Pass IIA-CIA-Part1 Exam Guide

Due professional care was applied by the internal auditor. According to IIA guidance, due professional care involves applying reasonable judgment in all audit circumstances. The auditor’s decision to extend the scope of testing based on a fraud risk assessment, even though no issues were initially found, represents a judicious use of professional judgment given the potential risk of fraud. The fact that fraud was later discovered does not necessarily imply a lack of professional care, as audits cannot guarantee the detection of all frauds.

IIA Standard 1220 - Due Professional Care

Effective third-party risk management involves conducting thorough due diligence before entering into a contract to ensure that the third party meets the organization ' s standards and requirements. Conducting due diligence only after contract signing is a significant red flag, as it indicates that the organization might be engaging with third parties without fully understanding the associated risks. This can lead to inadequate risk management and potential issues with compliance, performance, and security. References: The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2210 - Engagement Objectives, and COSO’s Enterprise Risk Management - Integrating with Strategy and Performance.

The periodic presentation designed to strengthen fraud-resilience awareness is preventive because it seeks to influence behavior, increase awareness of fraud schemes, and discourage misconduct before it occurs. Preventive controls are intended to reduce the likelihood that an undesirable event will happen. A whistleblower hotline primarily supports detection and reporting after suspicious conduct is observed. A year-end reconciliation is also detective because it identifies discrepancies after transactions have been processed. Likewise, reviewing management-approved exceptions is a monitoring or detective activity because it evaluates whether prior decisions complied with delegated authority. The IIA’s fraud guidance emphasizes awareness, education, culture, and governance as important elements of fraud deterrence. Among the choices, the awareness presentation is the only control primarily designed to prevent fraudulent behavior before it occurs.

According to IIA guidance, due professional care means that internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor. This involves considering the cost of assurance in relation to potential benefits and exercising judgment and care in accordance with the complexity of the task. It does not imply an exhaustive review of all transactions or guarantees that all significant risks will be identified or that fraud does not exist.

The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing, specifically those related to due professional care.