The internal audit charter is a formal document that defines the purpose, authority, and responsibility of the internal audit activity. It establishes the internal audit activity's position within the organization, authorizes access to records, personnel, and physical properties relevant to the performance of engagements, and defines the scope of internal audit activities. Final approval of the internal audit charter by the board ensures that there is a clear understanding and agreement on how the internal audit activity should function, thus supporting objectivity in carrying out its duties.
The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

According to IIA guidance, the chief audit executive is required to report the results of the quality assurance and improvement program, including external assessments, at least annually. This ensures that the board and senior management are kept informed about the internal audit activity's conformance with the Standards and other aspects of audit quality.
IIA's International Standards for the Professional Practice of Internal Auditing on Quality Assurance and Improvement.

When the chief audit executive (CAE) reports to the chief financial officer (CFO), it can create a potential conflict of interest and impair the independence of the internal audit activity. This reporting structure may lead to limitations in the scope of engagements, particularly when auditing areas under the CFO's purview.
Independence and objectivity are critical for the effectiveness of internal auditing, and reporting to the CFO can undermine these principles, restricting the ability to audit financial and other related areas without bias or undue influence.
The IIA Standards: Standard 1110 - Organizational Independence: "The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. The chief audit executive must confirm to the board, at least annually, the organizational independence of the internal audit activity." IIA Practice Guide: "Independence and Objectivity": Discusses the importance of appropriate reporting lines to maintain audit independence and avoid conflicts of interest.

The auditor's reluctance to apply statistical functions in spreadsheet software indicates a gap in applying analytical and problem-solving skills in complex data environments. This gap relates to critical thinking, which involves understanding logical connections between ideas, identifying the relevance and importance of arguments, and systematically solving problems. Training in critical thinking would equip the auditor to better utilize analytical tools and improve efficiency and effectiveness in auditing tasks.
Internal auditing educational materials on auditor competencies and skills development

Risk management is not solely about mitigating or eliminating potential hazards but also involves identifying and seizing potential opportunities that can benefit the organization. Effective risk management allows an organization to balance risk and reward, making informed decisions that align with its strategic objectives.
This approach ensures a proactive stance in optimizing performance and achieving competitive advantage while managing risks.
The Institute of Internal Auditors (IIA) Standards and Practice Advisories.
COSO Enterprise Risk Management (ERM) Framework.
" Risk Management: Principles and Practices " by IIA.