CIA Part 1 Complete Review Guide 2026–2027

4. The internal audit mandate defines the function's authority, role and responsibilities; it comes from the board and, where applicable, laws and regulations.
5. The internal audit charter is a formal written document: it includes the mandate, the commitment to follow the Standards, and the scope and types of services. The CAE drafts it; the board approves it.
6. The CAE reviews the charter periodically and presents it to the board and senior management for approval.
7. Functional reporting goes to the board (approving the charter, plan, budget and CAE appointment and pay); administrative reporting goes to the CEO or another senior executive for day-to-day matters.
8. Assurance services are objective assessments giving opinions or conclusions; three parties are involved: the process owner, the internal auditor and the user of the assessment.
9. Advisory services give advice to a requesting client; two parties are involved, and the scope is agreed with the client as long as objectivity is not impaired.
10. Typical assurance work includes risk and control assessments, compliance, financial, operational and IT audits, and assessments of governance processes.
11. Typical advisory work includes consulting on process design, training, facilitation, benchmarking and control self-assessment facilitation.
12. Organizational independence is the freedom from conditions that threaten the ability to carry out responsibilities in an unbiased manner; the CAE must confirm it to the board at least annually.
13. If independence is impaired in fact or appearance, the CAE must disclose the details of the impairment to the board.
14. Examples of impairment: interference in scope or reporting, budget cuts that limit work, the CAE reporting only to the CFO, or auditing an area the CAE also manages.
15. Internal audit's core role in risk management is giving assurance that risk processes are effective and that key risks are evaluated and reported properly.
16. Permitted with safeguards: facilitating risk identification workshops and coaching management on risk, provided management stays responsible for decisions.
17. Internal audit must not set the risk appetite, impose a risk management process, own risks, or decide and implement risk responses for management.

Common mistakes in this chapter

• ✕ Internal audit does not guarantee accuracy of financial statements or eliminate risk; it provides reasonable assurance and advice.
• ✕ The CAE does not approve its own charter; the board does.
• ✕ Advisory work does not need a separate opinion user; it has only a requester and the advisor.
• ✕ Reporting administratively to the CFO or CEO is fine; reporting functionally to them is what threatens independence.
• ✕ Facilitating a risk workshop is allowed; choosing the risk response for management is not.
• ✕ Independence is about the function's position; objectivity is the individual auditor's mental attitude. Do not swap them.