Omitting advance client notice when planning an audit engagement is justifiable if the engagement includes audit assurance procedures that involve sensitive or restricted assets. Providing advance notice in such cases could compromise the integrity of the audit, as it may give management an opportunity to conceal or alter the status of these assets. The goal is to ensure that the auditors can observe the actual condition and handling of sensitive assets without any prior alteration. References: IIA Standard 2201 - Planning Considerations, IIA Practice Advisory 2201-1

Comprehensive and Detailed Explanation From Exact Extract:
A heat map is a visual tool used to present risk severity by plotting likelihood versus impact. It helps communicate which risks are most significant. A risk register (D) lists risks but does not visually present severity. Control self-assessment (B) is a participatory tool to evaluate controls, while Kanban boards (A) are project management tools. The best choice for assessing and presenting severity is a heat map.

The engagement work program is primarily based on the scope and audit objectives of the engagement. The work program outlines the specific procedures to be followed during the audit to achieve the defined objectives within the scope of the engagement. It serves as a detailed plan that guides the audit team in their work, ensuring that all necessary areas are covered.
IIA References:
* IIA Standard 2240: Engagement Work Program states that internal auditors must develop and document work programs that achieve the engagement objectives. These work programs are directly tied to the scope and objectives of the audit, which determine the nature and extent of audit procedures.
* The Practice Guide on Engagement Planning explains that the work program should be designed to address the key risks and objectives identified during the planning phase, ensuring that the audit is comprehensive and focused on the most critical areas.

Comprehensive and Detailed Explanation:
Audit conclusions must be backed by sufficient, relevant, and reliable evidence (Standard 2330). In construction audits, the most reliable evidence of cost overruns and delays comes from payment records and milestone documentation (A), which clearly show the financial impact tied to project performance. While photos (B) may illustrate delays, they are not sufficient proof of cost impact. Sprint planning (C) is not relevant to construction projects and does not provide financial evidence. Internal rate of return (D) is a performance metric, not evidence of actual cost overruns. Therefore, the appropriate evidence for workpapers must be the payment and work milestone documents that support the $10 million loss conclusion.

The role of the CAE includes ensuring that all significant risks, including those related to health and safety, are properly managed. Even though the chief health and safety officer reports directly to the CEO, the CAE should still coordinate with and review the work of this officer to understand and evaluate the management of health and safety risks. This helps ensure a comprehensive risk management approach within the organization and supports the overall assurance framework. It is not appropriate for the CAE to have no role (Option A), report directly to the regulator (Option C), or hire an external specialist annually without internal coordination (Option D).
:
IIA Standard 2010: Planning.
IIA Practice Guide on Coordinating Risk Management and Assurance.