How Difficult Is CIA Part 2? Planning and Evidence Evaluation

Why the exam feels difficult

Part 2 asks candidates to decide what an auditor should do with incomplete but meaningful facts. The challenge is often sequencing rather than obscure terminology. A candidate may know how sampling works but miss that the population is incomplete. They may know that findings require evidence but label an exception as fraud before verifying it.

The 2025 blueprint emphasizes engagement planning at 50% and information gathering, analysis, and evaluation at 40%. Together those domains cover how to define the work and support a conclusion. The remaining 10% tests supervision and communication, which can also change the best answer when evidence is disputed, scope is constrained, or risk must be escalated.

Experience helps with process familiarity, but it can also create assumptions. A candidate used to one organization may overgeneralize its approval rules or evidence practices. The exam expects candidates to use the criteria and facts in the scenario, not import an unstated workplace policy.

Difficulty 1: turning a broad request into a plan

A request such as “audit purchasing” is too broad to determine which tests will answer the engagement question. A strong plan states objective, scope, criteria, key risks, controls, procedures, and resources. Candidates may be tempted to begin sampling before understanding the process or deciding what conclusion the engagement must reach.

Example: a school district reports frequent late supplier payments and asks internal audit to review procurement. The objective might address whether purchases are authorized and recorded correctly, or whether invoice processing meets payment terms. Those are related but distinct. The auditor learns the process, identifies relevant policies and objectives, then narrows the scope to the risk that matters.

The best option usually resolves the planning gap before fieldwork. If objective and scope are clear but the control risk is uncertain, a walkthrough and risk assessment may come next. If criteria are missing, clarify them before labeling a condition deficient. The order depends on which planning element the facts leave unresolved.

Difficulty 2: selecting evidence that fits

Evidence quality is not a single ranking in every situation. A signed form may be reliable evidence that someone documented approval but weak evidence that the approver reviewed the substance. Inquiry can reveal how an exception process works but may be less persuasive as the only evidence of consistent operation. A system report can be useful only after completeness, fields, and access controls are tested.

Example: management says every privileged account is reviewed quarterly. A policy and interview support the design and intended process; dated review records and account listings support operation and population coverage. If the listings exclude service accounts, the evidence does not support a conclusion about all privileged access.

Candidates must distinguish evidence that is available from evidence that is relevant. A large volume of unrelated records does not cure a weak procedure. Ask whether the information addresses the objective, comes from a trustworthy source, covers the appropriate period and population, and is sufficient for the conclusion.

Difficulty 3: drawing the right inference

A sample is only as useful as its selection and intended inference. Selecting high-dollar transactions can be appropriate to examine exposure but does not automatically estimate the error rate for all transactions. A statistical sample requires a suitable design and assumptions; judgmental sampling supports a different kind of conclusion.

Example: an auditor deliberately selects 15 unusual refunds from a population of 4,000 to investigate a fraud indicator. Finding two approval exceptions warrants follow-up, but it does not justify saying 13.3% of all refunds lacked approval. The selection was risk-based, not representative.

Similarly, one deviation does not always mean the control is ineffective for the entire period. Verify the exception, determine whether a compensating control operated, assess cause and recurrence, and decide whether expanded testing is justified. Avoid both extremes: dismissing every exception as isolated and generalizing every exception to the whole population.

Difficulty 4: connecting condition and criteria

A finding needs a comparison. Candidates sometimes identify a concerning condition but cannot state what should have happened. Criteria may come from an approved policy, law, contract, system design, or other suitable requirement. The auditor should verify that the criterion applies to the period and process under review.

Example: purchase orders are approved after goods arrive. If policy requires preapproval except for emergencies, the auditor must distinguish emergency purchases from ordinary ones and determine whether the exception path was authorized. Without this context, a report may overstate noncompliance.

Cause and effect also require support. “Staff were careless” is not a supported cause merely because a control failed. Evidence may instead show confusing workflow, inadequate training, access overlap, or unclear responsibility. If cause is not established, state the condition and risk accurately, then pursue additional work or avoid a speculative assertion.

Difficulty 5: role and independence

The strongest answer keeps management accountable. Internal audit evaluates and advises but should not approve transactions, operate controls, own remediation, or decide management’s risk acceptance. In some questions, the tempting answer seems efficient because the auditor can quickly fix the process. That may undermine independence or objectivity and prevent a later assurance review.

A chief audit executive can help management understand a risk and may facilitate discussion, but management must select and implement the response. Auditors can agree on an action plan and later validate completion. If management accepts risk beyond its authority or tolerance, the concern should be escalated through the appropriate channel.

How to know if the challenge is preparation or experience

A candidate new to audit may need to learn the engagement lifecycle, evidence terminology, controls, and documentation. An experienced auditor may know those ideas but need to adjust to the IIA’s current blueprint and exam-style sequencing. Both candidates should practice unfamiliar scenarios and explain decisions in terms of objective, risk, evidence, and authority.

If you miss mainly definitions, build retrieval practice and a concise concept glossary. If you miss “best next step” questions, diagram the engagement phase and identify missing information. If you miss evidence questions, state what each source proves and what it does not. If you run out of time, use timed mixed sets and stop over-investing in one item.

A readiness check

You are approaching readiness when you can plan a focused engagement from a short request, choose procedures tied to material risks, evaluate evidence from multiple sources, and express a conclusion that matches the sample and criteria. You should also recognize when a limitation, skill gap, scope change, or management response requires supervisor involvement.

Use new cases rather than judging readiness from a repeated bank. Explain why alternatives fail: one is premature, one relies only on inquiry, one generalizes a nonrepresentative sample, and one assigns management responsibility to audit. When you can do this consistently at exam pace, your preparation addresses the exam’s main difficulty.

Do not mistake difficulty for a fixed pass rate

The IIA does not publish a universal pass percentage that predicts an individual’s result. Avoid claims such as “most people fail” or “a 70% practice score guarantees a pass” without an authoritative basis. Difficulty varies with professional background, current syllabus familiarity, study quality, and ability to reason under time pressure.

A sound assessment is personal and evidence-based: practice with unseen questions, review the types of mistakes, measure pacing, and retest weak skills. That method gives a better readiness signal than comparing yourself with an unsupported pass-rate claim.

A complete worked case

A city department asks audit to determine whether overtime is approved and paid accurately. The objective must be precise: test authorization and calculation for a defined period and employee group. The auditor reviews policy, understands the timekeeping and payroll handoffs, identifies risks such as supervisor self-approval or manual edits, and defines criteria before selecting procedures.

A preliminary extract contains time entries but not payroll adjustments. The auditor should validate the population across timekeeping and payroll before sampling. If an employee has overtime just under an approval threshold, that is an indicator for follow-up, not proof of manipulation. Inspect edit logs, approvals, schedules, and payment records; corroborate significant claims.

Suppose testing identifies several late approvals in one unit. The auditor examines whether the policy allows exceptions, whether payroll review detected them, and whether they cluster under one supervisor. The conclusion reports what criteria were not met and how detection controls affect residual risk. A recommendation can target the process cause; audit should not become the approver of overtime. This case illustrates why planning, evidence, and role are all needed for the best answer.

Compare the tempting alternatives

When two answers seem plausible, identify what each assumes. “Expand the sample” assumes the population and selection are valid. “Interview the manager” assumes explanation will resolve an evidence issue. “Report fraud” assumes intent has been established. “Change the control” assumes audit owns implementation. A better answer addresses the missing fact first and stays within audit’s role.

This comparison also helps experienced candidates. Familiarity can make one response feel routine, but exam questions often test the exception in the scenario. Read the limiting phrase: period not covered, record created by the person being reviewed, conflicting evidence, no approved criteria, or management accepting a material exposure.

A second practice habit is to state the conclusion with a boundary: “The tested approvals did not consistently meet the stated policy in this sample,” rather than “the department does not approve overtime.” The narrower wording may feel less forceful, but it reflects the evidence and signals what additional testing could establish.