CRMA Internal Audit's Consulting Role 3 — Questions and Answers
Question 1: What should internal audit do FIRST when receiving a consulting request from management?
- Begin fieldwork immediately to demonstrate responsiveness
- Assess whether the request aligns with organizational risk priorities and the audit charter (Correct answer)
- Notify external auditors of the planned engagement
- Obtain board approval before beginning any preliminary work
Correct answer: Assess whether the request aligns with organizational risk priorities and the audit charter
Internal audit must first evaluate whether the consulting request is appropriate given charter authorization and organizational risk priorities.
Question 2: When a consulting engagement scope expands significantly beyond what was originally agreed, internal audit should:
- Complete the expanded work without modifying formal documentation
- Formally re-discuss and re-agree the revised scope with the client (Correct answer)
- Automatically decline any work outside the original agreed scope
- Transfer the excess scope to external management consultants
Correct answer: Formally re-discuss and re-agree the revised scope with the client
Scope changes should be formally re-agreed with the client to maintain clarity and protect both parties throughout the engagement.
Question 3: What is the greatest risk when internal audit takes on extensive consulting work for management over time?
- External auditors may reduce their reliance on internal audit findings
- The audit budget may be exceeded due to unplanned work
- Internal audit may lose the objectivity and independence needed to perform assurance work (Correct answer)
- Consulting findings may not be immediately actionable for management
Correct answer: Internal audit may lose the objectivity and independence needed to perform assurance work
Extensive consulting involvement with management can gradually impair the objectivity required for internal audit's assurance responsibilities.
Question 4: During a consulting engagement, internal audit identifies a significant fraud risk that falls outside the agreed scope. The auditor should:
- Ignore it since it falls outside the formally agreed consulting scope
- Include it in the final consulting report at the conclusion of the engagement
- Promptly disclose it to appropriate management and governance bodies (Correct answer)
- Conduct an immediate investigation before making any disclosure
Correct answer: Promptly disclose it to appropriate management and governance bodies
Significant risks discovered during consulting must be communicated promptly to appropriate parties, regardless of engagement scope limitations.
Question 5: Which resource consideration is unique to planning consulting engagements compared to assurance engagements?
- Consulting engagements never require specialized subject matter expertise
- The client may actively contribute subject matter expertise and resources to the engagement (Correct answer)
- Consulting engagements always require more audit staff than assurance engagements
- Board approval is required before any consulting resources can be committed
Correct answer: The client may actively contribute subject matter expertise and resources to the engagement
Consulting engagements are often collaborative, with the client contributing expertise and resources, unlike traditional assurance engagements.
Question 6: Internal audit should decline a consulting engagement when:
- The subject matter is somewhat unfamiliar to the current audit team
- Accepting the work would require internal audit to assume management responsibility for decisions (Correct answer)
- The engagement cannot be completed within the current fiscal year
- The request originates from the CEO rather than the audit committee
Correct answer: Accepting the work would require internal audit to assume management responsibility for decisions
Accepting management responsibility crosses the line from consulting into managing operations, which violates internal audit independence principles.
Question 7: A consulting engagement letter or planning document should contain:
- The auditor's personal opinion on current control effectiveness
- Only the deliverables and timelines, omitting scope limitations
- Objectives, scope, respective responsibilities, and agreed deliverables (Correct answer)
- A guarantee of improved outcomes following the engagement
Correct answer: Objectives, scope, respective responsibilities, and agreed deliverables
The engagement letter should capture all key parameters so both parties understand objectives, scope, roles, and expected outputs before work begins.
CRMA Internal Audit's Consulting Role 3
What should internal audit do FIRST when receiving a consulting request from management?