* Consulting Engagements: Consulting engagements are advisory in nature and are intended to add value and improve an organization's governance, risk management, and control processes.
* Role of Internal Auditor: In a consulting role, an internal auditor provides advice, facilitates risk management, and helps enhance the efficiency and effectiveness of operations.
* Briefing Managers: By briefing department managers on how to implement risk management processes into their daily operations, the internal auditor is providing valuable advice that can help improve the organization's risk management framework.
* IIA Standards: The IIA's standards emphasize that consulting activities should aim at improving governance, risk management, and control processes without taking on management responsibilities.
References:
IIA Standard 2010 - Planning .

The chief audit executive (CAE) has the responsibility to communicate audit results, including residual risks, to senior management. According to IIA Standard 2410 - Criteria for Communicating, the CAE should communicate the engagement's objectives, scope, conclusions, recommendations, and action plans. Residual risk, being a part of the audit outcome, should be reported at the same time as the audit results to ensure that senior management is fully informed of all aspects of the engagement. This allows senior management to understand the remaining risks after control measures have been applied.
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2410 - Criteria for Communicating

A risk-by-process matrix is a tool that allows users to identify and analyze the associations between various business processes and the risks that affect them. This matrix helps in understanding how risks are distributed across different processes and can be instrumental in prioritizing audit activities based on risk.
IIA References:
* IIA Standard 2210: Engagement Objectives suggests that internal auditors should consider risks when setting audit objectives. A risk-by-process matrix is an effective tool for mapping out these risks in relation to processes, providing a clear visual representation of where the most significant risks lie.
* The Practice Guide on Risk Assessment outlines the use of matrices, including risk-by-process matrices, to facilitate the identification and prioritization of risks within different processes.

The primary objective of an engagement supervisor's review of key activities during the engagement is to ensure that all work performed meets acceptable quality standards. This includes verifying that audit procedures were appropriately executed, audit evidence is properly documented, and audit conclusions are supported. The supervisor's review is crucial for maintaining the integrity and reliability of the audit process, ensuring compliance with internal audit standards and protocols.
IIA Standard 2340: Engagement Supervision
IIA Practice Guide: Quality Assurance and Improvement Program

According to the International Standards for the Professional Practice of Internal Auditing (Standards) issued by The Institute of Internal Auditors (IIA), the Chief Audit Executive (CAE) must communicate and obtain approval from the board for significant changes to the audit plan. A corporate merger is a significant event that introduces emerging risks, necessitating an interim adjustment to the audit plan. The CAE's responsibility includes ensuring that the board is informed and approves the revised audit plan to address these new risks adequately.
The Institute of Internal Auditors (IIA) Standard 2020 - Communication and Approval: "The chief audit executive must communicate the internal audit activity's plans and resource requirements, including significant interim changes, to senior management and the board for review and approval."