Skip to main content
CIA · Comparison

CIA Part 2 vs Part 3: the engagement and the audit function

Part 2 centers on planning, evidence and supervision within an engagement. Part 3 centers on the audit function’s resources, risk-based plan, quality, and communication and monitoring of results. Distinguish one engagement’s work program from the organization-wide internal audit plan.

By MiloPrep editorial team

Locate the level of the decision

  • What are we planning?

    Part 2 lens
    Objectives and work for one engagement
    Part 3 lens
    The portfolio of engagements and resources

  • What is quality?

    Part 2 lens
    Support and supervision for this work
    Part 3 lens
    Assessment and improvement of the function

  • What are we communicating?

    Part 2 lens
    Evidence and findings during engagement work
    Part 3 lens
    Results, stakeholder communication and monitoring

  • Format

    Part 2 lens
    100 MCQs / 120 minutes
    Part 3 lens
    100 MCQs / 120 minutes

Separate two documents that both say “plan”

An engagement work program lists procedures for a defined objective. The internal audit plan chooses and prioritizes engagements across the organization. A new strategic risk can change the latter before anyone designs detailed tests.

Plan versus work program

  • Internal audit plan

    Decision
    What should receive audit attention?
    Example
    Add an acquisition-integration audit

  • Engagement work program

    Decision
    How will this objective be addressed?
    Example
    Test access provisioning for acquired systems

Portfolio selection precedes detailed engagement design

An organization acquires a business with unfamiliar systems. The function must consider whether the changed risk warrants new audit attention and whether the necessary capability exists. That is a portfolio and resource decision. Once an engagement is selected, the team defines its objective, scope, criteria and procedures.

A detailed test plan cannot establish that this was the right engagement to prioritize. Conversely, an approved portfolio cannot substitute for a defensible work program. In a scenario containing both, identify which decision is actually being requested.

Quality of one file differs from quality of the function

A supervisor checks whether a workpaper supports a conclusion. A function-wide assessment considers a wider set of methods, responsibilities, performance and improvement. The activities are related, but completing the first does not demonstrate that the entire quality program is adequate.

For example, several engagements might have polished files while the portfolio repeatedly overlooks a material emerging risk. An assessment focused only on documentation would miss the planning weakness. Read whether the case concerns delivery of one assignment or the system directing all assignments.

Extend the finding into follow-up

Part 2 evidence supports the finding. Part 3 monitoring asks whether the agreed action is implemented and whether unresolved risk needs attention. Reuse the evidence discipline but change the time horizon and audience.

From test to monitored action
  1. 1

    Test

    Evaluate account approvals.

    Output: Supported exceptions

  2. 2

    Finding

    Connect the condition to criteria and risk.

    Output: A defensible conclusion

  3. 3

    Action

    Agree responsibility and timing.

    Output: Management’s action plan

  4. 4

    Monitor

    Verify the implemented control.

    Output: Evidence and escalation when needed

Follow an access finding across the reporting boundary

During fieldwork, a team identifies terminated users with active accounts and obtains evidence supporting the exception. It evaluates the relevant criterion, cause and risk. Communication during the engagement helps validate facts and address matters that need timely attention.

The work then moves into final results, an agreed management response and monitoring. A revised termination workflow is evidence of implementation. Subsequent access-removal records may be needed to evaluate operation. The evidential discipline carries forward while the decision, audience and time horizon change.

Do not confuse communication timing with the entire purpose

Both parts involve communication. An urgent fieldwork limitation cannot always wait for the final report, and final reporting is not merely formatting completed workpapers. Ask who needs which information to discharge the responsibility described in the case.

A board-level summary should communicate significant results, progress, constraints and unresolved matters relevant to oversight. It should not be assumed that sending every detailed test record achieves that purpose. Similarly, a broad dashboard cannot replace evidence supporting a specific engagement conclusion.

Do not use old part titles as your coverage map

The current Part 3 is Internal Audit Function. If older materials label Part 3 Business Knowledge for Internal Auditing, reconcile them against the current outcomes. Background business knowledge remains useful, but the old table of contents is not the current blueprint.

Transfer the skill, then add the new responsibility

Evidence evaluation from Part 2 is useful in Part 3 monitoring. Planning discipline is useful in portfolio decisions. But the new role requires attention to capacity, strategy, quality and organizational coverage. Add those outcomes deliberately instead of renaming your engagement notes as a function plan.

Use a two-level exercise: write why an acquisition review should be in the portfolio, then write how one access objective will be tested. Finally, explain how a significant unresolved finding will be monitored. Each paragraph should answer a different question with an identifiable responsible actor.

Check readiness for the next part without assuming equivalence

After studying Part 2, try unfamiliar cases about selecting engagements, obtaining specialist capacity, evaluating quality and monitoring actions. Note which decisions depend on knowledge you have not yet learned. This makes the study bridge specific rather than a general feeling that the two parts overlap.

If you use older materials, reconcile the current function outline before assigning study blocks. The syllabus-migration page provides a crosswalk. Current part numbers do not establish equivalence with older chapter locations, and shared vocabulary does not guarantee complete coverage.

Original worked case

A new acquisition changes two plans

The organization acquires a company with weak system-access controls.

Reveal the decision and reasoning

At function level, assess whether the risk-based audit plan needs to change and whether the team has capacity. At engagement level, define scope, criteria and procedures for the selected access-control review.

The portfolio decision comes before a detailed work program. Both are planning, but they answer different questions.

An editorial teaching example, not an official IIA question or a prediction of exam content.

Common questions

Does passing Part 2 mean Part 3 needs little study?
No. Function resources, risk-based audit planning, quality assessment and results monitoring need their own coverage and practice.
Why do both parts discuss communication?
Communication occurs throughout audit work. Read whether the scenario concerns engagement execution or the function’s final results, oversight and follow-up responsibilities.

Sources and editorial notes

Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.

MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.