IIA-CIA-PART1 practice question 8 of 35

Under which of the following circumstances should the final audit report include a disclosure of nonconformance with the Standards?

Answer options

A: An external quality assessment of the internal audit activity is performed only once every five years.

B: The internal auditor provided negative assurance, because he found no evidence of misconduct.

C: The annual internal audit plan includes some consulting engagements that are based on opportunities rather than risks to the organization.

D: A new internal auditor moved into the internal audit activity from the payroll department and was immediately assigned to the payroll audit. Correct answer

Correct Answer:

D. A new internal auditor moved into the internal audit activity from the payroll department and was immediately assigned to the payroll audit.

Explanation

The situation described involves an auditor being assigned to audit a department where they were recently employed. This creates an impairment of individual objectivity. According to The Institute of Internal Auditors (IIA) Standards, objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which they had responsibility within the previous year. When such an impairment impacts a specific engagement, the Standards mandate that the nonconformance, the reasons for it, and its impact on the engagement must be disclosed in the final communication of results (the audit report).

Why Incorrect

A. An external quality assessment performed once every five years is in full conformance with IIA Standard 1312, which requires such assessments "at least once every five years."
B. While positive assurance is generally preferred, the use of negative assurance is not an explicit nonconformance with the Standards that would require disclosure in the report.
C. The internal audit plan can and should include consulting engagements based on opportunities to add value, not just risks, as permitted by IIA Standard 2010.C1.

References

1. The Institute of Internal Auditors. (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1130.A1: "Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year."

Standard 2431 – Disclosure of Nonconformance: "When nonconformance with the Code of Ethics or the Standards impacts a specific engagement, communication of the results must disclose the: Principle or rule of conduct of the Code of Ethics or Standard(s) with which full conformance was not achieved; Reason(s) for nonconformance; and Impact of nonconformance on the engagement and the communicated engagement results."

2. The Institute of Internal Auditors. (2017). Implementation Guidance: Standard 1130: Impairment to Independence or Objectivity. This guide clarifies that if an auditor is assigned to an area of previous responsibility, "the impairment must be disclosed to the engagement client and in the engagement report."

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., Salamasick, M., & Sobel, P. J. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. Chapter 3, "Standard 1130: Impairment to Independence or Objectivity," discusses that assigning auditors to areas where they recently worked is a common example of an objectivity impairment that must be disclosed.

Question breakdown

Tests: Identify engagement-level nonconformance requiring disclosure
Difficulty: Medium

Key idea: When nonconformance with the Standards affects a specific engagement, the communication of results must disclose the requirement not met, the reason, and the impact.

How to reach the answer

Test each scenario against the Standards to see whether it actually breaches a requirement.
An external assessment at least once every five years meets the requirement, so A is not a breach.
Consulting engagements selected for their potential to add value are allowed, so C is not a breach.
An auditor assessing operations they were responsible for within the previous year impairs objectivity, so D is a breach.
Because the breach in D affects that specific engagement, it must be disclosed in the final report.

Each option

AIncorrect. The Standards require external assessments at least once every five years, so this conforms.
BIncorrect. Giving limited or negative assurance is a reporting choice and does not by itself violate the Standards.
CIncorrect. The CAE may accept consulting engagements based on their potential to improve operations and add value.
DCorrect. Objectivity is presumed impaired when an auditor assesses an area they worked in within the past year, a nonconformance that affects this engagement and must be disclosed.

Common trap: Five years sounds like a long time, so A looks like a lapse, but it is exactly the required minimum frequency.

In practice: CAEs should rotate staff who transfer in from operations away from their former areas for at least a year; otherwise the report must disclose the impairment.

Remember: Disclose a nonconformance in the engagement report only when an actual breach of the Standards affects that engagement, such as an objectivity impairment from a recent role.

Reviewed by Alexandra Stone.

Keep practicing

Take the free IIA-CIA-PART1 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test