The internal audit activity should avoid conflicts of interest and maintain independence and objectivity.
Rotational auditors performing consulting engagements in areas where they had previous responsibilities can impair their objectivity and independence, which is a non-conformance with the IIA Standards. References:
* IIA Standard 1130 - Impairment to Independence or Objectivity.
* IIA Standard 1100 - Independence and Objectivity.

Demonstrating due professional care involves ensuring that the internal audit activity follows established guidelines and standards for conducting audit engagements. By establishing internal audit manuals, an audit lead provides a structured approach and standardized procedures for the internal audit activity, which helps in maintaining consistency, quality, and adherence to professional standards. This practice exemplifies the application of due professional care by promoting thorough and well-documented audit processes.
The IIA Standards: Standard 1220 - Due Professional Care: "Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor. Due professional care does not imply infallibility." IIA Practice Guide: "Quality Assurance and Improvement Program": Highlights the importance of internal audit manuals and procedures in maintaining due professional care.

According to IIA guidance, a new internal auditor is expected to possess a broad understanding of IT risks and controls. This competency is crucial because:
* IT risks and controls are integral to the overall control environment and impact all areas of an organization.
* Knowledge of IT risks and controls enables auditors to assess the effectiveness of controls over information systems, data security, and technology infrastructure.
* As technology evolves, internal auditors must understand how to evaluate IT-related controls to provide relevant assurance and advisory services.
While technical industry-specific expertise, cybersecurity expertise, and forensic accounting knowledge are valuable, they are not core competencies expected of every new internal auditor according to IIA guidance.
The fundamental requirement is a solid grasp of IT risks and controls.
The Institute of Internal Auditors (IIA) Competency Framework.
"Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on IT Risks and Controls.
IIA's Global Internal Audit Competency Framework.

System validations and edit checks on vendor identification numbers are primary controls that effectively reduce the risk of setting up duplicate vendors in the system. These controls ensure that each vendor ' s information is unique and verified against existing records before a new vendor is entered into the system, thereby preventing duplication.
Institute of Internal Auditors (IIA) - Risk Control Matrices and Internal Control Frameworks

When the internal audit activity is found to be in nonconformance with the Code of Ethics or the Standards, the chief audit executive should communicate this matter to the board at the time of the next external assessment. This ensures that the board is aware of the nonconformance and can take appropriate actions to address the issue, maintaining the integrity and accountability of the internal audit function.
IIA standards on governance, which require the chief audit executive to report significant issues related to nonconformance with professional standards and the Code of Ethics to the board and senior management.