CIA Part 2 (2025): Internal Audit Engagement

CIA Part 2 (2025), Internal Audit Engagement, is the current second exam in The Institute of Internal Auditors’ three-part CIA program. It concentrates on the work of an individual engagement: deciding what should be examined, gathering and evaluating evidence, developing conclusions, supervising the work, and communicating results. Candidates should treat IIA certifications as the wider credential context while using the 2025 Part 2 syllabus as the direct study map.

The exam contains 100 multiple-choice questions with a 120-minute testing period. Under the 2025 syllabus, Engagement Planning carries 50 percent of the exam, Information Gathering, Analysis, and Evaluation carries 40 percent, and Engagement Supervision and Communication carries 10 percent. That weighting makes planning and evidence evaluation the center of gravity rather than administrative management of the internal audit function.

Part 2 assumes the concepts tested in CIA Part 1: Internal Audit Fundamentals: purpose, ethics, independence, governance, risk, controls, and fraud. Candidates relying on the older pre-2025 CIA Part 2 exam should update their preparation because the current syllabus organizes engagement work differently and aligns terminology with the Global Internal Audit Standards.

Engagement planning begins with objectives, not procedures

An internal audit engagement should start by understanding why the work is being performed and what decision or assurance need it is intended to address. Objectives translate the engagement’s purpose into specific questions, while scope defines the boundaries of the work. If those are unclear, even technically correct testing can produce a report that does not answer the organization’s real concern.

Planning should consider the organization’s strategy and objectives, governance, risk management, controls, regulatory obligations, prior audit results, relevant policies, stakeholder expectations, risk appetite and tolerance, and the work of other assurance providers. The goal is not to gather every available document. It is to identify the information that changes the risk assessment and therefore changes the engagement design.

Scope limitations must be identified and documented. A limitation may involve unavailable records, restricted system access, timing, geographic coverage, excluded processes, or management resistance. Candidates should distinguish a deliberate scope boundary agreed during planning from an inappropriate restriction that prevents internal audit from obtaining enough evidence to meet the engagement objective.

Evaluation criteria make findings defensible

Auditors need criteria against which to evaluate the condition they observe. Criteria can come from laws, regulations, policies, contractual obligations, standards, approved procedures, performance targets, control frameworks, or other authoritative expectations. Without suitable criteria, a finding can collapse into personal preference: the auditor dislikes a process but cannot explain what requirement or objective it fails to meet.

Good criteria are relevant to the engagement objective, specific enough to support consistent evaluation, practical in the organization’s context, and capable of producing reliable comparisons. Candidates should be cautious when a policy is outdated or when an industry benchmark is applied without considering the organization’s actual obligations and strategy.

Criteria also affect communication. A stakeholder is more likely to understand a finding when the report shows the expected condition, the observed condition, the significance of the gap, and its relationship to risk. Strong engagement planning therefore anticipates what evidence will be needed to support that comparison before fieldwork begins.

Risk assessment determines where audit effort should go

Engagement-level risk assessment connects organizational objectives to specific processes, events, and controls. Auditors identify what could prevent the activity from achieving its objectives, consider likelihood and impact, understand existing responses, and determine which risks deserve testing. A high-risk area may require deeper or broader work than a low-risk area even when both appear in the same process map.

The reasoning is consistent with broader risk-management principles: understand the objective, identify uncertainty, evaluate exposure, and examine the controls or responses that management relies on. Part 2 then asks how that analysis becomes an executable engagement plan.

Auditors should also consider fraud risk, technology, third parties, data quality, previous findings, change activity, and management judgment. A process that was low risk two years ago can become high risk after a system implementation, acquisition, regulatory change, or rapid growth. Planning is therefore an analysis of current conditions, not a copy of last year’s work program.

The work program converts risk into audit procedures

A work program identifies the procedures needed to achieve the engagement objectives and evaluate the selected risks and controls. Procedures may include inquiry, observation, inspection, reperformance, confirmation, analytical techniques, data analysis, sampling, and examination of system-generated evidence. Each procedure should have a purpose that connects to an objective.

Candidates should be able to distinguish a procedure from the evidence it produces. Interviewing a manager is a procedure; the explanation received is evidence whose reliability depends on the circumstances. Reperforming a control is a procedure; the result provides evidence about whether the control can operate as described. Understanding that relationship helps candidates evaluate whether the planned work is sufficient.

Resource planning is part of the work program as well. The engagement needs people with appropriate knowledge and enough time to complete the work. If a specialized area requires expertise the team does not possess, the correct response may be to obtain qualified assistance rather than narrow the work until it fits the team’s existing skills.

Evidence must be sufficient, reliable, relevant, and useful

Internal auditors form conclusions from evidence, so the quality of that evidence is central to Part 2. Sufficient evidence addresses quantity; reliability addresses trustworthiness; relevance addresses the relationship to the objective; and usefulness concerns whether it helps the auditor support a sound conclusion. More evidence is not automatically better if it is weak or unrelated.

Source and method affect reliability. Evidence obtained directly by the auditor may be stronger than an unsupported representation. External evidence can sometimes be more reliable than internally generated evidence, but context matters. System reports are only as trustworthy as the data, logic, access controls, and report parameters behind them.

Conflicting evidence should not be ignored. If documents, interviews, and data point in different directions, the auditor should investigate why. The disagreement may reveal a control failure, a misunderstanding, a data-quality issue, or a legitimate difference in scope. Simply choosing the evidence that supports the initial hypothesis undermines objectivity.

Sampling and analytics help auditors examine large populations

Auditors rarely inspect every transaction in a large population, so they need methods for selecting and analyzing evidence efficiently. Sampling can be statistical or nonstatistical depending on the objective and methodology. Candidates should understand selection risk, sample representativeness, and the danger of drawing a broad conclusion from a sample that does not reflect the population.

Data analytics can test entire populations for unusual patterns, duplicates, thresholds, sequence gaps, outliers, or relationships. The ability to analyze more records does not remove the need for sound judgment. An exception generated by a rule is a signal to evaluate, not automatic proof of an error or fraud.

Data completeness and accuracy must be addressed before relying on analytical results. If a population excludes manual adjustments or the extract omits a business unit, a sophisticated analysis can produce a confidently wrong conclusion. Good auditors validate the source and logic before interpreting exceptions.

Findings should explain significance, cause, and consequence

A finding becomes useful when it does more than describe a deviation. The auditor should understand the condition, the criteria, the cause or contributing factors, and the effect or risk. Not every engagement issue needs the same reporting structure, but the reasoning should show why the matter is important and what management needs to address.

Root-cause analysis prevents superficial recommendations. A late approval might be caused by unclear authority, poor system design, unrealistic workflow, missing training, staffing pressure, or intentional override. Recommending that employees 'follow the policy' may not solve the actual weakness if the process makes compliance impractical.

The same evidence discipline appears in quality-auditor responsibilities: define criteria, obtain evidence, evaluate performance, identify causes, and communicate an evidence-based conclusion.

Supervision protects both quality and development

Engagement supervision helps ensure objectives are achieved, evidence is appropriate, conclusions are supported, and work complies with the organization’s methodology and professional standards. Review should happen throughout the engagement rather than only after the draft report is complete, because late discovery of a planning flaw can require expensive rework.

Supervisors also help less-experienced auditors develop judgment. Review notes should address why evidence is insufficient, why a conclusion is overstated, or how a procedure could better address the risk. Merely correcting the file without explanation may fix one engagement while failing to improve the team’s future work.

Changes to objectives, scope, timing, or procedures should be documented and approved appropriately. An engagement can evolve as new evidence emerges, but uncontrolled changes make it difficult to explain what was actually audited and whether the final conclusion still matches the planned purpose.

Communication begins before the final report

Effective communication is timely, accurate, objective, clear, concise, constructive, complete, and supported by the work performed. Auditors communicate throughout an engagement: when confirming scope, requesting information, discussing emerging issues, validating facts, and presenting conclusions. Waiting until the final report to reveal a significant issue can create avoidable disputes and delay corrective action.

Management responses and action plans should address the risk or cause rather than merely promise activity. Internal audit may assess whether proposed actions are adequate, but management owns the response. The auditor should avoid designing or operating the control in a way that transfers management responsibility to internal audit.

Follow-up and monitoring determine whether agreed actions were implemented and whether the residual risk is acceptable. Closure should be based on evidence rather than a calendar date or a statement that work is complete. If management accepts a risk instead of remediating it, the matter may require escalation when the acceptance exceeds authorized risk tolerance.

Preparation should follow the lifecycle of an engagement. A strong Part 2 study plan follows the sequence of real work: understand the objective, assess risk, define scope, select criteria, design procedures, gather evidence, analyze results, develop findings, supervise quality, communicate, and follow up. This creates a mental model that helps candidates place individual questions even when the scenario is unfamiliar.

Practice questions are most valuable when candidates explain why the wrong options fail. An option may gather evidence before objectives are clear, rely on management representations when stronger evidence is available, confuse a control deficiency with its root cause, or recommend that internal audit take ownership of management action. Naming the flaw builds transferable judgment.

Use the current 2025 syllabus throughout preparation. The revised exam puts half its weight on planning because planning determines whether the rest of the engagement produces relevant evidence and useful conclusions. Candidates who can translate risk into a disciplined, evidence-based engagement process are preparing for both the exam and the work expected of a Certified Internal Auditor.