According to IIA guidance, which of the following statements is true regarding consulting engagements performed by the internal audit activity? A. Consulting engagements typically involve four or…

Question

Options

• BThe scope of a consulting engagement is determined by either the engagement supervisor or chief
• CAccording to the Standards, internal auditors are permitted to carry out certain management
• DA preliminary risk assessment may not be needed for consulting engagements, because the

• B
  18% (6)
• C
  9% (3)
• D
  73% (24)

Explanation

Option D is correct because IIA Standards recognize that consulting engagements are client-driven: the objectives and scope are agreed upon with the engagement client at the outset, so the auditor does not need to independently conduct a preliminary risk assessment to define the scope the way they would for an assurance engagement.

Why the distractors are wrong:

• A is wrong because consulting engagements involve two parties (the internal auditor and the engagement client). It is assurance engagements that involve three parties - the auditor, the responsible party, and the user. Adding a fourth or fifth party mischaracterizes the consulting relationship.
• B is wrong because the scope of a consulting engagement is agreed upon with the engagement client, not determined unilaterally by a supervisor or the CAE. Client collaboration is a defining feature of consulting work.
• C is wrong because the Standards explicitly prohibit internal auditors from assuming management responsibilities. Doing so impairs objectivity and independence, which the IIA treats as non-negotiable regardless of the engagement type.

Memory tip: Think "Consulting = Client Controls the Scope." Since the client defines what help they want, the auditor doesn't drive scope through a preliminary risk assessment - the client's request does that work instead. This is the clearest contrast between consulting and assurance engagements on the exam.

No community discussion yet for this question.