Primary Responsibilities: For entry-level internal auditors, the primary responsibilities focus on learning and supporting tasks. Documentation is a key responsibility as it involves recording the findings and work performed during an audit engagement. This helps in building a foundation for understanding audit processes and methodologies.
IIA's Global Internal Audit Competency Framework emphasizes documentation as a core skill for entry-level auditors.
Other Responsibilities:
Leadership: Typically a responsibility for more experienced auditors.
Analysis and Reporting: While entry-level auditors may assist with analysis and reporting, these tasks are generally more advanced and require a deeper understanding of audit processes.

* A. Information obtained from historic audits and memos:Useful for context but not typically part of the formal work program.
* B. Risk and control registers or matrices:Used in the planning phase but not part of the detailed execution in the work program.
* C. Resource deployment plans and sampling methodologies:Correct. These are essential components of the work program, guiding audit execution and resource allocation.
* D. Prior findings and management responses:Inform planning but do not typically appear in the work program itself.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Engagement Work Program.

* Definition of Risk Appetite: Risk appetite is the amount and type of risk an organization is willing to pursue or retain to achieve its objectives. It reflects the organization's overall approach to risk-taking and is typically articulated at the highest level of the organization.
Reference: COSO's Enterprise Risk Management Framework.
Definition of Risk Tolerance: Risk tolerance refers to the acceptable variation relative to the achievement of specific objectives. It is more granular and specific than risk appetite, detailing the levels of risk that are acceptable within the parameters set by the organization's risk appetite.
Reference: IIA's Practice Guide on Risk Management.
Distinguishing the Two Concepts: Risk appetite is broad and sets the overall boundaries for risk-taking, while risk tolerance is more specific, outlining acceptable risk levels for particular objectives within the broader risk appetite framework.
Practical Example: An organization may have a high risk appetite, accepting significant risks to achieve growth, but its risk tolerance for operational risks (such as system failures) may be low, indicating minimal acceptable deviations from expected performance.
Conclusion: The correct answer is C, as risk appetite represents the organization's general level of risk acceptance, whereas risk tolerance is more specific and detailed, falling under the broader scope of risk appetite.

Ensuring that risks to the timely completion of the engagement are assessed should be performed first during engagement supervision activities. This initial step is crucial as it sets the foundation for the entire audit process. By identifying and assessing risks early, the audit supervisor can develop appropriate plans and strategies to mitigate these risks, ensuring that the engagement stays on track and is completed within the allocated time frame. Addressing this aspect first helps in prioritizing tasks, allocating resources effectively, and managing any potential obstacles that might delay the audit process.
References:
The Institute of Internal Auditors (IIA) Standards
Internal Audit Engagement Planning and Risk Assessment Procedures

Understanding a business process involves several steps, with determining the process goals being the next logical step after identifying the process. The goals provide context for why the process exists and what it aims to achieve.
* IIA Standard 2201 - Planning Considerations:
* This standard emphasizes the importance of understanding the objectives and goals of the area under review. Identifying the goals of a business process is crucial for evaluating its effectiveness and alignment with organizational objectives.
* Process Goals:
* The process goals define the purpose and desired outcomes of the process. Without understanding these goals, an auditor cannot effectively assess whether the process is functioning as intended or if it needs improvement.
* IIA Practice Advisory 2201-1:
* This advisory suggests that auditors should first understand the objectives (goals) of the process before delving into the details of inputs, activities, and outputs. The goals provide a framework for evaluating the relevance and effectiveness of these elements.
* Option A (Determine process outputs): Outputs are important, but they should be understood in the context of the goals they are intended to achieve.
* Option B (Determine process inputs): Inputs are the resources used in the process, but their relevance depends on the process goals.
* Option C (Determine process activities): Activities are the steps within the process, but they must be aligned with the goals to be meaningful.
Detailed Explanation:Why Not Other Options?Conclusion: Option D is correct because understanding the process goals is the next logical step after identifying the process, as it provides the context needed to evaluate all other aspects of the process.