When using benchmarking to test the employee turnover rate, the internal auditor should compare the organization's turnover rate to the published turnover rates of peer organizations. This method provides a relevant standard or point of reference to evaluate the organization's performance relative to similar entities.
By using external benchmarks, the auditor can identify whether the turnover rate is above or below industry norms, which helps in assessing the effectiveness of the organization's HR practices.
The Institute of Internal Auditors (IIA) Practice Guide: Internal Audit and Organizational Performance IIA Standard 1220 - Due Professional Care

Omitting advance client notice when planning an audit engagement is justifiable if the engagement includes audit assurance procedures that involve sensitive or restricted assets. Providing advance notice in such cases could compromise the integrity of the audit, as it may give management an opportunity to conceal or alter the status of these assets. The goal is to ensure that the auditors can observe the actual condition and handling of sensitive assets without any prior alteration. References: IIA Standard 2201 - Planning Considerations, IIA Practice Advisory 2201-1

A flowchart is primarily used to evaluate the design of controls by visually representing the sequence of operations, decision points, and control activities within a process. This helps the internal auditor identify weaknesses, redundancies, and gaps in internal controls.
* Preparing for testing the effectiveness of controls (A) comes later in the audit process, after evaluating the design.
* Planning for evaluating potential losses (B) focuses on risk assessment rather than control design.
* Preparing a sampling plan (C) is a different step in the audit process, where the auditor determines the scope and sample size.
Reference:IIA's International Professional Practices Framework (IPPF) - Implementation Guide 2200:
Engagement Planning.

Inherent Risk: Inherent risk refers to the exposure to risk in its natural state, without considering any controls or mitigation measures. It is the risk that exists before any action is taken to manage it.
* Example: In the scenario of a snow removal company, the significant reduction in annual snowfall represents an inherent risk as it is a natural condition that affects the company's operations.
Other Risk Types:
* Residual Risk: This is the risk that remains after controls and mitigation strategies have been applied.
* Net Risk: Similar to residual risk, it is the risk that remains after considering existing controls.
* Accepted Risk: This is the risk that the organization knowingly accepts after evaluating its impact and likelihood.
Scenario Planning: The exercise of considering the impacts of reduced snowfall helps the company understand its inherent risks and prepare for potential adverse outcomes.

To ensure that the company is not taking any unwanted credit risks, the internal auditor should test controls that ensure construction orders are initiated only after the second invoice, which represents 70% of the payment, is paid. This control is critical because it minimizes the financial risk to the company by ensuring that a significant portion of the payment is received before the majority of the work is undertaken. This practice helps protect the company from potential non-payment issues and reduces the financial exposure associated with the project.
COSO Framework
The Institute of Internal Auditors (IIA) Standard 2130: Control