Due professional care is not about perfection; it's about providing reasonable assurance through prudent, competent judgment. The CIA exam traps candidates who mistake this for simply "trying hard" instead of applying a risk-based, objective standard throughout the entire engagement.
Due professional care, under the 2024 IIA Standards, is the requirement for internal auditors to apply the knowledge, skills, and experience of a reasonably prudent and competent professional. It involves aligning the engagement's scope and effort with its complexity and risk to provide reasonable, not absolute, assurance.
Key facts
- Governing Standard: IIA Global Internal Audit Standard 5.1: Due Professional Care (under Principle 5)
- Exam Section: CIA Part 1: Essentials of Internal Auditing
- Core Components: Proficiency, diligence, professional skepticism, and risk-based judgment
- Key Application: Aligning audit procedures with the significance and complexity of the engagement
- Common Trap: Equating due care with infallibility or exhaustive, inefficient testing
- Official Body: The Institute of Internal Auditors (IIA)
Historically, pass rates for the CIA exam have been challenging, hovering in the 40-45% range, which underscores the need to master foundational concepts like due care.
Why Is Due Professional Care So Heavily Tested on the CIA Exam?
Due professional care is the operational engine of a credible internal audit function. The IIA's 2024 Global Internal Audit Standards (GIAS) place it at the core of auditor conduct under Principle 5: Exercising Due Professional Care. This isn't just an ethical guideline; it's the testable framework for making professional judgments under real-world constraints.
Studying for CIA CIA1? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
CIA exam questions on this topic rarely ask for a textbook definition. Instead, they present a scenario and force you to choose the most prudent course of action. The examiner wants to know if you can balance competing priorities: the need for sufficient evidence, the constraints of the audit budget, and the complexity of the area under review.
The single biggest mistake candidates make is choosing an answer that represents either over-auditing or under-auditing. They pick the option that suggests testing every transaction (which is inefficient and ignores risk) or the one that accepts management's word without verification (which fails the skepticism test). Due care is the disciplined middle ground. It's about doing the right amount of work, based on a documented risk assessment, to achieve reasonable assurance. To master this, you need to think less like a student memorizing rules and more like an auditor managing an engagement.
What Are the Core Components of Due Professional Care Under the 2024 IIA Standards?
To correctly answer questions on due professional care, you must move beyond a general idea of "being careful." The 2024 GIAS framework breaks this concept into specific, testable components. The exam will test your understanding of how these pieces fit together in a practical audit scenario. Try VoraPrep's free CIA practice questions to see how these scenarios play out.
Here is how the exam's view of due professional care often differs from a candidate's initial assumption.
| The Common Myth (The Trap) | The Exam Reality (The Standard) |
|---|---|
| Due care means checking everything. | Due care means aligning audit scope with risk to provide reasonable assurance. |
| Having a certification means I'm competent. | Competence requires ongoing development and knowing when to engage specialists. |
| Professional skepticism means distrusting everyone. | Skepticism is a questioning mind that requires corroboration of evidence. |
| The goal is to find all fraud. | The goal is to consider fraud risk and be alert to its indicators. |
Proficiency and Competence (Principle 4)
Proficiency—having the necessary knowledge and skills—is foundational. Standard 4.1: Proficiency requires internal auditors to possess the right expertise for their responsibilities. But due professional care (Standard 5.1) is where this gets tested.You are not expected to be an expert in every business process. The exam will test your judgment on when to proceed and when to raise your hand. If you are auditing a highly specialized area like actuarial reserves or complex cybersecurity defenses, exercising due care means recognizing your limitations and recommending that the audit team engage a specialist. For more on this, see our guide on the use of external service providers in an audit.
Diligence and Professional Skepticism (Principle 5)
Diligence means performing work with care, thoroughness, and timeliness. This ties directly to the audit plan. An auditor exercising due care develops a plan based on risk, executes the planned procedures, and documents the work. Standard 5.2: Professional Skepticism is a critical component. It's an attitude that includes a questioning mind and a critical assessment of audit evidence. You cannot simply accept client-provided schedules or explanations without corroboration.The exam might present a scenario where an auditor is falling behind schedule. The tempting but incorrect answer might be to skip a planned test. The correct answer, reflecting due care, would involve re-evaluating the risk, communicating the delay, and making a reasoned, documented decision about the audit plan. This demonstrates judgment, not just task completion.
Reasonable Assurance
This concept is central to due professional care. Internal audit provides reasonable, not absolute, assurance because of inherent limitations. These include the use of judgment, testing on a sample basis, the potential for management override, and the possibility of collusion or concealed fraud.Due professional care is the standard that allows an auditor to conclude with reasonable assurance. You did enough work, based on risk, to support your conclusion, even if you didn't test 100% of the population.
How Do You Apply Due Professional Care in a Scenario Question?
Scenario-based questions are the examiner’s favorite way to test due professional care. Let's walk through one.
> 💡 Worked example: > Maria is a senior internal auditor at FinTech Solutions, a company that recently implemented a new automated expense reimbursement system powered by a third-party AI tool. The system processes approximately $2 million in employee expenses per month. It is designed to automatically approve any expense under $100 that meets pre-set policy criteria. Maria is tasked with auditing the new system's controls. Her audit budget allows for 80 hours of testing. > > Which of the following actions best demonstrates Maria's exercise of due professional care? > > A) Select a sample of 1,000 approved expenses under $100 and manually re-verify that each one complied with company policy. > B) Interview the system administrator to understand the AI's logic, obtain the system's configuration settings, and perform a walkthrough of a few transactions. > C) Conclude that the system is too complex to audit within the budget and recommend that management accept the risk. > D) Acknowledge her lack of expertise in AI algorithms, consult with the company's IT audit specialist to design appropriate tests of the AI's logic and exception handling, and focus her own testing on the manual controls for expenses over $100.
Step 1: Analyze the Core Risk
The key risk is not a single $50 error. The risk is systemic. A flawed AI logic could misapprove thousands of transactions, leading to significant financial loss. The materiality is high ($2M/month), and the technology is complex. The goal is reasonable assurance over the automated control.Step 2: Evaluate the Auditor's Competence
Maria is a senior internal auditor, but the prompt doesn't state she's an AI expert. A core part of due care (and Standard 4.1) is recognizing the limits of one's own proficiency. Auditing an AI's logic requires specialized skills.Step 3: Assess the Proposed Actions
Let's break down why the options succeed or fail the due care test.- Action A: This is the classic "inefficient over-auditing" trap. Manually checking a large sample of low-dollar transactions is labor-intensive and fails to address the core risk: the AI's logic. This is diligence without judgment.
- Action B: This is better but insufficient for providing reasonable assurance. A simple interview and walkthrough are superficial for a complex, automated system. It lacks the technical depth to validate the AI's function.
- Action C: This is the "giving up" trap. Abdicating responsibility without performing procedures is a failure of due care. An auditor's job is to provide assurance or, at a minimum, define the risk clearly.
- Action D: This is the correct answer. It perfectly demonstrates due professional care under the GIAS. Maria identifies her competency gap (AI expertise). She engages a specialist with the required skills. She also focuses her own efforts where she is competent (manual controls). This approach is risk-based, collaborative, and provides a path to reasonable assurance.
> ⚠️ Exam trap: > The most tempting wrong answer is A. It feels like "doing a lot of work," which candidates confuse with diligence. But due care requires effective diligence. The exam consistently rewards the auditor who thinks critically about risk and applies the right skills—even if that means admitting they need help—rather than the one who just works the hardest on the wrong thing.
Test Your CIA Exam Readiness
Evaluate your mastery of the new Global Internal Audit Standards and benchmark your baseline readiness.
Can You Spot the Due Professional Care Trap in These Practice Questions?
The best way to solidify your understanding is to apply it. The VoraPrep question bank has over 4,800 questions, with many targeting due professional care and its components.
Sample Question 1 During an audit of a complex derivatives portfolio, an internal auditor with a background in manufacturing audits must exercise due professional care. According to the IIA Standards, which action is most appropriate?A) Complete the engagement using existing knowledge and extensive research. B) Disclose the lack of expertise in the final audit report and proceed with the engagement. C) Obtain competent advice from a qualified expert in derivatives to assist in the engagement. D) Recommend postponing the engagement until the auditor can attend training.
Explanation: The correct answer is C. Standard 4.1: Proficiency and Standard 5.1: Due Professional Care require auditors to have the necessary skills. When they do not, they must obtain competent assistance. Option A is risky. Option B is a failure of due care; disclosure after the fact doesn't fix the lack of competence. Option D doesn't address the immediate audit need. Sample Question 2 In exercising due professional care during an assurance engagement, internal auditors must consider which of the following?I. The extent of work needed to achieve the engagement’s objectives. II. The relative complexity and materiality of matters to which assurance procedures are applied. III. The adequacy and effectiveness of governance, risk management, and control processes. IV. The probability of significant errors, fraud, or noncompliance.
A) I, II, III, and IV B) I and II only C) I, II, and IV only D) III and IV only
Explanation: The correct answer is A. Due professional care requires considering all these factors. The auditor must align the extent of work (I) with the complexity and materiality (II) of the subject. This is done in the context of the existing control environment (III) and the likelihood of significant issues (IV), which directly relates to how the IIA defines risk appetite and tolerance. Sample Question 3 During an engagement, an internal auditor is assessing fraud risks. Due professional care requires the auditor to:A) Have sufficient knowledge to evaluate the risk of fraud and how it is managed. B) Possess the expertise of a person whose primary responsibility is detecting and investigating fraud. C) Guarantee that all material fraud will be detected by the audit procedures. D) Automatically assume that management's representations regarding fraud risk are unreliable.
Explanation: The correct answer is A. An internal auditor is not expected to be a fraud expert (B), but they must be knowledgeable enough to evaluate fraud risk. Due care provides reasonable, not absolute, assurance, so auditors cannot guarantee fraud detection (C). Finally, professional skepticism (D) requires a questioning mind, not automatic distrust.What's the Smartest Way to Study Due Professional Care?
Mastering due professional care is about developing a mindset, not just memorizing a standard.
Connect the Concepts: This topic is the thread connecting the entire audit process. When you study internal controls, think about how much testing constitutes "due care." When you study the four principles of the IIA Code of Ethics, recognize that "Competency" is the foundation of due care. Focus on Application: Spend less time re-reading the definition and more time working through scenario questions in the VoraPrep adaptive question bank. For every question, ask yourself:- What is the primary risk?
- What is the most prudent and efficient way to achieve reasonable assurance?
- Does the proposed action require specialized skills?