According to the International Standards for the Professional Practice of Internal Auditing, the internal audit activity must have a quality assurance and improvement program that covers all aspects of the internal audit activity. This program should include both internal and external assessments. The chief audit executive must report the results of the quality assurance and improvement program to senior management and the board, including the frequency of quality assessments. This ensures that the board is aware of how often quality assessments are conducted, ensuring continuous improvement and adherence to standards. References: The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 1312 - External Assessments, and Standard 1320 - Reporting on the Quality Assurance and Improvement Program.

The first step in addressing a notification from a whistleblower about a conflict of interest should be to gain an understanding of the employee's role, responsibilities, and relationship with the supplier. This step is critical before conducting interviews or notifying others, as it helps establish the context for the investigation, ensuring that further steps are informed and targeted effectively.
IIA guidance on handling whistleblower claims and conducting internal investigations.

In the scenario where the board requests the chief audit executive (CAE) to provide consulting services for a new systems implementation project, the CAE should avoid making decisions on risk responses within risk management processes. The CAE's role is to provide independent and objective assurance and consulting services. Making decisions on risk responses would impair the CAE's independence and objectivity, which are crucial for the internal audit function. Instead, the CAE can provide advice and recommendations on risk management practices while ensuring that management retains responsibility for decision-making.
The IIA Standards: Standard 1112 - Chief Audit Executive Roles Beyond Internal Auditing: "If the CAE has or is expected to have roles and/or responsibilities that fall outside of internal auditing, safeguards must be in place to limit impairments to independence or objectivity." The IIA Practice Guide: "Independence and Objectivity": Discusses the importance of maintaining independence and objectivity in consulting engagements.

If the internal audit activity is not primarily responsible for conducting fraud investigations and should refrain from involvement in them, it would still be considered acceptable for internal auditors to evaluate the effectiveness of fraud investigations. This role aligns with the audit's function of providing independent assurance on the effectiveness of risk management and control processes within the organization.
IIA standards on the role of internal auditing in fraud risk management, which specify that internal auditors may assess the effectiveness and contribute to the improvement of fraud detection and investigation processes.

To evaluate the effectiveness of ethical programs, the most appropriate action for the CAE is to use employee surveys to assess whether the ethical programs are achieving desired outcomes (Option C). Surveys provide direct feedback from employees on the effectiveness and impact of ethical programs, offering insights into whether the programs are understood, accepted, and adhered to by the workforce. This approach aligns with the IIA Standards, specifically Standard 2110: Governance, which includes evaluating the design, implementation, and effectiveness of the organization's ethics-related objectives, programs, and activities.
IIA Standards, Standard 2110: Governance
IIA Practice Guide: Evaluating Ethics-related Programs and Activities