Skip to main content
CIA Part 1 · Study notes

CIA risk and control case: distinguish design from operation

A written approval policy establishes the expected control, not proof that it worked. In this supplier-change case, compare three layers: the required approval, the system’s activation rule, and the timing of approvals on actual changes. Separate a design gap from an operating exception before assigning the cause or recommending a fix.

Need the concepts first? Governance, risk, and control fundamentals.

Supplier-change case: what does each piece of evidence prove?

  • Policy

    Independent second approval is required before supplier activation. This supplies the criterion.

    Avoid: Treating the policy itself as evidence that every activation complied.

  • Configuration

    The system permits activation with only the preparer’s approval. This indicates a design gap against the criterion.

    Avoid: Assuming users followed the permitted path on every transaction.

  • Transaction records

    Eight of 30 targeted changes received second approval after activation. These are demonstrated operating exceptions.

    Avoid: Projecting 8/30 to the whole population without a suitable sampling basis.

  • Response

    Management should address the activation rule and assess affected changes; audit evaluates the response and support for its conclusion.

    Avoid: Reporting only a training need without addressing the system path.

A decision path you can use

  1. 1Identify the approval criterion
  2. 2Compare configuration and event timestamps
  3. 3Separate the demonstrated condition from inferred cause

Understand the method

Work through the reasoning

Build the chain from objective to control

In the supplier example, the objective is to pay legitimate obligations to authorized bank accounts. The risk is that a false or unauthorized bank change diverts payment. Governance determines who has authority and oversight; risk management identifies the exposure and response; the control implements a specific part of that response. Keeping this chain explicit prevents a policy document from becoming the only audit objective.

Write the expected control as an observable action. For example, a person independent of the change requester verifies the new bank details through an approved channel before activation. That wording identifies responsibility, evidence, timing, and the event being prevented. “Management reviews suppliers” is too vague to tell a tester what successful operation looks like.

Evaluate design before interpreting a test result

A control is suitably designed only if its operation could address the identified risk. Two approvals from people using the same unverified email may add activity without independently confirming the supplier’s bank details. Similarly, an approval performed after the first payment cannot prevent that payment from being diverted. Ask what the control can actually stop or identify.

Examine who can bypass the process. Privileged system users, emergency changes, and interfaces may create paths outside the ordinary approval screen. A clean sample from routine changes cannot repair a design that leaves important bypasses uncontrolled. Document the gap and consider any complementary controls before deciding whether the overall arrangement sufficiently addresses the objective.

Use evidence of actual operation rather than policy existence

Operating effectiveness concerns what happened when the control was needed. Select from the relevant changes, inspect approval timing and authority, and trace evidence of verification. A policy signed at the start of the year establishes an expectation; it does not show that an urgent change in September complied. A completed approval field may also be insufficient if it can be populated retrospectively.

Reconcile the population and consider how evidence was created. An export of approved requests may exclude changes made directly in the system. Logs can help identify the actual activation population, but their completeness and access controls also deserve attention. Link each conclusion to the tested period and pathways, and identify any areas for which evidence was unavailable.

Turn a control exception into a proportionate conclusion

An exception needs investigation before it becomes a finding about the whole process. Establish the condition, compare it with the criterion, explore its cause, and assess exposure. One missing approval for a privileged change can be significant even if routine approvals work well. Conversely, a missing form might have alternative evidence that the essential independent verification occurred.

The recommended response should address the cause. If the workflow permits one person to request and activate a change, a reminder email may leave the design defect untouched. Management should choose and own the response. Audit evaluates whether the proposed action addresses the risk and later seeks evidence of implementation and effectiveness within the agreed follow-up approach.

Original teaching example

Apply the method to a decision

The scenario

The policy requires independent approval before activation. Configuration allows the preparer to activate a supplier. In 30 targeted changes, eight second approvals occurred later, and two of those suppliers received payments before approval.

The decision

Report the configuration weakness and the eight timing exceptions. Investigate the two payment exposures; do not describe them as confirmed fraud or project the exception rate to the year.

Each conclusion needs its own evidence. The configured path supports a design concern; event timestamps establish the tested exceptions; payment review is needed to determine consequences. A targeted selection can reveal a significant problem without estimating its population frequency.

Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.

A second application

Two approvals share the same weak evidence

The situation

A supplier-bank change requires purchasing and treasury approval. Both approvers rely on the same message from a newly created supplier email address. The system blocks activation until both click approve.

Reason through it

The application reliably enforces two clicks, but the approval design may not verify the authenticity of the bank instruction. Audit should distinguish workflow compliance from the control objective. An independent verification step, with evidence and a trusted contact route, would address a different and necessary question.

Take the decision

A successful test of the two-click rule does not establish that unauthorized bank changes are prevented. Assess the verification design and any complementary controls before concluding on the payment-diversion risk.

Original hypothetical teaching case.

Check your understanding

Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.

Question 1: Policy requires second approval before a supplier becomes active. All 30 sampled suppliers had two approvals, but eight received the second approval after activation. Which conclusion is supported?
Compare all three choices
A. The control operated effectively because both approvals were eventually present
Presence and timing are different criteria. An approval after activation cannot prevent activity during the earlier unauthorized interval.
B. The timing requirement failed in eight tested cases; assess the exposure before concluding furtherBest answer
The evidence establishes operating exceptions against the timing criterion. Their significance and cause need evaluation before broader conclusions about the population or design.
C. The control design is necessarily defective because exceptions occurred
Operating exceptions may arise from poor execution, a design weakness, or both. The exceptions alone do not identify which cause applies.
Question 2: Every sampled approval is complete, but administrators can activate bank changes outside the workflow. What should audit do?
Compare all three choices
A. Conclude the entire process is effective
The tested workflow does not cover an important alternative route through which the same risk can arise.
B. Assess the bypass population and controls before extending the conclusionBest answer
The conclusion must account for relevant change pathways, including privileged activity outside the ordinary approval screen.
C. Ignore administrators because their access was authorized
Authorized access can still create risk; authorization does not prove that the resulting changes are controlled.
Question 3: A review occurs after payment release. Which claim requires the most caution?
Compare all three choices
A. The review can identify some exceptions for investigation
A later review can detect exceptions if its design and evidence are suitable for that purpose.
B. The review may support corrective action
Detection may support recovery or process improvement, although those responses also require action.
C. The review prevents the already released payment from going to the wrong accountBest answer
Timing matters: a review after release cannot prevent that completed release, even if it supports later detection.

Questions about this topic

How do inherent and residual risk differ?

Inherent risk describes exposure before the effects of controls or other responses. Residual risk is what remains after those responses. Assess the response’s actual effectiveness before relying on a low residual-risk rating.

Can a well-designed control still fail in operation?

Yes. An appropriate design may be bypassed, performed late, or supported by unreliable evidence. Assess design and operation separately, then explain how each affects the overall conclusion.

Sources and syllabus scope

Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.

IIA expanded syllabus

Establishes the examined topics. Primary domain: Governance, Risk Management, and Control (30% of Part 1). This is a domain allocation, not a separate weight for this lesson.

Global Internal Audit Standards reference
Locator: Standards 9.1 and 14.1-14.4; glossary: governance, risk management, and control. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.

Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.