CIA Part 2 · Study notes

CIA engagement planning case: build a defensible work program

For a supplier-bank-change audit, start from changes that actually became active and trace each to independent approval before activation. Testing only completed approval forms misses changes with no form. The worked plan below connects the diverted-payment risk to scope, criterion, population, and the evidence needed to answer the objective.

Need the concepts first? The engagement-planning method.

Worked plan: supplier-bank changes after a system migration

Worked plan: supplier-bank changes after a system migration
Decision	How to apply it	Mistake to avoid
Risk and objective	Risk: payments diverted through unauthorized bank changes. Objective: determine whether changes were independently approved before use.	Testing payment totals without examining authorization of the bank changes.
Scope	Cover the new system’s supplier-bank changes during the stated post-migration quarter, including privileged-user activity.	Assuming the old paper process covers changes made directly in the new system.
Criterion	Apply the authorized policy requiring independent approval before activation; establish suitable criteria if policy is inadequate.	Using a deadline chosen after reviewing the exception count.
Population and procedure	Reconcile the activation log, select changes for the objective, and compare approval identity and timestamps with activation.	Starting only from approved requests, which omits unauthorized changes.
Resources and limits	Obtain access-log expertise and reliable extracts. Address missing logs before claiming coverage of the period.	Keeping the original conclusion scope after removing an essential test.

Risk and objective
Risk: payments diverted through unauthorized bank changes. Objective: determine whether changes were independently approved before use.
Avoid: Testing payment totals without examining authorization of the bank changes.
Scope
Cover the new system’s supplier-bank changes during the stated post-migration quarter, including privileged-user activity.
Avoid: Assuming the old paper process covers changes made directly in the new system.
Criterion
Apply the authorized policy requiring independent approval before activation; establish suitable criteria if policy is inadequate.
Avoid: Using a deadline chosen after reviewing the exception count.
Population and procedure
Reconcile the activation log, select changes for the objective, and compare approval identity and timestamps with activation.
Avoid: Starting only from approved requests, which omits unauthorized changes.
Resources and limits
Obtain access-log expertise and reliable extracts. Address missing logs before claiming coverage of the period.
Avoid: Keeping the original conclusion scope after removing an essential test.

A decision path you can use

1Define the diverted-payment exposure
2Build the risk-to-evidence chain
3Resolve resource and access gaps before approval

Understand the method

Work through the reasoning

Understand what the migration changed

Begin the supplier-bank-change case by learning how a change reaches the live supplier record. Identify the request channel, verification step, approver, activation mechanism, and first payment. Compare the new process with the old one. A migration may preserve the written policy while introducing administrator privileges or interfaces that bypass its normal workflow.

Use that understanding to formulate the risk assessment. The important exposure is payment diversion through an unauthorized instruction, not simply missing paperwork. Ask whether the system prevents activation before approval, whether approval is genuinely independent, and whether urgent changes follow another route. Document assumptions that need confirmation rather than treating the process owner’s walkthrough as proof of operation.

Build procedures that can find the failure

An objective-linked work program starts from the event whose authorization matters: activation of the new bank details. Obtain the relevant change population, assess completeness, and connect each selected event to the required evidence. Starting with signed requests answers a different question because changes with no request cannot enter that selection.

Specify what the auditor will compare. Approval identity addresses authority and independence; timestamps address sequence; verification records address authenticity of the instruction. A procedure that says only “check approval” leaves these distinctions unresolved. Explain how exceptions, missing records, and conflicting timestamps will be investigated so the test can produce a supported conclusion.

Connect coverage, skills, and evidence availability

The quarter after migration may contain different configurations, emergency access, or data conversion issues. Establish which periods and pathways the work covers. Consider whether a system specialist is needed to interpret logs or whether business records can corroborate them. A familiar spreadsheet extract is not automatically the complete population of activated changes.

Estimate the work needed for ordinary items and likely exceptions, including review and communication. If essential logs have expired, identify alternative evidence and assess the resulting limitation. Reducing the number of procedures while retaining the same broad assurance claim is not a resource solution. Resolve the relationship between scope, effort, and the conclusion before the work program is approved.

Revise the plan when fieldwork changes the risk picture

Suppose testing reveals a service account that changes bank details without creating the normal approval event. That discovery challenges the population and the original control understanding. Determine which transactions used the account, whether complementary controls exist, and how much of the period is affected. The finding may require changes to both procedures and scope.

Record why the change is necessary, obtain the appropriate approval, and communicate its effect on timing and coverage. Preserve the original planning rationale so a reviewer can understand how the engagement developed. A defensible plan is adaptable, but changes should be governed by evidence and objectives rather than a desire to avoid inconvenient results.

Original teaching example

Apply the method to a decision

The scenario

A purchasing audit begins after a system migration. The team proposes selecting 25 signed approval forms because those are easy to retrieve. Some supplier changes can be activated directly without a form.

The decision

Start with a reconciled population of activated changes and trace back to approval evidence, including cases where that evidence is missing.

The proposed form-based population selects for documented approval and may exclude the failure the audit is looking for. Verify log completeness, identify relevant changes, and inspect approval identity and timing. The number 25 alone says nothing about sufficiency; the selection must fit the objective and intended inference.

Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.

A second application

The exception reveals an unplanned interface

The situation

A bank change appears in the live supplier table but not in the workflow export. IT explains that an overnight interface can also update bank details.

Reason through it

The original export does not cover the complete activation population. Audit needs to understand the interface, reconcile its changes, and evaluate its authorization controls before using workflow results to describe the entire process.

Take the decision

Amend the population and work program through the approval process. Report the limits of any coverage that cannot be recovered.

Original hypothetical teaching case.

Check your understanding

Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.

A. Inspect a signed procedure and ask the manager whether staff follow itB. Trace activated changes to independent approvals dated before activationC. Reconcile total supplier payments to the general ledger

Compare all three choices

A. Inspect a signed procedure and ask the manager whether staff follow it: This helps understand design and management’s account of operation, but does not test whether actual changes met the timing and authorization requirements.
B. Trace activated changes to independent approvals dated before activationBest answer: Starting from activated changes and tracing to the required approval tests the stated objective, including changes that lack approval records.
C. Reconcile total supplier payments to the general ledger: A ledger reconciliation addresses completeness or accuracy of recorded payments. It does not directly establish authorization of the bank-detail changes.

A. Specify the approval authority, required sequence, evidence, and treatment of exceptionsB. List the available documents without defining what must be verifiedC. Use the same sample size as last year

Compare all three choices

A. Specify the approval authority, required sequence, evidence, and treatment of exceptionsBest answer: These details turn a vague activity into a procedure that can evaluate the stated authorization objective.
B. List the available documents without defining what must be verified: A document inventory helps preparation but does not specify the attributes and criteria the test must evaluate.
C. Use the same sample size as last year: A previous sample size does not establish that the current population and risk are adequately covered.

A. Ignore it because planning is completeB. Document the implications and obtain approval for necessary changesC. Delete the original plan without retaining the reason

Compare all three choices

A. Ignore it because planning is complete: Planning must respond to relevant discoveries; approval of an initial program does not make new exposure irrelevant.
B. Document the implications and obtain approval for necessary changesBest answer: The team should reassess risk and coverage, record the rationale, and approve changes through the required process.
C. Delete the original plan without retaining the reason: Removing the planning history makes it harder to understand and review the basis for the changed engagement.

Questions about this topic

Can an engagement plan change during fieldwork?

Yes. New risks, evidence, or access restrictions can justify changes. Document the rationale, obtain the appropriate approval, and communicate the effect on scope, resources, and conclusions.

Why does the direction of testing matter in this planning case?

Tracing from activated changes to approvals can reveal changes without authorization. Selecting only existing approval forms excludes that failure from the starting population. Choose the direction that can expose the risk named in the objective.

Sources and syllabus scope

Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.

IIA expanded syllabus: Part 2, A.1-A.7
Establishes the examined topics. Primary domain: Engagement Planning (50% of Part 2). This is a domain allocation, not a separate weight for this lesson.
Global Internal Audit Standards reference: Locator: Standards 13.1-13.6. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.

Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.