An appropriate disclosure of potential nonconformance with the Standards would be that an external assessment of the internal audit activity was last performed six years ago. According to IIA standards, external assessments must be conducted at least once every five years. Failing to perform an external assessment within this timeframe constitutes nonconformance with the Standards.
IIA Standard 1312 - External Assessments, which requires that external quality assessments be performed at least once every five years to ensure conformity with the Standards.

The control that would have likely prevented the fraudulent modification of vendors' banking information is management's approval being required for updates to vendors' banking information. This control would provide a layer of verification and oversight, significantly reducing the risk of unauthorized and fraudulent changes.
Best practices in vendor management and internal controls over payment processes, as advocated by The IIA.

The role of internal auditors in assessing how an organization promotes ethics and values internally and with external business partners involves reviewing the organization's objectives, programs, and activities related to these areas. This approach aligns with the standard practice of internal auditing, which aims to ensure that an organization's processes and policies support its ethical standards and values.
Institute of Internal Auditors (IIA) Standards and Guidelines.

Residual risk is the remaining risk after management has implemented risk responses. The auditor is assessing what could still go wrong despite the effectiveness of the risk management technique in place, which is evaluating the remaining exposure to risk. References:
* IIA Standard 2120: Risk Management.
* COSO Enterprise Risk Management Framework.

Due professional care involves the exercise of professional judgment and the application of care that an ordinarily prudent person would use under the circumstances. In scenario A, the chief audit executive demonstrates due professional care by excluding an auditor who previously worked in the payroll department from the audit team assigned to audit that area. This action avoids conflicts of interest and ensures the objectivity of the audit, aligning with IIA guidelines on independence and objectivity in internal auditing.
IIA Standard 1100: "Independence and Objectivity"