Internal control questionnaires are used to determine whether specific control procedures are in place within an organization. They help auditors identify the existence and implementation of controls designed to mitigate risks. These questionnaires can provide a preliminary understanding of the control environment and identify areas that may require further detailed testing.
:
The Institute of Internal Auditors (IIA) Practice Guide: Using Internal Control Questionnaires to Assess Risk IIA Standard 2130 - Control

According to the International Standards for the Professional Practice of Internal Auditing, the Chief Audit Executive (CAE) has a responsibility to ensure that the results of both assurance and consulting engagements are communicated to the appropriate parties. This ensures that the observations and recommendations are acknowledged and acted upon by those who have the authority to implement necessary changes or take corrective actions. This communication is crucial for ensuring that the findings of the internal audit are effectively utilized to improve governance, risk management, and control processes.
:
The Institute of Internal Auditors (IIA) Standard 2440 - Disseminating Results: "The chief audit executive must communicate results to the appropriate parties." IIA Practice Guide on "Communicating Results"

A limitation of a heat map is that it can be challenging to differentiate between impact and likelihood as to which is more important. Heat maps visually represent risks based on their impact and likelihood, but they do not inherently provide a mechanism to weigh these factors against each other, which can make prioritizing risks difficult in some cases.
IIA References:
* The IIA's Practice Guide on Risk Assessment discusses the use of heat maps in visualizing risks but also highlights their limitations, particularly in how impact and likelihood are presented. While heat maps are useful for a high-level overview, they may not provide the nuanced understanding needed for decision-making when both factors are critical.

For a one-person audit function, the primary focus is on ensuring that there is a clear understanding of the audit policies and procedures without the need for extensive documentation. According to the IIA's guidance, a memorandum stating the policies and procedures would suffice for a one-person audit function, providing a concise yet comprehensive outline of the necessary protocols to follow. This approach ensures that the sole auditor has clear directives while avoiding the administrative burden of maintaining a more extensive manual that might be necessary for larger audit teams.
:
The Institute of Internal Auditors (IIA) - Practice Advisory 2040-1: Policies and Procedures

Comprehensive and Detailed Explanation From Exact Extract:
IIA guidance emphasizes considering risk, impact, and root cause in audit findings (Standard 2410 - Criteria for Communicating). In this case, brakes are safety-critical products. Even if the company discards failed items, testing in conditions not reflecting real-world use is a major deficiency, since it creates risk that unsafe products could pass the test and reach customers.
Therefore, Option C is correct: testing conditions must simulate real-world operating environments, especially where human life is at stake.