Role of CAE as Consultant: The chief audit executive (CAE) can act as a consultant to help management establish a risk management system. Their role should be facilitative rather than directive, ensuring that management owns the risk management process.
Appropriate Tasks:
* Risk Workshops: Coordinating and facilitating risk workshops (option A) helps management identify and assess risks, allowing them to develop appropriate responses. This is a suitable task for the CAE.
* Risk Appetite and Indicators: Establishing risk appetite (option B) and setting risk indicators and mitigation plans (option C) are management's responsibilities.
* Reporting Risks: Determining the number of significant risks to report (option D) should also be a management function.

* A. Vendor contracts:While vendor contracts may reveal terms, they do not directly identify potential conflicts of interest.
* B. Employee master list:Correct. Comparing the employee master list with vendor information can help identify conflicts of interest, such as vendor ownership or employee relationships.
* C. Payment records:Useful for verifying transactions but not for identifying conflicts of interest.
* D. Purchasing policy:Provides guidelines but does not assist directly in identifying conflicts.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Identifying and Mitigating Conflicts of Interest.

Flat structures reduce hierarchical layers, increasing spans of control. With fewer supervisors overseeing more employees, the time and ability for supervision becomes limited, which is a control weakness.
* Option A refers to innovation, not control implications.
* Options C and D describe hierarchical or vertical structures, not flat ones.
Thus, the control implication of a flat structure is limited supervision availability (Option B).

The IIA Standards require the CAE to communicate risk acceptance that may be unacceptable to senior management and the board. The first step is to discuss the issue with senior management to understand their perspective and potentially resolve the concern. If senior management does not take appropriate action, the CAE must then inform the board to ensure they are aware of the risk and can take necessary action.
The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards)
"Internal Auditing: Assurance and Advisory Services" by Urton L. Anderson et al.

* A. The sample rate of occurrence plus the precision exceeds the acceptable error rate:Correct. If the sample rate of occurrence (estimated error rate in the sample) plus the margin of error exceeds the acceptable error rate, it indicates a potential issue. To refine the estimate and maintain the desired confidence level and precision, the sample size needs to be increased.
* B. The sample rate of occurrence is less than the acceptable error rate:If the sample rate is below the acceptable error rate, there is no immediate need to adjust the sample size.
* C. The acceptable rate of occurrence less the precision exceeds the sample rate of occurrence:This condition does not imply the need to increase sample size but rather suggests acceptable results.
* D. The sample rate of occurrence plus the precision equals the acceptable error rate:This indicates the estimate is at the threshold, but it does not necessitate increasing the sample size unless more precision is required.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Sampling and Error Analysis.