The rotational model of internal audit staffing involves bringing in staff from other parts of the organization for a temporary period before they return to their original roles. While this model has several advantages, such as bringing diverse perspectives and business knowledge, it also has the disadvantage that auditors are often new to the internal audit function and are continuously in training.
* Rotational Model:
* In this model, employees from various departments are rotated into the internal audit activity for a specific period. They gain audit experience before rotating back to their original or other roles within the organization.
* Disadvantages:
* Since these individuals are not career auditors, they may lack the deep audit expertise of career auditors, and a significant amount of time is often spent on training. This constant influx of new, inexperienced staff can lead to a scenario where the team is always in training mode, potentially impacting audit efficiency and effectiveness.
* IIA Practice Advisory 1210-1:
* The advisory notes that while the rotational model can enhance business understanding within the audit team, it requires careful management to ensure that audit quality is not compromised due to the continuous learning curve of rotating staff.
* Option A (Career model): This involves auditors who remain in the internal audit function throughout their careers, leading to a highly skilled and experienced team.
* Option B (Center of competence model): This model focuses on a centralized group of audit experts, ensuring specialized skills and consistency.
* Option D (Hybrid model): This combines elements of the rotational and career models, aiming to balance expertise with fresh perspectives.
Detailed Explanation:Why Not Other Options?

* A. Inform management and request that the plan be tested immediately:Testing without updating the plan could lead to irrelevant results given the significant changes to the systems.
* B. Update the recovery plan for management, as part of the review:The auditor's role is to assess and recommend, not to perform management's responsibilities.
* C. Evaluate the recovery plan and report weaknesses to management:Evaluation alone does not address the need for an update and testing of the outdated plan.
* D. Recommend that management and users update and test the recovery plan:Correct. This approach addresses the deficiencies in the plan and ensures alignment with current systems.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Disaster Recovery and Business Continuity Planning.

According to the International Standards for the Professional Practice of Internal Auditing (Standards) set by the Institute of Internal Auditors (IIA), internal audit functions are allowed flexibility in including consulting engagements in their annual plans. Standard 2010 - Planning states that "the chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals." This risk-based plan should consider the potential value-add of consulting engagements. Consulting engagements that are expected to add significant value or align with strategic objectives are often included, but not all requests need to be automatically included unless they meet these criteria.
:
Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2010 - Planning.

The primary advantage of using internal control questionnaires (ICQs) as part of a preliminary survey for an engagement is their efficiency. ICQs allow auditors to quickly gather a large amount of information about the control environment by asking structured questions that cover key areas of interest. This helps in identifying areas that require further investigation or where controls may need improvement.
IIA References:
* The IIA's Practice Guide on Evaluating Internal Controls mentions that ICQs are useful for obtaining an initial understanding of controls and are particularly efficient when time or resources are limited. They allow auditors to systematically cover a wide range of control-related topics in a relatively short period.