According to IIA guidance on the quality assurance and improvement program:
* Monitoring of the internal audit activity's performance must indeed be ongoing to ensure continuous improvement.
* All aspects of the internal audit activity should be evaluated, not just selected parts.
IIA Standard 1300 - Quality Assurance and Improvement Program

According to the guidance from The IIA (International Professional Practices Framework - IPPF), the most robust support for concluding that an organization's risk management processes are effective is the alignment of selected risk responses with the organization's risk appetite. This indicates that the organization not only understands its risks but also manages them in a manner consistent with its capacity and willingness to accept risk. It reflects a mature risk management process where risks are identified, assessed, and managed in alignment with strategic objectives and risk appetite, ensuring that the organization is not taking on more risk than it can handle or than is acceptable to its stakeholders.
IIA Practice Guide on Assessing the Adequacy of Risk Management Processes.
COSO Enterprise Risk Management Framework.

The ultimate goal of establishing a robust risk management framework in an organization is to facilitate the achievement of the organization's business goals and objectives. A comprehensive risk management framework helps identify, assess, and mitigate risks that could impede the organization's ability to achieve its strategic objectives, ensuring that risks are managed in a way that supports the organization's overall mission and goals.
The IIA Standards: Standard 2120 - Risk Management: "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes." COSO Framework: Emphasizes that the purpose of risk management is to help organizations achieve their objectives and enhance performance through effective risk management practices.

Rationalization is evident here, as the manager justifies his fraudulent actions by viewing them as compensation for perceived unfair treatment. According to IIA guidance on fraud, rationalization allows individuals to reconcile unethical behavior with their self-concept.

The CAE acted appropriately, and the independence of the internal audit activity was not impaired by seeking input from senior management and the external auditor prior to submitting the annual audit plan for board approval. This practice aligns with the IIA ' s guidance, which encourages collaboration and communication to ensure that the audit plan addresses relevant risks and aligns with organizational goals.
The IIA's International Standards for the Professional Practice of Internal Auditing regarding the development of the internal audit plan.