* A. Review year-over-year trending of total dollars spent in each period:This is the correct approach because year-over-year analysis focuses on identifying anomalies or significant variances in expenses over time. Trends in data can help detect unexpected spikes, dips, or patterns that indicate irregularities or inefficiencies. This aligns with analytical procedures in expense analysis under the CIA Exam Syllabus Part 2, which emphasizes the use of comparative techniques to evaluate reasonableness.
* B. Review changes to the vendor master file for suspicious activity:While reviewing vendor master file changes is essential for fraud detection and control testing, it does not directly help in determining the reasonableness of monthly expenses.
* C. Review the percentage of on-time payments against prior periods:Examining payment timeliness relates to operational efficiency and cash flow management, not directly to evaluating whether monthly expenses are reasonable.
* D. Review total expenses for accounting against other department expenses in the organization:
Comparing accounting department expenses to those of other departments might indicate disparities but does not consider differences in department-specific activities and needs.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Analytical Procedures and Testing Methods.

If the branch manager decides not to act on a significant risk that was previously acknowledged, the CAE should escalate the issue to the board. The board has ultimate responsibility for risk management and needs to be informed about significant risks and the decisions made by management regarding these risks. This ensures transparency and allows the board to take appropriate action if necessary.
References:
* The Institute of Internal Auditors (IIA) Standards
* Risk Management Frameworks and Reporting

In internal auditing, when assessing the accuracy and completeness of employee time reporting, auditors often use sampling to determine the overall compliance of the process. In this scenario, the internal auditor sampled
30 employee time reports and found 5 incorrect and 4 unsupported reports. This indicates that a majority (21 out of 30) were accurate, suggesting that the organization generally ensures accurate reporting. However, the presence of incorrect and unsupported reports indicates deficiencies that need to be addressed, but do not point to systemic fraud or abuse. Thus, option D accurately reflects the findings by acknowledging both the general accuracy and the instances of errors.
:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing COSO Framework - Control Activities and Monitoring

During an inventory audit, the activity that would most benefit from the use of computerized audit tools (CAATs) is valuating the obsolete inventory from all the warehouse locations. CAATs can efficiently analyze large volumes of inventory data from multiple warehouses, identify patterns and trends, and automate the valuation process, making it more accurate and less time-consuming compared to manual methods.
:
IIA Standards: 1210.A3 - Proficiency in the Use of CAATs
IIA Practice Guide: Use of Technology in Auditing

The most effective time for an internal auditor to develop a risk and control matrix is during the planning phase of an audit engagement. This matrix helps in identifying the key risks and the controls in place to mitigate those risks, which is crucial for developing a focused and effective engagement work program.
IIA References:
* IIA Standard 2201: Planning Considerations requires internal auditors to consider significant risks and controls when planning the engagement. Developing a risk and control matrix at this stage ensures that the audit work is appropriately targeted at the most critical areas.
* The Practice Guide on Risk Assessment advises that creating a risk and control matrix during planning helps in structuring the audit to address identified risks effectively.