IIA-CIA-PART1 · Question #133
The internal audit activity conducted an organization wide risk assessment. One of the most significant risks identified is associated with the oil price market. The chief audit executive (CAE) is…
The correct answer is C. An assurance engagement. Assurance engagement (C) is correct because when the CAE independently evaluates the effectiveness of a risk management process and provides an objective conclusion to stakeholders, that is the textbook definition of an assurance engagement under the IIA Standards - it doesn't…
Question
The internal audit activity conducted an organization wide risk assessment. One of the most significant risks identified is associated with the oil price market. The chief audit executive (CAE) is considering including in the annual aud it plan an assessment of the effectiveness of oil price risk management. The manager responsible commented that the assessment was not needed, as market risks were regularly addressed by the financial risk committee. If the CAE decides to include this activity in the annual audit plan anyway, how should it be recorded?
Options
- AA consulting engagement independent of the financial risk committee's review.
- BA risk assessment.
- CAn assurance engagement.
- DA joint consulting engagement with input from the financial risk committee.
How the community answered
(60 responses)- A3% (2)
- B7% (4)
- C78% (47)
- D12% (7)
Explanation
Assurance engagement (C) is correct because when the CAE independently evaluates the effectiveness of a risk management process and provides an objective conclusion to stakeholders, that is the textbook definition of an assurance engagement under the IIA Standards - it doesn't matter that another body (the financial risk committee) also reviews the same area.
Why the distractors fail:
- A (consulting engagement, independent): Consulting engagements are advisory and typically requested by the client; here the CAE is proactively adding this to the plan to evaluate effectiveness, not advise - that's assurance, not consulting.
- B (risk assessment): A risk assessment is the process used to build the audit plan, not a type of engagement recorded in it; the risk assessment already happened and is what flagged oil price risk as significant.
- D (joint consulting engagement): Doubly wrong - collaborating with the financial risk committee would undermine audit independence, and the activity is assurance, not consulting regardless.
Memory tip: Ask yourself: Is audit forming an independent opinion on effectiveness? → Assurance. Is audit advising someone who asked for help? → Consulting. Whenever the CAE puts something in the annual plan to evaluate how well a control or risk management process works, it defaults to assurance.
Community Discussion
No community discussion yet for this question.