>CIA园地 >CIA考试指南

2006CIA考试大纲

来源:金燕华教授 时间:2006-10-08

注:大纲中红字标注的是2006年相对于2005年变动的部分;蓝字标注的是2005相对于2004变动的部分。

Part I - The Internal Audit Activity's Role in Governance, Risk, and Control

第一部分:内部审计在治理、风险和控制中的作用

ACOMPLY WITH THE IIA'S ATTRIBUTE STANDARDS (15 - 25 percent) Proficiency Level

遵守国际内部审计师协会的属性标准(15-25%)(要求熟练掌握)

1Define purpose, authority, and responsibility of the internal audit activity.

明确内部审计的宗旨、权限和职责

a.Determine if purpose, authority, and responsibility of internal audit activity are clearly documented/approved.

确定内部审计的宗旨、权限和职责是否清楚地以书面形式记录/获得批准

b.Determine if purpose, authority, and responsibility of internal audit activity are communicated to engagement clients.

确定内部审计的宗旨、权限和职责是否通报审计业务客户

c.Demonstrate an understanding of the purpose, authority, and responsibility of the internal audit activity.

阐明内部审计的宗旨、权限和职责

2Maintain independence and objectivity.

保持独立性和客观性

a.Foster independence

加强独立性

1)Understand organizational independence
理解机构的独立性

2)Recognize the importance of organizational independence
认识机构独立性的重要性

3)Determine if the internal audit activity is properly aligned to achieve organizational independence.

确定内部审计部门是否正确设置以获得其独立性

b.Foster objectivity

加强客观性

1)Establish policies to promote objectivity
制定政策以增进客观性

2)Assess individual objectivity
评估个人的客观性

3) Maintain individual objectivity
保持个人的客观性

4)Recognize and mitigate impairments to independence and objectivity
识别和减轻对独立性和客观性的损害

3Determine if the required knowledge, skills, and competencies are available.

确定是否具备必要的知识、技能和胜任能力

a.Understand the knowledge, skills, and competencies that an internal auditor needs to possess.

理解内部审计师需要具备的知识、技能和胜任能力

b.Identify the knowledge, skills, and competencies required to fulfill the responsibilities of the internal audit activity

确定内部审计部门履行内部审计职责所必要的知识、技能和胜任能力

4Develop and/or procure necessary knowledge, skills and competencies collectively required by internal audit activity.

开发和/或取得内部审计部门整体所需要的知识、技能和胜任能力

5Exercise due professional care.

运用应有的职业审慎

6Promote continuing professional development.

促进持续专业发展

a.Develop and implement a plan for continuing professional development for internal audit staff.

为内部审计人员制定并实施持续专业发展计划

b.Enhance individual competency through continuing professional development

通过持续专业发展提高个人能力

7Promote quality assurance and improvement of the internal audit activity.

促进内部审计的质量保证与改进

a.Establish and maintain a quality assurance and improvement program.

建立和保持质量保证与改进项目

b.Monitor the effectiveness of the quality assurance and improvement program.监督质量保证与改进项目的效果

c. Report the results of the quality assurance and improvement program to the board or other governing body.

将质量保证与改进项目的结果报告董事会或其他治理机构

d.Conduct quality assurance procedures and recommend improvements to the performance of the internal audit activity.

实施质量保证程序并建议改善内部审计业绩

8.Abide by and promote compliance with the IIA Code of Ethics

遵守和促进对IIA《道德规范》的遵守

BEstablish a Risk-based Plan to Determine the Priorities of the Internal Audit Activity (15 - 25 percent) Proficiency Level

以风险为基础制定计划确定内部审计重点(15-25%)(要求熟练掌握)

1Establish a framework for assessing risk.

建立评估风险的框架

2Use the framework to:

应用该框架:

a.Identify sources of potential engagements (e.g., audit universe, management request, regulatory mandate)

确认潜在审计业务的来源(如,进行审计域,管理层的要求,法规要求)

b.Assess organization-wide risk

评估组织范围内的风险

c.Solicit potential engagement topics from various sources

从不同来源寻求潜在审计业务

d.Collect and analyze data on proposed engagements

收集和分析拟审计业务的资料

e.Rank and validate risk priorities

对风险高低进行排序和确认

3Identify internal audit resource requirements

确认内部审计资源需求

4Coordinate the internal audit activity's efforts with:

与以下方面协调内部审计工作:

a.External auditor

外部审计师

b.Regulatory oversight bodies

法规监督机构

c.Other internal assurance functions (e.g., health and safety department)

其他内部保证部门(如,卫生健康和安全部门)

5Select engagements.

选择审计业务

a.Participate in the engagement selection process

参与审计业务选择过程

b.Select engagements.

选择审计业务

c.Communicate and obtain approval of the engagement plan from board

与董事会沟通以获得其对审计业务计划的批准

6Identify scope of engagements.

确定审计业务范围

CUnderstand the Internal Audit Activity's Role in Organizational Governance (10 - 20 percent) Proficiency Level

理解内部审计在公司治理中的作用(要求熟练掌握)

1Obtain board's approval of audit charter

获得董事会对审计章程的批准

2Communicate plan of engagements

沟通审计业务计划

3Report significant audit issues

报告重大审计事项

4Communicate key performance indicators to board on a regular basis

定期向董事会报告主要的审计工作业绩指标

5Discuss areas of significant risk

讨论重大风险领域

6Support board in enterprise-wide risk assessment

支持董事会开展全公司的风险评估

7Review positioning of the internal audit function within the risk management framework within the organization.

检查内部审计机构在组织内风险管理框架中的定位

8Monitor compliance with the corporate code of conduct/business practices

监督遵守公司行为规范和商业惯例情况

9Report on the effectiveness of the control framework

报告控制框架的效果

10Assist board in assessing the independence of the external auditor

协助董事会评估外部审计师的独立性

11Assess ethical climate of the board

评估董事会的道德环境

12Assess ethical climate of the organization

评估组织的道德环境

13Assess compliance with policies in specific areas (e.g., derivatives)

评估在特定领域遵守政策的情况(如,衍生产品)

14Assess organization's reporting mechanism to the board

评估组织向董事会报告的机制

15Conduct follow-up and report on management response to regulatory body reviews

跟踪并报告管理层对法规监督机构检查结果的落实情况

16Conduct follow-up and report on mangement response to external audit

跟踪并报告管理层对外部审计结果的落实情况

17Assess the adequacy of the performance measurement system, achievement of corporate objective

评估业绩测评系统的充分性和整体目标的实现情况

18Support a culture of fraud awareness and encourage the reporting of improprieties

树立舞弊防范意识,鼓励报告不正当的行为

DPerform Other Internal Audit Roles and Responsibilities (0 - 10 percent) Proficiency Level

执行其他内部审计任务和职责(0-10%)(要求熟练掌握)

1Ethics/compliance

道德规范/合规情况

a.Investigate and recommend resolution for ethics/compliance complaints

对道德规范/合规情况的投诉进行调查并提出解决办法

b.Determine disposition of ethics violations

确定违反道德规范的处理

c.Foster healthy ethical climate

培养健康的道德氛围

d.Maintain and administer business conduct policy (e.g., conflict of interest)

维护和管理业务行为政策(如,利益冲突)

e.Report on compliance

报告合规情况

2Risk management

风险管理

a.Develop and implement an organization-wide risk and control framework

建立和实施一个全组织的风险和控制框架

b.Coordinate enterprise-wide risk assessment

协调全公司的风险评估

c.Report corporate risk assessment to broad

向董事会报告公司的风险评估

d.Review business continuity planning process

检查经营持续性计划过程

3Privacy

保密

a.Determine privacy vulnerabilities

确定保密的薄弱环节

b.Report on compliance

报告合规情况

4Information or physical security

信息或物理安全

a.Determine security vulnerabilities

确定安全的薄弱环节

b.Determine disposition of security violations
确定对违反安全行为的处理

c.Report on compliance

报告合规情况

EGovernance, Risk, and Control Knowledge Elements (15 - 25 percent)

治理,风险,和控制知识要点(15-25%

1Corporate governance principles Awarenss Level

公司治理的原则(要求了解)

2Alternative control frameworkseAwarenss Level

可选择的控制框架(要求了解)

3Risk vocabulary and conceptsProficiency Level

风险的词汇和概念(要求熟练掌握)

4Risk management techniquesProficiency Level

风险管理技术(要求熟练掌握)

5Risk/control implications of different organizational structuresProficiency Level

不同组织结构中的风险/控制内容(要求熟练掌握)

6Risk/control implications of different leadership stylesAwareness Level

不同领导风格下的风险/控制内容

7Change managementAwareness Level

变革管理

8Conflict managementAwareness Level

冲突管理

9Management control techniquesProficiency Level

管理控制技术

10Types of control (preventive, detective, input, output) Proficiency Level

控制类型(预防型、检查型、输入、输出)

FPlan Engagements (15 - 25 percent) Proficiency Level

策划审计业务(15-25%

1Initiate preliminary communication with engagement client

开展与审计业务客户的初步沟通

2Conduct a preliminary survey of the area of engagement

对审计业务范围实施初步调查

a.Obtain input from engagement client

从审计业务客户处获得信息

b.Perform analytical reviews

进行分析性复核

c.Perform benchmarking

进行基准比较

d.Conduct interviews

实施面谈

e.Review prior audit reports and other relevant documentation

查阅以前的审计报告和其他相关资料

f.Map processes

绘制流程图

g.Develop Checklists

编制检查清单

3Complete a detailed risk assessment of the area (prioritize or evaluate risk/control factors)

完成相关领域的详细风险评估(对风险/控制因素进行排序或评估)

4Coordinate audit engagement efforts with

与以下方面协调审计业务工作:

a.External auditor

外部审计师

b.Regulatory oversight bodies

法规监督机构

5Establish/refine engagement objectives and finalize the scope of engagement.

建立/完善审计业务的目标,确定审计业务的范围

6Identify or develop criteria for assurance engagements (criteria against which to audit)

确认或开发保证业务的标准(审计所依照的标准)

7Consider the potential for fraud when planning an engagement

在策划审计业务时考虑舞弊的潜在可能

a.Be knowledgeable of the risk factors and red flags of fraud

理解舞弊的风险因素和危险信号

b.Identify common types of fraud associated with the engagement area.

确认与审计业务范围相关的一般舞弊类型

c.Determine if risk of fraud requires special consideration when conducting an engagement

在实施审计业务时确定是否需要对舞弊的风险进行特殊考虑

8Determine engagement procedures.

确定审计业务步骤

9Determine the level of staff and resources needed for the engagement

确定审计业务所需的人员水平和资源

10Establish adequate planning and supervision of the engagement.

建立对审计业务充分的计划和监督

11Prepare engagement work program.

编制审计业务工作方案

Part II - Conducting the Internal Audit Engagement

第二部分实施内部审计业务

A. Conduct Engagements (25 - 35 percent) (Proficiency Level)

实施审计业务 (25 – 35%) (要求熟练掌握)

1. Research and apply appropriate standards: 

研究和采用适当的标准: 

a. IIA Professional Practices Framework (e.g., Code of Ethics, Standards, Practice Advisories)

IIA 职业实务框架(如,《道德规范》、《标准》、《实务公告》);

b. Other professional., legal, and regulatory standards

其他职业的、法律的和法规的标准;

 2. Maintain awareness of potential for fraud when conducting an engagement

在实施审计业务时,要保持防范潜在舞弊的意识:

a. Notice indicators or symptoms of fraud

注意舞弊的迹象和征兆;

b. Design appropriate engagement steps to address significant risk of fraud

设计适当的审计业务步骤以应对重大的舞弊风险;

c. Employ audit tests to detect fraud

采用审计测试以发现舞弊;

d. Determine if any suspected fraud merits investigation

确定是否应对任何可疑的舞弊进行调查

3. Collect data.

收集数据。

4. Evaluate the relevance, sufficiency, and competence of evidence.

评估证据的相关性、充分性和适当性。

5. Analyze and interpret data.

分析和解释数据。

6. Develop workpapers.

编制工作底稿。

7. Review workpapers.

复核工作底稿。

8. Communicate interim progress.

沟通中期进展情况。

9. Draw conclusions.

得出结论。

10. Develop recommendations when appropriate.

在适当的时候编制建议书。

11. Report engagement results

报告审计业务结果:

a. Conduct exit conference

召开退出会议;

b. Prepare report or other communication

编制审计报告或其他沟通文件;

c. Approve engagement report

批准审计业务报告;

d. Determine distribution of report

确定审计报告的分发;

e. Obtain management response to report

取得管理层对报告的反馈意见;

12. Conduct client satisfaction survey.

实施顾客满意度调查。

13. Complete performance appraisals of engagement staff.

完成审计业务人员的业绩评价。

B.Conduct Specific Engagements (25 - 35 percent) (Proficiency Level)

实施具体审计业务 (25 - 35 %)(要求熟练掌握)

1. Conduct assurance engagements.

实施保证业务:

a. Fraud investigation.

舞弊调查。

1)Determine appropriate parties to be involved with investiagion

确定调查的适当对象;

2)Establish facts and extent of fraud (e.g., interviews, interrogations, and data analysis)

证实舞弊事实和程度(如,面谈、讯问和数据分析);

3)Report outcomes to apprpriate parties

向适当方面报告结果;

4)Complete a process review to improve controls to prevent fraud and recommend changes

对过程进行检查以改善预防舞弊的控制,并提出改进建议。

b. Risk and control self-assessment

风险和控制自我评价。

1)Facilitated approach

促进方法

(a)Client-facilitated

审计业务客户自我促进

(b) Audit-facilitated

审计促进

2)Questionnaire approach

调查问卷方法

3)Self-certification approach

自我认证方法

c. Audits of third parties.

第三方的审计。

d. Quality audit engagements.

质量审计业务。

e. Due diligence audit engagements.

尽职调查审计业务。

f.Security audit engagements.

安全审计业务。

g. Privacy audit engagements.

保密审计业务。

h. Performance (key performance indicators) audit engagements

绩效(主要绩效指标)审计业务

i. Operational (efficiency and effectiveness) audit engagements

经营(效率和效果)审计业务

j. Financial audit engagements.

财务审计业务。

k. Compliance audit engagements

合规性审计业务

l. Information technology (IT) audit engagements.

信息技术 (IT) 审计业务。

1)Operating systems

操作系统

(a)Mainframe

大型机

(b) Workstations

工作站

(c) Server

服务器

2)Application development

应用软件开发

(a)Application authentication

应用软件认证

(b) Systems development methodology

系统开发方法学

(c) Change control

变动控制

(d) End user computing

终端用户计算

3)Data and network communications

数据和网络通讯

4)Voice communications

语音通讯

5)System security (e.g., firewalls, access control)

系统安全(如,防火墙、访问控制)

6)Contingency planning

应急计划

7)Databases

数据库

8)Data center operations

数据中心运行

9)Web infrastructure

Web基础设施

10) Software licensing

软件许可

11) Electronic funds transfer (EFT) and Electronic data interchange (EDI)

电子资金转帐

12) e-Commerce

电子商务

13) Information protection (e.g., viruses, privacy)

信息防护(如:病毒、保密)

14) Encryption

加密

15) Enterprise-wide resource planning (ERP) software (e.g., SAP R/3)

企业资源计划软件(如:SAP R/3

2. Conduct consulting engagements

实施咨询业务。

a. Internal control training

内部控制培训

b. Business process review

业务流程检查

c. Benchmarking

基准比较法

d. Information technology (IT) and systems development

信息技术 (IT) 与系统开发

e. Design of performance measurement systems

业绩测评系统的设计

C. Monitor Engagement Outcomes (5 - 15 percent)Proficiency Level

监督审计业务结果 (5 – 15%)(要求熟练掌握)

1. Determine appropriate follow-up activity by the internal audit activity

根据内部审计结果确定适当的跟踪活动。

2. Identify appropriate method to monitor engagement outcomes

确认监督审计业务结果的适当方法。

3. Conduct follow-up activity

实施跟踪活动。

4. Communicate monitoring plan and results

沟通监督计划和结果。

D. Fraud Knowledge Elements (5 - 15 percent)

舞弊知识要点(5 – 15%)

1. Discovery sampling(Awareness Level)

发现抽样。(要求了解)

2. Interrogation techniques(Awareness Level)

讯问技术。(要求了解)

3. Forensic auditing(Awareness Level)

司法鉴定审计。(要求了解)

4. Legal hazards(Awareness Level)

法律漏洞。(要求了解)

5. Use of computers in analyzing data (Proficiency Level)

利用计算机分析数据。(要求熟练掌握)

6. Red flags (Proficiency Level)

红旗标志。(要求熟练掌握)

7. Types of fraud (Proficiency Level)

舞弊类型。(要求熟练掌握)

E.Engagement Tools (15 - 25 percent)

审计业务手段 (15 - 25 %)

1. Sampling(Awareness Level)

抽样。(要求了解)

a. Nonstatistical (judgmental)

非统计 (判断)

b. Statistical

统计

2. Statistical analyses (process control techniques) (Awareness Level)

统计分析 (过程控制技术)(要求了解)

3. Data gathering tools (Proficiency Level)

数据收集手段。(要求熟练掌握)

a. Interviewing

面谈

b. Questionnaires

调查问卷

c. Checklists

检查清单

4. Analytical review techniques (Proficiency Level)

分析性复核技术。(要求熟练掌握)

a. Ratio estimation

比率估计

b. Variance analysis (e.g., budget vs. actual)

变量分析 (如,预算与实际相比较)

c. Other reasonableness tests

其他合理性测试

5. Observation (Proficiency Level)

观察。(要求熟练掌握)

6. Problem solving. (Proficiency Level)

解决问题。(要求熟练掌握)

7. Risk and control self-assessment (CSA) (Awareness Level)

风险和控制的自我评价 (CSA)(要求了解)

8. Computerized audit tools and techniques (Proficiency Level)

计算机审计工具和技术。(要求熟练掌握)

a. Embedded audit modules

嵌入式审计模块

b. Data extraction techniques

数据提取技术

c. Generalized audit software (e.g., ACL, IDEA)

通用审计软件 (例如,ACL, IDEA)

d. Spreadsheet analysis

电子表格分析

e. Automated workpapers (e.g., Lotus Notes, Auditor Assistant)

自动化工作底稿 (例如,Lotus NotesAuditor Assistant)

9. Process mapping including flowcharting (Proficiency Level)

过程描述,包括流程图。(要求熟练掌握)

Part Business Analysis and Information Technology

第三部分:经营分析和信息技术

A. Business Processes(15 –25 percent)

经营过程(1525%)

1. Quality management (e.g., TQM)Awareness Level

质量管理(例如,全面质量管理)(要求了解)

2. The International Organization for Standardization (ISO) framework Awareness Level

国际标准化组织框架(要求了解)

3. ForecastingAwareness Level

预测(要求了解)

4. Project management techniquesProficiency Level

项目管理技术(要求熟练掌握)

5. Business process analysis (e.g., workflow analysis and bottleneck management, theory of constraints) Proficiency Level

经营过程分析 (例如, 工作流程分析和瓶颈管理, 约束理论) (要求熟练掌握)

6. Inventory management techniques and conceptsProficiency Level

存货管理技术与概念(要求熟练掌握)

7. Marketing-pricing objectives and policiesAwareness Level

营销-定价目标与政策(要求了解)

8. Marketing-supply chain managementAwareness Level

营销-供应链管理(要求了解)

9. Human ResourcesProficiency Level

人力资源(要求熟练掌握)

a. Individual performance management and measurement

个人业绩管理与测评

b. Supervision

监督

c. Environmental factors that affect performance

影响业绩的环境因素

d. Facilitation techniques

促进方法

e. Personnel sourcing/staffing

人员来源/配备

f.Training and development

培训与发展

g. Safety

安全

10. Balanced ScorecardAwareness Level

平衡记分卡(要求了解)

B.Financial Accounting and Finance (15 - 25 percent)

财务会计与财务管理(15-25%

1. Basic concepts and underlying principles of financial accounting (statements, terminology, relationships) Proficiency Level

财务会计的基本概念与基本原则(报表、术语、关系)(要求熟练掌握)

2. Intermediate concepts of financial accounting (e.g., bonds, leases, pensions, intangible assets, R&D) Awareness Level

中级财务会计概念(例如:债券、租赁、退休金、无形资产、研发支出)(要求了解)

3. Advanced concepts of financial accounting (e.g., consolidation, partnerships, foreign currency transactions) Awareness Level

高级财务会计概念(例如:合并、合伙、外币业务)(要求了解)

4. Financial statement analysisProficiency Level

财务报表分析(要求熟练掌握)

5. Cost of capital evaluationAwareness Level

资本成本评估(要求了解)

6. Types of debt and equityAwareness Level

债务和权益的种类(要求了解)

7. Financial instruments (e.g., derivatives) Awareness Level

金融工具(如:衍生工具)(要求了解)

8. Cash management (treasury functions) Awareness Level

现金管理(出纳职能)(要求了解)

9. Valuation modelsAwareness Level

估价模型(要求了解)

10. Business development life cyclesAwareness Level

企业发展生命周期(要求了解)

C. Managerial Accounting (10 - 20 percent)

管理会计 (10-20%   

1. Cost concepts (e.g., absorption, variable, fixed) Proficiency Level

成本的概念(例如:全部成本、变动成本、固定成本)(要求熟练掌握)

2. Capital budgetingAwareness Level

资本预算(要求了解)

3. Operating budgetProficiency Level

经营预算(要求熟练掌握)

4. Transfer pricingAwareness Level

转移定价(要求了解)

5. Cost-volume-profit analysisAwareness Level

--利分析(要求了解)

6. Relevant costAwareness Level

相关成本(要求了解)

7. Costing systems (e.g., activity-based, fixed) Awareness Level

成本系统(如:作业成本系统、固定成本系统)(要求了解)

8. Responsibility accountingAwareness Level

责任会计(要求了解)

D. Regulatory, Legal, and Economics (5 -15 percent) Awareness Level

规章,法律和经济(5-15%)(要求了解)

1. Impact of government legislation and regulation on business

政府法规对经营的影响

2. Trade legislation and regulations

贸易法规

3. Taxation schemes

税务体制

4. Contracts

合同

5. Nature and rules of legal evidence

法律证据的本质和规则

6. Key economic indicators

主要的经济指标

E.Information Technology (IT) (30 - 40 percent) Awareness Level
信息技术(要求了解)
1. Control frameworks (e.g., SAC, COBIT)
控制框架(例,SACCOBIT

2. Data and network communications/connections (e.g.,LAN, VAN, and WAN)

数据和网络通讯/连接(局域网,虚拟专用网和广域网

3. Electronic funds transfer (EFT)

电子资金转账

4. e-Commerce

电子商务

5. Electronic data interchange (EDI)

电子数据交换

6. Functional areas of IT operations(e.g., data center operations)

信息技术的功能分类(如:数据中心运行)

7. Encryption

加密

8. Information protection (e.g. viruses, privacy)

信息防护(如:病毒、保密)

9. Evaluate investment in IT (cost of ownership)

信息技术投资评估(拥有成本)

10. Enterprise-wide resource planning (ERP) software (e.g., SAP R/3, Peoplesoft)

企业资源计划(例,SAP R/3Peoplesoft

11. Operating systems

操作系统

12. Application development

应用软件开发

13. Voice communications

语音通讯

14. Contingency planning

应急计划

15. Systems security (e.g. firewalls, access control)

系统安全(如:防火墙、访问控制)

16. Databases

数据库

17. Software licensing

软件许可

18. Web infrastructure

网络基础设施