The risk committee is best suited to help the board identify and assess the effects of increased regulations on current industry lending practices. The risk committee focuses on overseeing the organization ' s risk management policies and procedures, ensuring that all risks, including regulatory risks, are identified, assessed, and managed appropriately. This committee is responsible for understanding the implications of regulatory changes and advising the board on how these changes may impact the organization ' s operations and strategic objectives.

The IIA’s Practice Guide on Risk Management.

COSO’s Enterprise Risk Management Framework.

The responsibility of the chief audit executive (CAE) to maintain organizational independence is fulfilled by developing and submitting an annual budget and resource plan to the board for approval. By doing so, the CAE ensures that the internal audit activity has the necessary resources to operate effectively without undue influence from management. This process upholds the independence and objectivity of the internal audit function, as it allows the board to oversee and approve the resources needed for the audit activity, thus preventing potential conflicts of interest and ensuring the audit function remains free from managerial interference.

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) - Standard 1110: Organizational Independence.

The IIA’s Practice Guide on Maintaining Internal Audit Independence.

The information required for an engagement depends on whether internal audit is providing assurance or advisory services because the objectives, stakeholders, evidence needs, and expected outputs differ. Assurance services involve an objective assessment intended to provide confidence or conclusions about governance, risk management, or controls. Advisory services provide advice, insight, facilitation, or similar assistance based on an agreed purpose and scope, without assuming management responsibility. Advisory work is not limited to areas outside assurance coverage, nor is it confined to project-planning stages. It may be performed before, during, or after significant initiatives when appropriate. Because the engagement purpose determines what information must be gathered and analyzed, the statement that information requirements depend on whether the engagement is assurance or advisory is the accurate choice.

Ensuring that suppliers comply with environmental regulations is consistent with corporate social responsibility because CSR extends beyond an organization’s direct operations to its environmental, social, ethical, and supply-chain impacts. Organizations increasingly evaluate whether third parties comply with environmental expectations, labor practices, sustainability requirements, and contractual standards because supplier conduct can create reputational, regulatory, and operational exposure. Providing free products or services to a political party relates to political activity and may itself create ethical or compliance concerns. Lobbying for regulations that benefit the organization’s industry primarily serves commercial interests rather than demonstrating social responsibility. Employee bonuses for cost-reduction ideas represent an internal compensation or efficiency initiative. Therefore, supplier environmental compliance is the option most clearly connected to responsible environmental and third-party governance practices within a CSR program.

Conformance with the Standards during an external assessment of the internal audit activity can be demonstrated through various means. One critical aspect is the review process of audit workpapers. According to the IIA Standards, particularly Standard 2340 - Engagement Supervision, audit work should be reviewed by an engagement supervisor to ensure objectives are achieved, quality is maintained, and staff are developed. The review and sign-off of all audit workpapers before the issuance of the audit report (Option C) align directly with these standards, ensuring that work meets the required quality and thoroughness.

IIA Standards, Standard 2340: Engagement Supervision

IIA Quality Assurance and Improvement Program (QAIP) guidelines

By adding more money to the IT training budget to ensure that internal auditors can perform data analytics, the chief audit executive is addressing the core competency of continuing professional development. Ensuring that auditors have the necessary skills and knowledge to perform advanced audit techniques, such as data analytics, is a critical aspect of their ongoing professional development. This investment helps auditors stay current with emerging technologies and methodologies, enhancing their overall effectiveness and the value they provide to the organization.

The IIA Standards: Standard 1230 – Continuing Professional Development: " Internal auditors must enhance their knowledge, skills, and other competencies through continuing professional development. "

IIA Practice Guide: " Developing an Internal Audit Training Program " : Discusses the importance of ongoing training and development to maintain auditor proficiency and effectiveness.

While the internal audit may be involved in assessing the adequacy of the organization ' s efforts in corporate social responsibility (CSR), the primary responsibility for ongoing monitoring of CSR activities, such as reducing carbon footprint, typically rests with operational management. In this context, the Facility Operation Manager would be the most appropriate choice, as they are directly involved in managing the day-to-day operations that affect the organization’s environmental impact.

General industry practices on CSR responsibilities

The internal audit charter is a formal document that outlines the purpose, authority, and responsibility of the internal audit activity. It includes the functional and administrative reporting lines for the chief audit executive, which helps define the independence and objectivity of the internal audit function. This charter is crucial as it also establishes the framework within which the internal audit team operates, ensuring alignment with organizational goals and governance frameworks.

The Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

A true statement regarding controls such as ethical values, tone at the top, and operational style is that breakdowns in these types of controls have historically led to fraudulent financial reporting. These are elements of what is often referred to as " soft controls " and play a critical role in shaping the corporate culture that governs employee behavior. When these controls are weak or improperly managed, they can contribute to an environment conducive to fraud.

Studies and reports on corporate governance and internal controls, including research on fraud cases.

A risk assessment process is a crucial precondition for developing an effective system of internal controls. It helps identify and analyze risks relevant to achieving the organization’s objectives, thereby informing the design and implementation of appropriate controls to mitigate those risks. This foundational step ensures that the internal controls are aligned with the specific risk landscape of the organization.

COSO Framework on Internal Control, Principle Related to Risk Assessment

Separating card issuance from PIN issuance is a critical preventive control because combining those responsibilities could allow one person to obtain both components necessary to access a customer’s account. Without segregation of duties, an employee may be able to create, intercept, or misuse ATM credentials without independent involvement or detection, significantly increasing fraud opportunity. Overlap between marketing and customer service does not directly affect ATM transaction authorization. Inadequate training may create operational errors, but it is less directly associated with deliberate unauthorized access. Scheduled maintenance downtime primarily represents an availability or operational risk rather than a fraud exposure. Segregation of duties is designed to prevent one individual from controlling incompatible stages of a transaction or access process. Therefore, option D presents the greatest fraud exposure for ATM activities.

According to IIA guidance, an internal audit charter would likely include a statement that internal auditors will demonstrate competence, concern, and the dedication expected of a professional. This aligns with the IIA ' s Code of Ethics and Standards, which emphasize the professional demeanor and commitment required from internal auditors.

The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing and Code of Ethics.

System validations and edit checks on vendor identification numbers are primary controls that effectively reduce the risk of setting up duplicate vendors in the system. These controls ensure that each vendor ' s information is unique and verified against existing records before a new vendor is entered into the system, thereby preventing duplication.

Institute of Internal Auditors (IIA) - Risk Control Matrices and Internal Control Frameworks

The most appropriate idea to include in the CSR policy is that management is responsible for ensuring that the organization’s CSR principles are communicated, understood, and integrated into decision-making processes. This aligns with good corporate governance practices which hold management accountable for embedding CSR into the corporate culture and daily operations of the organization, thus ensuring its effective implementation across all levels.

Corporate governance and CSR integration best practices as documented in business management literature.

The chief audit executive (CAE) would be required to decline a consulting engagement if there is no available expertise on the internal audit team to perform it. According to IIA standards, internal auditors must possess the knowledge, skills, and other competencies needed to perform their responsibilities. Accepting an assignment without the requisite expertise could impair the effectiveness and credibility of the audit function.

IIA Standards for the Professional Practice of Internal Auditing

In this situation, the appropriate action for the internal auditor is to remain independent and avoid roles that could impair this independence, such as making managerial decisions. By advising and then directing the management to submit the proposal to senior management and the board, the auditor maintains an advisory role without crossing into decision-making territory, thus preserving the independence necessary for an assurance role.

Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

According to IIA guidance, internal auditors are encouraged to obtain appropriate professional designations. This encouragement is part of a broader recommendation to pursue continuous professional development and maintain proficiency in audit practices. The statement correctly reflects the IIA ' s position on the importance of professional qualifications, though it does not imply that specific designations are mandatory.

IIA standards and guidelines, which promote ongoing professional education and encourage auditors to obtain certifications relevant to their field of work.

Signed inventory count sheets provide the most relevant historical evidence for determining when the missing spare parts were last physically confirmed. Establishing the last verified date can narrow the investigation period and help the auditor identify transactions, personnel, access records, or other events requiring further investigation. Quality certificates address product conformity rather than disappearance of inventory. The procurement contract may establish quantity and value originally ordered, but it does not establish when the items were last physically present. Testimony from the procurement specialist relates primarily to acquisition and tendering rather than custody after receipt. Research competence requires locating and evaluating documentary evidence directly relevant to the investigative question. Therefore, previous signed physical inventory records provide the strongest starting point for tracing when the discrepancy arose.

The proper sequence is to first evaluate the adequacy of the controls to ensure they are appropriately designed to mitigate risks. After confirming their design, the next step is to test the controls to verify they are operating effectively in practice. References:

IIA Standard 2120: Risk Management.

COSO Internal Control-Integrated Framework.