When documenting findings from a nonstatistical sample, internal auditors should record the factual observations and quantify the results where possible. In this case, the auditor should document that 17% of the sampled accounts receivable balances exceeded the approved unsecured credit limit. This provides a clear, quantifiable basis for the finding, which is critical for accurate reporting and for management to understand the scope of the issue. Documenting this percentage also supports the auditor's conclusions and recommendations for corrective actions.
The Institute of Internal Auditors (IIA) Practice Guide: Audit Sampling.
IIA Standard 2310 - Identifying Information

* 1. The internal audit activity's time constraints:Time constraints are important when allocating resources for efficiency.
* 2. The nature and complexity of the area to be audited:This directly affects the level of expertise and resources required.
* 3. The period of time since the area was last audited:While relevant, this is not critical for determining staff requirements.
* 4. The auditors' preference to audit the area:Preferences should not determine staffing; decisions should be based on the organization's needs.
* 5. The results of a preliminary risk assessment of the activity under review:High-risk areas may require more experienced auditors or additional staff.
CIA Exam Syllabus Reference:
Domain IV: Managing the Internal Audit Function - Staffing and Resource Allocation.

The engagement objective is to assess consistency of quality control practices across multiple factories. The best test is direct, real-time observation (B) of how employees actually perform checks, as this provides reliable, first-hand evidence of whether procedures are followed consistently.
* Option A (policies) and D (flowcharts) only show how processes should work.
* Option C (interviews) gives management's perspective but not actual practice.Thus, Option B provides the most valid evidence.

According to IIA guidance, the internal audit plan should be based on an assessment of risks to the organization (1), designed to determine the effectiveness of the organization's risk management process (2), and aligned with the organization's goals (4). The development of the audit plan is typically the responsibility of the chief audit executive, often with input from senior management and the audit committee, rather than being solely developed by senior management (3). References: IIA Standard 2010 - Planning, IIA Practice Guide - Developing the Internal Audit Plan

According to the IIA guidance, when determining the need to follow-up on recommendations, the internal audit activity should consider factors such as the degree of effort and cost needed to correct the reported condition, the complexity of the corrective action, and the impact that may result should the corrective action fail. These factors are critical in assessing the importance and urgency of follow-up. However, the amount of resources required to conduct the follow-up activities should not be a primary consideration, as the focus should be on the significance of the issues and the potential risks associated with them. References: IIA Standard 2500 - Monitoring Progress, IIA Practice Advisory 2500.A1-1