Cgap Exam - Domain 1

Front 1

Audit Standards are developed and followed to:

Back 1

1. Provide uniform guidance to auditors.
2. Build credibility and confidence.
3. Inform customers.
4. Establish a basis of conducting internal/external reviews.

Front 2

Role of Auditing Standards

Back 2

- Guide profession, enhance audit quality and credibility/confidence outside
- Generally address staff qualifications, independence, due care, quality, planning, fieldwork & reporting
- Benefit auditors, customers, management & external parties

Front 3

Four sets of Audit Standards

Back 3

1. IIA Standards
2. Generally Accepted Government Auditing Standards
3. International Organization of Supreme Audit Institutions (INTOSAI) Standards
4. International Standards on Auditing (ISA)

Front 4

Need for Effective Standards

Back 4

- “Audit failures” in 1980s
- Public wondered why “clean opinions?
- National Commission on Fraudulent Financial Reporting (Treadway, 1987)
- Financial mischief and “audit failures” relating to Arthur Andersen, Enron, Haliburton, & WorldCom
- Effective standards should help

Front 5

Audit Standards that Might Apply to Government Audits

Back 5

1. Institute of Internal Auditors’ Standards
2. Generally Accepted Government Auditing Standards (GAGAS)/(GAS)
3. GAAS (relationship to GAGAS) FS audit
4. International Organization of Supreme Audit Institutions (INTOSAI) Standards (ISSAI)
5. International Federation of Accountants (IFAC) (ISAs—auditing historical fin. info.)

Front 6

Application of appropriate standards depends on:

Back 6

1. Engagement objective
2. Mandates and local requirements relevant to the audit organization and engagement
3. Availability of information,

Front 7

Definition of Internal Auditing (IIA)

Back 7

Independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Front 8

Purpose of the IIA Standards

Back 8

1. Delineate basic principles of IA
2. Framework for value-added IA
3. Basis to evaluate IA performance
4. Foster improved processes and operations

Front 9

Mandatory Elements of the IIA IPPF

Back 9

1. Definition of IA
2. Code of Ethics
3. IIA Standards

Front 10

What are the IIA Standards

Back 10

Principles focused, mandatory requirements consisting of (1) statements of requirements and (2) interpretations.

Front 11

IIA Standards use of "must"

Back 11

unconditional requirement

Front 12

IIA Standards use of "should"

Back 12

conformance is expected unless, when applying professional judgement, circumstances justify deviation.

Front 13

Three Types of IIA Audit Standards

Back 13

1. Attribute
2. Performance
3. Implementation

Front 14

Implementation Standards (IIA)

Back 14

Expand upon the attribute and performance standards by providing the requirementst applicable to assurance (ISA) or consulting (ISC) services.

Front 15

Attrribute Standards (IIA)

Back 15

Address the attributes of organizations and individuals performing internal audit servcies.

Front 16

Performance Standards - PS (IIA)

Back 16

Describe the nature of Internal Audit services and provide quality criteria against which performance of these services can be measured. APPLY TO ALL IA SERVICES

Front 17

Assurance Services - AS (IIA)

Back 17

- Assessment of evidence to provide opinion or conclusion
- Involves process owner, internal auditor, & the user

Front 18

Consulting Services (IIA)

Back 18

- Advisory in nature, usually at request
- Involves internal auditor & client

Front 19

Attribute Standards - Organizations & Parties (1000-1300)

Back 19

- Define purpose, authority, and responsibility of IA activity.
- Independence & objectivity
- Proficiency & due care
- Continuing professional development
- Quality assurance & improvement program

Front 20

Performance Standards - Activities, Quality, Measurement (2000-2600)

Back 20

* Managing IA activity – planning, communication & approval, resource management, coordination, policies
* Nature of work – improve risk management, control and governance
* Engagement planning – consider risk & control; objectives (criteria); scope; resource allocation; & work program
* Performing – identifying suff., rel., rel., useful info; appropriate analysis & evaluation; documenting ; supervision
* Communicating results – criteria e.g. opinion, conclusion, as appropriate; quality, e.g.,accurate, objective, clear; noncompliance w/ stds; dissemination
* Monitoring progress (follow-up)
* Management’s acceptance of risks

Front 21

Purpose of IIA's Position Papers

Back 21

1. To assist a wide range of parties, including those not in the internal audit profession
2. Intended to assist in understanding significant governance, risk or control issues
3. Delineating related roles and responsibilities of internal auditing

Front 22

Two (IIA) Position Papers

Back 22

1. The Role of Internal Auditing in Enterprise-wide Risk Management
2. The Role of Internal Auditing in Resourcing the Internal Auditing Activity

Front 23

Purpose of IIA Practice Advisories

Back 23

* Assist internal auditors in applying the IA Definition, the Code of Ethics and the Standards, and promote good practices
* Address IA’s approach, methodologies, and considerations, but do not give detailed processes or procedures
* Include practices related to international, country, or industry-specific issues; specific types of engagements; and legal/regulatory issues
* Scope of practice advisories was narrowed in 2009, with the content that addresses tools or techniques moved to the Practice Guides element

Front 24

How many and what kind of IIA Practice Advisories have bene issued?

Back 24

About 20 attribute-related and 40 performance-related PAs

Front 25

Practice Advisories Related to Attribute Standards (AS) (IIA)

Back 25

1. Internal Audit Charter
2. Organizational Independence
3. Individual Objectivity
4. Impairment to Independence or Objectivity
5. Quality Assurance and Improvement
6. Use of “Conforms with ISPPIA”

Front 26

Practice Advisories Related to Performance Standards (PS) (IIA)

Back 26

1. Linking the Audit Plan to Risk and Exposure
2. Reporting to Senior Management and the Board
3. Assessing the Adequacy of Control Processes
4. Risk Assessment in Audit Planning

Front 27

IIA Practice Guides

Back 27

Provide detailed guidance for conducting internal audit activities and include detailed processes and procedures, such as tools and techniques, programs, and step-by-step approaches, including examples of deliverables.

Front 28

How many Practice Guides (IIA) have been issued?

Back 28

13

Front 29

What is a GTAG?

Back 29

Global Tehnology Audit Guide (IIA)

Front 30

How many GTAG's have been issued?

Back 30

16

Front 31

GTAG Examples (IIA)

Back 31

* Information Technology Controls
* Continuous Auditing
* Auditing Application Controls
* Developing the IT Audit Plan

Front 32

Who must follow GAGAS?

Back 32

Fed IGs, nonfederal auditors on federal audits, CFO Act auditors, Single Audit Act auditors, others required by law, regulation or other requirement.

Front 33

GAGAS use of "must"

Back 33

Unconditional Requirement

Front 34

GAGAS use of "should"

Back 34

Presumptively Mandatory

Front 35

GAGAS use of "may", "might", and "could"

Back 35

Explanatory, descriptive

Front 36

What are GAGAS General Standards?

Back 36

1. Independence*—personal*, external and organizational impairments
2. Professional judgment
3. Competence
4. Quality control & assurance

Front 37

Personal Independence Impairments (GAGAS)

Back 37

* Relationships, fin interests, biases, etc.
* Non-audit services—two overarching principles & “safeguards” (clarified in 2007 revision)
* Conceptual framework added in 2011

Front 38

Organizational Independence Impairments (GAGAS)

Back 38

Reporting externally—presumptive criteria, other
Reporting internally--criteria

Front 39

Types of Audits (GAGAS)

Back 39

Finanical
Performance
Attestation

Front 40

What are GAGAS Financial Audits?

Back 40

principally whether FS’s are fairly presented
also, “special reports,” e.g. OCBOA, Single Audit

Front 41

What are GAGAS Attestation Engagements?

Back 41

involves “assertions” by mgmt. (examples?)

Front 42

Other standards that GAGAS Financial Audits are performed under

Back 42

AICPA’s GAAS/SAS’s

Front 43

Other standards that GAGAS Attestation Enagagements are performed under

Back 43

AICPA’s SSAE’s

Front 44

What are GAGAS Performance Audits?

Back 44

E & E, or program effectiveness
Can focus on I/C, compliance, prospective issues

Front 45

Types of GAGAS Standards

Back 45

1. General Standards for all audits/engagements
2. Field Work Standards for Financial Audits
3. Reporting Standards for Financial Audits
4. General, Field Work and Reporting for Attestation Engagements
5. Field Work Standards for Performance Audits
6. Reporting Standards for Performance Audits

Front 46

Two ways to report GAGAS compliance

Back 46

1. Unmodified - audit was in accordance
2. Modified - some standards were not followed

Front 47

Generally Accepted Audit Standards (GAAS) by the AICPA

Back 47

General(3), *fieldwork(3), & *reporting(4)
Statements of Audit Standards (SAS), codified annually, provide interpretation

Front 48

GAGAS Fieldwork Standards – Financial Audits

Back 48

Incorporate GAAS for
(1) planning (supervision),
(2) understanding I/C’s, &
(3) evidence—sufficient, competent

GAGAS* adds
(1) communication,
(2) audit follow-up
(3) material misstatements—from violations of G’s/K’s, abuse
(4) developing finding elements, &
(5) audit documentation.

Front 49

Additional considerations” in in Government: Materiality and Early Communication (GAGAS)

Back 49

* Materiality may be set lower in government
* Early communication allows prompt corrective action

Front 50

The Role of Management Assertions in Considering I/C’s (GAGAS)

Back 50

Management assertions
- existence or occurrence
- completeness
- rights & obligations
- valuation & allocation
- presentation & disclosure

Front 51

GAGAS Reporting Standards – Financial Audits

Back 51

Per GAAS,
(1) GAAP
(2) consistency,
(3) disclosures and
(4) opinion/discl.

Add-ons
(1) GAGAS,
(2) req. reptg on I/C & compliance w/ laws, regs., K’s & G’s
(3)*I/C, F & IAs, non-compliance
(4) views of mgmt,
(5) privileged or confidential info and
(6) report distribution *(AICPA, elements-finding)

Front 52

Components of Financial Statement Audit Reports

Back 52

1. Auditor’s opinion

2. Internal control (A “management letter” can also be used.)

3. Compliance

Front 53

Attestation Standards

Back 53

1. AICPA General & Field Work
2. Field Work Standards in GAGAS (Auditor communication, previous audits/engagements, internal control, FWA, elements of findings, documentation)
3. Reporting Standards in GAGAS (Compliance w/ GAGAS, I/C & FWA, mgmt views, priv/conf info, issue/distribution)

Front 54

GAGAS Fieldwork Standards – Performance Audits

Back 54

1. Planning
2. Supervision
3. Evidence
4. Audit Documentation

Front 55

GAGAS Reporting Standards – Performance Audits

Back 55

Form – appropriate, retrievable

Contents

Quality

Issuance & Distribution

Front 56

What are the contents of an audit report?
GAGAS Reporting Standard - Performance Audit

Back 56

O,S & M,
findings (“elements”, I/C deficiencies, fraud & illegal acts),
conclusions,
recommendations,
GAGAS statement,
compliance,
views of management,
privileged/confidential data

Front 57

What are the quality standards for a GAGAS Performance Audit?

Back 57

timely,
complete,
accurate,
objective,
convincing,
clear,
concise

Front 58

Differences between GAO and IIA Standards (12)

Back 58

1. “Consulting”
2. Independence
3. Performing Non-audit Work
4. Reviewing ethics programs
5. Risk assessment for overall planning
6. External quality assurance
7. Quality assurance systems
8. Reporting compliance with standards
9. Referencing the standards
10. Fraud
11. Follow-up on previous audits
12. CPE’s

Front 59

What is INTOSAI?

Back 59

International Organization of Supreme Audit Institutions
* professional organization of SAI’s in countries belonging to UN

Front 60

What are the INTOSAI publications?

Back 60

1. Auditing Standards
2. Guidelines for Internal Control Standards

Front 61

INTOSAI Framework

Back 61

1. Founding Principles
2. Codes for SAIs
3. Fundamental Audit Principles (includes audit standards)
4. Audit Guidelines (voluminous)
- Financial
- Performance
- Compliance

Front 62

INTOSAI Structure of Auditing Standards

Back 62

Basic Principles
General Standards
Field Standards
Reporting Standards

Front 63

INTOSAI’s Basic Principles

Back 63

1. Comply w/ standards where material
2. SAI applies judgment
3. Need for accountability
4. Adequate information, control, evaluating, & reporting (management)
5. Accounting stds/performance targets
6. Fair presentation—position, results
7. Adequate i/c minimizes risks of errors & irregularities
8. Legislative enactments should facilitate auditors’ access to records
9. All audit activities should be within SAI’s audit mandate
10. Work on validity of performance measures

Front 64

INTOSAI’s View of Full Scope of Government Auditing

Back 64

1. Regularity audits - Financial accountability, systems, i/c, other
2. Performance audits - Economy, efficiency, effectiveness

Front 65

INTOSAI’s General Standards: Auditor & Audit Organization

Back 65

1. Recruiting qualified personnel
2. Development & training
3. Manuals, guidance to conduct audits
4. Skills, experience, sufficient numbers, proper planning & supervision
5. Review of SAI’s standards, procedures (i. e., quality assurance)

Front 66

INTOSAI’s General Standards IDs standards w/ Ethical Significance

Back 66

* Independence
* Avoiding Conflicts of Interest
* Competence (e.g. full range of up-to date audit methodologies, including systems-based techniques, analytical review, statistics, & automation)
* Due Care

Front 67

INTOSAI’s Field Standards

Back 67

1. Planning
2. Supervision & Review
3. Study & Evaluation of I/C
4. Compliance with Applicable Laws, Regs
5. Audit Evidence: competent, relevant, reasonable, techniques/procedures, wp
6. Analysis of Financial Statements: In regularity audits and other, if applicable

Front 68

INTOSAI’s Reporting Standards

Back 68

* Not possible to lay down a rule for reporting for every situation (judgment)
* For “regularity” audits, an opinion and other remarks, e.g. compliance, control, fraud, maybe budgetary execution
* For “performance” audits, reports vary considerably in scope and nature

Front 69

INTOSAI’s Two Reporting Standards

Back 69

1. Written opinion or report—clear; supported by evidence; independent; objective, fair & constructive
- Principles for form and content
- 4 Types of opinions on FSs
2. SAI needs to decide on final action in cases of fraud or serious irregularity

Front 70

INTOSAI Reporting on Compliance in Regularity Audits

Back 70

Address consideration of compliance with relevant laws, regulations, and report:
* Positive assurance where tested,
* Negative assurance where not tested.

Front 71

INTOSAI Reporting on Compliance in Performance Audits

Back 71

Address compliance where pertinent to the audit objectives, and report significant instances of non-compliance

Front 72

What is IFAC?

Back 72

International Federation of Accountants
Worldwide organization for accounting profession.

Front 73

What is IAASB?

Back 73

IFAC’s International Auditing & Assurance Standards Board (IAASB) issues auditing & assurance standards

Front 74

What has been IFAC’s Impact on Government Audits?

Back 74

1. SAIs or other bodies appointed may be required to audit FSs in public sector.
2. When an audit opinion is to be expressed on FSs, the same audit principles apply, regardless of entity
3. In past, basics supplemented/clarified in PSPs, being eliminated. (PSPs did not apply to unique compliance, i/c, e-e-e in govt audits.)

Front 75

IFAC: International Framework for Assurance Engagements

Back 75

1. IFAC Code of Ethics
2. International Standards on Quality Control
3. Audits and Reviews of Historical Financial Information (includes International Standards of Auditing, ISAs)
4. Assurance Engagements Other Than Audits and Reviews of Historical Financial Information (includes International Standards on Assurance Engagements, ISAEs)

Front 76

Description of IFAC Assurance Engagements

Back 76

1. Designed to enhance confidence—two types are “reasonable” (positive) &”limited” (neg.)
2. Excludes certain engagement, e.g. taxes, consluting
3. ISAs, ISAE’s, ISRE’s are applied under this “framework” and provide the principles, etc.
- IFAC’s acceptance characteristics include ethics, suitable criteria, access to evidence
4. Elements: 3-party relationship (practitioner, responsible party, users); appropriate subject matter; suitable criteria; sufficient, appropriate evidence; written report

Front 77

Are IFAC International Standards on Auditing (ISA's) applicable to performance audits?

Back 77

No

Front 78

What is Governance in the Public Sector?

Back 78

Accountability
Standard setting
Ethics/Code of Conduct
Public Scrutiny
Elected or appointed officials

Front 79

What is Accountability as it relates to governance?

Back 79

1. Foundation of democracy
2. Exercise of authority, direction & control
3. Elements include: Performance budgeting & reporting, Financial reporting, audits, evaluations, Open government
4. Drucker explained why important, e.g. no PM capacity, involuntary resources, etc.

Front 80

What is the role of auditing in Accountability?

Back 80

Accuracy & completeness of records
Compliance
Goal accomplishment, E & E, safeguarding
Should not be seen as only a negative.

Front 81

Four Levels of Ethics/Code of Conduct in Governance

Back 81

1. Personal morality
2. Professional ethics
3. Organizational ethics
4. Social ethics

Front 82

Concept of Public Scrutiny in Governance

Back 82

1. Open government laws, e.g., access to records, public meetings
2. Due process considerations
3. Affects government practices regarding: Agency responsibilities, Customer/client privacy, Elected /appointed officials, and Audit process

Front 83

What is the role of auditing in Governance?

Back 83

1. Part of foundation of trust
2. Access to information not available to the public creates audit responsibilities
3. Sensitivity to misuse of information from computer systems
4. Auditors’ responsibilities for returning/destroying sensitive info

Front 84

What is the Audit Committee's Role in Governance?

Back 84

1. Critical element of control environment
2. Assures independence of IA.
3. Assures appropriate action on rec.s
4. Links internal & external auditors
5. Members should be independent
6. Formal, written charter (or equivalent)
7. Auth., respons., meetings, maybe in law?

Front 85

Risk/Control Framework: Definition of Internal Control

Back 85

I/C defined as a process effected by an entity’s board of directors, management, and other personnel designed to provide reasonable assurance for three categories of objectives:
* operations
* financial reporting
* compliance.

Front 86

AICPA’s Five Interrelated Components of I/C

Back 86

1. control environment
2. risk assessment
3. information & communication
4. control activities
5. monitoring

Front 87

Two Primary I/C Frameworks

Back 87

1. COSO’s conceptual framework widely accepted
* private sector initiative in 1980’s to address fraudulent financial reporting
* AICPA, AAA,FEI, IIA, IMA formed COSO
2. CICA’s IC Framework Evolution

Front 88

According to COSO - Two Goals of Risk and Control

Back 88

1. Common definition
2. A standard for measurement

Front 89

Views on Risk and Control According to COSO

Back 89

- I/C is a “tool,” not a substitute for mgmt.
- I/C has limitations
- Key words—process, people (carry it out), reasonable assurance, achievement of objectives

Front 90

COSO's ERM Described

Back 90

A process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding achievement of entity objectives.

Front 91

Four ERM Categories (COSO)

Back 91

1. Strategic
2. Operations
3. Reporting
4. Compliance

Front 92

What are the two components of the IIA's Code of Ethics?

Back 92

Principles & Rules of Conduct

Front 93

What are the four principles of the IIA's Code of Ethics?

Back 93

Integrity
Objectivity
Confidentiality
Competency

Front 94

What is CICA?

Back 94

Canadian Institute iof Chartered Accountants

Front 95

According to CICA's Risk/Control Framework, what are the six board responsibilities?

Back 95

1) Ethics &
2) Mission, vision & strategy
3) External communication &
4) sr. mgmt.
5) Control systems &
6) bd. effectiveness

Front 96

What are the three objectives of CICA's Risk/Control Framework?

Back 96

Effectiveness & efficiency
Reliability of internal and external reporting
Compliance

Front 97

According to COSO, what is the auditors role in ERM?

Back 97

Assurance on processes
Assurance that risk are properly assessed

Front 98

According to COSO, what shoudl auditors NOT undertake in ERM?

Back 98

Setting the Risk Appetite

Front 99

What are COSO's eighth ERM Sub-components?

Back 99

Internal environment
Objective setting
Event identification
Risk assessment
Risk response
Control activities
Information and communication
Monitoring

Front 100

What are the IIA's Rules of Conduct for Integrity?

Back 100

honesty, diligence, responsibility, observe law, no illegal or discreditable act, respect for ethics

Front 101

What are the IIA's Rules of Conduct for Objectivity?

Back 101

relationships/activities/gifts that are/appear to bias--avoid. Disclose.

Front 102

What are the IIA's Rules of Conduct for Confidentiality?

Back 102

prudent use of info, not to be used for personal gain or illegally

Front 103

What are the IIA's Rules of Conduct for Competency?

Back 103

Have KSE, follow ISPPIA, improve proficiency/efficiency

Front 104

What ar the four key words in INTOSAI's Code of Ethics?

Back 104

Integrity
Independence/objectivity/impartiality
Professional Secrecy
Competence

Front 105

What are the principles of IFAC's Code of Ethics for Public Accountants?

Back 105

Integrity
Objectivity
Professional Competence & Due Care
Confidentiality
Professional Behavior
Technical Standards

Front 106

What are the GAGAS Ethical Principles?

Back 106

The public interest
Integrity
Objectivity
Proper use of government information, resources, and position
Professional behavior