According to IIA guidance, it is appropriate for an internal auditor to determine whether the organization has adequate controls to achieve its CSR objectives and to facilitate a management self-assessment of CSR controls and results. These activities are within the scope of internal auditing as they involve evaluating the effectiveness of governance, risk management, and control processes. Consulting on project design and implementation for CSR or excluding external risks goes beyond the typical role of internal auditing, which is to provide independent assurance.References: The IIA's guidance on the role of internal auditing in organizational governance and control evaluations.

The principle of objectivity in the IIA Code of Ethics specifically requires internal auditors to disclose all material facts known to them that, if not disclosed, may distort the reporting of activities under review (Option D). This principle ensures that internal auditors remain unbiased and do not withhold information that could affect the conclusions of their audit reports, thus maintaining the integrity and transparency of the audit process.References:
* IIA Code of Ethics: Objectivity
* IIA Standards, Standard 1120: Individual Objectivity

According to the IIA guidance on using the maturity model for assessing an organization's risk management program, a key activity to examine is "Monitor and Review." This element evaluates how well the organization continues to monitor its risk environment and reviews the effectiveness of risk management strategies over time. It is crucial for ensuring that risk management adapts to changes and continues to align with organizational objectives.References: Institute of Internal Auditors (IIA) - Guidance on Risk Management Maturity Models

According to the IIA's definition of due professional care, internal auditors are expected to perform assurance services that are needed to achieve the engagement's objectives. This includes considering the cost of assurance in relation to the benefits. The standard does not require auditors to identify all risks or guarantee that all significant risks will be addressed, as absolute assurance in any auditing context is unattainable.References: IIA Standard on Due Professional Care.

The first step for a newly hired chief audit executive (CAE) to build and maintain the proficiency of the internal audit activity should be to incorporate the basic criteria of internal audit competency into job descriptions. This foundational step ensures that all current and future hires are aligned with the required skills and competencies needed for effective internal audit functions. It sets a clear expectation of skills and knowledge right from the recruitment stage, thereby facilitating the development and maintenance of a competent audit team.References: The Institute of Internal Auditors (IIA) - Practice Guides on Talent Management