Why is an old policy date not enough evidence that a control is operating well?

Question

AcadiFi · Accepted Answer

Frame this as a policy evidence and control design question. The CIA exam is usually asking for the professional sequence, not the loudest reaction to the situation. The sequence is: inspect the document, confirm process ownership, walk through current activity, test recent samples, and decide whether the policy is merely outdated or the control is ineffective. That keeps the answer tied to standards, risk, evidence, and communication instead of rumor, frustration, or habit.

At fictional Amber Ridge Health sends a procedure file last updated four years ago. The auditor compares it to current walkthroughs, system access, actual approvals, and management ownership before concluding anything about control design or operating effectiveness. The internal auditor should identify the objective first, then decide what evidence is relevant and sufficient. If the fact pattern involves audit management, the same discipline applies: clarify authority, competence, resources, and stakeholder expectations before choosing a response.

```mermaid
flowchart LR
  A[Document request] --> B[Policy date]
  B[Policy date] --> C[Walkthrough]
  C[Walkthrough] --> D[Testing]
  D[Testing] --> E[Conclusion]
```

The common trap is writing a finding solely because a date is old without proving risk or impact. A weaker answer either jumps to a conclusion without evidence or treats the issue as a personality problem. A stronger answer names the risk, ties it to criteria, gathers evidence, and communicates the result to the right level of management or the board.

For exam purposes, state that a stale policy is a risk indicator that must be connected to criteria, condition, cause, and effect. Then apply the facts: what is known, what is missing, what procedure is appropriate, and what communication or follow-up is needed. That pattern works across Part 1 governance questions, Part 2 engagement-performance questions, and Part 3 business or technology scenarios. Practice more in our CIA Part 2 question bank.

Why is an old policy date not enough evidence that a control is operating well?

Master Part 2 with our CIA Course

Related Questions

Practice Questions