CIA audit operations case: expose a hidden coverage gap
A 100% completion dashboard can still hide a significant assurance gap. In this case, audit completed all ten engagements remaining on its schedule after removing a high-risk platform review. Report the removed coverage and specialist constraint, then compare options for restoring assurance without disguising the tradeoff in a revised denominator.
Need the concepts first? How the internal audit function operates.
Read the operating dashboard behind the headline
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Reported completion | 10 of 10 revised engagements completed: 100% against the revised schedule. | Presenting this as complete coverage of the original risk-based plan. |
| Removed commitment | The original plan included an eleventh engagement over a high-risk platform; it was deferred for lack of expertise. | Removing the item and its risk from board reporting when the denominator changes. |
| Decision options | Compare specialist support, staff development, and reprioritization; explain timing, cost, and displaced work. | Treating the same staff working more hours as a solution to a competence gap. |
| Oversight evidence | Show original and revised plans, reasons, authorization, and the still-uncovered exposure. | Equating an approved schedule change with elimination of the underlying risk. |
Reported completion
10 of 10 revised engagements completed: 100% against the revised schedule.
Avoid: Presenting this as complete coverage of the original risk-based plan.
Removed commitment
The original plan included an eleventh engagement over a high-risk platform; it was deferred for lack of expertise.
Avoid: Removing the item and its risk from board reporting when the denominator changes.
Decision options
Compare specialist support, staff development, and reprioritization; explain timing, cost, and displaced work.
Avoid: Treating the same staff working more hours as a solution to a competence gap.
Oversight evidence
Show original and revised plans, reasons, authorization, and the still-uncovered exposure.
Avoid: Equating an approved schedule change with elimination of the underlying risk.
A decision path you can use
- 1Reconcile the dashboard to the original plan
- 2Identify the missing capability and coverage
- 3Communicate options and their consequences
Understand the method
Work through the reasoning
Reconcile the operating dashboard to its commitments
In the ten-of-ten case, the completion percentage is arithmetically correct for the revised schedule. The missing information is the eleventh engagement removed from the original plan. Reconcile the current dashboard to the approved commitments, including additions, deferrals, cancellations, and reasons. This distinguishes delivery performance from the assurance coverage originally intended.
A plan change may be appropriate, but approval does not make the underlying exposure disappear. The board needs to understand what remains uncovered and why. Preserve both the original and revised denominators so an improvement in the percentage cannot silently conceal a reduction in coverage.
Diagnose the capability behind the coverage gap
The deferred platform review requires technical knowledge the team lacks. More generalist hours may not solve that problem. Identify the specific capabilities needed to understand the system, obtain evidence, and evaluate its controls. Consider specialist support, recruitment, development, or a different delivery arrangement.
Assess the timing and quality consequences of each option. Training may build durable capability but may not address an urgent current exposure. External support may provide immediate expertise but still requires clear scope, appropriate oversight, and evaluation of its work. The operating decision should explain these tradeoffs in terms of assurance needs.
Manage delivery without confusing activity and value
Report progress alongside significant risk coverage, quality, resources, and unresolved constraints. Counts of reports or workpapers describe activity. They do not establish that engagements addressed the right risks or that conclusions were supported. Use a balanced view that makes operational problems visible early enough to act.
Regular communication with senior management and the board should identify decisions required, not merely celebrate completed tasks. In this case, the decision concerns how and when to restore platform coverage and what other work may be displaced. Explain the remaining exposure under each feasible option.
Retain oversight when work is sourced externally
An external provider can supply capability, but the function still needs to assess competence, objectivity, scope, methods, and results. Define deliverables and review expectations before work begins. Ensure the provider’s conclusion actually addresses the risk that caused the engagement to be prioritized.
Use the experience to improve the operating model. A recurring need for the same specialist may warrant a longer-term capability decision rather than repeated emergency procurement. Keep that strategic question connected to evidence about future demand and the organization’s direction.
Original teaching example
Apply the method to a decision
The scenario
Eleven engagements were planned. Ten routine engagements finish, while the platform review is removed because the team lacks suitable expertise. The report shows ten of ten complete and no open delivery issue.
The decision
Keep the valid 100% measure for the revised schedule, but disclose the removed platform review and its unresolved assurance consequence alongside it.
The arithmetic is correct while the overall impression is incomplete. The board needs the original commitment, rationale and authorization for the change, current risk, and a proposed response. The CAE should not imply that an approved deferral proves the risk is acceptable or controlled.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A replacement engagement improves the count but misses the risk
The situation
The deferred platform review is replaced with a quick policy review. The completion dashboard returns to eleven engagements and reports that the gap is closed.
Reason through it
The number of engagements is restored, but the platform’s technical assurance need remains. Compare the replacement work with the original risk and objective rather than treating equal counts as equal coverage.
Take the decision
Show the remaining platform exposure and the actual contribution of the policy review. Restore meaningful coverage, not merely the original denominator.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Can outsourced internal audit work remove the CAE’s oversight responsibility?
No. The function still needs to evaluate the provider, agree the work, oversee quality, and assess results. Buying a service does not remove the need to understand the conclusion it supports.
Can an approved deferral still leave a reportable coverage gap?
Yes. Approval governs the plan change, but the underlying risk may remain. Explain the uncovered exposure, available assurance, and proposed response so oversight is based on the actual situation.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Internal Audit Operations (25% of Part 3). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 9.2-9.5, 10.1-10.3, and 11.1-11.3. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.