A control weakness in the context of internal control over purchasing might be seen in the process where department managers initiate purchase requests that must be approved by the plant superintendent. If the approval process is not robust, this could lead to conflicts of interest or lack of independent review, especially if the superintendent has significant influence or control, and there are no further checks or balances. This situation could potentially allow for inappropriate approvals without sufficient oversight, representing a control weakness.
Internal control frameworks, such as COSO (Committee of Sponsoring Organizations of the Treadway Commission).

An assurance engagement provides an independent assessment of governance, risk management, and control processes. In this case, including the effectiveness of oil price risk management in the annual audit plan as an assurance engagement would allow the internal audit activity to evaluate the controls and processes in place for managing this significant risk. Even though the financial risk committee regularly addresses market risks, an independent review by internal audit can provide additional assurance to stakeholders about the effectiveness of these risk management practices. References: The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2010 - Planning, and Standard
2130 - Control.

According to the IIA Standards, the chief audit executive (CAE) must ensure that internal audit activities are performed with competence and due professional care. If the internal audit team lacks the necessary knowledge or skills to perform all or part of the work, the CAE must obtain competent advice and assistance.
Thus, the CAE's best response to defend the expenditure for an external fraud expert is to refer to the Standards, explaining that the internal audit activity must obtain competent assistance if needed to ensure the investigation is conducted effectively and professionally.
IIA Standard 1210: Proficiency

The IIA's guidelines suggest that internal audit may provide support by coaching management on risk responses, but it should not take on management's responsibilities, such as implementing risk responses or setting the risk appetite, as this would impair objectivity.

Surveying employees to determine whether they are aware of the ethics hotline is the most effective action to help an internal auditor assess how successful the organization has been in communicating the existence of its ethics hotline. Employee surveys can provide direct feedback on their awareness and understanding of the hotline, allowing the auditor to gauge the effectiveness of communication efforts and identify areas where additional outreach or education may be necessary.
The IIA's Practice Guide on Assessing the Effectiveness of the Ethics Program.
The IIA's International Professional Practices Framework (IPPF) on Communicating and Reporting.