Upon discovering a potential conflict of interest, the most appropriate action for the internal auditor is to inform the audit supervisor. This ensures that the issue is properly addressed and investigated according to the organization's policies and procedures. The audit supervisor can then decide on the appropriate course of action, including whether further investigation is warranted. References: = IIA Standard 2440 - Disseminating Results and IIA Standard 2600 - Resolution of Senior Management's Acceptance of Risks.

An internal control questionnaire (ICQ) is best used to assess whether different subsidiaries apply centrally established procurement rules in the same manner because it helps gather structured responses from different units regarding their compliance with established policies.
* Receiving mid-level management insight on hiring practices (A) is better suited for interviews or surveys.
* Verifying adherence to approval matrices (B) requires observation and transactional testing rather than a questionnaire.
* Gaining assurance on inventory counts (C) would involve direct observation and reconciliation rather than an ICQ.
Reference:IIA's Practice Guide: Internal Audit and Fraud Risk Management - Use of Questionnaires in Control Assessments.

To determine if loans were granted in accordance with the organization's policies, the most effective approach is to validate a sample of loans against the applicable underwriting guidelines. This method allows the auditor to directly assess compliance with the specific criteria set out in the organization's loan granting policies, providing clear evidence on whether the loans meet the required standards.
The Institute of Internal Auditors (IIA) Practice Guide: Auditing Credit Risk Management IIA Standard 2210 - Engagement Objectives

The engagement's objective is compliance with project management principles. The corresponding work program aim is to evaluate whether project management guidance is applied in practice (A). Options B, C, and D reflect risk, legal, or strategy audits - not the stated project management compliance objective.

After management has implemented an action plan to improve controls, the most appropriate follow-up action for the auditor is to perform retesting. Retesting involves verifying that the new procedures are effective in addressing the control deficiencies identified during the initial audit.
* IIA Standard 2500 - Monitoring Progress:
* This standard requires the internal audit activity to monitor and ensure that management actions have been implemented and are working as intended. Retesting is a critical component of this process because it confirms that the new controls effectively mitigate the risks.
* Importance of Retesting:
* Retesting allows the auditor to verify that the specific control activities, which were previously found to be deficient, have been corrected. This hands-on approach provides direct evidence of the effectiveness of the new procedures.
* IIA Practice Advisory 2500-1:
* The advisory emphasizes the need for follow-up activities to include retesting when necessary to confirm that management's actions have resolved the issues identified.
* Option A (Conduct another audit): Conducting a completely new audit might be excessive; follow-up and retesting are sufficient to confirm the effectiveness of the corrective actions.
* Option B (Ensure procedures are documented): Documentation is important, but it does not confirm that the procedures are actually effective.
* Option D (Analyze procedures and report to management): Analysis is useful, but retesting provides direct verification of effectiveness.
Detailed Explanation:Why Not Other Options?Conclusion: Option C is correct because retesting confirms that the new procedures effectively address the previously identified deficiencies, ensuring that the risks have been mitigated as intended, in line with IIA guidance.