The best example of a risk appetite statement concerning an investment portfolio is one that explicitly states a tolerance level for investment earnings volatility, such as "We have a moderate tolerance for investment earnings volatility with a target value at risk of $50 million." This statement directly addresses the organization's willingness to accept risk and quantifies it, which is characteristic of effective risk appetite statements.
IIA best practices on defining risk appetite, which recommend quantifying risk tolerance in financial terms to guide strategic decision-making.

Due professional care is the care and skill expected of a reasonably prudent and competent internal auditor2. It requires internal auditors to follow the International Professional Practices Framework (IPPF) issued by the Institute of Internal Auditors (IIA), which includes the Code of Ethics and the Standards3. One of the aspects of due professional care is to perform risk-based audits, which means identifying and assessing the risks that may affect the organization's objectives, and designing and executing audit procedures that provide reasonable assurance on the effectiveness of risk management and internal control4. Therefore, option B is an appropriate statement to include in the report to demonstrate how the internal audit activity meets its requirement for due professional care.
References:
1: Standard 1220 - Due Professional Care
2: Due professional care definition
3: What is due professional care in internal audit?
4: Standard 1220 - Due Professional Care - The Institute of Internal Auditors or The IIA

Loss of intellectual property is a significant strategic risk that internal auditors should consider when performing a third-party risk management engagement. This risk can have substantial implications for the organization's competitive advantage, reputation, and financial performance. Ensuring that third parties have adequate controls to protect intellectual property is essential for mitigating this risk. Internal auditors should evaluate the effectiveness of these controls and the potential impact of intellectual property loss on the organization's strategic objectives.
The IIA Standards: Standard 2120 - Risk Management: "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes." IIA Practice Guide: "Auditing Third-party Risk Management": Highlights the importance of assessing strategic risks, including intellectual property protection, in third-party relationships.

In a consulting engagement, the internal auditors collaborate with management to determine the objectives and scope. In contrast, for assurance engagements, the internal audit activity sets the objectives and scope independently to provide an unbiased assessment. References:
* IIA Standard 2010: Planning.
* IIA Practice Guide: Consulting Services.

Consulting engagements are designed to add value and improve an organization's operations through advice and counsel. Briefing the organization's department managers on how to implement risk management processes into their daily operations is a prime example of a consulting activity. It involves providing expertise and support to enhance the managers' understanding and implementation of risk management, which is aligned with the IIA's definition of consulting services.
IIA Practice Advisory 1000-1: Nature of Work