According to The IIA's Core Principles for the Professional Practice of Internal Auditing, one of the key principles is that internal auditors should be objective and free from undue influence (independence). The correct option that aligns with these principles is B, where final reports from consulting engagements provide a summary of findings and ensure that the auditor's advice is distinctly separated from management's decisions. This separation supports the principle of objectivity and avoids conflicts of interest, which is fundamental in upholding the integrity and independence of the internal audit function.
The IIA's Core Principles for the Professional Practice of Internal Auditing

Control activities are specific actions defined by management aimed at mitigating risk to the achievement of objectives. They are part of the broader internal control framework, which management designs according to the organization's risk management strategies. These activities can vary widely across different organizations depending on the specific risks they face and the strategies management employs to mitigate these risks.
COSO Framework on Internal Controls

For consulting engagements, the criteria used to evaluate governance, risk management, and controls are determined jointly by internal auditors and the management. This is distinct from assurance engagements, where criteria are set independently by the auditor to assess whether an organization's components are functioning as intended and to evaluate compliance with policies and procedures. This distinction emphasizes the collaborative nature of consulting engagements in contrast to the independent nature of assurance engagements.
Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

The quality assurance and improvement program (QAIP) should include both internal assessments performed by staff and external assessments performed by independent, objective individuals. This ensures that the internal audit activity maintains high standards of quality and adheres to professional guidelines.
* Option A: The QAIP must include ongoing internal assessments and external assessments every five years, not necessarily every three years.
* Option B: While ongoing self-assessments are part of QAIP, external assessments by independent assessors are also required.
* Option D: The board may set scoping limitations, but the comprehensive nature of QAIP includes both internal and external evaluations without board-imposed restrictions.
IIA Standard 1300: Quality Assurance and Improvement Program.
IIA Standard 1312: External Assessments.

The authority of the internal audit activity, as outlined in the audit charter, includes having full access to the organization's records, physical property, and personnel necessary to conduct audit engagements. This access is critical for the internal audit activity to perform its duties effectively and independently, ensuring that auditors can obtain the information and resources they need to evaluate the organization's processes and controls comprehensively.
The IIA Standards: Standard 1000 - Purpose, Authority, and Responsibility: "The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter... The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval." The IIA Practice Guide: "Understanding the Importance of the Internal Audit Charter": Emphasizes the necessity for the internal audit activity to have unrestricted access to organizational records, property, and personnel.