According to IIA guidance, the internal audit charter should document the nature of consulting services provided by the internal audit activity. This helps to define and communicate the scope and extent of consulting services that the internal audit is authorized to provide, thereby establishing clear boundaries and expectations for both the audit team and the rest of the organization.
IIA Standard 1000: Purpose, Authority, and Responsibility.

If an auditor concluded a major audit finding based on hearsay evidence, it indicates a lack of demonstration of due professional care. Due professional care requires that conclusions be based on evidence that is sufficient, reliable, relevant, and useful to support audit findings and recommendations. Relying on hearsay does not meet these criteria and undermines the audit ' s reliability and credibility.
IIA standards related to due professional care, which dictate that internal auditors must gather adequate factual evidence to support their findings and conclusions.

The statement that best describes the difference between risk appetite and risk tolerance is that risk appetite refers to an organization's general level of acceptance of risk, while risk tolerance is a more specific and subordinate concept. Risk appetite is the broad-based amount of risk an organization is willing to accept in pursuit of its mission, while risk tolerance defines the acceptable level of variation that management is willing to allow for any particular risk as it pursues its objectives.
The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

According to IIA guidance, the internal audit activity ' s quality assurance and improvement program (QAIP) encompasses both internal and external assessments. Internal assessments involve ongoing monitoring and periodic self-assessments or reviews, while external assessments are conducted by a qualified, independent assessor at least once every five years.
The chief audit executive (CAE) has the responsibility to ensure that the external assessor possesses the appropriate qualifications and independence to perform the assessment. This includes evaluating the assessor ' s competence, experience, and objectivity. This responsibility is crucial for maintaining the integrity and reliability of the QAIP.
IIA Standard 1312: External Assessments
IIA Practice Guide: Quality Assurance and Improvement Program

The statement that a report, including the results of both internal and external assessments, must be provided to the board annually is true regarding the reporting of results of the quality assurance and improvement program (QAIP) to senior management and the board. Regular reporting of QAIP results ensures that the board is continually informed about the effectiveness and conformance of the internal audit activity with established standards and practices. References: Institute of Internal Auditors (IIA) - Standard 1320 - Reporting on the Quality Assurance and Improvement Program