Auditors Evaluate Budgets — Never Prepare Them

When Methods Conflict, NPV Wins

Profit Is Not Cash

The Cloud Never Outsources Accountability

Disaster Recovery Is Not Business Continuity

Least Privilege and Segregation of Duties Are Bedrock

The Scorecard Links Leading Indicators to Results

Match the Structure to the Business

Mission Is Purpose, Vision Is Destination, Strategy Is the Path

Detail to Management, Big Picture to the Board

Bombshells Don't Wait for the Final Report

The 5-Element Finding Anatomy

Attribute = Rates, Variable = Amounts

Statistical Projects — Judgmental Doesn't

Evidence's Three Tests: Sufficient, Reliable, Relevant

Never Write a Finding Without Criteria

Risk Drives the Work Program

Engagements Start With Objectives, Scope, Criteria

Coordinate, Don't Blindly Rely

Management Dictating the Plan = Scope Impairment

The Audit Plan Is Risk-Based and Board-Approved

Undetected Fraud Is Not a Breach of Due Care

Management Owns Fraud — The Auditor Assesses

The Fraud Triangle: All Three Corners Must Be Present

'Absolute Assurance' Is Always Wrong on the CIA Exam

Inherent Risk Is Before Controls, Residual Is After

Risk Appetite vs Risk Tolerance vs Risk Capacity

External Assessment Every 5 Years — Results to the Board

Due Care Is Not Catching Every Fraud

Proficiency Is Collective — Get Help

The CAE Owns Independence — You Own Objectivity

Independence Is Structural, Objectivity Is Mental

Mandatory vs Recommended Guidance — The Exam's Favorite Split