Ethics are indeed not defined by laws alone; they are based on standards of conduct derived from shared principles and values. This statement most accurately reflects the nature of ethics in the context of corporate social responsibility (CSR), emphasizing that while ethics are guided by laws, they fundamentally originate from broader societal values and the ethical norms of the community.
Basic ethical principles in CSR and business ethics literature

In assessing the design of a training program for an organization's ethics program, the most relevant questions would be those that address the content of the training and the feedback mechanism used to foster ethical decision-making. Questions 1 and 4 directly relate to these aspects, examining if the training includes ethical decision-making scenarios and if there is feedback on the thought processes involved, which are critical for effective ethics training.
IIA guidance on auditing ethics programs, focusing on the effectiveness and design of training components.

Ensuring that internal audit staff are regularly informed of changes to policies and procedures is crucial for maintaining due professional care. Regular updates ensure that auditors are aware of current standards, methodologies, and best practices, which helps them perform their duties effectively and with due diligence.
* Option A: Reviewing workpapers after the final engagement report is issued is too late to ensure due professional care.
* Option B: Independent assessments by entry-level staff might not ensure the required objectivity and proficiency.
* Option D: Destroying training documents does not contribute to due professional care and may hinder ongoing training and development efforts.
IIA Standard 1230: Continuing Professional Development.
IIA Standard 1220: Due Professional Care.

According to IIA guidance, it is a best practice for the internal audit charter to be reviewed and resubmitted for board approval annually, along with the audit plan. This annual review ensures that the charter remains relevant and aligned with the organization's objectives and governance structure. It also provides an opportunity to update the charter to reflect any changes in the internal audit activity's role, responsibilities, or scope of work. This process helps maintain the charter as a living document that accurately defines the purpose, authority, and responsibility of the internal audit function.
The IIA Standards: Standard 1000 - Purpose, Authority, and Responsibility: "The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval." The IIA Practice Guide: "Internal Audit Charter: Understanding

Posting the organization's code of conduct on its website is a strategy to mitigate cultural risk by promoting transparency and establishing a clear set of behavioral expectations for both employees and stakeholders. This helps in shaping a positive organizational culture where ethical behavior is encouraged and deviations from expected conduct are minimized. By making the code of conduct publicly available, the organization demonstrates its commitment to integrity and ethical behavior, which can enhance trust and accountability.
References: The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2110 - Governance, and COSO's Internal Control - Integrated Framework.