A chief audit executive discovers the last external quality assessment finished six years ago and that three of this year's engagements were released without documented supervisory review. Both are nonconformance. Only one of them changes what the board must be told, and knowing which is the whole exam question.
The chief audit executive (CAE) may state that the internal audit function conforms with the Global Internal Audit Standards only when the quality assurance and improvement program results support it, and the key steps in communicating nonconformance start from that same evidence. Absent supporting results, the claim cannot be made, and the circumstances must be communicated instead. Nonconformance is any departure from a requirement of the Standards, from a topical requirement, or from the mandatory elements the function has committed to follow.
The circumstances, and the actions taken in response, come to light through the same channels that produce conformance evidence: ongoing monitoring inside daily supervision, periodic self-assessments, external assessments performed at least every five years by an assessor independent of the organization, regulator findings, and...
Common mistakes
- Disclosing only circumstances and corrective actions. Impact and rationale are required too. Impact is the element that tells the board whether prior conclusions remain reliable.
- Sending every departure to the board. One engagement's sampling deviation is corrected and tracked, not escalated. Escalation follows effect on the function's overall scope or operation.
- Going to the board before senior management. The order is senior management, then the board. An answer that skips management is wrong even when the board ultimately receives the same facts.
Bottom line
- Conformance claim: the CAE may state conformance with the Global Internal Audit Standards only when quality assurance and improvement program results support it.
- Escalation test: nonconformance affecting the function's overall scope or operation goes to senior management and the board; isolated departures are corrected, documented, and tracked.
- Four content elements: circumstances, actions taken, impact, and rationale. All four, every time.
- Impact means naming which engagements, conclusions, or coverage areas are affected and whether stakeholders relied on them.
Exam shortcut
Read the stem for scale before you read the options. Words like "the function," "all engagements," "the reporting line," "the risk universe," or "the audit plan" signal function-level impact, so the answer names senior management and the board. Words like "one engagement," "a single sample," or "this review" keep it at supervision plus quality-program tracking. Grade the answer options against four slots: circumstances, actions, impact, rationale.
The full lesson (about 2,256 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 2
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.