The most effective way to ensure that a newly formed internal audit activity remains free from undue management influence is to establish the internal audit activity's position within the organization through an audit charter. According to the Institute of Internal Auditors (IIA) standards, the audit charter should define the purpose, authority, and responsibility of the internal audit activity, clearly outlining the scope of internal auditing within the organization. This foundational document formalizes the internal audit function's role and provides a framework that supports its operational independence.
The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing.

The IIA standards specify that quality assurance and improvement programs (QAIP) must include both internal and external assessments. The internal assessments must be conducted continuously, and external assessments must be conducted at least once every five years, not seven. A key aspect of QAIP is that quality assessments should be performed by individuals who have sufficient knowledge of internal audit practices, ensuring the effectiveness and credibility of the audit process.
IIA Standard 1300: "Quality Assurance and Improvement Program"

The practice of supervisors providing feedback to internal auditors after reviewing workpapers demonstrates the exercise of due professional care within the internal audit activity. This feedback mechanism helps ensure the quality of audit work and adherence to professional standards, and it promotes continuous improvement and development of audit staff. This aligns with the IIA's definition of due professional care, which includes diligence, attention to detail, and continuous professional development.
IIA Standard 1300: Quality Assurance and Improvement Program, which outlines the requirements for due professional care.

Residual risk is the remaining risk after management has implemented risk responses. The auditor is assessing what could still go wrong despite the effectiveness of the risk management technique in place, which is evaluating the remaining exposure to risk. References:
* IIA Standard 2120: Risk Management.
* COSO Enterprise Risk Management Framework.

Segregating duties between code development and migrating changes into production is a critical control to prevent fraudulent activities by developers. This control ensures that no single individual has the ability to develop code and deploy it to the production environment without oversight. Key benefits include:
* Reducing the risk of unauthorized or malicious code changes.
* Ensuring that changes are reviewed and tested by a different team before deployment.
* Increasing accountability and transparency in the software development lifecycle.
By implementing this control, organizations can prevent developers from committing fraud or making unapproved changes to the ERP system, thereby protecting the integrity and security of the system.
The Institute of Internal Auditors (IIA) Standards and Practice Advisories.
COBIT (Control Objectives for Information and Related Technologies) framework.
"Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on IT General Controls and Segregation of Duties.