The organizational independence of an internal audit activity is considered impaired if there are scope limitations imposed on internal audits. Such limitations prevent the internal audit activity from fully evaluating and reporting on risk management, control, or governance processes within the organization, thus hindering the ability to perform work freely and objectively. Administrative reporting lines (such as to the CEO), the process of compensation approval, or assurance services provided for previous responsibilities do not inherently impair independence unless they lead to restrictions on audit scope or influence over audit findings.
IIA Standards and guidance on independence and objectivity.

The appropriate role for the internal audit activity is assisting the organization in maintaining effective controls. The internal audit function provides an independent and objective assessment of whether the organization's risk management, control, and governance processes are adequate and functioning effectively.
Implementing new controls or ensuring key risks are managed falls outside the typical scope of internal audit responsibilities, which are primarily advisory and evaluative, not operational.
Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

The first step in conducting a fraud risk assessment is to identify relevant fraud risk factors (Option A). This involves understanding the internal and external factors that could influence the likelihood and impact of fraud within the organization. Identifying these risk factors sets the foundation for subsequent steps, such as identifying potential fraud schemes, existing controls, and red flags. This approach aligns with the guidance provided in the IIA's Practice Guide on Managing the Business Risk of Fraud, which outlines the process of conducting comprehensive fraud risk assessments starting with identifying risk factors.
IIA Practice Guide: Managing the Business Risk of Fraud
COSO Framework for Fraud Risk Management

The appropriate role for the internal audit activity in relation to an organization's risk management process is to provide assurance on the effectiveness of these processes. This involves evaluating whether risk management practices help the organization manage its risks within defined risk tolerance levels effectively and are aligned with the strategic goals. Internal audit should not be involved in designing controls or setting risk tolerance as this could impair their independence.
Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

An example of an entity-level control pertaining to the finance area of an organization is "The establishment of a finance and audit committee." This is a governance control that provides oversight of financial reporting, internal controls, and audit functions, and is designed to ensure integrity and accuracy in financial statements and compliance with laws and regulations.
References: COSO Framework on Internal Control