Two teams audit the same cloud migration. One writes a 60-page workprogram, disappears for eleven weeks, and delivers a report about a configuration that changed in week three. The other ships findings every two weeks while the build is still moldable. Same risk, same budget, different approach decision.
Once objectives and scope are fixed, you choose how the work gets done: the delivery method (traditional, agile, integrated, remote, or a blend) and the project management discipline that keeps it on schedule and inside budget. The Global Internal Audit Standards address this in the planning domain, with Standard 13.3 (Engagement Resources) and Standard 13.4 (Work Program) as the anchors. Approach is a judgment call driven by risk volatility, stakeholder need, evidence location, and available skills. It is never a house style applied to every engagement.
KEY: Approach follows objectives, never the reverse. If a stem shows a team choosing agile first and then deciding what to test, the sequence itself is the error.
Common mistakes
- Choosing agile because it is faster. Agile is faster to first feedback, not to total hours. It often costs more supervisory time. It is selected for risk volatility and client engagement, not for speed alone.
- Assuming agile lowers evidence or documentation standards. Sufficiency, reliability, and supervisory review are identical across approaches. Only cadence changes.
- Treating remote as a universal substitute. Inventory observation, physical security, and custody counts (like the check-stock count in Example 1) cannot be fully performed remotely; the gap is a documented limitation.
Bottom line
- Approach is selected after objectives and scope are fixed, based on risk volatility, evidence location, required skills, and stakeholder need.
- Traditional auditing runs sequential phases and delivers one report; it fits stable processes and fixed criteria.
- Agile auditing uses time-boxed sprints of one to four weeks, a risk-ranked backlog, standups, sprint reviews, and retrospectives; it requires an available, empowered client and a genuinely volatile risk area.
- Agile changes the cadence of documentation and supervisory review, never the standards for evidence sufficiency or review.
Exam shortcut
Read the stem for the trigger word before you read the options. "Requirements keep changing" or "the system is still being built" means agile. "Control depends on a system setting" or "IT and operations both own it" means integrated. "Multiple countries" or "travel restricted" means remote. "Regulator expects an opinion" or "criteria are fixed" means traditional. Two trap patterns repeat.
The full lesson (about 2,553 words, 17 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 4
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.