Due professional care is not maximum effort. It is calibrated effort: the care a reasonably prudent and competent internal auditor would apply, given what is at stake and what the work costs.
Due professional care asks you to weigh several factors before and during an engagement, then apply the diligence a competent peer would apply in the same circumstances. It does not promise that every deficiency will be found. It promises that your judgment was proportionate, informed, and documented.
Four weighing factors drive the exam questions.
- Strategy and objectives: What the organization is trying to achieve, and whether the work you plan supports those objectives.
- Adequacy and effectiveness of governance, risk management, and control processes: Whether the design is sound (adequacy) and whether it operates as designed (effectiveness).
- Cost versus benefit: The resources the engagement consumes against the value of the assurance produced.
- Probability of significant errors, fraud, and noncompliance: How likely material failures are in this area.
KEY: Due professional care is a standard of conduct, not a standard of result. A stem that says "the auditor failed to detect a $400,000 fraud, therefore care was not...
Common mistakes
- Equating care with detection. Failing to find a well-concealed fraud is not automatically a breach; inadequate risk-based planning is.
- Using cost-benefit to skip high-risk work. Cost weighing shapes scope inside a justified engagement. A resource shortfall is escalated, not silently absorbed.
- Treating skepticism as suspicion. Assuming management is dishonest is bias. The posture is unverified until evidenced.
Bottom line
- Due professional care is the diligence of a reasonably prudent and competent internal auditor, judged on conduct, not on whether every deficiency was found.
- Four weighing factors: strategy and objectives, adequacy and effectiveness of governance/risk/control processes, engagement cost versus benefit, and the probability of significant errors, fraud, and noncompliance.
- Adequacy is design; effectiveness is operation. Design flaws get redesign, operating flaws get enforcement.
- Cost-benefit weighing shapes scope inside a justified engagement; it never authorizes skipping high-risk work, and resource shortfalls go to senior management and the board.
Exam shortcut
Read the stem for what changed. If a new signal appears (matched bank account, unexplained relationship, override), the answer expands procedures and escalates, never "complete testing as originally planned." If the stem only complains about budget, the answer scopes by risk or escalates the resource limit; it never quietly drops coverage.
The full lesson (about 2,134 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 5
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.