Study guide
10.1 Evaluating Adequacy of the Engagement Work Program
CIA Part 2 Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIA Part 2 Exam Orientation
1.1 Current CIA Part 2 Exam Facts 1.2 Eligibility, Fees, and Pearson VUE Scheduling 1.3 Scoring, Results Timing, and the 2025 Syllabus Map
2 Chapter 2: Engagement Objectives and Scope
2.1 Topical Requirements in Objectives and Scope 2.2 Elements Used to Build Engagement Objectives 2.3 Scope Limitations, Stakeholder Requests, and Scope Changes
3 Chapter 3: Evaluation Criteria and Planning Context
3.1 Selecting and Testing Evaluation Criteria 3.2 Applying Topical Requirements When Planning 3.3 Strategy, Risk Management, and Performance of the Activity Under Review
4 Chapter 4: Technology, Continuity, and Finance in Planning
4.1 Cybersecurity, IT General Controls, Privacy, and Data Security 4.2 Business Continuity, Disaster Recovery, and Resilience 4.3 Finance and Accounting Concepts for the Activity Under Review
5 Chapter 5: Business Process and System Risks in Planning
5.1 Asset, Supply Chain, Inventory, Payables, Procurement, and Compliance Processes 5.2 Third-Party Process Risks 5.3 CRM, ERP, and GRC System Risks
6 Chapter 6: Engagement Approach and Project Management
6.1 Agile, Traditional, Integrated, and Remote Approaches 6.2 Project Management While Planning and Conducting Engagements
7 Chapter 7: Engagement Risk Assessment
7.1 Topical Requirements and Pervasive Financial, Operational, IT, Cyber, and Regulatory Risks 7.2 Emerging Risks and the Impact of Change 7.3 Methods to Evaluate and Prioritize Risks and Controls
8 Chapter 8: Structure, Environment, and Culture
8.1 Centralized vs Decentralized, Flat vs Traditional, In-Person vs Remote 8.2 Culture, Group Behavior, and Tone at the Top
9 Chapter 9: Control Design, Effectiveness, and Efficiency Procedures
9.1 Procedures to Evaluate Control Design 9.2 Procedures to Test Operating Effectiveness 9.3 Procedures to Test Control Efficiency
10 Chapter 10: Work Programs, Testing Methodologies, and Resources
10.1 Evaluating Adequacy of the Engagement Work Program 10.2 Testing Methodologies for Accounting, Finance, IT, Operations, and Cybersecurity 10.3 Financial, Human, and Technological Resources and Limitation Implications
11 Chapter 11: Information Sources and Preliminary Survey
11.1 Interviews, Observations, and Walk-Throughs 11.2 Data Analysis as an Information Source 11.3 Policies, Checklists, Risk-and-Control Questionnaires, and Self-Assessments
12 Chapter 12: Evidence Relevance, Sufficiency, and Reliability
12.1 Criteria for Evidence Quality 12.2 Independence, Corroboration, and the Control Environment 12.3 Evidence an Informed, Competent Person Could Rely On
13 Chapter 13: Technology Options for Findings and Conclusions
13.1 Artificial Intelligence, Machine Learning, and Robotic Process Automation 13.2 Continuous Monitoring, Dashboards, and Embedded Audit Modules
14 Chapter 14: Process Mapping and Data Analytics
14.1 Workflow Segments, Process Maps, Walk-Throughs, and RACI 14.2 Structured vs Unstructured Data and the Analytics Process 14.3 Diagnostic, Prescriptive, Predictive, Anomaly, and Text Analysis
15 Chapter 15: Analytical Review and Finding Evaluation
15.1 Ratios, Variances, Trends, and Benchmarking 15.2 Selecting Analytical Techniques for Engagement Objectives 15.3 Comparing Existing Conditions to Evaluation Criteria 15.4 Root Causes, Effects, and Significance of Findings
16 Chapter 16: Workpapers and Engagement Conclusions
16.1 Organizing Complete Workpapers with Sufficient Evidence 16.2 Linking Workpapers to Results; Retention, Regulation, and Policy 16.3 Aggregating Findings and Concluding on Governance, Risk, and Control
17 Chapter 17: Engagement Supervision
17.1 Supervision Throughout Planning and Fieldwork 17.2 Coordinating Assignments and Reviewing Workpapers and Conclusions 17.3 Evaluating Auditors' Performance
18 Chapter 18: Communication During the Engagement
18.1 Formal and Informal Communication Across Planning, Fieldwork, and Reporting 18.2 Situations That Require Escalation 18.3 Selecting Appropriate Stakeholders for Engagement Communication
19 Chapter 19: Final Review and Test Day
19.1 2025 vs 2019 Traps and Part 2 vs Part 3 Boundaries 19.2 Pacing, Test-Center Rules, and Official Results
10.1 Evaluating Adequacy of the Engagement Work Program
Key Takeaways Explain This Topic AI
GIAS Standard 13.6 requires a documented work program that achieves the engagement objectives and identifies evaluation criteria, tasks, methodologies including analytical procedures and tools, and the internal auditors assigned to each task.
The chief audit executive must review and approve the work program before it is implemented and promptly when any subsequent changes are made.
Adequacy is judged against objectives and high residual risks: design, operating-effectiveness, and efficiency procedure families must be present where those are objectives, and each task must plan the evidence to be obtained.
A library or prior-year file is not adequate until it is tailored to this activity, system, period, and risk assessment; copy-paste programs are a standard CIA trap.
When the activity, risks, operations, programs, systems, or controls change significantly, update the work program and obtain prompt re-approval rather than improvising or silently dropping tests.
Last updated: August 2026
Evaluating the engagement work program is where planning either becomes a usable fieldwork plan or stays a stack of copied steps. CIA Part 2 objective A6d asks you to evaluate adequacy , not to invent a house style. The governing standard is Global Internal Audit Standards (GIAS) Standard 13.6, Work Program . Conformance with the 2024 Standards is expected from 9 January 2025. If a stem still smells like 2017 Standard 2240, translate it: the current test is 13.6 plus the engagement risk assessment from Chapter 7.
Quick Answer: An adequate work program is based on engagement planning (including the engagement risk assessment when applicable); identifies evaluation criteria, tasks to achieve the objectives, methodologies (including analytical procedures) and tools, and the internal auditors assigned to each task; is sufficient to achieve the engagement objectives; is reviewed and approved by the chief audit executive (CAE) before implementation; and is updated and re-approved promptly when the activity or its risks change. A generic copy-paste file that skips high residual risks, omits planned evidence, or silently drops tests is not adequate.
What Standard 13.6 Requires the Program to Identify
Internal auditors must develop and document a work program that achieves the engagement objectives. GIAS 13.6 requires that program to rest on information obtained during engagement planning, including—when applicable—the results of the engagement risk assessment.
The work program must identify :
Criteria to be used to evaluate each objective.
Tasks to achieve the engagement objectives.
Methodologies , including the analytical procedures to be used, and tools to perform the tasks.
Internal auditors assigned to perform each task.
CIA items often wrap two extra adequacy questions around that mandatory list. First, is the extent of work (period, locations, population or sample approach, depth of test) enough for the residual risk? Extent usually lives inside the task and methodology description, not as a decorative cover-sheet field. Second, are specialists named when the assigned team cannot perform a task competently? Specialist need is a Standard 13.5 resource decision, but an adequate program makes the assignment visible—named internal auditor, guest auditor, or co-sourced specialist—rather than leaving a high-skill task as staff, TBD.
Engagement objectives are set under Standard 13.3 (Chapter 2). The work program does not replace those objectives; it operationalizes them. If an approved objective has no corresponding tasks, criteria, and assigned person, the program is not adequate for that objective even if every other template box is ticked.
Approval, Review, and Subsequent Changes
The CAE must review and approve the engagement work program before it is implemented and promptly when any subsequent changes are made . In many functions the CAE designates an engagement supervisor to perform that review. CIA stems still treat documented supervisory approval as the control: an unsigned draft is not a license to start testing.
Promptly is the keyword for changes. Expanding or shrinking samples, dropping a location, swapping observation for a desk review, or adding a specialist after a system incident are changes. Obtaining initials at the closing meeting after the work was skipped is not prompt approval. It is an undocumented limitation.
Adequacy Tests That Separate a Plan from a Template
Completeness of headings is not adequacy. Score the program against the objectives and against high residual risks from planning.
Adequacy test Question the reviewer asks Typical CIA failure
High residual-risk coverage Does every high residual risk have tasks, criteria, and extent? Last year's accounts-payable program ignores this year's ERP vendor-master access risk
Design vs operating effectiveness vs efficiency Where those are objectives, are matching procedure families present? Design walk-throughs only, when the objective includes operating effectiveness
Planned evidence Does each task state what evidence, from whom, and how much? Test a sample of invoices with no source, period, or population
Tailoring Is this program built for this activity, system, period, and geography? Industry template with the client name search-and-replaced
Sufficiency vs objectives If every task is executed as written, would the objectives be achieved? Three days of cutoff work against a six-location revenue objective
Assignment and skills Are named auditors or specialists competent for each task? New hire assigned to review firewall rules with no specialist support
Approval trail Is the current version approved, and are changes re-approved promptly? Supervisor signed an obsolete draft; fieldwork used a different file
Chapter 9 already taught procedures to evaluate control design , test operating effectiveness , and test control efficiency . Do not rebuild those catalogs here. The adequacy question is narrower: if the engagement objectives include design, operating effectiveness, or efficiency, the work program must contain the corresponding procedure family. A beautifully written design walk-through script cannot support an operating-effectiveness objective by itself.
Evidence planning is the other frequent miss. An adequate task names the record or system extract, the owner, the period, and whether the auditor will inspect, reperform, observe, confirm, or analyze. Obtain evidence as needed is not a procedure.
Copy-Paste Programs Are the Reliable Trap
A library program is a starting point. Adequacy is judged after tailoring to this engagement. Red flags the exam loves:
Same steps as last year despite a system conversion, acquisition, new third party, new regulation, or new Topical Requirement in scope.
Tasks written as management control objectives (vendor payments are accurate) instead of auditor procedures (recalculate three-way match exceptions for March–May disbursements).
No line of sight from high residual risks to specific tasks.
Methodologies listed as per methodology with no methodology.
Assignments still TBD after a fieldwork start date is locked.
Efficiency objectives with no efficiency-oriented procedures, or the reverse: a cost-study disguised as an assurance program with no design or operating-effectiveness work.
If the in-charge cannot explain why a step is in or out, the program is not ready for CAE or supervisor approval.
Update the Program When Risks Change
Planning is not a frozen photograph. When the organization's activities, risks, operations, programs, systems, or controls change significantly—or when fieldwork reveals a risk that planning missed—the work program must be reassessed. Revise tasks, methodologies, extent, tools, and assignments, then obtain prompt approval of the change.
Two opposite failures both miss 13.6:
Rigid execution of an obsolete program (it was already approved, so we will not add the new payment interface).
Informal improvisation (we skipped the inventory observation because the warehouse was busy) with no documented, approved change.
The professional path is recognize the change, decide whether the current program is still sufficient to achieve the objectives, revise it, approve it, and then execute the revised program. Silently doing less work to protect the original due date is not an update; it is the resource-limitation trap Chapter 10.3 treats as a finding against the auditors.
Worked Adequacy Review
Consider a procure-to-pay engagement. Approved objectives: (1) vendor-master changes are authorized, (2) three-way match operates effectively during the period, and (3) duplicate-payment prevention is efficient enough to catch repeats at reasonable cost. Residual risk is high for vendor-master access after ERP go-live, medium for matching, and medium for duplicates.
An adequate program would state criteria (policy, configuration standards, duplicate-payment threshold); assign vendor-master access and configuration tests to someone with ERP security skill or name a specialist; include operating-effectiveness procedures for the match (not only a design narrative); include efficiency-oriented analytics for duplicates without turning the whole job into a consulting cost study; specify evidence and extent; and show CAE or supervisor approval before kickoff.
A program that copies test 25 invoices from last year, ignores ERP access, and lists no specialist is not adequate —even if someone signed the cover sheet. Signature without substance does not satisfy 13.6.
How to Attack a CIA Stem
When the item gives you a work-program excerpt, score in this order: (1) Does it cover the high residual risks and the stated objectives ? (2) Does it identify 13.6's required elements, including extent and evidence inside the tasks? (3) Are design, operating-effectiveness, and efficiency procedure families present where those are objectives ? (4) Is approval timely, including for changes? Pick adequate only when those tests pass. A header, a budget, and a signature block are not enough.