Cia Review: Part 2 Study Unit 2: Assurance and Compliance Engagements

CIA REVIEW: PART 2 2.
1 Assurance Engagements
2.2 Risk and Control Self Assessment
Study Unit 2 2.3 Audits of Third Parties and Contract Auditing

2.4 Quality Auditing
2.5 Due Diligence Auditing
Assurance and Compliance 2.6 Security and Privacy Audits
2.7 Performance and Operational Auditing
Engagements 2.8 Compliance Auditing
Copyright © 2017 Gleim Publications, Inc. All rights reserved. Duplication prohibited. Reward for information exposing violators. Contact copyright@gleim.com. 1 Copyright © 2017 Gleim Publications, Inc. All rights reserved. Duplication prohibited. Reward for information exposing violators. Contact copyright@gleim.com. 2
CIA 2, SU 2 CIA 2, SU 2
Financial, Compliance,
Operational, and IT Auditing
• According to the Introduction to the Standards, Assurance
services involve the internal auditors objective assessment of
evidence to provide opinions or conclusions regarding an entity,
operation, function, process, system, or other subject matter.
• The following overview of assurance services is based on various
publications of The IIA:
Assurance Engagements o Financial assurance provides analysis of the economic activity

of an entity as measured and reported by accounting
methods.
2.1 o Compliance assurance is the review of financial and operating
controls to assess conformance with established laws,
standards, regulations, policies, plans, procedures, contracts,
and other requirements.
Financial, Compliance, Three Objectives of Internal
Operational, and IT Auditing Control
• Operational assurance is the review of a function or process • Internal control is a process effected by an entitys board,
to appraise the efficiency and economy of operations and management, and other personnel that is designed to
the effectiveness with which those functions achieve their provide reasonable assurance regarding the achievement of
objectives. the following objectives:
1. Operations objectives relate to the effectiveness and
• IT assurance is the review and testing of IT (for example, efficiency of operations, e.g., achievement of
computers, technology infrastructure, IT governance, operational and financial performance goals, and the
mobile devices, and cloud computing) to assure the integrity safeguarding of assets against loss.
of information. 2. Reporting objectives relate to internal and external
o Traditionally, IT auditing has been done in separate financial and nonfinancial reporting and may include the
projects by IT audit specialists, but increasingly it is reliability, timeliness, and transparency of such
reporting.
being integrated into all audits.
3. Compliance objectives relate to adherence to applicable
laws and regulations.
Assurance Services Assurance Mapping

• The services described also may be performed by external • An assurance map is a visual representation of an
auditors, for example, in outsourcing or cosourcing organizations risks and assurance activities.
engagements. • Assurance providers are internal and external stakeholders
• Nevertheless, the traditional focus of external auditors is on that are responsible for implementing and maintaining
the fair presentation of general purpose financial assurance services.
information.
Risk Example
• Risk is determined by judging the inherent risk of the
activity, the risk that internal controls may not prevent or
detect noncompliance, and the potential consequences of
noncompliance.
• The level of assurance is determined by considering the
quality, extent, and costs of internal controls.
Notes:
• As customer privacy concerns have become more important, the entity has determined that its
assurance activities related to customer privacy need to be increased.
• Compliance with employment law has not previously been an issue. However, due to recent
changes in the law, the entity is considering increasing assurance activities.
• Due to the balance between risk and assurance activities, the entity does not know whether it
should increase or decrease assurance activities.
• The level of assurance activities for fraudulent financial reporting is high. The entity therefore is
considering using some resources for those assurance activities elsewhere.
Multiple-Choice Question Multiple-Choice Answer

When the internal audit activity performs an assurance engagement, how many parties are When the internal audit activity performs an assurance engagement, how many parties are
involved? involved?
A. One. A. One.
B. Two. B. Two.
C. Three. C. Three.
D. The entire organization. D. The entire organization.
Three parties are involved in an assurance engagement. They are the process
owner (the party directly involved with the process or system), the internal auditor
(the assessor), and the user of the assessment. For an assurance service, the
internal audit activity determines the nature and scope of the engagement and
objectively assesses the evidence gathered. The evidence and its evaluation form
the basis for expressing an opinion or stating a conclusion about the subject
matter of the engagement.
Risk and Control Self-
Assessment (CSA)
• Control self assessment (CSA) increases awareness of risk
and control throughout the organization.
• CSAs basic philosophy is that control is the responsibility of
everyone in the organization.
Risk and Control Self- • CIA candidates should understand
Assessment o The objectives of CSA,

o Its advantages to an organization, and
o Limitations.
2.2
Elements of CSA Responsibilities

• Senior management should oversee the establishment,
• A typical CSA process has the following elements: administration, and evaluation of the processes of risk
o Front end planning and preliminary audit work. management and control.
o An in person meeting, typically involving a facilitation
seating arrangement (U shaped table) and a meeting • Operating managers responsibilities include assessment of
facilitator. the risks and controls in their units.
o A structured agenda used by the facilitator to lead the group
through an examination of the processs risks and controls. • Internal and external auditors provide varying degrees of
o An option is the presence of a scribe to take an online assurance about the state of effectiveness of the risk
transcription of the session and electronic voting technology management and control processes of the organization.
to enable participants to state their perceptions of the
issues anonymously.
o Reporting and the development of action plans.
How Internal Auditors Use
CSA Key Features
• Internal auditings investment in CSA programs may be significant. • CSA includes self assessment surveys and facilitated workshops.
• It may • An organization that uses self assessment will have a formal,
o Sponsor, design, implement, and own the process;
documented process that allows management and work teams
o Conduct the training;
who are directly involved in a business unit, function, or process
o Supply the facilitators, scribes, and reporters; and
to participate in a structured manner for the purpose of
o Coordinate the participation of management and work
teams. o Identifying risks and exposures,
• Through a CSA program, the internal audit activity and the o Assessing the control processes that mitigate or manage
business units and functions collaborate to produce better those risks,
information about how well the control processes are working
and how significant the residual risks are. o Developing action plans to reduce risks to acceptable levels,
• The internal audit activity often finds that it may reduce the effort and
spent in gathering information about control procedures and o Determining the likelihood of achieving the business
eliminate some testing. objectives.
Outcomes Approaches
• People in the business units become trained and • The three primary approaches of CSA programs are
experienced in assessing risks and associating control o Facilitation,
processes with managing those risks and improving the o Survey (questionnaire), and
chances of achieving business objectives.
o Self certification.
• Internal auditors become involved in and knowledgeable
about the self assessment process by serving as facilitators, • The variety of approaches used for CSA processes in
scribes, and reporters for the work teams and as trainers in organizations reflects the differences in industry, geography,
risk and control concepts supporting the CSA program. structure, organizational culture, degree of employee
empowerment, dominant management style, and the
• Managements responsibility for the risk management and manner of formulating strategies and policies.
control processes of the organization is reinforced, and
managers will be less tempted to abdicate those activities to
specialists, such as auditors.
Facilitation Approach Facilitation Approach
• Objective Based Format • Control Based Format
o Focuses on the best way to accomplish a business o Focuses on how well the controls in place are working.
objective.
o During the workshop, the work team assesses how well
o The workshop begins by identifying the controls
the controls mitigate risks and promote the achievement
presently in place to support the objective and then
determines the residual risks remaining. of objectives.
• Risk Based Format • Process Based Format
o Focuses on listing the risks to achieving an objective. o Focuses on selected activities that are elements of a
o The workshop begins by listing all possible barriers, chain of processes.
obstacles, threats, and exposures that might prevent o This type of workshop usually covers the identification
achieving an objective and then examines the control of the objectives of the whole process and the various
procedures to determine whether they are sufficient to intermediate steps.
manage the key risks.
Survey and Self-Certification Risk and Control, Workshop

Approaches Reports, and Limitations
• Survey Approach • Understanding of Risk and Control
o All self assessment programs assume that managers and
o The survey form of CSA uses a questionnaire that tends members of the work teams understand risk and control
to ask mostly simple yes/no or have/have not concepts and use them in communications.
questions that are carefully written to be understood by • Workshop Reports
the target recipients. o In the typical CSA facilitated workshop, a report is
substantially created during the deliberations.
• Self Certification Approach o A consensus is recorded for the various segments of the
o This form of self assessment is based on management discussions, and the group reviews the proposed final report
before the end of the final session.
produced analyses to produce information about
• Limitations
selected business processes, risk management activities, o The internal auditor may not effectively use the selected CSA
and control procedures. approach(es), or the persons performing the self assessments
may not be skilled in risk management and control.
o The relevant risks and controls then may not be identified or,
if identified, not properly assessed.
Which type of facilitated approach format begins by listing all possible barriers, obstacles, threats, Which type of facilitated approach format begins by listing all possible barriers, obstacles, threats,
and exposures that might prevent achieving an objective? and exposures that might prevent achieving an objective?
A. Objective based format. A. Objective based format.

B. Control based format. B. Control based format.
C. Process based format. C. Process based format.
D. Risk based format. D. Risk based format.
A risk based format focuses on listing the risks to achieving an objective. The
workshop begins by listing all possible barriers, obstacles, threats, and exposures
that might prevent achieving an objective and, then, examining the control
procedures to determine if they are sufficient to manage the key risks. The aim of
the workshop is to determine significant residual risks. This format takes the work
team through the entire objective risks controls formula.
External Business
Relationships (EBRs)
• Organizations have multiple external (extended) business
relationships.
• EBRs may involve service providers, supply side partners,
demand side partners, strategic alliances and joint ventures,
Audits of Third Parties and intellectual property partners.
and Contract Auditing • EBR partners may offer lower costs, better operational
efficiency, special expertise, new technology, a known
brand, or economies of scale.
2.3 • The internal audit activity helps management and the board
identify, assess, and manage risks, including reputation risks
as well as economic risks.
Auditing EBRs Cycle for an EBR Audit
• Before auditing an EBR, the internal auditors first must 1. Understanding the organization, its environment, its
determine whether the EBR partner has agreed to the audit. processes, and the nature of each EBR.
• Internal auditors need to understand all elements of an EBR: 2. Assessing risks and controls.
o Initiating the EBR
3. Performing the audit.
o Contracting for and defining the EBR
o Procurement 4. Reporting.
o Managing and monitoring the EBR 5. Monitoring progress.
o Discontinuing the EBR
• The internal auditors need to understand the expectations
of the parties and the processes for managing and
monitoring the EBR.
• The CAE decides whether to audit (1) each EBR separately,
(2) certain EBRs, or (3) the total EBR process.
Third-Party Audits Contract Auditing

• The organization may be audited. This is routine for • Internal auditors often perform engagements to monitor
organizations that issue general use financial statements and evaluate significant construction contracts and
and for many EBRs. operating contracts that involve the provision of services.
o Lump sum contracts. The internal auditor may have
• The internal auditors should coordinate their activities with little to evaluate when the work is performed in
those of the third party auditor to share information and to accordance with the contract.
prevent duplication of effort. o Cost plus contracts are ways to cope with uncertainties
about costs by setting a price equal to (1) cost plus a
fixed amount or (2) cost plus a fixed percentage of cost.
o Unit price contracts are often used when a convenient
measure of work is available, such as acres of land
cleared, cubic yards of earth moved, or square footage
patrolled by a security service.
An internal auditor is conducting an audit of a contract to build a new branch office. The auditor An internal auditor is conducting an audit of a contract to build a new branch office. The auditor
should consider whether the should consider whether the
1. Materials used in construction meet specified contractual standards. 1. Materials used in construction meet specified contractual standards.
2. Contractor has established a fraud hotline. 2. Contractor has established a fraud hotline.
3. Construction is on schedule. 3. Construction is on schedule.
A. 1 and 2 only. A. 1 and 2 only.

B. 1 and 3 only. B. 1 and 3 only.
C. 2 and 3 only. C. 2 and 3 only.
D. 1, 2, and 3. D. 1, 2, and 3.
The purpose of a contract audit is to determine whether the contractor is

performing as specified in the contract. Whether the contractor has a fraud hotline
is of no concern to the entity and is beyond the scope of a contract audit.
Quality Auditing
• The internal audit activitys role is to provide assurance that
the approved quality structures are in place and quality
processes are functioning as intended.
Quality Auditing
2.4
Traditional vs. Modern Views Total Quality Management
of Quality (TQM)
• The traditional view of quality emphasized the detection of • TQM can increase revenues and decrease costs significantly.
products that do not meet standards. • Quality is best viewed from multiple perspectives: attributes
• The modern view is that quality is a value added activity of the product, customer satisfaction, conformity with
performed throughout all processes, from product design to manufacturing specifications, and value.
raw materials acquisition and final inspection. • TQM is a comprehensive approach.
• TQM emphasizes the suppliers relationship with the
customer and identifies customer needs.
• Given the organization wide scope of TQM and of the
internal audit activity, the role of the internal auditors is to
evaluate the entire quality function.
Due Diligence Auditing

• The term due diligence is applied to a service in which internal
auditors and others determine the business justification for a
major transaction and whether that justification is valid.
• The due diligence process establishes whether the expected
benefits of the transaction are likely to be realized.
• It also may facilitate the realization of those benefits by improving
Due Diligence Auditing the effectiveness and efficiency of the implementation of the
transaction.
2.5 • One of the keys to the effectiveness and efficiency of the

engagement is coordination among the groups involved.
• The final report should be factual, not subjective, with supporting
information indexed and backed up on computer disks.
Information Security Auditing
• Information security auditing is an expansion of the
assurance services performed by auditors.
• The creation of organization wide computer networks with
the potential for access by numerous outside parties has
Security and Privacy greatly increased risk. Thus, risk management and control
processes may be inadequate.
Audits • The role of the internal audit activity in these circumstances

is to assess risks, monitor the implementation of corrective
action, and evaluate controls.
2.6 • Internal auditors also evaluate compliance with laws and
regulations concerning privacy. Thus, they assess the
adequacy of the identification of risks and the controls that
reduce those risks.
Adequacy and Effectiveness Security Auditing

• Implementation Standard 2130.A1 • The most common use of the term security in an
o The internal audit activity must evaluate the adequacy and organizational setting is in connection with information
effectiveness of controls in responding to the risks within the technology (IT).
organizations governance, operations, and information
systems regarding the: • The internal audit activity evaluates the adequacy and
effectiveness of controls designed and implemented by
• Achievement of the organizations strategic objectives;
management in all areas of security.
• Reliability and integrity of financial and operational
information;
• Effectiveness and efficiency of operations and programs;
• Safeguarding of assets; and
• Compliance with laws, regulations, policies, procedures,
and contracts.
Evaluation of a Privacy
Privacy Auditing Framework
• The amount of personal information stored on computers • Protection of personal information prevents such negative
organizational consequences as legal liability and loss of
has greatly increased. reputation.
• The security risks involved have increased because of the • The following are various definitions of privacy:
interconnections among computers permitted by the o Personal privacy (physical and physiological)
Internet. o Privacy of space (freedom from surveillance)
o Privacy of communication (freedom from monitoring)
• Privacy engagements address the security of personal o Privacy of information (collection, use, and disclosure of
information, especially information stored in computer personal information by others)
systems. An example is healthcare information in the files of • Personal information is any information that can be associated
insurers and providers. with a specific individual or that might be combined with other
information to do so.
• The board is ultimately accountable for identifying principal risks,
implementing controls, and managing privacy risk, e.g., by
establishing and monitoring a privacy framework.
Evaluation of a Privacy Use of Personal Information in

Framework Performing Engagements
• The internal audit activity assesses the adequacy of • Advances in IT and communications present privacy risks and
managements risk identification and the controls that reduce threats.
those risks. • Many jurisdictions require organizations to identify the purposes
• The internal audit activitys role depends on the level or maturity for which personal information is collected at or before collection.
of the organizations privacy practices. • Internal auditors must understand and comply with all laws
• The internal auditor identifies regarding the use of personal information.
o Personal information gathered • It may be inappropriate or illegal to access, retrieve, review,
o Collection methods manipulate, or use personal information in conducting certain
o Whether use of the information is in accordance with its engagements.
intended use and applicable law • The internal auditor may seek advice from legal counsel before
• Given the difficulty of the technical and legal issues, the internal beginning audit work if questions arise about access to personal
audit activity needs the knowledge and competence to assess the information.
risks and controls of the privacy framework.
The IIA’s Code of Ethics Multiple-Choice Question
• The IIAs Code of Ethics requires internal auditors to Which of the following is part of the boards role in protecting against privacy threats?
maintain the confidentiality of private information.

A. Establishing a privacy framework.
o Internal auditors shall be prudent in the use and
B. Identifying the information gathered by the organization that is deemed personal or private.
protection of information acquired in the course of their
C. Identifying the methods used to collect information.
duties (Rule of Conduct 3.1).
D. Determining whether the use of the information collected is in accordance with its intended
o Internal auditors shall not use information for any use and the laws.
personal gain or in any manner that would be contrary
to the law or detrimental to the legitimate and ethical
objectives of the organization (Rule of Conduct 3.2).
Multiple-Choice Answer
Which of the following is part of the boards role in protecting against privacy threats?
A. Establishing a privacy framework.

B. Identifying the information gathered by the organization that is deemed personal or private.
C. Identifying the methods used to collect information.
D. Determining whether the use of the information collected is in accordance with its intended
Performance and
Operational Auditing
use and the laws.
The board is ultimately accountable for ensuring that the principal risks of the
organization have been identified, and the appropriate control processes have
2.7
been implemented to mitigate those risks. This includes establishing the necessary
privacy framework for the organization and monitoring its implementation.
Performance Auditing SWOT Analysis
• A performance audit may provide assurance about the • An organization identifies its critical success factors by
organizations key performance indicators. means of an analysis that addresses internal factors
• Internal auditors assess an organizations ability to measure (strengths and weaknesses) and external factors
its performance, recognize deficiencies, and take corrective (opportunities and threats). This process is SWOT analysis.
actions. • Strengths and weaknesses are internal resources or a lack
• A balanced scorecard is useful for performance of resources.
measurement. • Opportunities and threats arise from factors external to the
• It is a report that connects critical success factors organization, such as government regulations, advances in
determined in a strategic analysis with financial and technology, and demographics changes.
nonfinancial measures of the elements of performance.
Balanced Scorecard Approach Balanced Scorecard Approach

• Specific, reliable measures must be determined for each • A typical balanced scorecard includes measures in four
factor relevant to organizational success. categories:
• Measures should be nonfinancial as well as financial, long o Financial
term as well as short term, and internal as well as external. o Customer
• The development and implementation of a comprehensive o Internal

balanced scorecard requires active participation by senior o Learning, growth, and innovation
management.
Operational Audit Program Evaluation and
Engagements Review Technique (PERT)
• An operational audit assesses the efficiency and • PERT was developed to control large scale, complex
effectiveness of an organizations operations. projects. PERT diagrams are free form networks showing
o Process (functional) engagements are operational audit each activity as a line between events.
engagements that follow process crossing organizational • A PERT network consists of two components:
lines, service units, and geographical locations. o Events moments in time representing the start or
o Program results engagements are intended to obtain finish of an activity; depicted as circles
information about the costs, outputs, benefits, and o Activities tasks to be accomplished; depicted as lines
effects of a program. They attempt to measure the
accomplishment and relative success of the undertaking.
Example Critical Paths

• This is a sample PERT network. The numbers represent the • The critical path is the longest path in time through the
duration of each activity (in days). network.
o If any activity on the critical path takes longer than
expected, the entire project will be delayed.
• Any activity not on the critical path has slack time.
o Unused resources that can be diverted to the critical
path.
Critical Path Method (CPM) vs.
Expected Duration PERT
• A major advantage of PERT is that activity times can be • CPM uses a network approach like PERT, but it has two
expressed probabilistically. distinct differences:
o Three estimates are made: optimistic, most likely, and o PERT uses probabilistic time estimates, but CPM is a
pessimistic. deterministic method.
o The usual weighting of the estimates is 1:4:1. o PERT considers only the time required to complete a
project. CPM incorporates cost amounts.
CPM Network Models

• Two estimates are made for each time and cost • Network models are used to solve managerial problems
combination: pertaining to project scheduling, information systems
o Normal estimate design, and transportation systems design.
o Crash estimate o Networks consisting of nodes and arcs may be created
• A crash estimate assumes all available resources are to represent in graphic form problems related to
applied. transportation, assignment, and transshipment.
Managerial performance may be measured in many ways. For example, an internal nonfinancial Managerial performance may be measured in many ways. For example, an internal nonfinancial
measure is measure is
A. Market share. A. Market share.

B. Delivery performance. B. Delivery performance.
C. Customer satisfaction. C. Customer satisfaction.
D. Manufacturing lead time. D. Manufacturing lead time.
Feedback regarding managerial performance may take the form of financial and
nonfinancial measures that may be internally or externally generated. Moreover,
different measures have a long term or short term emphasis. Examples of internal
nonfinancial measures are product quality, new product development time, and
manufacturing lead time (cycle time).
Compliance
• Compliance is defined as adherence to policies, plans,
procedures, laws, regulations, contracts, or other
requirements.
• Internal auditors assess compliance in specific areas as part
of their role in organizational governance.
o They also follow up and report on managements
Compliance Auditing response to regulatory body reviews.
• Caution: Internal auditors are encouraged to consult legal
2.8 counsel in all matters involving legal issues. Requirements
may vary significantly in different jurisdictions.
Compliance Programs
• The internal audit activitys responsibilities with regard to • Compliance programs assist organizations in preventing
compliance are addressed in two Implementation unintended employee violations, detecting illegal acts, and
Standards. discouraging intentional employee violations.
• The internal audit activity must evaluate risk exposures • They also help
relating to governance, operations, and information systems o Prove insurance claims
with regard to o Determine director and officer liability
o Compliance (Implementation Standard 2120.A1) and
o Create or enhance corporate identity
o The adequacy and effectiveness of controls responding
o Decide the appropriateness of punitive damages
to these risks (Implementation Standard 2130.A1).
Organizational Standards and

Procedures Responsibility
• The organization establishes compliance standards and • Specific high level personnel who are properly empowered
procedures to be followed by its employees and other and supplied with necessary resources should be
agents who are reasonably capable of reducing the responsible for the compliance program.
probability of criminal conduct. o Senior management also should be involved.
o High level personnel should have substantial control of
the organization or a substantial role in making policy.
o Compliance personnel should have adequate access to
senior management, and the chief compliance officer
should report directly to the CEO.
Applicant Screening and
Communication Monitoring and Reporting
• Applicant Screening • Monitoring and auditing systems for detecting illegal or
o Due care should be used to avoid delegating authority to unethical behavior and employee hotlines should be used.
those with a tendency to engage in illegal activities. The best approach is to coordinate multiple monitoring and
auditing systems.
• Communication
o Standards and procedures, including readily available
• Attorney client and attorney work product privileges
ethics related documents, should be communicated protect certain information disclosed to (or produced by) an
effectively, preferably in an interactive format and on attorney from being used by an adverse party in a legal
multiple occasions. proceeding. An attorney monitoring the hotline is best able
to protect the privileges.
• An on site official may be assigned to receive and
investigate complaints.
Monitoring and Reporting Monitoring and Reporting

• An ethics questionnaire should be sent to each employee • After detection, the response should be appropriate and
asking whether the employee is aware of kickbacks, bribes, designed to prevent other similar offenses.
or other wrongdoing. • Failure to detect or prevent a serious violation may indicate
• Organizational compliance standards should be consistently that the compliance program needs to be restructured.
enforced by adequate, fair, case specific discipline. • One change that may be required is the replacement or
• Employee discipline should be thoroughly documented so transfer of compliance personnel.
that the organization will be able to prove that it made its
best effort to collect information and took appropriate
action.
Which of the following is an effective tool for uncovering unethical or illegal activity in an Which of the following is an effective tool for uncovering unethical or illegal activity in an
organization? organization?
A. The screening of applicants. A. The screening of applicants.

B. The ethics interview. B. The ethics interview.
C. The background check. C. The background check.
D. The ethics questionnaire. D. The ethics questionnaire.
An effective tool for uncovering unethical or illegal activity is the ethics

questionnaire. Each employee of the organization should receive a questionnaire
that asks whether the employee is aware of kickbacks, bribes, or other
wrongdoing.

Cia Review: Part 2 Study Unit 2: Assurance and Compliance Engagements

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cia Review: Part 2 Study Unit 2: Assurance and Compliance Engagements

Uploaded by

Copyright:

Available Formats

CIA REVIEW: PART 2 2.

Study Unit 2 2.3 Audits of Third Parties and Contract Auditing

Assurance Engagements o Financial assurance provides analysis of the economic activity

Assurance Services Assurance Mapping

Multiple-Choice Question Multiple-Choice Answer

Assessment o The objectives of CSA,

Elements of CSA Responsibilities

Survey and Self-Certification Risk and Control, Workshop

A. Objective based format. A. Objective based format.

Third-Party Audits Contract Auditing

A. 1 and 2 only. A. 1 and 2 only.

The purpose of a contract audit is to determine whether the contractor is

Due Diligence Auditing

2.5 • One of the keys to the effectiveness and efficiency of the

Audits • The role of the internal audit activity in these circumstances

Adequacy and Effectiveness Security Auditing

Evaluation of a Privacy Use of Personal Information in

maintain the confidentiality of private information.

A. Establishing a privacy framework.

Balanced Scorecard Approach Balanced Scorecard Approach

• The development and implementation of a comprehensive o Internal

Example Critical Paths

CPM Network Models

A. Market share. A. Market share.

Organizational Standards and

Monitoring and Reporting Monitoring and Reporting

A. The screening of applicants. A. The screening of applicants.

An effective tool for uncovering unethical or illegal activity is the ethics

You might also like