The IIA's International Standards for the Professional Practice of Internal Auditing (Standards) provide guidance on the reporting requirements of the quality assurance and improvement program. According to Standard 1320, "The chief audit executive must communicate the results of the quality assurance and improvement program to senior management and the board." This communication must include the results of both internal and external assessments and ongoing monitoring. Specifically, the results of ongoing monitoring of the internal audit activity's performance should be reported to senior management and the board at least annually. This ensures that the internal audit activity maintains its proficiency, enhances its effectiveness, and complies with the Standards.
Reference: IIA Standard 1320

* A. Determine whether the purchasing department complies with policy by examining a random selection of purchase orders:Correct. Reviewing a random sample of purchase orders is a standard procedure for evaluating compliance with purchasing policies, such as approval requirements, vendor selection, and adherence to budget constraints.
* B. Evaluate whether purchasing requests are properly approved by authorized staff by obtaining independent verification from the vendors:Vendor verification is not typically used to evaluate internal approvals as this information is available within the organization's records.
* C. Ascertain whether material receipts are recorded on a timely basis by reviewing physical inventory stock counts:Physical inventory reviews focus on inventory management and reconciliation, not specifically on the timeliness of receipts.
* D. Determine whether prices charged for goods received are correct by reviewing the appropriate accounts payable record by vendor:While reviewing accounts payable records helps verify the accuracy of pricing, it does not directly evaluate the purchasing department's adherence to procedures.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Audit Engagement Objectives and Procedures.

Comprehensive and Detailed Explanation:
When auditors use judgmental (non-statistical) sampling, the results apply only to the items tested and cannot be extrapolated statistically to the entire population. In this case, auditors tested 60 timesheets and found 3 exceptions. The appropriate conclusion is simply that 5% of the selected sample was not properly approved (D). Statements about effectiveness percentages (A, B) would require statistical sampling. Option C is inappropriate because exceptions do not prove flawed design - they may reflect control execution lapses. Per IIA standards, conclusions must reflect evidence without overgeneralization. Thus, Option D is the most appropriate conclusion.

According to IIA guidance, internal auditors should use relevant information obtained during a consulting engagement to inform and enhance their evaluation of internal controls during related audit engagements.
This is because the knowledge gained from consulting activities can provide valuable insights into the functioning of controls and processes, which can be applied when assessing their effectiveness in a subsequent audit.
IIA References:
* IIA Standard 1220: Due Professional Care indicates that internal auditors should consider all relevant information available to them when making judgments and recommendations. This includes information obtained from consulting engagements.
* The IIA's Practice Guide on Consulting Engagements advises that while internal auditors must maintain objectivity, they can and should use knowledge gained from consulting engagements to enhance the value and accuracy of their assurance work.

The risk-factor approach involves developing a list of internal and external risk considerations, creating a scale to assess each risk, and allocating the relative importance of each risk. This approach allows the auditor to systematically evaluate risks based on predefined criteria and weightings, ensuring a comprehensive risk assessment across the organization's processes.
References:
The Institute of Internal Auditors (IIA) Standards
Risk Assessment Methodologies in Internal Auditing