CIA 3 questions (discussion)
During testing, an internal auditor finds inconsistent handling of organizational personal data and expands the audit scope to include a review of controls over client data. Would it be acceptable to include "conducted in accordance with the Global Internal Audit Standards" in the audit report?
A. Yes, as long as the scope of the audit was expanded to address important risks related to data protection, which is within the auditor’s professional judgment.
B. No, because the change in scope without proper approval from senior management invalidates the claim of compliance with GIAS.
C. Yes, because expanding the scope to include additional risks enhances the audit’s comprehensiveness and demonstrates adherence to GIAS
D. No, because the expanded scope was not initially included in the audit plan, which means the audit process did not follow the original plan outlined by GIAS
Additionally, my understanding is that internal audit departments can state conformance with the Global Internal Audit Standards during the five-year period between external quality assessments, provided they have completed the required internal assessments.
Also, if management imposes a scope limitation on an engagement, does that necessarily mean the engagement may not have been conducted in accordance with the Standards?