engagement rather than financial, operational, or risk management consulting.

IIA guidance on different types of audit engagements.

Exercising due professional care means ensuring that audit procedures are sufficient to meet the audit objectives and identify all significant risks. Ensuring that the work program is appropriately designed to identify all risks surrounding the payroll process demonstrates due professional care, as it involves planning and performing the audit with diligence and thoroughness.

Option B: Determining compliance with laws is part of due professional care but not as comprehensive as designing the work program to identify all risks.

Option C: Verifying internal controls implementation is part of the audit scope but does not fully encompass due professional care in planning and executing the audit.

Option D: Consulting with the risk manager is a good practice but does not substitute for the auditor ' s responsibility to plan and perform the audit.

IIA Standard 1220: Due Professional Care.

IIA Practice Guide: Due Professional Care.