A consulting engagement in internal auditing involves providing advisory and related client service activities, the nature and scope of which are agreed upon with the client. These are intended to add value and improve an organization's governance, risk management, and control processes. Helping in the design of the risk management program is a consulting activity because it involves advising management on how to establish or improve the processes for identifying, assessing, and managing risks. This is different from assurance engagements, which primarily focus on assessing existing processes.
:
The Institute of Internal Auditors (IIA) Standard 2010: Planning
IIA Practice Advisory 2010-1: Linking the Audit Plan to Risk and Exposures

Comprehensive and Detailed Explanation:
The governing body (board of directors) is responsible for strategic oversight. The most relevant evidence of their involvement in strategic social media decisions would be board meeting minutes (A), as these formally document discussions, approvals, and resolutions on strategic topics. Budget reports (B) reflect financial allocations but not governance involvement. Marketing plans (C) and procedures manuals (D) reflect management's role in execution, not the board's strategic oversight. According to IIA guidance on governance assessments (Standard 2110), auditors should look at evidence of board-level involvement in significant strategic initiatives. Thus, meeting minutes are the strongest and most direct evidence of governance participation in strategic decisions on social media use.

When significant control breaches are identified, IIA Standard 2410: Communicating Results requires auditors to address the issue with appropriate management immediately. Issuing an interim report ensures the organization takes timely corrective action to mitigate risks and potential regulatory sanctions. Delaying communication until the final report (options A, B, or D) may increase the risk of noncompliance or sanctions. Addressing issues promptly reflects adherence to the professional practice standards and helps mitigate harm.

When setting the scope for identifying and assessing key risks and controls in a process, developing the scope of the audit based on a bottom-up perspective is the least appropriate approach. A bottom-up perspective typically focuses on individual controls and processes without necessarily aligning with the organization's critical business objectives and risk appetite. Effective risk assessment should begin with a top-down approach, identifying key business objectives and the associated risks, and then determining the necessary controls to manage these risks. References: IIA Practice Guide - Auditing Key Risk Management, IIA Standard 2200 - Engagement Planning

Comprehensive and Detailed Explanation:
Risk-and-control questionnaires are structured tools used to quickly determine whether specific control activities are formally in place. They are efficient (D) because they provide management's input on whether defined controls exist, helping auditors identify gaps before fieldwork. However, they are not the most effective way to understand processes (C) since questionnaires rely on management's responses, which may be biased or incomplete. Instead, walkthroughs and direct observation provide more depth. Options A and B are incorrect since questionnaires are efficient and do not prevent team involvement. Therefore, the correct view is that such questionnaires are an efficient tool for confirming control existence, not for complete process understanding.