Setting clear objectives is crucial for effective risk management. Clear objectives provide a basis for identifying, assessing, and responding to risks. They ensure that all risk management activities are aligned with the organization's goals and help to prioritize risks based on their potential impact on achieving these objectives. Without clear objectives, it is challenging to evaluate the relevance and significance of risks and to develop appropriate risk responses.
References:
* COSO Enterprise Risk Management Framework
* IIA Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000

An appropriate disclosure of potential nonconformance with the Standards would be that an external assessment of the internal audit activity was last performed six years ago. According to IIA standards, external assessments must be conducted at least once every five years. Failing to perform an external assessment within this timeframe constitutes nonconformance with the Standards.References: IIA Standard 1312 - External Assessments, which requires that external quality assessments be performed at least once every five years to ensure conformity with the Standards.

In analyzing the situation where a key account manager failed to register a large number of contracts, a competent internal auditor should evaluate whether attributes such as intent and personal gain were present.
This involves assessing whether the individual's actions were deliberate and motivated by personal benefits.
Understanding these attributes is crucial for determining the root cause of the issue and identifying potential fraud or misconduct. It also helps in making recommendations to prevent future occurrences.
References:
* IIA Practice Guide: Fraud and Internal Audit
* IIA Standard 1210.A2: Proficiency - Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization

According to the standards and practices of internal auditing, the internal audit function is primarily responsible for providing an independent and objective assurance and consulting service aimed at adding value and improving an organization's operations. If internal auditors were tasked with developing controls in business procedures, it could compromise their objectivity. Objectivity is crucial as it allows auditors to carry out audits impartially and without bias. Involvement in control creation could lead internal auditors to later audit their own work, which is a conflict of interest and undermines the principle of independence and objectivity as set by the Institute of Internal Auditors (IIA).References: The Institute of Internal Auditors (IIA)
- International Standards for the Professional Practice of Internal Auditing

In situations where proper segregation of duties is not achievable due to insufficient staffing, internal auditors recommend the implementation of compensating controls. Compensating controls are additional procedures or safeguards designed to reduce the risk associated with insufficient segregation of duties. These controls do not prevent errors or fraud from occurring but aim to detect them in a timely manner if they do occur.
For instance, in a small manufacturer where the accounting department cannot separate tasks adequately due to limited staff, the auditor might suggest:
* Enhanced supervisory reviews: Managers or supervisors closely review and approve transactions and reconciliations performed by the staff.
* Periodic independent reviews: Regular audits or reviews by internal auditors or third-party auditors to ensure transactions are proper and in compliance with company policies.
* Use of technology: Implementing automated controls that require multiple approvals for significant transactions.
* Rotation of duties: Regularly rotating employees' responsibilities to prevent familiarity and collusion.
These measures help mitigate the risks that arise from the lack of segregation of duties, providing reasonable assurance that financial records are accurate and that fraud or errors are detected promptly.
References:
* The Institute of Internal Auditors (IIA) Standards and Practice Advisories.
* COSO Internal Control - Integrated Framework.
* "Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on Control Activities and Segregation of Duties.