IIA IIA-CIA-Part2 - Practice of Internal Auditing

The correct approach aligns with the International Standards for the Professional Practice of Internal Auditing (Standards), particularly Standard 2400: Communicating Results. The auditor must promptly discuss material errors to prevent ongoing misstatements. Immediate correction ensures timely remediation and reduces the risk of material misstatement persisting in the financial records. Additionally, if the error is resolved before the engagement concludes, it may not necessitate inclusion in the final report, as per the guidance on handling material findings (Practice Advisory 2410-1). This approach also demonstrates collaboration and alignment with management, fostering trust.

Developing a tracking system to monitor the status of engagement recommendations ensures that the chief audit executive (CAE) can systematically track the progress and implementation of corrective actions. This approach provides continuous assurance that recommendations are being acted upon and allows the CAE to identify and address any delays or issues in the implementation process. It is a proactive strategy that enables regular follow-ups and reporting to senior management, thus maintaining accountability and transparency.References:

The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2500 - Monitoring Progress

According to MA (Management Accounting) guidance and internal auditing standards, when assessing the likelihood of fraud risk, internal auditors should consider historical data and patterns within the organization. Past fraud allegations and actual occurrences provide valuable insights into potential vulnerabilities and areas where controls might have previously failed. This historical perspective helps in evaluating the current fraud risk environment and in identifying areas that require stronger controls or more vigilant monitoring.

When identifying audit resource requirements, the chief audit executive (CAE) should consider approaching an external service provider to conduct internal audits in areas where the organization lacks the necessary skills (2). This ensures that audits are conducted by individuals with the appropriate expertise. Additionally, communicating to senior management a summary report on the status and adequacy of audit resources (4) keeps them informed about the internal audit activity's capacity and any resource constraints. Considering employees from other operational areas as audit resources (1) could compromise objectivity and independence, while suggesting deferral of audits (3) is generally not advisable as it might leave significant risks unaddressed. References: IIA Standard 2030 – Resource Management, IIA Practice Advisory 2030-1

According to IIA guidance, the internal audit plan should be based on an assessment of risks to the organization (1), designed to determine the effectiveness of the organization's risk management process (2), and aligned with the organization's goals (4). The development of the audit plan is typically the responsibility of the chief audit executive, often with input from senior management and the audit committee, rather than being solely developed by senior management (3). References: IIA Standard 2010 – Planning, IIA Practice Guide – Developing the Internal Audit Plan

The primary purpose of creating a preliminary draft audit report is to facilitate communication with management of the area under review. This draft allows for discussion and feedback on the findings, recommendations, and any potential misunderstandings or disagreements before the final report is issued. It helps ensure that the final report is accurate, fair, and reflects the input of both the auditors and management. References:

The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2410 - Criteria for Communicating.

The IIA’s Practice Guide on Communicating Results.

The key issue here is the risk associated with non-compliance to document management policies, particularly in terms of legal exposure. If sales contracts are not stored systematically in the electronic document management database, it can lead to difficulties in retrieving these documents, especially in the case of litigation. This can pose significant legal risks because the organization might struggle to prove the agreed pricing terms and conditions, which could potentially result in financial losses or legal penalties. The consequence highlighted in option C directly addresses this critical risk. References:

"Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)

"Document Management in Internal Auditing: Best Practices" (The Institute of Internal Auditors)

According to the International Standards for the Professional Practice of Internal Auditing (Standards) issued by The Institute of Internal Auditors (IIA), the Chief Audit Executive (CAE) must communicate and obtain approval from the board for significant changes to the audit plan. A corporate merger is a significant event that introduces emerging risks, necessitating an interim adjustment to the audit plan. The CAE's responsibility includes ensuring that the board is informed and approves the revised audit plan to address these new risks adequately.

According to IIA guidance, before implementing any changes to the audit program's scope prior to beginning fieldwork, the most important action is to seek approval from the chief audit executive (CAE) for the proposed scope change. This ensures that any significant modifications are reviewed and authorized at the appropriate level, maintaining the integrity and alignment of the audit activity with the organization's audit plan and objectives.

Management testimony of improper segregation of duties in the cash receipt process can be considered relevant. Relevant evidence directly relates to the matter being examined, which in this case is the proper segregation of duties in the cash receipt process. Testimony from management can provide insights and context that are pertinent to understanding and assessing this specific control issue.