The best example of a risk appetite statement concerning an investment portfolio is one that explicitly states a tolerance level for investment earnings volatility, such as "We have a moderate tolerance for investment earnings volatility with a target value at risk of $50 million." This statement directly addresses the organization's willingness to accept risk and quantifies it, which is characteristic of effective risk appetite statements.
IIA best practices on defining risk appetite, which recommend quantifying risk tolerance in financial terms to guide strategic decision-making.

Ensuring that internal audit staff are regularly informed of changes to policies and procedures is crucial for maintaining due professional care. Regular updates ensure that auditors are aware of current standards, methodologies, and best practices, which helps them perform their duties effectively and with due diligence.
* Option A: Reviewing workpapers after the final engagement report is issued is too late to ensure due professional care.
* Option B: Independent assessments by entry-level staff might not ensure the required objectivity and proficiency.
* Option D: Destroying training documents does not contribute to due professional care and may hinder ongoing training and development efforts.
IIA Standard 1230: Continuing Professional Development.
IIA Standard 1220: Due Professional Care.

This scenario violates The IIA's standards regarding internal audit independence because the chief risk officer's involvement in validating and dictating which audit findings are included in the audit committee reports undermines the independence of the internal audit activity. Independence is compromised when audit findings are subject to alteration or selection by another party within the organization, particularly one involved in managing risks that the audit may be assessing.
The IIA's International Standards for the Professional Practice of Internal Auditing, specifically standards related to independence.

The objective of a consulting engagement where the internal audit team is asked to advise on new controls following a high-profile processing error is typically determined collaboratively by the business unit manager and the engagement supervisor. This cooperation ensures that the engagement's goals align with the specific needs of the business unit while adhering to the broader objectives and standards of the internal audit function.
References: Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

The proper sequence is to first evaluate the adequacy of the controls to ensure they are appropriately designed to mitigate risks. After confirming their design, the next step is to test the controls to verify they are operating effectively in practice. References:
* IIA Standard 2120: Risk Management.
* COSO Internal Control-Integrated Framework.