CIA IIA-CIA-Part2 Release Date

 Verification of Controls: The auditor should verify that the new IT system addresses the previously identified risks. This involves reviewing the system documentation and ensuring that the controls in the new system effectively mitigate the risks.

IIA Standard 2500 - Monitoring Progress, which emphasizes the need for auditors to follow up on management's corrective actions.

 Reporting: Once the auditor has confirmed that the new system controls address the risks, they can report to senior management and close the outstanding issue, ensuring that all audit recommendations are appropriately resolved.

 Other Options:

Accepting Management's Explanation: Without verification (option B) is not appropriate as it may leave risks unmitigated.

Escalating Without Verification: Advising management and escalating (option C) is premature if the new system may already address the issues.

Detailed Process Evaluation: Requiring additional details about the process (option D) may be unnecessary if the auditor can verify the controls directly.

If an internal auditor identifies that some employees have inappropriate access to a key system in the early stage of an audit, the best course of action is to issue an interim audit report so that management can implement action plans. This approach ensures that the identified issue is formally communicated to management promptly, allowing them to take immediate corrective action to mitigate the risk. It also documents the auditor's findings and recommendations, providing a clear audit trail and supporting accountability. Obtaining verbal assurance or creating a ticket might address the issue temporarily but lacks the formal documentation and follow-up mechanisms inherent in an interim audit report.

IIA Standard 2440: "Disseminating Results"

IIA Practice Advisory 2440-1: "Communicating Interim Engagement Results"

 Corporate Policy Statement: Having the president and the board issue a statement stressing the importance of accurate management reporting and the negative consequences of intentional misreporting can help set a tone at the top. This reinforces the significance of ethical behavior and compliance with reporting policies across the organization.

Strong tone at the top is critical for fostering an ethical culture and compliance within an organization (IIA Standard 2110 – Governance).

 Business Process Indicators: Assisting the controller in developing and monitoring business process indicators that are historically correlated with, but independent of, sales can provide an objective means to validate sales reports. This reduces the opportunity for management to exaggerate sales figures as these indicators can act as a control mechanism.

If a significant error or omission is found in the final audit report, it is crucial for the internal audit activity to correct the information and redistribute the corrected report to all original recipients. This ensures that all stakeholders are informed of the accurate findings and can take appropriate actions based on correct information.

IIA References:

IIA Standard 2440: Disseminating Results requires that the internal audit activity communicate accurate and complete results. If an error or omission is identified, the corrected information must be promptly communicated to all relevant parties to maintain the integrity of the audit process.

The Practice Guide on Communicating Results emphasizes that errors in audit reports should be corrected and the revised report should be distributed to ensure stakeholders are acting on accurate information.