Having internal auditors rotate to other areas of the organization for non-audit assignments poses the greatest risk of compromising audit objectivity. This practice can lead to conflicts of interest and familiarity threats, as auditors may become too closely aligned with the operations of the areas they audit later, potentially impairing their impartiality and independent judgment.
IIA Standards on objectivity and independence; guidelines on auditor rotation and non-audit assignments.

Comparing vendor addresses to employee addresses is a common audit test to detect fictitious invoices.
Fictitious invoices are often created by employees who use their addresses or addresses of associates as vendor addresses to facilitate fraud.
* Option B: Matching cancelled checks to invoices ensures payment was made but does not specifically detect fictitious invoices.
* Option C: Searching for duplicate payments addresses duplicate invoices but not necessarily fictitious ones.
* Option D: Checking employee bank records could indicate fraud but is invasive and less direct than comparing addresses.
IIA Practice Guide: Fraud Detection.
COSO Fraud Risk Management Guide.

According to the International Professional Practices Framework (IPPF) issued by the Institute of Internal Auditors (IIA), the internal audit charter must be formally approved by senior management and the board.
This requirement ensures that the internal audit activity has the appropriate authority, support, and independence to carry out its responsibilities effectively. The charter defines the purpose, authority, and responsibility of the internal audit activity, providing a clear framework for its operations and ensuring alignment with the organization's objectives and governance structures.
The IIA Standards: Standard 1000 - Purpose, Authority, and Responsibility: "The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval."

If the internal audit activity accepts a request to determine appropriate risk management responses for management, it would impair its independence. The role of internal audit is to provide assurance and consulting services, but not to take on management responsibilities such as making decisions on risk responses. Doing so would compromise the objectivity and independence required of the internal audit function. References: The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 1100 - Independence and Objectivity, and Standard 1112 - Chief Audit Executive Roles Beyond Internal Auditing.

The use of due professional care by the internal audit activity is best demonstrated by internal auditors undertaking the necessary training to complete their audit work. Due professional care involves applying the diligence and judgment needed to conduct audits effectively. This includes continuous training and development to ensure auditors are proficient in their field and up-to-date with relevant audit standards, technologies, and methodologies, which aligns with the International Standards for the Professional Practice of Internal Auditing from the Institute of Internal Auditors (IIA).
The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing