The risk assessment process in planning begins with identifying inherent risks (risks without considering controls). The next logical step is to identify and map existing controls to those inherent risks to determine whether they mitigate them effectively. Only after this step can residual risk be assessed. Detecting actual fraud (Option B) is not part of planning. Risk appetite (C) is a management responsibility, not audit’s. Option D occurs later after evaluating controls.

Valid closure of an audit observation requires evidence that the corrected process will function as expected in the future. This involves not just addressing the immediate condition but also ensuring that the root cause has been addressed and that the implemented corrective actions are sustainable and effective in preventing recurrence. This ensures that the underlying issue has been resolved comprehensively. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2500 - Monitoring Progress.

The IIA’s Practice Guide on Audit Follow-up.

When a key control is identified during fieldwork that was not recognized during the planning phase, it is critical to update the audit work program to include tests for this newly identified control. However, this adjustment should be made with the approval of the engagement supervisor. This ensures that the changes are properly documented and that the scope and objectives of the engagement remain aligned with the overall audit plan. Additionally, obtaining approval from the engagement supervisor maintains the integrity and oversight of the audit process.

The Institute of Internal Auditors (IIA) Standard 2240 – Engagement Work Program: " Internal auditors must develop and document work programs that achieve the engagement objectives. "

IIA Practice Guide on " Engagement Planning "

According to the IIA Standards, particularly in the context of risk management consulting, internal audit activities may provide risk management consulting services under specific conditions. These conditions include:

There is a clear strategy and timeline to migrate risk management responsibility back to management.This condition ensures that the internal audit ' s involvement in risk management is temporary and transitional, emphasizing the principle that management retains ultimate responsibility for risk management.

The nature of services provided to the organization is documented in the internal audit charter.This condition ensures transparency and clarity about the internal audit ' s role in risk management, as outlined in the internal audit charter. This documentation is essential for defining the scope and limitations of the internal audit ' s consulting role.

In contrast, options 2 and 3 are inappropriate under the Standards:

The internal audit activity has the final approval on any risk management decisions (Option 2): This would compromise the independence and objectivity of the internal audit function, as internal auditors should not make management decisions.

The internal audit activity gives objective assurance on all parts of the risk management framework for which it is responsible (Option 3): This creates a conflict of interest because internal auditors cannot objectively audit areas where they have direct responsibility.

IIA References:

IIA Standard 2050: Coordination and Reliance emphasizes that internal audit should not assume management responsibilities, including final risk management decisions, to maintain objectivity and independence.

IIA Standard 1000: Purpose, Authority, and Responsibility and related guidance stress the importance of documenting the internal audit’s role in the audit charter, especially when the internal audit is involved in consulting activities like risk management.

An organic organizational structure is more flexible and adaptive compared to a mechanistic structure. It is characterized by less formalization, decentralized decision-making, and a greater reliance on lateral communication. This type of structure is beneficial in environments that are dynamic and uncertain, such as when an organization faces strong political and social pressures. The flexibility of an organic structure allows the organization to respond more effectively to external changes and pressures.

This concept is supported by organizational theory literature, which suggests that organic structures are better suited for turbulent and changing environments where quick adaptation is necessary​​.

During the planning phase of an assurance engagement, gaining an understanding of how the area under review is accomplishing its objectives is crucial. Reviewing key performance indicators (KPIs) is a primary technique because KPIs are directly tied to the objectives and provide measurable data on performance. This review helps the auditor understand whether the objectives are being met effectively and highlights areas that may require further investigation.

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2201 - Planning Considerations

Comprehensive and Detailed Explanation:

Secondary controls are not primary risk mitigations but provide backup support if key controls fail. When preparing the work program, auditors generally focus on key controls, since they directly address significant risks. Secondary controls may not require testing unless they provide meaningful risk reduction where primary controls are weak or absent. Option A is inefficient; a separate work program for secondary controls is not required. Option C is incorrect — documentation alone does not make them essential. Option D is misleading because secondary controls are not subject to the same level of testing rigor as key controls. Therefore, Option B is correct: secondary controls do not always need to be tested.

When an internal auditor discovers an issue such as a programming error allowing multiple accounts for a single address, the auditor should ensure that the corrective actions are both adequate and effective. This includes scheduling a follow-up review (1) to verify that the program has been corrected and that the accounts have been consolidated. Additionally, evaluating the adequacy and effectiveness of the corrective action proposed by management (2) is essential to ensure the issue has been resolved properly. References: = IIA Standard 2500 - Monitoring Progress and IIA Standard 2320 - Analysis and Evaluation.

Comprehensive and Detailed Explanation:

Even though this is an advisory engagement, internal auditors must still evaluate significant control gaps discovered during the engagement (Standard 2120 – Risk Management). Since a key procurement control is missing, the auditor should not ignore the risk (D). Expanding the advisory engagement scope (C) would be outside the engagement mandate unless approved. Deferring review to next year’s plan (A) delays needed assurance. The most appropriate step is to perform a root cause analysis and test whether the approved workaround is effective (B). This ensures that risks are mitigated in the interim until a permanent control is implemented, providing management with actionable feedback.

Comprehensive and Detailed Explanation:

Audit conclusions must be backed by sufficient, relevant, and reliable evidence (Standard 2330). In construction audits, the most reliable evidence of cost overruns and delays comes from payment records and milestone documentation (A), which clearly show the financial impact tied to project performance. While photos (B) may illustrate delays, they are not sufficient proof of cost impact. Sprint planning (C) is not relevant to construction projects and does not provide financial evidence. Internal rate of return (D) is a performance metric, not evidence of actual cost overruns. Therefore, the appropriate evidence for workpapers must be the payment and work milestone documents that support the $10 million loss conclusion.

During planning, auditors gather information about processes and controls. While management (A) provides oversight and external auditors (C) focus on financial reporting controls, employees who perform the daily tasks (B) have the most accurate, detailed, and current knowledge of how processes and controls actually operate. The board (D) provides governance, not operational detail.

Proper engagement supervision is documented through formal records that show a systematic review and oversight process. A completed engagement workpaper review checklist provides evidence that the supervisor has reviewed and approved the work done by the audit team. This formal checklist ensures all critical aspects of the engagement are reviewed systematically, meeting the standards for proper supervision documentation. References:

" Internal Auditing: Assurance & Advisory Services " (The Institute of Internal Auditors)

" International Standards for the Professional Practice of Internal Auditing " (IIA)

Nonstatistical sampling allows auditors to use their professional judgment to determine the sample size and select the items to be tested. Unlike statistical sampling, which relies on probabilistic methods to determine the sample size and selection, nonstatistical sampling is more flexible and can be tailored to the specific circumstances of the audit engagement.

IIA References:

IIA Standard 2320: Analysis and Evaluation suggests that internal auditors should apply appropriate methods to analyze data and draw conclusions. Nonstatistical sampling allows for the application of professional judgment, which can be advantageous in certain audit situations where rigid statistical methods may not be practical or necessary.

The Practice Guide on Sampling discusses the differences between statistical and nonstatistical sampling, highlighting that nonstatistical sampling relies more on the auditor’s judgment, which can be beneficial in certain contexts.

Given this, the correct answer is C. Nonstatistical sampling provides for the use of subjective judgment in determining the sample size.

A consulting engagement in internal auditing involves providing advisory and related client service activities, the nature and scope of which are agreed upon with the client. These are intended to add value and improve an organization ' s governance, risk management, and control processes. Helping in the design of the risk management program is a consulting activity because it involves advising management on how to establish or improve the processes for identifying, assessing, and managing risks. This is different from assurance engagements, which primarily focus on assessing existing processes.

The Institute of Internal Auditors (IIA) Standard 2010: Planning

IIA Practice Advisory 2010-1: Linking the Audit Plan to Risk and Exposures

A RACI (responsible, accountable, consult, and inform) chart is the tool that an internal auditor should use to determine whether all principal stakeholders are involved in a project. A RACI chart clearly defines roles and responsibilities for each task or deliverable in a project, ensuring that all necessary stakeholders are identified and their involvement is appropriately documented.

IIA Practice Guide: Auditing Project Management Activities

IIA Standards: 2201 - Planning Considerations