Administering control questionnaires to individuals with primary responsibilities in the process can yield valuable information about processes and controls. However, one significant drawback is that the information gathered may be limited regarding the actual functionality of the controls. This approach relies on the respondents' knowledge and perceptions, which may not accurately reflect the effectiveness of the controls in practice. Moreover, respondents might not fully understand the auditor's intentions or may provide biased or incomplete information, thereby limiting the depth of insights into how controls function in real-world scenarios.
IIA Standard 2201: Planning Considerations
IIA Practice Guide: Assessing the Adequacy of Risk Management Processes

The CAE should discuss the concerns with the finance manager and work together to agree on the engagement objectives. This collaborative approach ensures that the engagement objectives are aligned with the finance manager's needs and expectations, and it allows the CAE to provide relevant and tailored assistance regarding the new management system for managing receivables.
IIA Standards: 2010 - Planning
IIA Practice Guide: Consulting Services

* A. Review a random sample of concluded disciplinary reports to assess how the policy was applied in each case:This is the correct answer because reviewing documented reports provides objective evidence of whether decisions complied with policies. This approach ensures that the auditor relies on concrete evidence rather than subjective opinions or observations.
* B. Interview a sample of impacted employees for their opinions on the clarity and fairness of the policy:
While employee feedback is valuable, it is subjective and does not provide sufficient evidence of compliance with the documented policy.
* C. Observe several disciplinary hearings to determine whether they are in compliance with the policy:
Observations are limited to current proceedings and do not account for how policies were applied in past cases, making this approach less comprehensive.
* D. Conduct an interview to assess the disciplinary hearing chairman's understanding of the policy and its appropriate use:Interviews provide insight into understanding and intent but do not offer evidence of actual compliance.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Evidence Collection and Assessment Methods.

In this scenario, the internal auditor performed a test of controls on the accounts receivable ledger and found that the error rate was within management's expectations. Since the audit focused on the accounts receivable controls, the conclusion should be specific to the scope of the engagement. The auditor can provide positive assurance about the effectiveness of the controls over the recording of transactions in the accounts receivable ledger, as the evidence gathered supports this conclusion.
IIA References:
* IIA Standard 2410: Criteria for Communicating states that communications must include the engagement's objectives and scope as well as applicable conclusions, recommendations, and action plans. Since the engagement was focused on accounts receivable, the assurance provided should relate specifically to the controls in that area.
* The Practice Guide on Communicating Results emphasizes that conclusions and assurance should be directly related to the scope of the engagement and the evidence obtained.

Stratified sampling is used when the population can be divided into distinct subgroups (strata) that differ significantly from each other but are internally homogeneous. In the context of auditing, revenue earned through cash receipts or as receivables would have different characteristics and risk profiles. Stratifying the population allows the auditor to ensure that each subgroup is adequately represented in the sample, leading to more reliable and accurate audit conclusions.
The Institute of Internal Auditors (IIA) Practice Guide: Audit Sampling IIA Standard 2320 - Analysis and Evaluation