Nonsampling risk is the risk that the auditor may reach incorrect conclusions for reasons not related to the sampling process, such as failure to recognize exceptions or misinterpretation of audit results. In this case, the internal auditor did not notice that some purchase requisitions were approved by unauthorized persons, which is an oversight unrelated to the sample size or selection process. This is distinct from sampling risk, which is the risk that the sample selected does not represent the population. References:
* The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2320 - Analysis and Evaluation.
* The IIA's Practice Guide on Audit Sampling.

When developing the objectives for an assurance engagement in a newly acquired subsidiary, the most critical items to consider are the organizational strategy, objectives, risks, control framework, and the expectations of stakeholders regarding the audit. This holistic approach ensures that the internal audit aligns with the broader goals and risk management processes of the organization, providing a comprehensive evaluation of the subsidiary's operations within the context of the entire entity.
* Organizational Strategy and Objectives: Understanding the overarching goals and strategic direction of the organization helps to align the audit objectives with business priorities and ensures that the subsidiary's operations are evaluated in the context of their contribution to these goals.
* Risks: Identifying and assessing the risks associated with the subsidiary is essential for focusing audit efforts on areas that could significantly impact the organization. This involves understanding both inherent and residual risks.
* Control Framework: Evaluating the existing control framework within the subsidiary helps determine the adequacy and effectiveness of controls in mitigating identified risks.
* Stakeholder Expectations: Considering what stakeholders expect from the audit helps in shaping objectives that address key concerns and provide valuable insights, fostering greater acceptance and implementation of audit recommendations.
This comprehensive approach ensures the audit is relevant, targeted, and capable of adding significant value to the organization by addressing key risk areas and strategic objectives.
:
The Institute of Internal Auditors (IIA) Standards
IIA Practice Guide: Formulating and Expressing Internal Audit Opinions

When a key control is identified during fieldwork that was not recognized during the planning phase, it is critical to update the audit work program to include tests for this newly identified control. However, this adjustment should be made with the approval of the engagement supervisor. This ensures that the changes are properly documented and that the scope and objectives of the engagement remain aligned with the overall audit plan. Additionally, obtaining approval from the engagement supervisor maintains the integrity and oversight of the audit process.
:
The Institute of Internal Auditors (IIA) Standard 2240 - Engagement Work Program: "Internal auditors must develop and document work programs that achieve the engagement objectives." IIA Practice Guide on "Engagement Planning"

Comprehensive and Detailed Explanation From Exact Extract:
Retained earnings represent the cumulative profits reinvested in the organization rather than distributed as dividends. They reflect the organization's ability to generate resources internally, supporting working capital, expansion, and long-term sustainability.
* Option A is incorrect: retained earnings are not the same as dividends.
* Option B is incorrect: retained earnings are not equal to excess cash.
* Option D is incorrect: rating agencies use broader financial measures, not retained earnings alone.
Thus, the best explanation is Option C: retained earnings show that the organization has been able to generate and reinvest resources from its own operations.

According to IIA guidance, risk assessment is a critical step that precedes the development of audit engagement objectives. The risk assessment process helps internal auditors identify the key areas of risk within the organization, which then informs the setting of appropriate objectives for the audit engagement.
* IIA Standard 2201 - Planning Considerations:
* This standard requires internal auditors to consider risk when planning an engagement. The risk assessment process identifies the areas of highest risk, which allows the auditor to focus on the most critical issues during the engagement.
* Role of Risk Assessment:
* By assessing risks, the auditor can determine which processes or controls are most likely to affect the achievement of the organization's objectives. This understanding is essential for setting the audit engagement's objectives, ensuring that they are aligned with the areas of greatest concern.
* IIA Practice Advisory 2210.A1-1:
* The advisory suggests that auditors should use the results of the risk assessment to establish the scope, objectives, and priorities of the engagement. Without this risk assessment, the audit objectives may not fully address the most significant risks.
* Option A (Identification of controls): This typically occurs after the objectives are set, as controls are evaluated based on the identified risks.
* Option B (Scope establishment): The scope is determined after the objectives are set, which are based on the risk assessment.
* Option D (Review of resources): This step is related to the allocation of resources after the objectives and scope are defined.
Detailed Explanation:Why Not Other Options?