During facilitated workshops, people more openly say things to internal auditors than during private interviews.

Internal auditors do not need other sources of information, as the data gathered during facilitated workshops is sufficient.

Facilitated workshops create a synergy of discussion that can bring multiple perspectives to the same issue.

The testimonial evidence obtained during facilitated workshops is generally considered more reliable.

The scope and frequency of internal and external assessments as well as the qualifications and independence of the assessor.

The scope and cost of the QAIP. frequency of internal and external assessments, and conclusions of the assessor.

The scope, findings, risks, recommendations, and agreed-upon improvement actions.

The number and types of people involved in the assessment, costs, and duration of the QAIP

1 and 2.

1 and 3.

2 and 4.

3 and 4.

The financial interest the service provider may have in the organization.

The relationship the service provider may have had with the organization or the activities being reviewed.

Compensation or other incentives that may be applicable to the service provider.

The service provider ' s experience in the type of work being considered.

The organization ' s audit universe is extensive and diverse.

There has been an increase in unanticipated requests for advisory work.

Previous work provided by the external service provider has been of great quality and value.

A recent benchmarking study found that using external service providers is a common practice of similarly-sized IAAs in other organizations.

Degree of effort and cost needed to correct the reported condition.

Complexity of the corrective action.

Impact that may result should the corrective action fail.

Amount of resources required to conduct the follow-up activities.

Identify and manage risks in line with the organization ' s risk appetite.

Ensure that a proper and effective risk management process exists.

Attain an adequate understanding of the organization ' s key risk mitigation strategies.

Identify and ensure that appropriate controls exist to mitigate risks.

1 and 2

1 and 4

2 and 3

3 and 4

1 and 2

1 and 3 only

2 and 4

1, 3, and 4

The amount of experience the auditors have conducting audits in the specific area of the organization.

The availability of the auditors in relation to the availability of key client staff.

Whether the budgeted hours are sufficient to complete the audit within the current scope.

Whether outside resources will be needed, and their availability.

It minimizes the amount of time spent and cost incurred to gather the necessary information.

Responses can be confidential, thus encouraging participants to be candid expressing their concerns.

Workshops do not require extensive facilitation skills and are therefore ideal for nonauditors.

Workshop participants have an opportunity to learn while contributing ideas toward the objectives.

Require the approval of additions and changes to the vendor master listing, where the inherent risk of false vendors is high.

Monitor amounts paid each period and compare them to the budget to identify potential issues.

Compare employee addresses to vendor addresses to identify potential employee fraud.

Monitor customer quality complaints compared to the prior period to identify vendor issues.

Report follow-up activities to senior management.

Implement follow-up procedures to evaluate residual risk.

Determine the costs of implementing the recommendations.

Evaluate the extent of improvements.

Increase shareholder value.

Maximize market share.

Improve operational efficiency.

Mitigate losses.

Providing fire detection and suppression equipment

Establishing a physical security policy and promoting it throughout the organization

Performing business continuity and disaster recovery planning

Keeping an offsite backup of the organization ' s critical data