A final report says the work "followed professional standards," lists eight observations with no owners or dates, and buries the fact that the auditor never received access to the third-party vendor's logs. Three separate reporting defects, and the exam tests all three.
A final engagement communication is the deliverable that converts fieldwork into decisions. Five components carry the load, and the exam expects you to name them and distinguish them.
- Objectives: what the engagement set out to evaluate, stated so a reader knows what question the conclusion answers.
- Scope: what was covered. Scope fixes the boundaries: which processes, which locations, which systems, and the period examined.
- Conclusions: internal audit's assessment of the objectives against criteria. A conclusion is an opinion at the engagement level, not a list of facts.
- Recommendations: what internal audit believes should change to address the root cause of each observation. Recommendations belong to internal audit.
- Action plans: what management has committed to do, by whom, by when. Action plans belong to management.
Common mistakes
- Merging recommendations and action plans into one column. They have separate owners. When internal audit writes the due date, the report has lost the evidence that management accepted the risk decision.
- Writing observations without cause. Criteria, condition, and effect with no cause produces recommendations that treat symptoms; the same finding returns next cycle.
- Concluding beyond the scope. Testing 930 of 1,240 purchase orders and concluding on all four regions is over-conclusion. Limit the conclusion to what was covered.
Bottom line
- Five components: objectives, scope, conclusions, recommendations, and management action plans; recommendations are internal audit's, action plans are management's with owner and date.
- Observations carry criteria, condition, cause, and effect; cause is the element most often missing and the one that drives the recommendation.
- Conclusions may never extend past the scope tested; disclose exclusions in the scope section.
- Conformance claim: state Global Internal Audit Standards conformance only when QAIP results support it, including an external assessment at least every five years by an assessor independent of the organization.
Exam shortcut
Read the stem for an ownership swap. If internal audit is writing due dates or naming the remediation owner, pick the answer that returns the action plan to management. Trap distractors praise the efficiency. Any date attached to an external assessment is arithmetic bait. Subtract. Past five years means the unqualified conformance claim dies, and the disclosure goes to senior management and the board.
The full lesson (about 2,308 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 2
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.