CIA ethics and professionalism: five duties in practice
Ethical audit work requires honesty, unbiased judgment, suitable competence, due care, and responsible handling of information. A defensible answer identifies which duty is at risk and changes the action that threatens it. Merely promising to be careful does not resolve a conflict or a skills gap.
Match the conduct to the duty
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Integrity and objectivity | Report supported facts even when unwelcome; identify interests that could distort judgment. | Editing a finding to protect a friend or a performance bonus. |
| Competence and due care | Use suitable expertise, assess the evidence critically, and investigate contradictions. | Accepting a specialist assignment with no plan to obtain the needed skills. |
| Confidentiality | Use audit information only for an appropriate purpose and protect its distribution. | Forwarding identifiable employee records through an unapproved personal account. |
Integrity and objectivity
Report supported facts even when unwelcome; identify interests that could distort judgment.
Avoid: Editing a finding to protect a friend or a performance bonus.
Competence and due care
Use suitable expertise, assess the evidence critically, and investigate contradictions.
Avoid: Accepting a specialist assignment with no plan to obtain the needed skills.
Confidentiality
Use audit information only for an appropriate purpose and protect its distribution.
Avoid: Forwarding identifiable employee records through an unapproved personal account.
A decision path you can use
- 1Identify the threatened duty
- 2Change or safeguard the assignment
- 3Communicate and document the response
Understand the method
Work through the reasoning
Integrity includes how you handle an uncomfortable result
Integrity is visible when an auditor reports a supported result accurately despite pressure to make it easier to accept. It does not require aggressive language or an unsupported accusation. If records show missed approvals, describe that condition, its evidence, and its implications. An honest report can acknowledge limitations and management’s explanation without concealing the exception.
Distinguish professional courage from certainty beyond the evidence. A manager’s objection may reveal a factual error that should be corrected. It may instead be pressure to suppress a valid finding. Investigate the substance of the objection and document the resolution. Agreeing with every objection undermines integrity; refusing every correction undermines accuracy.
Objectivity requires action on threats to judgment
Personal relationships, previous responsibilities, gifts, incentives, and pressure can distort an auditor’s assessment. A threat can matter even when the auditor believes they can remain fair. The relevant question is whether the assignment and its safeguards support unbiased judgment and are credible to the people relying on the work.
Disclose the circumstances through the appropriate process before proceeding with a compromised assignment. Depending on the facts, a suitable response may involve reassignment, different supervision, or another provider. A disclosure statement is not a universal cure. If an auditor is asked to review decisions they owned, promising to be objective does not change the self-review problem.
Separate competence from due professional care
Competence concerns the knowledge and skills needed for the work. Due professional care concerns how the auditor applies them, considering the objective, complexity, significance, and quality of evidence. A technically qualified auditor can still exercise poor care by ignoring contradictory records. A diligent auditor can still lack the competence to evaluate a specialized system configuration.
Identify the gap before choosing a remedy. Training, specialist support, or a different assignment can address capability. Better procedures, supervision, and critical evaluation can address execution. Neither duty requires infallibility, but both require a defensible process. Record assumptions, investigate contradictions, and avoid treating a familiar explanation as reliable merely because a respected manager provided it.
Protect information throughout its use and communication
Audit access is granted for an authorized purpose. It does not permit personal use, unrestricted sharing, or indefinite retention of every record obtained. Consider who needs the information, which details are necessary, and how it should be stored and transmitted. Sensitive employee records may be relevant to a test without belonging in every copy of the final report.
Confidentiality also does not mean promising secrecy regardless of the circumstances. Applicable requirements and authorized reporting processes can require communication. Explain those limits when gathering information. Use approved channels, preserve relevant evidence, and obtain appropriate guidance when obligations conflict. Avoid inventing a legal rule from a short exam scenario; respond to the duties and facts actually provided.
Original teaching example
Apply the method to a decision
The scenario
An auditor is assigned to review a complex cloud migration. They understand purchasing controls but have never assessed cloud access configuration. The deadline is close.
The decision
Raise the competence gap and obtain specialist support or adjust the assignment before drawing a technical conclusion.
Due care is not the same as trying harder with unsuitable knowledge. The auditor can contribute procurement expertise while a qualified specialist addresses configuration risk. The team must still evaluate the specialist’s work.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A persuasive manager offers a partial explanation
The situation
A sales director asks an auditor to remove a finding about unusual discounts. The director provides a plausible commercial explanation but no approvals. The auditor’s bonus partly depends on the director’s satisfaction rating.
Reason through it
Two issues need separate treatment. The new explanation deserves evaluation against the records and criteria. The incentive creates a threat to unbiased judgment that should be disclosed and addressed. Neither the incentive nor the director’s confidence proves that the discounts were improper, but both make an unsupported withdrawal unacceptable.
Take the decision
Evaluate the explanation, obtain the missing evidence, and address the objectivity threat through suitable oversight. Change the finding if the evidence warrants it, not to protect the satisfaction score.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Where does ethics sit in the current IIA framework?
Use Domain II, Ethics and Professionalism, of the Global Internal Audit Standards. Older materials may organize the subject under a separate Code of Ethics; match your preparation to the current syllabus.
Does due professional care mean an auditor must find every error?
No. It requires an appropriately designed and performed process, critical evaluation, and attention to significant risks. It does not guarantee that every error or concealed act will be detected.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Ethics and Professionalism (20% of Part 1). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Domain II, Principles 1-5. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.