According to IIA guidance, the chief audit executive (CAE) may consider performing a self-assessment with independent external validation in lieu of performing a full external assessment. This is known as a self- assessment with independent validation (SAIV) and is acceptable as a part of the internal audit activity's quality assurance and improvement program. Choosing an independent reviewer or review team to perform sufficient tests of the self-assessment to validate the results is also aligned with IIA standards for maintaining quality within the internal audit function.References: IIA Standard 1300: Quality Assurance and Improvement Program, which outlines requirements for ongoing and periodic reviews of the internal audit activity.

If the operations management lacks the competency to execute internal control measures, the most appropriate action by the internal audit activity to assist in achieving continuous improvement is to provide training on controls and on self-monitoring processes. This helps build management's capacity to understand and implement effective controls and fosters a culture of continuous improvement within the organization.
IIA guidance on the role of internal audit in developing management's control competencies, highlighting training and educational support as key methods for enhancing internal control practices.

Critical thinking skills are essential for internal auditors when designing audit procedures and selecting samples. The situation described indicates that the auditor relied on a sampling method without thoroughly considering the potential risks and the specific context of the transaction population. Improved critical thinking skills would help the auditor better assess the representativeness of the sample, identify potential fraud risks, and ensure a more thorough and effective audit approach, potentially preventing the oversight that led to undetected fraud.
The IIA Standards: Standard 1220 - Due Professional Care: "Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor. Due professional care includes consideration of the use of technology-based audit and other data analysis techniques." IIA Practice Guide: "Assessing the Adequacy of Risk Management and Controls": Emphasizes the importance of critical thinking in evaluating risks and controls.

According to the IIA's standards on proficiency, the Chief Audit Executive (CAE) should consider primarily how well the skills and experience of a new auditor complement those of the existing audit team. This ensures a diverse and comprehensive skill set within the audit team, aligning with the Standard 1210.A2, which stipulates that the internal audit activity collectively should possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities.
Institute of Internal Auditors (IIA) Standards, specifically Standard 1210 on Proficiency.

An effective governance process requires that risk is considered in strategic decision-making, ensuring that all significant risks are identified, assessed, and managed appropriately. This integration of risk management into the strategic planning process helps align risk appetite and strategy, improving the overall governance and risk management framework of the organization.
References: Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)