A work program that says "test purchase orders" tells the staff auditor nothing about sample size, source, criteria, or what counts as an exception. Three auditors will execute it three different ways, and none of the three results can be defended.
An engagement procedure is the specific task an auditor performs to obtain evidence about one objective: inspect, observe, inquire, recalculate, confirm, reperform, or analyze. The engagement work program is the ordered document that carries those testing methodologies for engagements, lists the procedures, assigns them, and records their completion. Standard 13.3 (Engagement Resources) and Standard 13.4 (Engagement Work Program) anchor this in the Global Internal Audit Standards.
Every procedure for evaluating control must trace upward to an objective and downward to a criterion. If you cannot name the objective a procedure serves, delete it. If you cannot name the standard the result is measured against, the procedure produces observations nobody can call exceptions.
KEY: Procedures are selected by the assertion being tested, not by habit. Existence questions call for physical inspection or confirmation.
Common mistakes
- Testing operation before confirming design. A 78-item sample on a control routing by the wrong field returns a clean 0% deviation rate while $8,774,000 escapes approval. Design conclusion gates operating tests.
- Sizing automated controls like manual ones. Pulling 78 items for a deterministic ERP edit check burns budget. Three items plus change-management evidence is the correct design.
- Treating analytics exceptions as findings. The 4,700 flagged records are anomalies until validated against criteria; only then are they exceptions.
Bottom line
- Design evaluation asks whether the control would work and needs one walkthrough; operating effectiveness asks whether it did work and needs a period-spread sample.
- Design fails, testing stops. Never test operation of a badly designed control.
- Efficiency evaluation is separate: a well-designed, well-operating control that costs more than the exposure is an opportunity, not a deficiency.
- Work program line items carry objective reference, procedure, population and source, sample basis, criteria, auditor and date, and workpaper cross-reference.
Exam shortcut
Read the stem for which of the two questions is being asked. "Would this control address the risk" means design, so the answer involves walkthrough or policy review. "Did the control operate throughout the year" means effectiveness, so the answer involves sampling and reperformance. If the stem says design was deficient and an option proposes expanded testing, that option is wrong by construction.
The full lesson (about 2,465 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 6
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.