Skip to main content
CIA · Comparison

CIA Part 1 vs Part 2: principles versus engagement decisions

Part 1 asks why internal audit exists and which principles govern its work. Part 2 asks how to plan and perform a specific engagement. Controls and risk appear in both, but recognizing a responsibility in Part 1 does not prove you can design an evidence-gathering procedure in Part 2.

By MiloPrep editorial team

Same vocabulary, different decision

  • Primary lens

    Part 1
    Purpose, ethics and risk/control foundations
    Part 2
    Engagement objectives, scope and evidence

  • Procurement case

    Part 1
    Who owns supplier-approval controls?
    Part 2
    Which test evaluates supplier approval?

  • Judgment

    Part 1
    Independence and appropriate responsibility
    Part 2
    Suitable criteria and supported conclusions

  • Format

    Part 1
    125 MCQs / 150 minutes
    Part 2
    100 MCQs / 120 minutes

Carry the principle forward, then add the procedure

Use the same business process to make the difference visible. Start by naming the risk owner and assurance role. Then define an objective and choose evidence that answers it.

A practical bridge between parts
  1. 1

    Risk

    Unauthorized supplier payments.

    Output: A Part 1 risk/control distinction

  2. 2

    Responsibility

    Management controls setup; audit evaluates.

    Output: A defensible actor assignment

  3. 3

    Objective

    Determine whether setup approvals operate.

    Output: A Part 2 engagement objective

  4. 4

    Test

    Inspect selected setup and approval records.

    Output: Evidence tied to the objective

The same control creates two different learning tasks

Consider supplier setup and payment approval performed by one employee. A Part 1 lens asks why the responsibility combination matters and who owns the control response. A Part 2 lens asks how an engagement would evaluate the exposure: what objective, criterion, population and evidence are needed.

The principle transfers, but the procedure must be designed. Saying “segregate duties” does not answer a question asking which records support a conclusion about the control’s operation. Equally, proposing an elaborate sample does not answer a question about who has management responsibility.

Contrast an ethical concern with an evidence problem

An auditor previously operated payroll. In one scenario the question asks whether assigning that auditor to review payroll creates an objectivity concern. In another, an appropriately assigned team must determine whether payroll approvals operated. The first requires attention to the assignment; the second requires relevant evidence.

Do not let a familiar phrase override the task. A technically reliable record does not resolve an individual conflict, and a sound reporting line does not establish that an approval occurred. Name the decision in plain language before choosing the response.

Choose a study order based on your gaps

Starting with Part 1 can create a useful foundation for someone new to internal audit. An experienced engagement auditor may already understand fieldwork but still need explicit Standards and ethics review. Treat this as study advice, not a rule that Part 1 must always be taken first.

Choose preparation order from your actual gaps

Foundational risk, control and responsibility knowledge can make engagement work easier to understand. That provides a learning reason to build those concepts before advanced application, but it does not establish a universal personal study duration or a guarantee that the next part will be easy.

If you already work in audit, test the foundations rather than assuming your role covers every outcome. If you are new to the profession, explain a simple control scenario before designing a large work program. Use the results to choose where instruction begins, then confirm your own program and booking conditions separately.

Build a bridge notebook rather than copying every note

For each transferable concept, create two columns: the principle and the engagement application. For residual risk, explain the remaining exposure first; then describe how it might affect an engagement objective or procedure. For professional skepticism, explain the attitude first; then identify evidence needed to assess a particular claim.

Keep the new Part 2 outcomes visible. Planning criteria, selecting a relevant population, analyzing exceptions and documenting a conclusion need their own instruction and practice. A Part 1 pass is valuable background, not a substitute for those tasks.

  • Keep a compact responsibilities sheet from Part 1.
  • Add objectives, criteria and testing direction for Part 2.
  • Check the complete Part 2 outline instead of assuming shared vocabulary covers it.

Avoid two transfer mistakes

Do not answer an engagement question only with a broad principle when the task asks for a test. Do not choose a technically strong procedure that fails the objective. The right level of detail depends on the question.

Check the task verb

  • Identify responsibility

    Useful response
    Name the actor and explain independence

  • Plan an engagement

    Useful response
    Define objective, scope and criteria

  • Evaluate evidence

    Useful response
    Assess relevance, reliability and sufficiency

Three ways a correct principle becomes a wrong answer

First, the answer may name the wrong actor. Second, it may act at the wrong stage. Third, it may fail the objective. For example, recommending an operational control can be reasonable advice, but it is not necessarily the evidence-gathering step requested during an engagement.

Use those three checks on the plausible alternatives in a practice question. Explain which fact defeats each choice rather than simply labeling it wrong. This creates a reusable method for close distinctions without inventing a rule that one particular phrase always signals the correct option.

A bridge exercise with a changed objective

Start with inventory theft: identify the risk, management responsibility and a control response. Now design an engagement procedure to assess that response. Then change the objective to finding goods received but not recorded. The risk and evidence chain should change, even though the business process remains inventory.

If the same answer is reused unchanged, the bridge is incomplete. Return to the objective and population. If you can explain the changed chain, move to mixed cases where the topic heading no longer tells you which part’s lens to use.

Original worked case

One supplier case, two questions

A manager creates suppliers and approves their first payment. Part 1 asks why this creates risk; Part 2 asks how to evaluate it.

Reveal the decision and reasoning

Part 1: incompatible responsibilities weaken the control structure. Part 2: define the approval requirement and inspect evidence of supplier creation and payment authorization.

The principle transfers, but the second answer must specify what evidence would test the control.

An editorial teaching example, not an official IIA question or a prediction of exam content.

Common questions

Is Part 2 simply a harder Part 1?
No. It changes the decision from foundational responsibilities to engagement planning and execution. Shared concepts support that work but do not replace it.
Can I reuse Part 1 notes?
Reuse the risk, controls and ethics foundations. Add the Part 2 outcomes on objectives, criteria, evidence, analysis and supervision.

Sources and editorial notes

Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.

MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.