Before taking further action, the internal auditor should understand why management asked employees to act against policies and procedures. This could reveal underlying issues or misunderstandings that need to be addressed. References:
* IIA's International Standards for the Professional Practice of Internal Auditing.
* COSO Framework on Monitoring and Risk Assessment.

System validations and edit checks on vendor identification numbers are primary controls that effectively reduce the risk of setting up duplicate vendors in the system. These controls ensure that each vendor ' s information is unique and verified against existing records before a new vendor is entered into the system, thereby preventing duplication.
Institute of Internal Auditors (IIA) - Risk Control Matrices and Internal Control Frameworks

The role of the board in organizational governance most accurately involves the responsibility for the outcome of the process. This encompasses overseeing the strategic direction of the organization, ensuring that corporate objectives are met, and that the management's activities align with the overall strategic vision and risk appetite of the organization. The board's oversight role is crucial in ensuring effective governance and accountability throughout the organization.
The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

To evaluate the effectiveness of ethical programs, the most appropriate action for the CAE is to use employee surveys to assess whether the ethical programs are achieving desired outcomes (Option C). Surveys provide direct feedback from employees on the effectiveness and impact of ethical programs, offering insights into whether the programs are understood, accepted, and adhered to by the workforce. This approach aligns with the IIA Standards, specifically Standard 2110: Governance, which includes evaluating the design, implementation, and effectiveness of the organization's ethics-related objectives, programs, and activities.
IIA Standards, Standard 2110: Governance
IIA Practice Guide: Evaluating Ethics-related Programs and Activities

The most reliable source of documentation for conformance with the standard for continuing professional development is the organization's training policy. This policy typically outlines the requirements for ongoing education, training, and professional development for internal auditors. It may include mandatory training hours, the types of training that qualify, and procedures for tracking and reporting completed training. Other documents, such as a list of auditors attending a conference or an in-house training manual, may provide evidence of individual training activities but do not provide comprehensive proof of an ongoing commitment to professional development across the entire internal audit activity.
IIA Standard 1230: Continuing Professional Development
IIA Practice Guide: Continuing Professional Development