Practices related to Internal Auditing: formula sheet

Key formulas

Risk score (common scoring model)

Risk score = Impact × Likelihood

Used with a 1-5 scale in many organisations. It is a method, not a legal formula. State the scale you use. Some models also adjust for control effectiveness.

Residual risk (conceptual)

Residual risk = Inherent risk − Effect of controls

Conceptual, not literal subtraction. Weak controls leave residual risk close to inherent risk.

Weighted risk score

Weighted score = Σ (factor rating × factor weight)

Weights should total 100% so scores are comparable across auditable units.

Resource availability

Available audit hours = Number of auditors × Working days × Hours per day − Leave, training and admin time

Compare this with the total hours needed for the planned engagements. Keep a contingency for unplanned work.

Audit cycle rule of thumb

High risk: annual; Medium risk: every 2-3 years; Low risk: longer cycle or on request

This is a common practice, not a mandatory rule. The audit committee can set different cycles.

Sampling interval (systematic selection)

Sampling interval = Population size ÷ Sample size

Pick a random start within the first interval, then every nth item. Example: 1,000 invoices, sample 50, interval 20.

Sampling risk (conceptual)

Larger sample → lower sampling risk, but more time and cost

Sampling risk is the risk that the sample conclusion differs from the conclusion on testing the whole population.

Test of controls vs substantive test

Test of controls = does the control operate? Substantive test = is the balance or transaction correct?

Keep the two purposes separate in answers.

Attributes of good evidence

Sufficient + Relevant + Reliable + Useful

Sufficiency is about quantity. Relevance, reliability and usefulness are about quality.

Deviation rate

Deviation rate = Number of deviations ÷ Sample size × 100

Compare it with the tolerable deviation rate set in planning.

Elements of a finding (5 Cs)

Criteria + Condition + Cause + Consequence + Corrective action

Use this as a checklist for every finding you write in an answer.

Core contents of a report

Objective + Scope + Period + Conclusion + Findings + Recommendations + Management response + Limitations

Adapt the order to the question, but cover each element.

Follow-up tracker fields

Issue ref + Risk rating + Recommendation + Owner + Target date + Status

Status is typically open, in progress, implemented or overdue.

Reporting line

Auditee discussion → Management → Audit committee

Administrative reporting may be to management; functional reporting should be to the audit committee to protect independence.

IIA Code of Ethics principles

Integrity + Objectivity + Confidentiality + Competency

Four principles. Each comes with rules of conduct in the code. Name all four in any ethics answer.

Source of standards

India: ICAI SIAs | Global: IIA International Standards

Say which framework you are answering from. Do not mix them without saying so.

Two broad IIA standard groups

Attribute standards (who the auditor is) + Performance standards (how work is done)

Attribute covers independence, objectivity, proficiency, due care. Performance covers planning, execution, communication.

Standards vs ethics

Standards = how to perform the work | Ethics = how to behave

Use this one-line contrast to frame short notes.

Variance in analytical procedure

Variance = Actual − Expected; Variance % = (Actual − Expected) ÷ Expected × 100

Investigate when the variance exceeds the threshold set in the audit plan. The threshold is a judgement and not a fixed number.

Reliability of evidence (rule of thumb)

External, written and directly obtained evidence is generally more reliable than internal, oral and indirectly obtained evidence

It is a general guide and not a law. Reliability also depends on the controls over the source.

Gross profit ratio

Gross profit ratio = (Sales − Cost of goods sold) ÷ Sales × 100

A common analytical test. A sudden change may signal misstatement, pricing change or cut-off error.

Receivable days

Receivable days = Average trade receivables ÷ Credit sales × 365

A rise may indicate weak collection or fictitious sales. Use credit sales and not total sales where possible.

Charter contents

Purpose + Authority + Responsibility + Scope + Reporting lines + Access rights + Standards followed

Approved by the board or audit committee. Review it periodically and update when needed.

Dual reporting line

Functional reporting → Audit Committee / Board; Administrative reporting → senior management

Functional line protects independence. Administrative line covers day-to-day matters such as budget and leave.

QAIP components

Ongoing monitoring + Periodic internal assessment + External assessment

Results go to the board or audit committee. External assessment is done by a qualified, independent reviewer.

Outsourcing principle

Work may be outsourced; accountability stays with the entity

Board and audit committee remain responsible for the function and its quality.

Quick revision

• The audit cycle runs in this order: plan, perform fieldwork, report, follow up.
• Planning is risk-based: higher-risk areas get more audit attention and earlier coverage.
• Fieldwork produces evidence recorded in working papers that support every conclusion.
• A good finding states what was found, what should have been, why it happened and its effect.
• Management responses and agreed action dates belong in the report.
• Follow-up checks whether agreed actions were actually implemented.
• Independence and objectivity are central to the internal auditor's role.
• Ethics principles cover integrity, objectivity, confidentiality and competence.
• Techniques and tools support analysis, but the auditor's judgement stays essential.
• Quality assurance includes ongoing monitoring and periodic review of the audit function.
• In case answers, always write provision or practice, analysis of facts, then conclusion.
• Link every recommendation to a risk it reduces.

Common mistakes

• Treating the audit universe as only the financial accounting areas. Fix: Include operations, compliance, IT, locations and subsidiaries. Internal audit covers all areas where risk exists.
• Planning audits by rotation or equal time for every area. Fix: Allocate frequency and depth by risk. Equal coverage wastes effort on low-risk areas.
• Treating audit evidence and working papers as the same thing. Fix: Say evidence is the information obtained, and working papers are the auditor's record of procedures, evidence examined and conclusions.
• Skipping the walkthrough and going straight to sampling. Fix: Explain that the walkthrough confirms how the process really operates, so you can design relevant tests and spot control gaps.
• Writing findings as only a description of what went wrong. Fix: Use the 5 Cs every time so the finding is complete.
• Skipping discussion with the auditee before issuing the report. Fix: Mention the draft discussion to confirm facts and obtain management responses.
• Saying SIAs and Standards on Auditing are the same thing Fix: State that SAs govern statutory audit opinions on financial statements, while SIAs guide internal audit work for management and the board.
• Listing the IIA principles wrongly, such as adding independence or professional scepticism Fix: Remember the four: integrity, objectivity, confidentiality, competency. Independence belongs to the standards.
• Treating inquiry as sufficient evidence Fix: State that inquiry must be corroborated by inspection, observation or reperformance.
• Confusing inspection with observation Fix: Inspection is examining records or assets. Observation is watching a process being performed.

Exam tips

• Write answers in the order: definition, inputs, risk assessment, plan, resources, approval. It earns marks for structure.
• If a question gives numbers, show the calculation line by line and state the ranking in words.
• Use the facts in the case. Name the actual area, such as procurement or payroll, and say why its risk is high or low.
• Mention the audit committee's role in approving the plan. Examiners look for the governance link.
• For drafting questions, set out the audit plan as a short table-like list in text: area, risk rating, frequency, hours, timing.
• Follow the sequence entry meeting, walkthrough, sampling, testing, evidence, working papers, and use it as your answer skeleton.
• In case-based questions, name the exact technique and link it to the facts given, for example inspection of goods received notes.
• When asked to differentiate evidence from working papers, define both and add one example of each.