Engagement Risk Assessment and Scoping: IIA Standards 13.2 and 13.3 in Practice

The annual plan picks the engagement. Standards 13.2 and 13.3 of the IIA Global Internal Audit Standards govern what happens next: understanding the activity, identifying its risks, and writing objectives and a scope that the work program can deliver. Weak planning memos produce work programs that test whatever was easy to test. This post shows what the standards require and how to document it.

Standard 13.2: engagement risk assessment

Internal auditors must develop an understanding of the activity under review in order to assess the relevant risks. To do that, they gather reliable, relevant and sufficient information about:

• The organization's strategies, objectives and risks relevant to the activity.
• The organization's risk tolerance, if established.
• The risk assessment that supports the internal audit plan.
• The governance, risk management and control processes of the activity.
• Applicable frameworks, guidance and other criteria for evaluating those processes.

Auditors review the information to understand how processes are intended to operate. Then they identify the risks to review by identifying the potentially significant risks to the activity's objectives, considering specific risks related to fraud, and evaluating and prioritizing the risks for review. They also identify the criteria management uses to measure whether the activity is achieving its objectives. When the risks were identified in an earlier engagement, only a review and update of the earlier assessment is required.

For advisory services the standard says a formal, documented risk assessment may not be necessary, depending on the agreement with stakeholders. For assurance work, document it.

Standard 13.3: objectives and scope

The objectives must state the purpose and the specific goals, including any mandated by laws or regulations. The scope must set the focus and boundaries by specifying the activities, locations, processes, systems, components and time period covered, and it must be sufficient to achieve the objectives. Auditors must consider whether the engagement is intended to provide assurance or advisory services, because stakeholder expectations and the standards' requirements differ.

Three rules deserve attention.

1. Scope limitations must be discussed with management when identified. The standard defines them as assurance conditions, such as resource constraints or restricted access to people, facilities, data and information, that prevent the work program from being performed as expected.
2. If management cannot resolve a scope limitation, the chief audit executive must elevate it to the board under an established methodology.
3. Auditors must have the flexibility to change objectives and scope as the work reveals the need, and the chief audit executive must approve the objectives, the scope and any changes.

Worked example: disbursements engagement planning memo

In this hypothetical, a distributor with $90 million of revenue has asked internal audit to review procure to pay. The planning memo reads as follows.

Objective. Provide assurance on whether controls over vendor setup, purchase approval, receiving, invoice matching and payment release operate effectively for the 12 months ended September 30 of the audited year.

Scope. Two warehouses and the corporate accounts payable team; the ERP purchasing and payables modules; all payment methods (ACH, check, card). Excluded: capital projects (covered by a separate engagement on the plan) and intercompany settlements.

Risks identified, with fraud considered.

Criteria. The company's purchasing policy (approval limits by role), the three-way match requirement in the AP procedures manual, and, for companies subject to it, the internal accounting controls provision of Exchange Act section 13(b)(2)(B), which requires reasonable assurances that transactions are executed in accordance with management's general or specific authorization.

Management's measures. Days payable, duplicate payment recoveries tracked monthly by AP, vendor master change log reviewed by the controller each month.

That last line matters. Standard 13.2 requires the auditor to identify the criteria management uses to measure whether the activity is meeting its objectives. If management has no measure for duplicate payments, that absence is itself an early observation.

From risk to work program

Standard 13.6 requires the work program to be based on the planning information, including the risk assessment, and to identify the criteria for each objective, the tasks, the methodologies and tools, and the people assigned. The chief audit executive reviews and approves it before it is implemented and promptly after any change. In the example, the high-priority vendor risks would drive the largest tests: a full-population comparison of vendor bank accounts to employee bank accounts, a review of vendor master changes against approved change requests, and a match of payments to receiving records.

Scope limitation example

Suppose the ERP administrator declines to give internal audit read access to the vendor master change log because the data contains banking details. Under Standard 13.3 this is a scope limitation. Document it, discuss it with the controller and the chief financial officer, offer alternatives (masked fields, an administrator-run extract witnessed by an auditor), and if unresolved, escalate to the audit committee through the chief audit executive. Do not quietly narrow the scope and report a clean result.

Common errors

• Scope written as a list of departments, with no systems or time period.
• A risk list with no fraud consideration, which Standard 13.2 requires.
• Objectives copied from the prior engagement without a review of changes.
• Scope changes made during fieldwork without the chief audit executive's approval.

For the plan that precedes this step, see /us/blog/internal-audit-plan-standard-9-4-annual-risk-assessment-and-board-approval. For the findings that follow, see /us/blog/internal-audit-findings-criteria-condition-cause-and-effect-standard-14-3.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 13.2 Engagement Risk Assessment, 13.3 Engagement Objectives and Scope, 13.6 Work Program: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• Securities Exchange Act of 1934, section 13(b)(2)(B), 15 U.S.C. 78m(b)(2)(B): https://www.law.cornell.edu/uscode/text/15/78m

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error