* Tracing starts with source documents (e.g., receiving reports) and follows them forward through invoices and accounting entries to ensure completeness.
* Vouching starts with recorded entries and looks backward to supporting documents, testing validity.
* Independent confirmation involves external verification (e.g., with vendors).
* Reperformance involves redoing a control activity.
Here, the test begins with receiving documents and traces forward to invoices and postings, making tracing the correct procedure (Option B).

Strategic sourcing would best assist the CAE in balancing the internal audit activity's needs for technical audit skills, budget efficiency, and staff development opportunities. Strategic sourcing involves using a mix of internal resources, co-sourcing, and outsourcing to optimize the audit function. This approach allows the CAE to leverage external expertise for specialized skills, manage costs effectively, and provide growth opportunities for internal staff.
IIA Standards: 2030 - Resource Management
IIA Practice Guide: Developing the Internal Audit Strategic Plan

* Understanding the GRI: The Global Reporting Initiative (GRI) provides a comprehensive framework for reporting on sustainability performance, including social responsibility aspects.
* Framework and Standards: GRI standards are widely used and recognized globally, which helps organizations benchmark their performance against other entities using the same framework.
* Stakeholder Communication: The GRI framework emphasizes transparency and accountability in reporting, making it an effective tool for informing stakeholders about an organization's social responsibility performance.
* Comprehensive Coverage: GRI covers various aspects of social responsibility, including economic, environmental, and social impacts, providing a holistic view of an organization's performance.
References:
The Global Reporting Initiative (GRI) .

A compliance assurance engagement focuses on evaluating whether an organization is adhering to applicable laws, regulations, policies, and procedures. Assessing the design adequacy of controls related to consumer privacy and confidentiality is a prime example of such an engagement, as it ensures that the organization's controls are designed to comply with relevant privacy laws and regulations, thereby protecting consumer data and maintaining compliance.
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2410 - Criteria for Communicating

The internal audit charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility.
Establishing the internal audit activity's position within the organization in an audit charter ensures independence and objectivity by clearly stating the internal audit's role and its reporting lines.
The charter should be approved by the board and senior management to reinforce its authority and protect the internal audit activity from undue influence by management